A Sound Flow-Sensitive Heap Abstraction for the Static Analysis of Android Applications

by   Stefano Calzavara, et al.

The present paper proposes the first static analysis for Android applications which is both flow-sensitive on the heap abstraction and provably sound with respect to a rich formal model of the Android platform. We formulate the analysis as a set of Horn clauses defining a sound over-approximation of the semantics of the Android application to analyse, borrowing ideas from recency abstraction and extending them to our concurrent setting. Moreover, we implement the analysis in HornDroid, a state-of-the-art information flow analyser for Android applications. Our extension allows HornDroid to perform strong updates on heap-allocated data structures, thus significantly increasing its precision, without sacrificing its soundness guarantees. We test our implementation on DroidBench, a popular benchmark of Android applications developed by the research community, and we show that our changes to HornDroid lead to an improvement in the precision of the tool, while having only a moderate cost in terms of efficiency. Finally, we assess the scalability of our tool to the analysis of real applications.


page 1

page 2

page 3

page 4


Eventually Sound Points-To Analysis with Missing Code

Static analyses make the increasingly tenuous assumption that all source...

On The (In)Effectiveness of Static Logic Bomb Detector for Android Apps

Android is present in more than 85 target for malware. Malicious code is...

Neural-Augmented Static Analysis of Android Communication

We address the problem of discovering communication links between applic...

Certificate Enhanced Data-Flow Analysis

Proof-carrying-code was proposed as a solution to ensure a trust relatio...

Data-Flow Guided Slicing

We propose a flow-insensitive analysis that prunes out portions of code ...

DexLego: Reassembleable Bytecode Extraction for Aiding Static Analysis

The scale of Android applications in the market is growing rapidly. To e...

Automated Repair of Resource Leaks in Android Applications

Resource leaks – a program does not release resources it previously acqu...

Please sign up or login with your details

Forgot password? Click here to reset