Abstract:To identify security vulnerabilities in Android applications, numerous static application security testing (SAST) tools have been proposed. However, it poses significant challenges to assess their overall performance on diverse vulnerability types. The task is non-trivial and poses considerable challenges. {Firstly, the absence of a unified evaluation platform for defining and describing tools' supported vulnerability types, coupled with the lack of normalization for the intricate and varied reports generated by different tools, significantly adds to the complexity.} Secondly, there is a scarcity of adequate benchmarks, particularly those derived from real-world scenarios. To address these problems, we are the first to propose a unified platform named VulsTotal, supporting various vulnerability types, enabling comprehensive and versatile analysis across diverse SAST tools. Specifically, we begin by meticulously selecting 11 free and open-sourced SAST tools from a pool of 97 existing options, adhering to clearly defined criteria. After that, we invest significant efforts in comprehending the detection rules of each tool, subsequently unifying 67 general/common vulnerability types for {Android} SAST tools. We also redefine and implement a standardized reporting format, ensuring uniformity in presenting results across all tools. Additionally, to mitigate the problem of benchmarks, we conducted a manual analysis of huge amounts of CVEs to construct a new CVE-based benchmark based on our comprehension of Android app vulnerabilities. Leveraging the evaluation platform, which integrates both existing synthetic benchmarks and newly constructed CVE-based benchmarks from this study, we conducted a comprehensive analysis to evaluate and compare these selected tools from various perspectives, such as general vulnerability type coverage, type consistency, tool effectiveness, and time performance.

A Model Guided Security Analysis Approach for Android Applications.

An automated testing approach for inter-application security in Android.

Systematic Analysis and Detection of Misconfiguration Vulnerabilities in Android Smartphones

AndroShield: Automated Android Applications Vulnerability Detection, a Hybrid Static and Dynamic Analysis Approach

Security Analysis for Android Applications Using Sensitive Path Identification

Security Smells in Android

Secure Mobile Software Development with Vulnerability Detectors in Static Code Analysis

A Comprehensive Study on Static Application Security Testing (SAST) Tools for Android

ADS-SA - System for Automatically Detecting Sensitive Path of Android Applications Based on Static Analysis.

Dynamic Security Analysis on Android: A Systematic Literature Review

Automated, Dynamic Android App Vulnerability and Privacy Leak Analysis: Design Considerations, Required Components and Available Tools

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

A3: Automatic Analysis of Android Malware

An Android Application Software Security Protection Method Based on Hybrid Reinforcement

Demystifying security and compatibility issues in Android Apps

Study of the Influence of Anti-analysis Techniques on the Security of Android Ecosystem

A programming model and framework for comprehensive dynamic analysis on Android

Incorporating Android Code Smells into Java Static Code Metrics for Security Risk Prediction of Android Applications

SeMA: Extending and Analyzing Storyboards to Develop Secure Android Apps

ARCHITECTURE SECURITY PRINCIPLES OF THE ANDROID APPLICATIONS-BASED INFORMATION SYSTEM

A Systematic Literature Review of Android Malware Detection Using Static Analysis