CrashFuzzer: Detecting Input Processing Related Crash Bugs in Android Applications

Aimin Zhang,Yi He,Yong Jiang
DOI: https://doi.org/10.1109/pccc.2016.7820625
2016-01-01
Abstract:Android has become the largest-selling operating system for smartphones, and thousands of new Android applications are developed and published everyday. However, quality, not quantity, is the real mobile application problem. The robustness of Android applications are worrisome as many of them always have crash bugs. It's unrealistic to rely on developers' experience to eliminate them all. There are so many input sources and we cannot assume developers will check all data from them properly. And some Android system services suffer denial-of-service attacks because of crash bugs due to their poor input validation. Crash bugs not only degrade user experience but also may raise security issues. In this paper, we propose a heuristic approach which combines static analysis and semi-random input generation to detect crash bugs related to input data processing in Android applications. We present techniques for automatic generating input data, injecting them to an application, producing structured trace information. We perform experiments on 100 Android applications and find 28 of them have crash bugs due to their poor input validation. We believe our study and techniques also have the potential to release developers from boring testing tasks to a certain extent and help developers improve quality of their Android applications.
What problem does this paper attempt to address?