Abstract:With the enormous popularity of smartphones, millions of mobile apps are developed to provide rich functionalities for users by accessing certain personal data, leading to great privacy concerns. To address this problem, many approaches have been proposed to detect privacy disclosures in mobile apps, but they largely fail to automatically determine whether the privacy disclosures are necessary for the functionality of apps. As a result, security analysts may easily face with a large number of false positives when directly adopting such approaches for app analysis. In this paper, we propose LeakDoctor, an analysis system seeking to automatically diagnose privacy leaks by judging if a privacy disclosure from an app is necessary for some functionality of the app. Functionality-irrelevant privacy disclosures are not justifiable, so considered as potential privacy leak cases. To achieve this goal, LeakDoctor integrates dynamic response differential analysis with static response taint analysis. In addition, it employs a novel technique to locate the program statements of each privacy disclosure. We implement a prototype of LeakDoctor and evaluate it against 1060 apps, which contain 2,095 known disclosure cases. Our experimental results show that LeakDoctor can automatically determine that 71.9% of the privacy disclosure cases indeed serve apps' functionalities and are justifiable. Hence, with the diagnosis results of LeakDoctor, analysts may avoid analyzing many justifiable privacy disclosures and only focus on the those unjustifiable cases.

AppLance: A Lightweight Approach to Detect Privacy Leak for Packed Applications

PackerGrind: An Adaptive Unpacking System for Android Apps.

Happer - Unpacking Android Apps via a Hardware-Assisted Approach.

Parema: an Unpacking Framework for Demystifying VM-based Android Packers.

Hybrid User-level Sandboxing of Third-party Android Apps.

What Did You Pack in My App? a Systematic Analysis of Commercial Android Packers.

LeakDoctor: Toward Automatically Diagnosing Privacy Leaks in Mobile Applications

AppIntent: analyzing sensitive data transmission in android for privacy leakage detection.

Detecting Third-Party Libraries for Privacy Leakage in Packed Android Applications

DroidJust: automated functionality-aware privacy leakage analysis for Android applications.

Execution Enhanced Static Detection of Android Privacy Leakage Hidden by Dynamic Class Loading

Automatic Privacy Leakage Detection for Massive Android Apps Via a Novel Hybrid Approach.

Leakage Detection and Risk Assessment on Privacy for Android Applications: LRPdroid

Analysis and Comparison of Privacy Leak Static Detection Tools for Android Applications

A Privacy Leakage Detection System for Android

AUTOMATICALLY DETECTING PRIVACY LEAKS OF ANDROID APPLICATIONS

IccTA: Detecting Inter-Component Privacy Leaks in Android Apps

AppsPlayground: automatic security analysis of smartphone applications.

An Analysis on Sensitive Data Passive Leakage in Android Applications

Dynamic Privacy Leakage Analysis of Android Third-Party Libraries.

MonkeyDroid: Detecting Unreasonable Privacy Leakages of Android Applications.