Abstract:The android platform adopts permissions to protect sensitive resources from untrusted apps. However, after permissions are granted by users at install time, apps could use these permissions (sensitive resources) with no further restrictions. Thus, recent years have witnessed the explosion of undesirable behaviors in Android apps. An important part in the defense is the accurate analysis of Android apps. However, traditional syscall-based analysis techniques are not well-suited for Android, because they could not capture critical interactions between the application and the Android system. This paper presents VetDroid, a dynamic analysis platform for generally analyzing sensitive behaviors in Android apps from a novel permission use perspective. VetDroid proposes a systematic permission use analysis technique to effectively construct permission use behaviors, i.e., how applications use permissions to access (sensitive) system resources, and how these acquired permission-sensitive resources are further utilized by the application. With permission use behaviors, security analysts can easily examine the internal sensitive behaviors of an app. Using real-world Android malware, we show that VetDroid can clearly reconstruct fine-grained malicious behaviors to ease malware analysis. We further apply VetDroid to 1249 top free apps in Google Play. VetDroid can assist in finding more information leaks than TaintDroid, a state-of-the-art technique. In addition, we show how we can use VetDroid to analyze fine-grained causes of information leaks that TaintDroid cannot reveal. Finally, we show that VetDroid can help to identify subtle vulnerabilities in some (top free) applications otherwise hard to detect.

DroidProtector: Preventing Capability Leak of Android Applications

Detecting Passive Content Leaks and Pollution in Android Applications.

Detecting capability leaks in Android-based smartphones

Systematic Detection of Capability Leaks in Stock Android Smartphones.

RiskRanker: scalable and accurate zero-day android malware detection.

DroidAlarm: an all-sided static analysis tool for Android privilege-escalation malware.

DroidMD: an Efficient and Scalable Android Malware Detection Approach at Source Code Level

An Android Application Software Security Protection Method Based on Hybrid Reinforcement

Reviving Android Malware with DroidRide: and How Not To.

Permission Use Analysis for Vetting Undesirable Behaviors in Android Apps

AUTOMATICALLY DETECTING PRIVACY LEAKS OF ANDROID APPLICATIONS

Automatic Generation of Capability Leaks' Exploits for Android Applications

Capability Leakage Detection Between Android Applications Based on Dynamic Feedback

Vetting Undesirable Behaviors in Android Apps with Permission Use Analysis

Automatic Privacy Leakage Detection for Massive Android Apps Via a Novel Hybrid Approach.

Android Malicious Behavior Detection based on Reverse Engineering

Security Analysis for Android Applications Using Sensitive Path Identification

Protecting Android Apps against Reverse Engineering

DroidMark: A Tool for Android Malware Detection using Taint Analysis and Bayesian Network

Characterizing Sensor Leaks in Android Apps

Taming Transitive Permission Attack Via Bytecode Rewriting on Android Application