一句话：提出 WhisperCatcher，融合流量语义、静态分析与动态插桩，检测 Android 应用中未经同意且加密传输的私有数据。
论文针对 Android 应用中未经用户同意收集并以加密形式传输的私有数据难以检测的问题，提出自动化工具 WhisperCatcher。它首先捕获应用启动阶段、用户同意隐私政策之前的原始流量并提取语义信息，再利用流量语义引导静态代码分析，定位与传输相关的关键函数，最后通过动态插桩恢复加密数据，从而识别未经授权的私有数据传输。评估表明 WhisperCatcher 显著优于现有工具，召回率达 91.38%，F1 为 95.49%。作者还对 14,879 个应用进行大规模测量，发现 4,966 个应用存在 13,966 条在获得用户同意前传输私有数据的流量，其中 3,838 条（27.48%）含应用层加密数据，揭示了潜在的隐私泄露风险。
The privacy issues associated with Android apps are increasingly raising our concerns. Unfortunately, a large portion of privacy breaches in Android apps cannot be accurately detected by existing approaches, especially private data that is collected without consent and transmitted in encrypted form. Even if existing studies are able to break the encryption at protocol level to recover the structure and content of traffic packets, they are still unable to understand the code layer encrypted data. To solve this problem, we propose WhisperCatcher, an automated tool for analyzing unauthorized and encrypted private data transmitted by apps. For each app, WhisperCatcher first captures the raw traffic generated during the app’s startup phase, before the user consents to the privacy policy, and then extracts the semantic information. Furthermore, it utilizes the traffic semantics to guide static code analysis and extracts transmission-related key functions. Finally, it performs dynamic instrumentation analysis and recovers the encrypted data, thereby identifying unauthorized private data transmissions. Extensive evaluations show that WhisperCatcher significantly outperforms existing tools, and it achieves the recall of 91.38% and F1-Score of 95.49%, respectively. In addition, we conduct a large-scale measurement analysis on 14,879 apps and WhisperCatcher identifies 13,966 traffic flows from 4,966 apps that transmit private data prior to obtaining user consent, among which 3,838 (27.48%) flows contain app-encrypted data. Our findings highlight the potential privacy leakage risks in Android apps, which should be brought to the attention of the community.
@inproceedings{paperbot11933,
title = {WhisperCatcher: Demystifying Unauthorized and Encrypted Private Data Transmission in Android Applications},
author = {Zhaoyu Qiu and Ming Fan and Bocan Ma and Yutian Tang and Lei Xue and Haijun Wang and Ting Liu},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773154}
}