一句话：提出屏幕条件化运行时差异信号，引导 Android GUI 探索走向更具安全审查价值的状态。
现有 Android GUI 探索工具通常以结构覆盖率、崩溃发现或拟人化交互为目标，但这些目标无法指出哪些 UI 跳转会暴露值得安全审查的运行时行为。本文提出“屏幕条件化运行时差异”（screen-conditioned runtime discrepancy）：一种衡量“可见 UI 所正当化的 activity”与“运行时实际观察到的 activity”之间不一致程度的引导信号。作者在 UIXPOSE 中实现了该概念，这是一个不依赖源码的 Android 框架，它为每个动作条件化跳转关联可重放的 UI、网络、内存与资源证据，并用所得差异指导后续探索。在六个带 oracle 的 Android 应用上的初步评估中，UIXPOSE 在相同执行预算内到达了朴素状态感知探索遗漏的已知 UI 触发行为，访问了显著更多的不同抽象状态与动作条件化跳转，同时产出与步骤对齐的证据供分析人员审阅。结果表明运行时差异可将状态感知探索重定向到行为信息更丰富的状态，并通过排序、可重放的证据支持下游人工标注。
Android GUI explorers typically optimise structural coverage, crash discovery, or human-like interaction, but these objectives do not identify which UI transitions expose runtime behaviour that deserves security inspection. We introduce screen-conditioned runtime discrepancy, a steering signal that measures disagreement between activity justified by the visible UI and activity observed at runtime. We implement this concept in UIXPOSE, a source-code-agnostic Android framework that associates each action-conditioned transition with replayable UI, network, memory, and resource evidence and uses the resulting discrepancy to guide subsequent exploration. In a preliminary evaluation of six oracle-backed Android applications, UIXPOSE reached known UI-triggered behaviours that vanilla state-aware exploration missed within the same execution budget. It also visited substantially more distinct abstract states and action-conditioned transitions while producing step-aligned evidence for analyst review. These results indicate that runtime discrepancy can redirect state-aware exploration toward behaviourally informative states and support downstream analyst-led application labelling through ranked, replayable evidence.
@inproceedings{paperbot12181,
title = {UIXPOSE: Screen-Conditioned Runtime Discrepancy Analysis for Security-Aware Android GUI Exploration},
author = {Amirmohammad Pasdar and Van-Thuan Pham and Toby Murray},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3834556}
}