一句话：在统一配置与同一基准上独立复现并对比三款 Android 信息流静态分析工具，揭示比较偏差与工具不准确原因。
近年来针对移动应用信息流的静态分析技术层出不穷，但已有比较常依赖句法基准，且很少说明工具配置，导致不同设置下比较不可复现且不准确。本文对三款主流工具 FlowDroid 与 IccTA 组合、Amandroid、DroidSafe 进行大规模、受控、独立的对比。作者采用统一配置和相同基准应用评估所有工具，并将所得结果与先前研究报告的结果对照，分析差异来源，识别导致工具分析不准确的主要原因，最后为未来研究提出建议。
Numerous static analysis techniques have recently been proposed for identifying information flows in mobile applications. These techniques are compared to each other, usually on a set of syntactic benchmarks. Yet, configurations used for such comparisons are rarely described. Our experience shows that tools are often compared under different setup, rendering the comparisons irreproducible and largely inaccurate. In this paper, we provide a large, controlled, and independent comparison of the three most prominent static analysis tools: FlowDroid combined with IccTA, Amandroid, and DroidSafe. We evaluate all tools using common configuration setup and the same set of benchmark applications. We compare the results of our analysis to the results reported in previous studies, identify main reasons for inaccuracy in existing tools, and provide suggestions for future research.
DOI 原文 ·
@inproceedings{paperbot4815,
title = {Analyzing the analyzers: FlowDroid/IccTA, AmanDroid, and DroidSafe},
author = {Lina Qiu and Yingying Wang and Julia Rubin},
booktitle = {ISSTA},
year = {2018},
doi = {10.1145/3213846.3213873}
}