一句话：提出可扩展的 Android 静态分析框架 Androlic，同时支持流、上下文、对象、字段与路径敏感，并可通过配置与 API 定制分析任务。
静态分析被广泛用于检测 Android 应用中的潜在缺陷，但现有工具往往只针对特定问题，且支持的敏感度各不相同，导致其难以复用，也难以扩展到新的分析任务上。本文提出 Androlic，一个面向 Android 的精确静态分析框架，同时具备流敏感、上下文敏感、对象敏感、字段敏感与路径敏感等特性。为便于复用与扩展，Androlic 向开发者暴露了若干配置项与 API，使其能够在框架之上实现自定义的分析任务。作者在一个示例程序与 20 个真实世界应用上对 Androlic 进行了评估，结果表明该框架能够以较高的精度和效率完成对应用的分析。
Static analysis is widely used to detect potential defects in apps. Existing analysis tools focus on specific problems and vary in supported sensitivity, which make them difficult to reuse and extend for new analysis tasks. This paper presents Androlic, a precise static analysis framework for Android which is flow, context, object, field and path-sensitive. Through configuration items and APIs provided by Androlic, developers can easily extend it to perform custom analysis tasks. Evaluation on an example program and 20 real-world apps show that Androlic can analyze apps with high precision and efficiency.
DOI 原文 ·
@inproceedings{paperbot5350,
title = {Androlic: an extensible flow, context, object, field, and path-sensitive static analysis framework for Android},
author = {Linjie Pan and Baoquan Cui and Jiwei Yan and Xutong Ma and Jun Yan and Jian Zhang},
booktitle = {ISSTA},
year = {2019},
doi = {10.1145/3293882.3339001}
}