一句话：将运行时堆快照融入静态污点分析，提升 Android 信息流分析的精度与性能。
Android 应用的信息流评估常依赖静态污点分析，但其精度受限于无法精确确定指针可能指向的对象。本文研究将运行时某一时刻采集的动态堆快照引入静态分析后，能否同样改善污点分析，并考察快照采集时机、数量及使用方式对可靠性与精度的影响。作者扩展 FlowDroid 以融入堆快照，实现原型 Heapster，并在新构建的真实 Android 应用基准 DroidMacroBench 上评估，该基准也作为工件公开。结果表明：使用堆快照可降低分析时间与内存消耗并提高精度；对无动态数据的对象回退到静态指向关系的混合模式能在精度与召回间取得良好权衡；单次快照（理想为执行结束时采集）即可改善性能与精度，而多次快照可获得更优权衡。
The assessment of information flows is an essential part of analyzing Android apps, and is frequently supported by static taint analysis. Its precision, however, can suffer from the analysis not being able to precisely determine what elements a pointer can (and cannot) point to. Recent advances in static analysis suggest that incorporating dynamic heap snapshots, taken at one point at runtime, can significantly improve general static analysis. In this paper, we investigate to what extent this also holds for taint analysis, and how various design decisions, such as when and how many snapshots are collected during execution, and how exactly they are used, impact soundness and precision. We have extended FlowDroid to incorporate heap snapshots, yielding our prototype Heapster, and evaluated it on DroidMacroBench, a novel benchmark comprising real-world Android apps that we also make available as an artifact. The results show (1) the use of heap snapshots lowers analysis time and memory consumption while increasing precision; (2) a very good trade-off between precision and recall is achieved by a mixed mode in which the analysis falls back to static points-to relations for objects for which no dynamic data was recorded; and (3) while a single heap snapshot (ideally taken at the end of the execution) suffices to improve performance and precision, a better trade-off can be obtained by using multiple snapshots.