一句话：提出基于静态分析的 Android 应用 GUI 策略符合性检查，并实现工具 Venus。
移动应用的 GUI 需满足厂商与监管机构日益增多的呈现和交互限制，但自动检查应用是否符合这些 GUI 策略仍很困难。本文面向 Android 应用提出一套基于静态分析的符合性检查技术：首先设计用于形式化 GUI 策略的规约语言；其次提出事件驱动布局森林这一新程序抽象，用于刻画 GUI 相关的事件与视图层次；最后给出构造该抽象并将其与 GUI 策略比对的静态分析。作者实现工具 Venus，并在 2361 个 Android 应用和 17 条策略上评估，成功发现进行广告欺诈的恶意应用，以及违反 GUI 设计指南和 GDPR 的应用。
A good graphical user interface (GUI) is crucial for an application's usability, so vendors and regulatory agencies increasingly place restrictions on how GUI elements should appear to and interact with users. Motivated by this concern, this paper presents a new technique (based on static analysis) for checking conformance between (Android) applications and GUI policies expressed in a formal specification language. In particular, this paper (1) describes a specification language for formalizing GUI policies, (2) proposes a new program abstraction called an _event-driven layout forest_, and (3) describes a static analysis for constructing this abstraction and checking it against a GUI policy. We have implemented the proposed approach in a tool called Venus, and we evaluate it on 2361 Android applications and 17 policies. Our evaluation shows that Venus can uncover malicious applications that perform ad fraud and identify violations of GUI design guidelines and GDPR laws.
DOI 原文 ·
@inproceedings{paperbot6303,
title = {Checking conformance of applications against GUI policies},
author = {Zhen Zhang and Yu Feng and Michael D. Ernst and Sebastian Porst and Isil Dillig},
booktitle = {FSE},
year = {2021},
doi = {10.1145/3468264.3468561}
}