一句话：提出结合动静态分析与自动验证的 Android 隐私泄露分析流水线，以降低误报并提升检测准确率。
该论文针对 Android 应用中的隐私泄露问题，提出一套自动化分析流水线。方法上融合动态分析与静态分析，并让二者结果相互验证；不仅抓取网络流量，还检查应用内部数据流，重点关注第三方服务和高风险权限导致的隐私泄露。流水线结合污点分析、权限分析、网络流量分析和运行时动态函数追踪来识别私有信息泄露，并实现自动验证与补全过程以减少误报。评估方面，已在 30 个 Android 应用上开展小规模实验，超过 10,000 个应用的大规模实验正在进行中。
We propose an automated pipeline for analyzing privacy leaks in Android applications. By using a combination of dynamic and static analysis, we validate the results from each other to improve accuracy. Compare to the state-of-the-art approaches, we not only capture the network traffic for analysis, but also look into the data flows inside the application. We particularly focus on the privacy leakage caused by third-party services and high-risk permissions. The proposed automated approach will combine taint analysis, permission analysis, network traffic analysis, and dynamic function tracing during run-time to identify private information leaks. We further implement an automatic validation and complementation process to reduce false positives. A small-scale experiment has been conducted on 30 Android applications and a large-scale experiment on more than 10,000 Android applications is in progress.
DOI 原文 ·
@inproceedings{paperbot6617,
title = {An Automated Pipeline for Privacy Leak Analysis of Android Applications},
author = {Yifan Zhou},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678875}
}