When Program Analysis Meets Bytecode Search: Targeted and Efficient Inter-procedural Analysis of Modern Android Apps in BackDroid
Daoyuan Wu, Debin Gao, Robert H. Deng, Rocky K. C. Chang

TL;DR
BackDroid introduces a targeted, search-based inter-procedural analysis for Android apps that significantly improves efficiency and scalability over traditional whole-app analysis, especially for large, modern apps.
Contribution
It proposes a novel on-the-fly bytecode search technique guiding targeted analysis without relying on a complete app graph, handling Android-specific complexities.
Findings
BackDroid is 37 times faster than Amandroid.
It detects security issues with comparable or better accuracy.
No timeouts in analysis, unlike Amandroid.
Abstract
Widely-used Android static program analysis tools, e.g., Amandroid and FlowDroid, perform the whole-app inter-procedural analysis that is comprehensive but fundamentally difficult to handle modern (large) apps. The average app size has increased three to four times over five years. In this paper, we explore a new paradigm of targeted inter-procedural analysis that can skip irrelevant code and focus only on the flows of security-sensitive sink APIs. To this end, we propose a technique called on-the-fly bytecode search, which searches the disassembled app bytecode text just in time when a caller needs to be located. In this way, it guides targeted (and backward) inter-procedural analysis step by step until reaching entry points, without relying on a whole-app graph. Such search-based inter-procedural analysis, however, is challenging due to Java polymorphism, callbacks, asynchronous…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Software Testing and Debugging Techniques · Digital and Cyber Forensics
