Accession Number:

AD1044991

Title:

Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets

Descriptive Note:

Technical Report

Corporate Author:

CARNEGIE-MELLON UNIV PITTSBURGH PA PITTSBURGH United States

Personal Author(s):

• Burket,Jonathan
• Flynn,Lori
• Klieber,William
• Lim,Jonathan
• Shen,Wei
• Snavely,William

Report Date:

2015-03-31

Pagination or Media Count:

29.0

Abstract:

This report describes recent significant enhancements to DidFail Droid Intent Data Flow Analysis for Information Leakage, the CERT static taint analyzer for sets of Android apps. In addition to improving the analyzer itself, the enhancements include a new testing framework, new test apps, and test results. A framework for testing the DidFail analyzer, including a setup for cloud-based testing was developed and instrumented to measure performance. Cloud-based testing enables the parallel use of powerful, commercially available virtual machines to speed uptesting. DidFail was also modified to use the most current version of FlowDroid and Soot, in-creasing its success rate from 18 to 68 on our test set of real-world apps. Analytical features were added for more types of components and shared static fields and new apps developed to test these features. The improved Did Fail analyzer and the cloud-based testing framework were used to test the new apps and additional apps from the Google Play store.

Descriptors:

• CLOUD COMPUTING
• WEB APPLICATIONS
• WEB APP
• APPLICATION SOFTWARE

Subject Categories:

• Computer Programming and Software
• Cybernetics

Distribution Statement:

APPROVED FOR PUBLIC RELEASE