Thesis
Incremental taint analysis of Android applications
Washington State University
Master of Science (MS), Washington State University
12/2020
DOI:
https://doi.org/10.7273/000004209
Handle:
https://hdl.handle.net/2376/125108
Abstract
Over the past decade, Android applications have become one of the principal interfaces by which consumers interact with technology. To date, there are reportedly 2.5 billion Android devices in circulation. Due to the global pervasiveness of the Android Operating System, Android applications are subject to pervasive attack and thus require effective, efficient methods of detecting data leaks. A robust security analysis technique known as taint analysis performs an analysis of the sources (i.e. user inputs) and sinks (i.e. destinations for user input, such as a database) within an application to discover points in the data flow paths where sensitive information may be leaking out. However, performing taint analysis can be prohibitively expensive in terms of time and computational resources. This thesis refines incremental taint analysis, a taint analysis technique that provides efficiency advantages over traditional taint analysis. Since changes between two versions of an Android application are typically small, incremental taint analysis performs a change impact analysis between two application versions prior to running a taint analysis. The addition of this step allows for re-analyzing only the impacted portions of the program, thus saving considerable resources during analysis. This thesis also provides an open-source tool to the public that can perform incremental taint analysis automatically by performing an automated change impact analysis between two versions of an Android application and using the analysis results to perform incremental taint analysis on the evolved variant. After performing incremental taint analysis using this tool on 615 Android applications, the results demonstrate that incremental taint analysis increases the efficiency of analyzing any random pair of Android applications by 42.2% when not considering any other factors. Furthermore, the average efficiency of the analysis increases by 73.8% when the overhead of analyzing small differences between two versions crosses a specific threshold.
Metrics
17 File views/ downloads
32 Record Views
Details
- Title
- Incremental taint analysis of Android applications
- Creators
- John Jacob Jenkins
- Contributors
- Haipeng Cai (Advisor) - Washington State University, Electrical Engineering and Computer Science, School of
- Awarding Institution
- Washington State University
- Academic Unit
- Electrical Engineering and Computer Science, School of
- Theses and Dissertations
- Master of Science (MS), Washington State University
- Publisher
- Washington State University
- Identifiers
- 99900896437101842
- Language
- English
- Resource Type
- Thesis