Detecting privacy leaks in Android apps

Li Li; Alexandre Bartel; Jacques Klein; Yves Le Traon

Detecting privacy leaks in Android apps

Li Li
, Alexandre Bartel
, Jacques Klein
, Yves Le Traon

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research

Abstract

The number of Android apps have grown explosively in recent years and the number of apps leaking private data have also grown. It is necessary to make sure all the apps are not leaking private data before putting them to the app markets and thereby a privacy leaks detection tool is needed. We propose a static taint analysis approach which leverages the control-flow graph (CFG) of apps to detect privacy leaks among Android apps. We tackle three problems related to intercomponent communication (ICC), lifecycle of components and callback mechanism making the CFG imprecision. To bridge this gap, we explicitly connect the discontinuities of the CFG to provide a precise CFG. Based on the precise CFG, we aim at providing a taint analysis approach to detect intra-component privacy leaks, inter-component privacy leaks and also inter-app privacy leaks.

Original language	English
Title of host publication	Proceedings of the 2014 ESSoS Doctoral Symposium co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2014)
Editors	Wouter Joosen, Fabio Martinelli, Thomas Heyman
Place of Publication	Aachen Germany
Publisher	Rheinisch-Westfaelische Technische Hochschule Aachen
Number of pages	6
ISBN (Electronic)	007412981
Publication status	Published - 2014
Externally published	Yes
Event	ESSoS Doctoral Symposium 2014 - Munich, Germany Duration: 26 Feb 2014 → 26 Feb 2014 https://distrinet.cs.kuleuven.be/events/essos/2014/?utm_source=researchbib

Publication series

Name	CEUR Workshop Proceedings
Publisher	Ruzica Piskac
Volume	1298
ISSN (Electronic)	1613-0073

Conference

Conference	ESSoS Doctoral Symposium 2014
Abbreviated title	ESSoS-DS 2014
Country/Territory	Germany
City	Munich
Period	26/02/14 → 26/02/14
Internet address	https://distrinet.cs.kuleuven.be/events/essos/2014/?utm_source=researchbib

Keywords

CFG
ICC
Privacy leaks
Static analysis
Taint analysis

Access to Document

288854981-oaFinal published version, 249 KB

http://ceur-ws.org/Vol-1298/paper5.pdf

Cite this

Li, L., Bartel, A., Klein, J., & Le Traon, Y. (2014). Detecting privacy leaks in Android apps. In W. Joosen, F. Martinelli, & T. Heyman (Eds.), Proceedings of the 2014 ESSoS Doctoral Symposium co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2014) Article 5 (CEUR Workshop Proceedings; Vol. 1298). Rheinisch-Westfaelische Technische Hochschule Aachen. http://ceur-ws.org/Vol-1298/paper5.pdf

Li, Li ; Bartel, Alexandre ; Klein, Jacques et al. / Detecting privacy leaks in Android apps. Proceedings of the 2014 ESSoS Doctoral Symposium co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2014). editor / Wouter Joosen ; Fabio Martinelli ; Thomas Heyman. Aachen Germany : Rheinisch-Westfaelische Technische Hochschule Aachen, 2014. (CEUR Workshop Proceedings).

@inproceedings{bc4228e015944c1992edf0d28122ed20,

title = "Detecting privacy leaks in Android apps",

abstract = "The number of Android apps have grown explosively in recent years and the number of apps leaking private data have also grown. It is necessary to make sure all the apps are not leaking private data before putting them to the app markets and thereby a privacy leaks detection tool is needed. We propose a static taint analysis approach which leverages the control-flow graph (CFG) of apps to detect privacy leaks among Android apps. We tackle three problems related to intercomponent communication (ICC), lifecycle of components and callback mechanism making the CFG imprecision. To bridge this gap, we explicitly connect the discontinuities of the CFG to provide a precise CFG. Based on the precise CFG, we aim at providing a taint analysis approach to detect intra-component privacy leaks, inter-component privacy leaks and also inter-app privacy leaks.",

keywords = "CFG, ICC, Privacy leaks, Static analysis, Taint analysis",

author = "Li Li and Alexandre Bartel and Jacques Klein and \{Le Traon\}, Yves",

year = "2014",

language = "English",

series = "CEUR Workshop Proceedings",

publisher = "Rheinisch-Westfaelische Technische Hochschule Aachen",

editor = "Wouter Joosen and Martinelli, \{Fabio \} and Heyman, \{Thomas \}",

booktitle = "Proceedings of the 2014 ESSoS Doctoral Symposium co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2014)",

note = "ESSoS Doctoral Symposium 2014, ESSoS-DS 2014 ; Conference date: 26-02-2014 Through 26-02-2014",

url = "https://distrinet.cs.kuleuven.be/events/essos/2014/?utm\_source=researchbib",

}

Li, L, Bartel, A, Klein, J & Le Traon, Y 2014, Detecting privacy leaks in Android apps. in W Joosen, F Martinelli & T Heyman (eds), Proceedings of the 2014 ESSoS Doctoral Symposium co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2014)., 5, CEUR Workshop Proceedings, vol. 1298, Rheinisch-Westfaelische Technische Hochschule Aachen, Aachen Germany, ESSoS Doctoral Symposium 2014, Munich, Bavaria, Germany, 26/02/14. <http://ceur-ws.org/Vol-1298/paper5.pdf>

Detecting privacy leaks in Android apps. / Li, Li; Bartel, Alexandre; Klein, Jacques et al.
Proceedings of the 2014 ESSoS Doctoral Symposium co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2014). ed. / Wouter Joosen; Fabio Martinelli; Thomas Heyman. Aachen Germany: Rheinisch-Westfaelische Technische Hochschule Aachen, 2014. 5 (CEUR Workshop Proceedings; Vol. 1298).

Research output: Chapter in Book/Report/Conference proceeding › Conference Paper › Research

TY - GEN

T1 - Detecting privacy leaks in Android apps

AU - Li, Li

AU - Bartel, Alexandre

AU - Klein, Jacques

AU - Le Traon, Yves

PY - 2014

Y1 - 2014

N2 - The number of Android apps have grown explosively in recent years and the number of apps leaking private data have also grown. It is necessary to make sure all the apps are not leaking private data before putting them to the app markets and thereby a privacy leaks detection tool is needed. We propose a static taint analysis approach which leverages the control-flow graph (CFG) of apps to detect privacy leaks among Android apps. We tackle three problems related to intercomponent communication (ICC), lifecycle of components and callback mechanism making the CFG imprecision. To bridge this gap, we explicitly connect the discontinuities of the CFG to provide a precise CFG. Based on the precise CFG, we aim at providing a taint analysis approach to detect intra-component privacy leaks, inter-component privacy leaks and also inter-app privacy leaks.

AB - The number of Android apps have grown explosively in recent years and the number of apps leaking private data have also grown. It is necessary to make sure all the apps are not leaking private data before putting them to the app markets and thereby a privacy leaks detection tool is needed. We propose a static taint analysis approach which leverages the control-flow graph (CFG) of apps to detect privacy leaks among Android apps. We tackle three problems related to intercomponent communication (ICC), lifecycle of components and callback mechanism making the CFG imprecision. To bridge this gap, we explicitly connect the discontinuities of the CFG to provide a precise CFG. Based on the precise CFG, we aim at providing a taint analysis approach to detect intra-component privacy leaks, inter-component privacy leaks and also inter-app privacy leaks.

KW - CFG

KW - ICC

KW - Privacy leaks

KW - Static analysis

KW - Taint analysis

UR - https://www.scopus.com/pages/publications/84915746219

M3 - Conference Paper

AN - SCOPUS:84915746219

T3 - CEUR Workshop Proceedings

BT - Proceedings of the 2014 ESSoS Doctoral Symposium co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2014)

A2 - Joosen, Wouter

A2 - Martinelli, Fabio

A2 - Heyman, Thomas

PB - Rheinisch-Westfaelische Technische Hochschule Aachen

CY - Aachen Germany

T2 - ESSoS Doctoral Symposium 2014

Y2 - 26 February 2014 through 26 February 2014

ER -

Li L, Bartel A, Klein J, Le Traon Y. Detecting privacy leaks in Android apps. In Joosen W, Martinelli F, Heyman T, editors, Proceedings of the 2014 ESSoS Doctoral Symposium co-located with the International Symposium on Engineering Secure Software and Systems (ESSoS 2014). Aachen Germany: Rheinisch-Westfaelische Technische Hochschule Aachen. 2014. 5. (CEUR Workshop Proceedings).

Detecting privacy leaks in Android apps

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Cite this