POSTER: Detection of information leaks via reflection in Android apps

Jyoti Gajrani, Li Li, Vijay Laxmi, Meenakshi Tripathi, M. S. Gaur, Mauro Conti

Research output: Chapter in Book/Report/Conference proceedingConference PaperOther

3 Citations (Scopus)

Abstract

Reflection is a language feature which allows to analyze and transform the behavior of classes at the runtime. Reflection is used for software debugging and testing. Malware authors can leverage re ection to subvert the malware de- tection by static analyzers. Re ection initializes the class, invokes any method of class, or accesses any field of class. But, instead of utilizing usual programming language syn- tax, reflection passes classes/methods etc. as parameters to reflective APIs. As a consequence, these parameters can be constructed dynamically or can be encrypted by malware. These cannot be detected by state-of-the-art static tools. We propose EspyDroid, a system that combines dynamic analysis with code instrumentation for a more precise and automated detection of malware employing re ection. Weflevaluate EspyDroid on 28 benchmark apps employing majorflre ection categories. Our technique show improved results over FlowDroid via detection of additional undetected ows. These flows have potential to leak sensitive and private in- formation of the users, through various sinks.

Original languageEnglish
Title of host publicationProceedings of the 2017 ACM Asia Conference on Computer and Communications Security
EditorsAhmad-Reza Sadeghi, Xun Yi
Place of PublicationNew York NY USA
PublisherAssociation for Computing Machinery (ACM)
Pages911-913
Number of pages3
ISBN (Electronic)9781450349444
DOIs
Publication statusPublished - 2017
Externally publishedYes
EventACM Symposium on Information, Computer and Communications Security 2017 - Abu Dhabi, United Arab Emirates
Duration: 2 Apr 20176 Apr 2017
Conference number: 12th
https://dl.acm.org/doi/proceedings/10.1145/3052973

Conference

ConferenceACM Symposium on Information, Computer and Communications Security 2017
Abbreviated titleAsiaCCS 2017
Country/TerritoryUnited Arab Emirates
CityAbu Dhabi
Period2/04/176/04/17
Internet address

Keywords

  • Android
  • Dynamic analysis
  • Instrumentation
  • Malware
  • Reflection

Cite this