English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

Mobile application security has been one of the major areas of securityresearch in the last decade. Numerous application analysis tools have beenproposed in response to malicious, curious, or vulnerable apps. However,existing tools, and specifically, static analysis tools, trade soundness of theanalysis for precision and performance, and are hence soundy. Unfortunately,the specific unsound choices or flaws in the design of these tools are oftennot known or well-documented, leading to a misplaced confidence amongresearchers, developers, and users. This paper proposes the Mutation-basedsoundness evaluation ($\mu$SE) framework, which systematically evaluatesAndroid static analysis tools to discover, document, and fix, flaws, byleveraging the well-founded practice of mutation analysis. We implement $\mu$SEas a semi-automated framework, and apply it to a set of prominent Androidstatic analysis tools that detect private data leaks in apps. As the result ofan in-depth analysis of one of the major tools, we discover 13 undocumentedflaws. More importantly, we discover that all 13 flaws propagate to tools thatinherit the flawed tool. We successfully fix one of the flaws in cooperationwith the tool developers. Our results motivate the urgent need for systematicdiscovery and documentation of unsound choices in soundy tools, and demonstratethe opportunities in leveraging mutation testing in achieving this goal.

Discovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation