English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Widely-used Android static program analysis tools, e.g., Amandroid andFlowDroid, perform the whole-app inter-procedural analysis that iscomprehensive but fundamentally difficult to handle modern (large) apps. Theaverage app size has increased three to four times over five years. In thispaper, we explore a new paradigm of targeted inter-procedural analysis that canskip irrelevant code and focus only on the flows of security-sensitive sinkAPIs. To this end, we propose a technique called on-the-fly bytecode search,which searches the disassembled app bytecode text just in time when a callerneeds to be located. In this way, it guides targeted (and backward)inter-procedural analysis step by step until reaching entry points, withoutrelying on a whole-app graph. Such search-based inter-procedural analysis,however, is challenging due to Java polymorphism, callbacks, asynchronousflows, static initializers, and inter-component communication in Android apps.We overcome these unique obstacles in our context by proposing a set ofbytecode search mechanisms that utilize flexible searches and forward objecttaint analysis. Atop of this new inter-procedural analysis, we further adjustthe traditional backward slicing and forward constant propagation to providethe complete dataflow tracking of sink API calls. We have implemented aprototype called BackDroid and compared it with Amandroid in analyzing 3,178modern popular apps for crypto and SSL misconfigurations. The evaluation showsthat for such sink-based problems, BackDroid is 37 times faster (2.13 v.s.78.15 minutes) and has no timed-out failure (v.s. 35% in Amandroid), whilemaintaining close or even better detection effectiveness.

When Program Analysis Meets Bytecode Search: Targeted and Efficient Inter-procedural Analysis of Modern Android Apps in BackDroid