NDLI: Android repository mining for detecting publicly accessible functions missing permission checks

Please wait, while we are loading the content...

Do software developers understand open source licenses?

Meaningful identifier names: the case of single-letter variables

Binary code clone detection across architectures and compiling configurations

RepDroid: an automated tool for Android application repackaging detection

An exploratory study on the relationship between changes and refactoring

Bug localization with combination of deep learning and information retrieval

Constructing feature model by identifying variability-aware modules

Comprehending studies on program comprehension

Removing code clones from industrial systems using compiler directives

The code time machine

Software engineers' information seeking behavior in change impact analysis: an interview study

Effects of variable names on comprehension an empirical study

Identifying code clones having high possibilities of containing bugs

Comprehension of ads-supported and paid Android applications: are they different?

Developer-related factors in change prediction: an empirical assessment

Bug report enrichment with application of automated fixer recommendation

An empirical study on code comprehension: data context interaction compared to classical object oriented

It's duck (typing) season!

Language-independent information flow tracking engine for program comprehension tools

FindSmells: flexible composition of bad smell detection strategies

How developers document pull requests with external references

Syntax, predicates, idioms: what really affects code complexity?

Smells are sensitive to developers!: on the efficiency of (un)guided customized detection

How professional hackers understand protected code while performing attack tasks

Analyzing user comments on YouTube coding tutorial videos

How does execution information help with information-retrieval based bug localization?

The effect of delocalized plans on spreadsheet comprehension: a controlled experiment

Replicating parser behavior using neural machine translation

Docio: documenting API input/output examples

Variability through the eyes of the programmer

Exploiting type hints in method argument names to improve lightweight type inference

On the uniqueness of code redundancies

NetDroid: summarizing network behavior of Android apps for network code maintenance

A comparison of three algorithms for computing truck factors

Automatically detecting integrity violations in database-centric applications

The discipline of preprocessor-based annotations does #ifdef TAG n't #endif matter

Towards automatic generation of short summaries of commits

MetricAttitude++: enhancing polymetric views with information retrieval

Android repository mining for detecting publicly accessible functions missing permission checks

Studying the prevalence of exception handling anti-patterns

On the properties of design-relevant classes for design anomaly assessment

Android repository mining for detecting publicly accessible functions missing permission checks

Content Provider	ACM Digital Library
Author	Quan, Tho Nguyen, Hoang H. Jiang, Lingxiao
Abstract	Android has become the most popular mobile operating system. Millions of applications, including many malware, haven been developed for it. Even though its overall system architecture and many APIs are documented, many other methods and implementation details are not, not to mention potential bugs and vulnerabilities that may be exploited. Manual documentation may also be easily outdated as Android evolves constantly with changing features and higher complexities. Techniques and tool supports are thus needed to automatically extract information from different versions of Android to facilitate whole-system analysis of undocumented code. This paper presents an approach for alleviating the challenges associated with whole-system analysis. It performs usual program analysis for different versions of Android by control-flow and data-flow analyses. More importantly, it integrates information retrieval and query heuristics to customize the graphs for purposes related to the queries and make whole-system analyses more efficient. In particular, we use the approach to identify functions in Android that can be invoked by applications in either benign or malicious way, which are referred to as publicly accessible functions in this paper, and with the queries we provided, identify functions that may access sensitive system and/or user data and should be protected by certain permission checks. Based on such information, we can detect some publicly accessible functions in the system that may miss sufficient permission checks. As a proof of concept, this paper has analyzed six Android versions and shows basic statistics about the publicly accessible functions in the Android versions, and detects and verifies several system functions that miss permission checks and may have security implications.
Starting Page	324
Ending Page	327
Page Count	4
File Format	PDF
ISBN	9781538605356
DOI	10.1109/ICPC.2017.14
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2017-05-20
Access Restriction	Subscribed
Subject Keyword	Program comprehension Information retrieval Dependency Program analysis Call graph Android
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in