NDLI: Automatic generation of inter-component communication exploits for Android applications

Please wait, while we are loading the content...

The rising tide lifts all boats: the advancement of science in cyber security (invited talk)

A fast causal profiler for task parallel programs

When program analysis meets mobile security: an industrial study of misusing Android internet sockets

Strong agile metrics: mining log data to determine predictive power of software metrics for continuous delivery teams

What do software engineers care about? gaps between research and practice

Automated identification of security issues from commit messages and bug reports

QEMU-based framework for non-intrusive virtual machine instrumentation and introspection

DynAlloy analyzer: a tool for the specification and analysis of alloy models with dynamic behaviour

Cherry-picking of code commits in long-running, multi-release software

Using search-based software engineering to handle the changes with uncertainties for self-adaptive systems

Suggesting meaningful variable names for decompiled code: a machine translation approach

Verifying the forecast: how climate models are developed and tested (invited talk)

On the scalability of Linux kernel maintainers' work

File-level vs. module-level regression test selection for .NET

Screening heuristics for project gating systems

Reference architectures and Scrum: friends or foes?

LaChouTi: kernel vulnerability responding framework for the fragmented Android devices

RunDroid: recovering execution call graphs for Android applications

From scenario modeling to scenario programming for reactive systems with dynamic topology

ARCC: assistant for repetitive code comprehension

DRACO: discovering refactorings that improve architecture using fine-grained co-change dependencies

Practical symbolic verification of regular properties

Software engineering research results in industrial practice: a tale of two projects (invited talk)

Modeling and verification of evolving cyber-physical spaces

Record and replay for Android: are we there yet in industrial cases?

Natural language querying in SAP-ERP platform

Guidelines for adopting frontend architectures and patterns in microservices-based systems

Applying deep learning based automatic bug triager to industrial projects

RGSE: a regular property guided symbolic executor for Java

CLTSA: labelled transition system analyser with counting fluent support

JoanAudit: a tool for auditing common injection vulnerabilities

User- and analysis-driven context aware software development in mobile computing

FOSS version differentiation as a benchmark for static analysis security testing tools

Reflections on the REST architectural style and "principled design of the modern web architecture" (impact paper award)

Easy over hard: a case study on deep learning

Model-driven software engineering in practice: privacy-enhanced filtering of network traffic

Serverless computing: economic and architectural impact

Improving understanding of dynamically typed software developed by agile practitioners

Static analysis for optimizing big data queries

A tool for automated reasoning about traces based on configurable formal semantics

The MONDO collaboration framework: secure collaborative modeling over existing version control systems

XSearch: a domain-specific cross-language relevant question retrieval tool

Recommender system for model driven software development

DecisionDroid: a supervised learning-based system to identify cloned Android applications

Finding near-optimal configurations in product lines by random sampling

Automated testing of hybrid Simulink/Stateflow controllers: industrial case studies

VART: a tool for the automatic detection of regression faults

Model-based privacy and security analysis with CARiSMA

On the similarity of software development documentation

Reasons and drawbacks of using trivial npm packages: the developers' perspective

Revisiting unsupervised learning for defect prediction

Application of search-based software engineering methodologies for test suite optimization and evolution in mission critical mobile application development

Detecting wearable app permission mismatches: a case study on Android wear

Loopster: static loop termination analysis

Summarizing software engineering communication artifacts from different sources

Automating traceability link recovery through classification

Model-based dynamic software project scheduling

Improving performance of automatic program repair using learned heuristics

The power of "why" and "why not": enriching scenario exploration with provenance

System performance optimization via design and configuration space exploration

Where is the bug and how is it fixed? an experiment with practitioners

Understanding misunderstandings in source code

Measuring neural efficiency of program comprehension

Bayesian specification learning for finding API usage errors

Synergistic debug-repair of heap manipulations

Failure-directed program trimming

Why modern open source projects fail

Trade-offs in continuous integration: assurance, security, and flexibility

µDroid: an energy-aware mutation testing framework for Android

PATDroid: permission-aware GUI testing of Android

Enabling mutation testing for Android apps

Guided, stochastic model-based GUI testing of Android apps

Using bad learners to find good configurations

Attributed variability models: outside the comfort zone

Kmax: finding all configurations of Kbuild makefiles statically

Is there a mismatch between real-world feature models and product-line research?

Adaptively generating high quality fixes for atomicity violations

AtexRace: across thread and execution sampling for in-house race detection

Symbolic execution of programmable logic controller code

Thread-modular static analysis for relaxed memory models

ARTINALI: dynamic invariant detection for cyber-physical system security

A symbolic justice violations transition system for unrealizable GR(1) specifications

Automated control of multiple software goals using multiple actuators

Why do developers use trivial packages? an empirical case study on npm

Detecting missing information in bug descriptions

Continuous variable-specific resolutions of feature interactions

Model-level, platform-independent debugging in the context of the model-driven development of real-time systems

Cooperative kernels: GPU multitasking for blocking algorithms

Toward full elasticity in distributed static analysis: the case of callgraph analysis

Probabilistic model checking of perturbed MDPs with applications to cloud computing

Understanding the impact of refactoring on smells: a longitudinal study of 23 software projects

Cimplifier: automatically debloating containers

Craig vs. Newton in software model checking

Fairness testing: testing software for discrimination

The care and feeding of wild-caught mutants

QTEP: quality-aware test case prioritization

Constraint normalization and parameterized caching for quantitative program analysis

Generalized observational slicing for tree-represented modelling languages

On evidence preservation requirements for forensic-ready systems

BDCI: behavioral driven conflict identification

NoFAQ: synthesizing command repairs from examples

S3: syntax- and semantic-guided repair synthesis via programming by examples

Counterexample-guided approach to finding numerical invariants

Discovering relational specifications

Steelix: program-state based binary fuzzing

CodeMatch: obfuscation won't conceal your repackaged app

A compiler and verifier for page access oblivious computation

Automatic generation of inter-component communication exploits for Android applications

OASIS: prioritizing static analysis warnings for Android apps based on app user reviews

Recovering clear, natural identifiers from obfuscated JS names

DESCRY: reproducing system-level concurrency failures

Reproducing concurrency failures from crash stacks

Automatically analyzing groups of crashes for finding correlations

Automatic inference of code transforms for patch generation

A feasibility study of using automated program repair for introductory programming assignments

Automatically diagnosing and repairing error handling bugs in C

Are deep neural networks the best choice for modeling source code?

Understanding the impact of support for iteration on code search

LAMP: data provenance for graph based machine learning algorithms through derivative computation

More accurate recommendations for method-level changes

Regression test selection across JVM boundaries

Measuring the cost of regression testing in practice: a study of Java projects using continuous integration

Better test cases for better automated program repair

Automatic generation of inter-component communication exploits for Android applications

Content Provider	ACM Digital Library
Author	Ghorbani, Negar Hammad, Mahmoud Garcia, Joshua Malek, Sam
Abstract	Although a wide variety of approaches identify vulnerabilities in Android apps, none attempt to determine exploitability of those vulnerabilities. Exploitability can aid in reducing false positives of vulnerability analysis, and can help engineers triage bugs. Specifically, one of the main attack vectors of Android apps is their inter-component communication interface, where apps may receive messages called Intents. In this paper, we provide the first approach for automatically generating exploits for Android apps, called LetterBomb, relying on a combined path-sensitive symbolic execution-based static analysis, and the use of software instrumentation and test oracles. We run LetterBomb on 10,000 Android apps from Google Play, where we identify 181 exploits from 835 vulnerable apps. Compared to a state-of-the-art detection approach for three ICC-based vulnerabilities, LetterBomb obtains 33%-60% more vulnerabilities at a 6.66 to 7 times faster speed. .
Starting Page	661
Ending Page	671
Page Count	11
File Format	PDF
ISBN	9781450351058
DOI	10.1145/3106237.3106286
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2017-08-21
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Test oracle Vulnerability Exploit Android Test generation
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in