search menu icon-carat-right cmu-wordmark

Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets

Technical Report
In this report, the authors describe how the DidFail tool was enhanced to improve its effectiveness.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2015-TR-001
DOI (Digital Object Identifier)
10.1184/R1/6575201.v1

Abstract

This report describes recent significant enhancements to DidFail (Droid Intent Data Flow Analysis for Information Leakage), the CERT static taint analyzer for sets of Android apps. In addition to improving the analyzer itself, the enhancements include a new testing framework, new test apps, and test results. A framework for testing the DidFail analyzer, including a setup for cloud-based testing was developed and instrumented to measure performance. Cloud-based testing enables the parallel use of powerful, commercially available virtual machines to speed up testing. DidFail was also modified to use the most current version of FlowDroid and Soot, increasing its success rate from 18% to 68% on our test set of real-world apps. Analytical features were added for more types of components and shared static fields and new apps developed to test these features. The improved DidFail analyzer and the cloud-based testing framework were used to test the new apps and additional apps from the Google Play store.

Cite This Technical Report

Burket, J., Flynn, L., Klieber, W., Lim, J., Shen, W., & Snavely, W. (2015, March 4). Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets. (Technical Report CMU/SEI-2015-TR-001). Retrieved April 24, 2024, from https://doi.org/10.1184/R1/6575201.v1.

@techreport{burket_2015,
author={Burket, Jonathan and Flynn, Lori and Klieber, William and Lim, Jonathan and Shen, Wei and Snavely, William},
title={Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets},
month={Mar},
year={2015},
number={CMU/SEI-2015-TR-001},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6575201.v1},
note={Accessed: 2024-Apr-24}
}

Burket, Jonathan, Lori Flynn, William Klieber, Jonathan Lim, Wei Shen, and William Snavely. "Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets." (CMU/SEI-2015-TR-001). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, March 4, 2015. https://doi.org/10.1184/R1/6575201.v1.

J. Burket, L. Flynn, W. Klieber, J. Lim, W. Shen, and W. Snavely, "Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Report CMU/SEI-2015-TR-001, 4-Mar-2015 [Online]. Available: https://doi.org/10.1184/R1/6575201.v1. [Accessed: 24-Apr-2024].

Burket, Jonathan, Lori Flynn, William Klieber, Jonathan Lim, Wei Shen, and William Snavely. "Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets." (Technical Report CMU/SEI-2015-TR-001). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 4 Mar. 2015. https://doi.org/10.1184/R1/6575201.v1. Accessed 24 Apr. 2024.

Burket, Jonathan; Flynn, Lori; Klieber, William; Lim, Jonathan; Shen, Wei; & Snavely, William. Making DidFail Succeed: Enhancing the CERT Static Taint Analyzer for Android App Sets. CMU/SEI-2015-TR-001. Software Engineering Institute. 2015. https://doi.org/10.1184/R1/6575201.v1