TU Darmstadt / ULB / TUbiblio

Effective Inter-Component Communication Mapping in Android: An Essential Step Towards Holistic Security Analysis

Octeau, Damien ; McDaniel, Patrick ; Jha, Somesh ; Bartel, Alexandre ; Bodden, Eric ; Klein, Jacques ; Le Traon, Yves (2013)
Effective Inter-Component Communication Mapping in Android: An Essential Step Towards Holistic Security Analysis.
In: Proceedings of the 22nd USENIX Conference on Security
Book Section, Bibliographie

Abstract

Many threats present in smartphones are the result of interactions between application components, not just artifacts of single components. However, current techniques for identifying inter-application communication are ad hoc and do not scale to large numbers of applications. In this paper, we reduce the discovery of inter-component communication (ICC) in smartphones to an instance of the Interprocedural Distributive Environment (IDE) problem, and develop a sound static analysis technique targeted to the Android platform. We apply this analysis to 1,200 applications selected from the Play store and characterize the locations and substance of their ICC. Experiments show that full specifications for ICC can be identified for over 93% of ICC locations for the applications studied. Further the analysis scales well; analysis of each application took on average 113 seconds to complete. Epicc, the resulting tool, finds ICC vulnerabilities with far fewer false positives than the next best tool. In this way, we develop a scalable vehicle to extend current security analysis to entire collections of applications as well as the interfaces they export.

Item Type: Book Section
Erschienen: 2013
Creators: Octeau, Damien ; McDaniel, Patrick ; Jha, Somesh ; Bartel, Alexandre ; Bodden, Eric ; Klein, Jacques ; Le Traon, Yves
Type of entry: Bibliographie
Title: Effective Inter-Component Communication Mapping in Android: An Essential Step Towards Holistic Security Analysis
Language: English
Date: August 2013
Place of Publication: Berkeley, Calif
Publisher: USENIX Association
Book Title: Proceedings of the 22nd USENIX Conference on Security
Series: SEC'13
Event Location: Washington, DC, USA
Abstract:

Many threats present in smartphones are the result of interactions between application components, not just artifacts of single components. However, current techniques for identifying inter-application communication are ad hoc and do not scale to large numbers of applications. In this paper, we reduce the discovery of inter-component communication (ICC) in smartphones to an instance of the Interprocedural Distributive Environment (IDE) problem, and develop a sound static analysis technique targeted to the Android platform. We apply this analysis to 1,200 applications selected from the Play store and characterize the locations and substance of their ICC. Experiments show that full specifications for ICC can be identified for over 93% of ICC locations for the applications studied. Further the analysis scales well; analysis of each application took on average 113 seconds to complete. Epicc, the resulting tool, finds ICC vulnerabilities with far fewer false positives than the next best tool. In this way, we develop a scalable vehicle to extend current security analysis to entire collections of applications as well as the interfaces they export.

Uncontrolled Keywords: Secure Architectures
Identification Number: TUD-CS-2013-0479
Divisions: 20 Department of Computer Science
20 Department of Computer Science > Databases and Distributed Systems
20 Department of Computer Science > System Security Lab
Profile Areas
Profile Areas > Cybersecurity (CYSEC)
LOEWE
LOEWE > LOEWE-Zentren
LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
Date Deposited: 28 Aug 2017 12:29
Last Modified: 17 Apr 2019 12:08
PPN:
Export:
Suche nach Titel in: TUfind oder in Google
Send an inquiry Send an inquiry

Options (only for editors)
Show editorial Details Show editorial Details