FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps

By Steven Arzt, Siegfried Rasthofer, Christian G Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, Patrick Drew McDaniel. ACM-SIGPLAN Symposium on Programming Language Design and Implementation, 2014

2,257 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/b585c2e102f20a71f1588440470186c49a532dfd

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Statistical Deobfuscation of Android Applications (2016, background): “Mobile developers tend to rely on a large number of libraries which often contain security vulnerabilities — from personal information release [15, 11] to severe man-in-the-middle vulnerabilities [1].”
HOLMES: Real-Time APT Detection through Correlation of Suspicious Information Flows (2018, background): “Furthermore, HOLMES can be adapted to take advantage of additional works, which track information flows at finer granularities, either by instrumenting additional instructions [11], [25] or by decoupling taint tracking [14], [24], [33], [41].”
Uranine: Real-time Privacy Leakage Monitoring without System Modification for Android (2015, methodology): “FlowDroid [2] also converts Dalvik back to Java bytecode and builds on top of Soot(6) while adding in Android-specific requirements to the analysis.”
Obfuscation-Resilient Privacy Leak Detection for Mobile Apps Through Differential Analysis (2017, background): “Table II shows the comparison between our tool and AppAudit [46], Andrubis [26] (which internally uses TaintDroid [13]), FlowDroid [6], and ReCon.”
Reliable Third-Party Library Detection in Android and its Security Applications (2016, background): “For instance, a wide range of security-related analyses studied apps for privacy and security issues and raised awareness for various problem areas, including privacy leaks [12, 2, 42, 13, 3], permission usage [43], dynamic code loading [28], SSL/TLS”
Static analysis of android apps: A systematic literature review (2017, methodology): “TOOL Brief Description IR Example Usages Soot [12] A Java/Android static analysis and optimization framework JIMPLE, JASMIN FlowDroid [6], IccTA [7], AppIntent [90] WALAa A Java/Javascript static analysis framework WALA-IR (SSA-based) AsDroid [95], Asynchronizer [144], ORBIT [154] Chord [161] A Java”
Intriguing Properties of Adversarial ML Attacks in the Problem Space (2019, methodology): “In absence of FlowDroid exceptions (see Appendix G), we are able to create an evasive variant for each malware in all four conﬁgurations.”
Amandroid: A Precise and General Inter-component Data Flow Analysis Framework for Security Vetting of Android Apps (2014, methodology): “We then experimentally compare Amandroid with two static analyzers for Android: FlowDroid [6, 17] and Epicc [25], and show that Amandroid can address a wide range of security problems due to inter-component communications in Android that cannot be handled by these existing tools.”
SLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data (2018, background): “While the majority of the aforementioned systems operate at the system call level, several other systems track information flows at finer granularities [24, 8, 31].”
The Evolution of Android Malware and Android Analysis Techniques (2017, background): “More recently, short for Sources and Sinks (SUSI) [Rasthofer et al. 2014], built on Android v4.”
A Survey of App Store Analysis for Software Engineering (2017, neutral): “[1, 10) 19 [104, 105) 39 [10, 102) 21 [105, 106) 28 [102, 103) 31 ≥ 106 3”
Computation Offloading Toward Edge Computing (2019, methodology): “Program analysis technologies are often employed to perform automatic privacy detections [230], [231].”
A Survey of Android Malware Detection with Deep Neural Models (2020, methodology): “First, the static analysis tool FlowDroid [107] processed Android apps to identify the sensitive data sources and the sensitive data sinks and to extract all data flows between the identified data points.”
*droid (2016, methodology): “This ultimately leads to tools like FlowDroid [Fritz et al. 2014], Amandroid [Wei et al. 2014], and DroidSafe [Gordon et al. 2015], which are precise but not necessarily scalable to large, complex applications or will not run on standard desktop hardware.”