NDroid: Toward tracking information flows across multiple android contexts

Lei Xue, Chenxiong Qian, Hao Zhou, Xiapu Luo (Corresponding Author), Yajin Zhou, Yuru Shao, Alvin T.S. Chan

Research output: Journal article publicationJournal articleAcademic researchpeer-review

12 Citations (Scopus)

Abstract

For performance and compatibility reasons, developers tend to use native code in their applications (or simply apps). This makes a bidirectional data flow through multiple contexts, i.e., the Java context and the native context, in Android apps. Unfortunately, this interaction brings serious challenges to existing dynamic analysis systems, which fail to capture the data flow across different contexts. In this paper, we first performed a large-scale study on apps using native code and reported some observations. Then, we identified several scenarios where data flow cannot be tracked by existing systems, leading to uncaught information leakage. Based on these insights, we designed and implemented NDroid, an efficient dynamic taint analysis system that could track the data flow between both Java context and native context. The evaluation of real apps demonstrated the effectiveness of NDroid in identifying information leakage with reasonable performance overhead.

Original languageEnglish
Article number8443386
Pages (from-to)814-828
Number of pages15
JournalIEEE Transactions on Information Forensics and Security
Volume14
Issue number3
DOIs
Publication statusPublished - Mar 2019

Keywords

  • Android application analysis
  • Java native interface (JNI)
  • taint analysis

ASJC Scopus subject areas

  • Safety, Risk, Reliability and Quality
  • Computer Networks and Communications

Cite this