VulHunter: Toward discovering vulnerabilities in android applications

Chenxiong Qian, Xiapu Luo, Yu Le, Guofei Gu

Research output: Journal article publicationJournal articleAcademic researchpeer-review

30 Citations (Scopus)


With the prosperity of the Android app economy, many apps have been published and sold in various markets. However, short development cycles and insufficient security development guidelines have led to many vulnerable apps. Although some systems have been developed for automatically discovering specific vulnerabilities in apps, their effectiveness and efficiency are usually restricted because of the exponential growth of paths to examine and simplified assumptions. In this article, the authors propose a new static-analysis framework for facilitating security analysts to detect vulnerable apps from three aspects. First, they propose an app property graph (APG), a new data structure containing detailed and precise information from apps. Second, by modeling app-related vulnerabilities as graph traversals, the authors conduct graph traversals over APGs to identify vulnerable apps for easing the identification process. Third, they reduce the workload of manual verification by removing infeasible paths and generating attack inputs whenever possible. They have implemented the framework in a system named VulHunter with 9,145 lines of Java code and modeled five types of vulnerabilities. Checking 557 popular apps that are randomly collected from Google Play and have at least 1 million installations, the authors found that 375 apps (67.3 percent) have at least one vulnerability.
Original languageEnglish
Article number7057600
Pages (from-to)44-53
Number of pages10
JournalIEEE Micro
Issue number1
Publication statusPublished - 1 Jan 2015


  • Android applications
  • app property graph
  • static analysis
  • vulnerabilities detection

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture
  • Electrical and Electronic Engineering


Dive into the research topics of 'VulHunter: Toward discovering vulnerabilities in android applications'. Together they form a unique fingerprint.

Cite this