Discovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation
Discovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation
复制标题
DOI：
--
复制
发表时间：
2018-06
期刊：
影响因子：
--
通讯作者：
R. Bonett;Kaushal Kafle;Kevin Moran;Adwait Nadkarni;D. Poshyvanyk
中科院分区：
文献类型：
--
作者：
R. Bonett;Kaushal Kafle;Kevin Moran;Adwait Nadkarni;D. Poshyvanyk
移动的应用安全是近十年来安全研究的主要领域之一。已经提出了许多应用程序分析工具来响应恶意，好奇或易受攻击的应用程序。然而，现有的工具，特别是静态分析工具，交易的准确性和性能的分析，因此是健全的。不幸的是，这些工具设计中的具体错误选择或缺陷通常不为人知或没有很好的记录，导致研究人员，开发人员和用户之间的错误信心。本文提出了基于突变的可靠性评估（µSE）框架，该框架系统地评估Android静态分析工具，通过利用突变分析的良好实践来发现，记录和修复缺陷。我们将µSE实现为半自动化框架，并将其应用于一组突出的Android静态分析工具，用于检测应用程序中的私有数据泄漏。作为对主要工具之一的深入分析的结果，我们发现了13个未记录的缺陷。更重要的是，我们发现所有13个缺陷都传播到继承有缺陷工具的工具。我们与工具开发人员合作成功修复了其中一个缺陷。我们的研究结果激发了对系统发现和记录可靠工具中不可靠选择的迫切需求，并展示了利用突变测试实现这一目标的机会。
Mobile application security has been one of the major areas of security research in the last decade. Numerous application analysis tools have been proposed in response to malicious, curious, or vulnerable apps. However, existing tools, and specifically, static analysis tools, trade soundness of the analysis for precision and performance, and are hence soundy. Unfortunately, the specific unsound choices or flaws in the design of these tools are often not known or well-documented, leading to a misplaced confidence among researchers, developers, and users. This paper proposes the Mutation-based soundness evaluation (µSE) framework, which systematically evaluates Android static analysis tools to discover, document, and fix, flaws, by leveraging the well-founded practice of mutation analysis. We implement µSE as a semi-automated framework, and apply it to a set of prominent Android static analysis tools that detect private data leaks in apps. As the result of an in-depth analysis of one of the major tools, we discover 13 undocumented flaws. More importantly, we discover that all 13 flaws propagate to tools that inherit the flawed tool. We successfully fix one of the flaws in cooperation with the tool developers. Our results motivate the urgent need for systematic discovery and documentation of unsound choices in soundy tools, and demonstrate the opportunities in leveraging mutation testing in achieving this goal.