TWC: Medium: Collaborative: Scaling and Prioritizing Market-Sized Application Analysis

TWC：媒介：协作：扩展和优先考虑市场规模的应用程序分析

• 批准号: 1563831
• 负责人: Somesh Jha
• 金额: $ 59.97万
• 依托单位: University of Wisconsin-Madison
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-07-01 至 2023-06-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1563831&HistoricalAwards=false
• 关键词: TWC; Medium; Collaborative; Scaling; Prioritizing

The emergence of smartphones and more generally mobile platforms as a vehicle for communication, entertainment, and commerce has led to a revolution of innovation. Markets now provide a dizzying array of applications that inform and aid every conceivable human need or desire. At the same time, application markets allow previously unknown multitudes of application developers access to user devices through fast- tracked software publishing with well-documented consequent security concerns. The science and tools for performing security analysis of applications have vastly improved over the last decade. However, market providers have limited capability to apply those analyses at scale to the massive software markets. This project is a crosscutting research, educational, and outreach plan improving the scalability and accuracy of smartphone application analysis. The research effort focuses on the creation of new techniques and algorithms to enable analysis of large bodies of applications by reducing analysis cost and prioritizing identified security vulnerabilities by their expected impact. Explored within the context of Android Intent analysis resolution, the team is developing efficient algorithms and study the computational complexity of matching application communication sources and sinks thereby supporting phone-wide information flow analysis, developing empirical models for estimating the likelihoods of inter-component communication, and exploring features and metrics indicating their potential security impacts communication pathways. The approaches are being applied to a commercial markets (Apple iOS) and domains (web, desktop, and server environments) and massive application data sets.

智能手机和更普遍的移动平台的出现作为通信，娱乐和商业的工具，导致了一场创新的革命。现在，市场提供了令人眼花apper乱的应用程序，这些应用程序为所有可能的人类需求或欲望提供了信息。同时，应用程序市场允许以前未知的应用程序开发人员通过快速跟踪的软件出版访问用户设备，并有据可查的结果安全问题。在过去的十年中，对应用程序进行安全分析的科学和工具已大大改善。但是，市场提供商的能力有限，可以将这些分析按大规模应用于大规模的软件市场。该项目是一项横切研究，教育和外展计划，可提高智能手机应用程序分析的可扩展性和准确性。研究工作着重于创建新技术和算法，以通过降低分析成本并通过其预期影响来对确定的安全漏洞进行优先排序，从而对大型应用程序进行分析。 在Android意图分析解决方案的背景下，该团队正在开发有效的算法，并研究匹配应用程序通信源和下沉的计算复杂性，从而支持整个电话的信息流分析，开发了经验模型，以估算组件间交流的可能性，并探索其潜在的安全性影响通信路径的特征和衡量标准。 这些方法正在应用于商业市场（Apple iOS）和域（Web，桌面和服务器环境）以及大量的应用程序数据集。