UBCBench

UBCBench contains all benchmarks we designed for confirming our hypothesized findings while analyzing the three well-known static taint analysis tools, FlowDroid, Amandroid, and DroidSafe.

The master branch contains benchmarks for our extended journal paper Analyzing Android Taint Analysis Tools: FlowDroid, Amandroid, and DroidSafe published at IEEE Transactions on Software Engineering (TSE) journal. If you are looking for benchmarks used in our conference paper published at ISSTA'18 (Analyzing the analyzers: FlowDroid/IccTA, AmanDroid, and DroidSafe), please switch to the ISSTA branch.

UBCBench Results - DroidIccSourceSinks.xlsx

We ran all benchmarks with the three aforementioned tools, using the same tool configurations and sources and sinks list we described in our TSE paper. We analyzed all tool analysis results and provided our analysis results, along with the ground truth in the excel file called "UBCBench Results.xlsx".

Benchmark Names and Mappings

U-DB2.12: ConservativeModel1-3
U-DB4.15: HardCodedLocationTest
U-DB4.16: CallbacksIntentHandling
U-DB4.17: SetContentView
U-DB4.18: CallbacksInFragment
U-DB7.24: ViewCasting
U-DB10.6: ReflectiveSource
U-DB10.7: GetClass
U-DB10.8: ReflectionOverloaded
U-DB10.9: ReflectionRes
U-DB10.10: ReflectionDynamic
U-DB10.11: ReflectionAndroid
U-DB10.12: GetConstructor, ReturnConstructor

FlowSensitivity does not better reflect flowsensitivity

This is the code fragment I decompiled from the apk file:

@Override // android.app.Activity
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_flow_sensitivity);
    TelephonyManager tpm = (TelephonyManager) getSystemService("phone");
    String deviceId = tpm.getDeviceId();
    Log.e("FlowSensitivity1", deviceId);
    Log.e("FlowSensitivity2", "123");
}

From this code,it is clear that there will only raise 1 leak path whether the taint analysis tool is flow-sensitivity or not.
But however when I watched the source code of this apk,I find the original design of it really makes sense.

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_flow_sensitivity);

    TelephonyManager tpm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
    String deviceId = tpm.getDeviceId();    // Source: <android.telephony.TelephonyManager: java.lang.String getDeviceId()> -> _SOURCE_
    Log.e("FlowSensitivity1", deviceId);    // Sink1, Leak: <android.util.Log: int e(java.lang.String,java.lang.String)> -> _SINK_

    deviceId = "123";
    Log.e("FlowSensitivity2", deviceId);    // Sink2, No leak: <android.util.Log: int e(java.lang.String,java.lang.String)> -> _SINK_
}

This code difference may be caused by compilation optimization which eliminates differences in analysis results.
Considering that much analysis will directly be put on the apk file,maybe a better one which can show the difference is expected.

linaqiu / ubcbench Goto Github PK

ubcbench's Introduction

UBCBench

UBCBench Results - DroidIccSourceSinks.xlsx

Benchmark Names and Mappings

ubcbench's People

Contributors

Stargazers

Watchers

Forkers

ubcbench's Issues

FlowSensitivity does not better reflect flowsensitivity

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent