Data-Oriented Instrumentation against Information Leakages of Android Applications

摘要: As one of the most prominent threat, information leakages usually take sensitive data from some private sources and improperly release through malicious or misused method invocations intercommunications. a countermeasure against this number detection approaches have been developed based on static analysis, esp. taint analysis. But we still not reached satisfactory solution to patching mitigation threat. In paper, propose an approach automatically instrument Android applications with cryptographic primitives randomization. With help off-the-shelf analyzer, detect parts code that might leak information. order mitigate these leakages, standard cipher transformations randomization are used enforce different security policies according positions related sinks intermediate system calls along flow paths. The evaluation benchmark suites real-world demonstrates our can avoid false positives around 91% in real applications, acceptable cost analysis instrumentations affordable by desktops.