Please use this identifier to cite or link to this item:
Title: VulHunter : toward discovering vulnerabilities in android applications
Authors: Qian, C
Luo, X 
Le, Y
Gu, G
Keywords: Android applications
App property graph
Static analysis
Vulnerabilities detection
Issue Date: 2015
Publisher: IEEE Computer Society
Source: IEEE Micro, 2015, v. 35, no. 1, 7057600, p. 44-53 How to cite?
Journal: IEEE Micro 
Abstract: With the prosperity of the Android app economy, many apps have been published and sold in various markets. However, short development cycles and insufficient security development guidelines have led to many vulnerable apps. Although some systems have been developed for automatically discovering specific vulnerabilities in apps, their effectiveness and efficiency are usually restricted because of the exponential growth of paths to examine and simplified assumptions. In this article, the authors propose a new static-analysis framework for facilitating security analysts to detect vulnerable apps from three aspects. First, they propose an app property graph (APG), a new data structure containing detailed and precise information from apps. Second, by modeling app-related vulnerabilities as graph traversals, the authors conduct graph traversals over APGs to identify vulnerable apps for easing the identification process. Third, they reduce the workload of manual verification by removing infeasible paths and generating attack inputs whenever possible. They have implemented the framework in a system named VulHunter with 9,145 lines of Java code and modeled five types of vulnerabilities. Checking 557 popular apps that are randomly collected from Google Play and have at least 1 million installations, the authors found that 375 apps (67.3 percent) have at least one vulnerability.
ISSN: 0272-1732
DOI: 10.1109/MM.2015.25
Appears in Collections:Journal/Magazine Article

View full-text via PolyU eLinks SFX Query
Show full item record


Last Week
Last month
Citations as of Oct 11, 2017

Page view(s)

Last Week
Last month
Checked on Oct 16, 2017

Google ScholarTM



Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.