![](bg6.png)
is still room for improvement. The call graph con-
struction, although conservative, creates many differ-
ent edges that end up increasing the number of false
positives and raises the size of our system depen-
dency graph drastically. The user awareness has al-
ways been the focus of this method. However, the
way FLOWSLICER shows the alerts and the results of
analysis is not very user-friendly. In a future work, we
also want to give the user more power, allowing him
to decide what is considered a sensitive information
by filtering the list of sources and sinks.
ACKNOWLEDGEMENTS
The authors thank the National Council for Scientific
and Technological Development (CNPq) for the fi-
nancial support.
REFERENCES
Arp, D., Spreitzenbarth, M., Gascon, H., and Rieck, K.
(2014). Drebin: Effective and explainable detection
of android malware in your pocket.
Arzt, S., Rasthofer, S., and Bodden, E. (2013). Susi: A tool
for the fully automated classification and categoriza-
tion of android sources and sinks.
Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A.,
Klein, J., Le Traon, Y., Octeau, D., and McDaniel, P.
(2014). Flowdroid: Precise context, flow, field, object-
sensitive and lifecycle-aware taint analysis for android
apps. SIGPLAN Not., 49(6):259–269.
Enck, W., Cox, L. P., Jung, J., and et al. (2010). Taintdroid:
An information-flow tracking system for realtime pri-
vacy monitoring on smartphones.
Fan, G. and Xuan, Z. (2016). Design and implementation
of a dependence-based taint analysis. In 2016 11th
International Conference on Computer Science & Ed-
ucation (ICCSE), pages 985–991. IEEE.
Felt, A. P., Chin, E., Hanna, S., Song, D., and Wagner, D.
(2011a). Android permissions demystified. In Pro-
ceedings of the 18th ACM Conference on Computer
and Communications Security, CCS ’11, pages 627–
638, New York, NY, USA. ACM.
Felt, A. P., Greenwood, K., and Wagner, D. (2011b). The
effectiveness of application permissions. In Proceed-
ings of the 2Nd USENIX Conference on Web Applica-
tion Development, WebApps’11, pages 7–7, Berkeley,
CA, USA. USENIX Association.
Google (2017). Ui/application exerciser monkey.
https://developer.android.com/studio/test/monkey.html.
[Online; accessed 09-March-2017].
Gordon, M. I., Kim, D., Perkins, J. H., Gilham, L., Nguyen,
N., and Rinard, M. C. (2015). Information flow anal-
ysis of android applications in droidsafe. In 22nd An-
nual Network and Distributed System Security Sym-
posium, NDSS 2015, San Diego, California, USA,
February 8-11, 2015. The Internet Society.
Hedin, D. and Sabelfeld, A. (2011). A perspective on
information-flow control.
Horwitz, S., Reps, T., and Binkley, D. (1988). Interpro-
cedural slicing using dependence graphs. In Pro-
ceedings of the ACM SIGPLAN 1988 Conference on
Programming Language Design and Implementation,
PLDI ’88, pages 35–46, New York, NY, USA. ACM.
Jeon, J., Micinski, K. K., Vaughan, J. A., Fogel, A., Reddy,
N., Foster, J. S., and Millstein, T. (2012). Dr. android
and mr. hide: Fine-grained permissions in android ap-
plications. In Proceedings of the Second ACM Work-
shop on Security and Privacy in Smartphones and Mo-
bile Devices, SPSM ’12, pages 3–14, New York, NY,
USA. ACM.
Kulenovic, M. and Donko, D. (2014). A survey of static
code analysis methods for security vulnerabilities de-
tection. In MIPRO, pages 1381–1386. IEEE.
Lantz, P. (2011). Droidbox: An android ap-
plication sandbox for dynamic analysis.
https://github.com/pjlantz/droidbox. [Online; ac-
cessed 27-February-2017].
Larsen, L. and Harrold, M. J. (1996). Slicing object-
oriented software. In Rombach, H. D., Maibaum, T.
S. E., and Zelkowitz, M. V., editors, ICSE, pages 495–
505. IEEE Computer Society.
Livshits, B. (2005). Stanford securibench. https://suif. stan-
ford.edu/livshits/securibench/. [Online; accessed 22-
February-2017].
Malloy, B. A., Mcgregor, J. D., Krishnaswamy, A., and
Medikonda, M. (1994). An extensible program rep-
resentation for object-oriented software. ACM SIG-
PLAN Notices, 29:38–47.
Ottenstein, K. J. and Ottenstein, L. M. (1984). The program
dependence graph in a software development environ-
ment. SIGPLAN Not., 19(5):177–184.
Vallée-Rai, R., Co, P., Gagnon, E., Hendren, L., Lam,
P., and Sundaresan, V. (1999). Soot - a java byte-
code optimization framework. In Proceedings of the
1999 Conference of the Centre for Advanced Studies
on Collaborative Research, CASCON ’99, pages 13–.
IBM Press.
Walden, J. and Doyle, M. (2012). SAVI: static-analysis
vulnerability indicator. IEEE Security & Privacy,
10(3):32–39.
Weiser, M. (1981). Program slicing. In Proceedings of the
5th International Conference on Software Engineer-
ing, ICSE ’81, pages 439–449, Piscataway, NJ, USA.
IEEE Press.
FlowSlicer - A Hybrid Approach to Detect and Avoid Sensitive Information Leaks in Android Applications using Program Slicing and
Instrumentation
455