Precise and Efficient Patch Presence Test for Android Applications against Code Obfuscation
Third-party libraries (TPLs) are widely utilized by Android developers to implement new apps.
Unfortunately, TPLs are often suffering from various vulnerabilities, which could be exploited by attackers to cause catastrophic consequences for app users.
Therefore, testing whether a vulnerability has been patched in target apps is crucial.
However, existing techniques are unable to effectively test patch presence for obfuscated apps while obfuscation is pervasive in practice.
To address the new challenges introduced by code obfuscation, this study presents PHunter, which is a system that captures obfuscation-resilient semantic features of patch-related methods to identify the presence of the patch in target apps.
Specifically, PHunter utilizes coarse-grained features to locate patch-related methods, and compares the fine-grained semantic similarity to determine whether the code has been patched.
Extensive evaluations on 94 CVEs and 200 apps show that PHunter can outperform state-of-the-art tools, achieving an average accuracy of 97.1% with high efficiency and low false positive rates.
Besides, PHunter is able to be resilient to different obfuscation strategies.
More importantly, PHunter is useful in eliminating the false alarms generated by existing TPL detection tools.
In particular, it can help reduce up to 25.2% of the false alarms with an accuracy of 95.3%.
Wed 19 JulDisplayed time zone: Pacific Time (US & Canada) change
15:30 - 17:00 | ISSTA Online 5: Domain-Specific TestingTechnical Papers at Habib Classroom (Gates G01) Chair(s): Michal Young University of Oregon | ||
15:30 10mTalk | DeUEDroid: Detecting Underground Economy Apps Based on UTG Similarity Technical Papers Zhuo Chen Zhejiang University; Ant Group, Jie Liu Ant Group, Yubo Hu Xidian University, Lei Wu Zhejiang University, Yajin Zhou Zhejiang University, Yiling He Zhejiang University, Xianhao Liao Ant Group, Ke Wang Ant Group, Jinku Li Xidian University, Zhan Qin Zhejiang University DOI | ||
15:40 10mTalk | Precise and Efficient Patch Presence Test for Android Applications against Code Obfuscation Technical Papers Zifan Xie Huazhong University of Science and Technology, Ming Wen Huazhong University of Science and Technology, Haoxiang Jia Huazhong University of Science and Technology, Xiaochen Guo Huazhong University of Science and Technology, Xiaotong Huang Huazhong University of Science and Technology, Deqing Zou Huazhong University of Science and Technology, Hai Jin Huazhong University of Science and Technology DOI | ||
15:50 10mTalk | DDLDroid: Efficiently Detecting Data Loss Issues in Android Apps Technical Papers Yuhao Zhou Nanjing University of Science and Technology, Wei Song Nanjing University of Science and Technology DOI | ||
16:00 10mTalk | Exploring Missed Optimizations in WebAssembly Optimizers Technical Papers Zhibo Liu Hong Kong University of Science and Technology, Dongwei Xiao Hong Kong University of Science and Technology, Li Zongjie Hong Kong University of Science and Technology, Shuai Wang Hong Kong University of Science and Technology, Wei Meng Chinese University of Hong Kong DOI | ||
16:10 10mTalk | Vectorizing Program Ingredients for Better JVM Testing Technical Papers Tianchang Gao Tianjin University, Junjie Chen Tianjin University, Yingquan Zhao Tianjin University, Yuqun Zhang Southern University of Science and Technology, Lingming Zhang University of Illinois at Urbana-Champaign DOI | ||
16:20 10mTalk | 1dFuzz: Reproduce 1-Day Vulnerabilities with Directed Differential Fuzzing Technical Papers Songtao Yang Tsinghua University, Yubo He Information Engineering University, Kaixiang Chen Tsinghua University, Zheyu Ma Tsinghua University, Xiapu Luo Hong Kong Polytechnic University, Yong Xie Qinghai University, Jianjun Chen Tsinghua University, Chao Zhang Tsinghua University DOI | ||
16:30 10mTalk | SBDT: Search-Based Differential Testing of Certificate Parsers in SSL/TLS Implementations Technical Papers Chu Chen Qufu Normal University, Pinghong Ren Qufu Normal University, Zhenhua Duan Xidian University, Cong Tian Xidian University, Xu Lu Xidian University, Bin Yu Xidian University DOI | ||
16:40 10mTalk | Silent Compiler Bug De-duplication via Three-Dimensional Analysis Technical Papers Chen Yang Tianjin University, Junjie Chen Tianjin University, Xingyu Fan Tianjin University, Jiajun Jiang Tianjin University, Jun Sun Singapore Management University DOI | ||
16:50 10mTalk | Alligator in Vest: A Practical Failure-Diagnosis Framework via Arm Hardware Features Technical Papers Yiming Zhang Southern University of Science and Technology; Hong Kong Polytechnic University, Yuxin Hu Southern University of Science and Technology, Haonan Li Southern University of Science and Technology, Wenxuan Shi Southern University of Science and Technology, Zhenyu Ning Hunan University; Southern University of Science and Technology, Xiapu Luo Hong Kong Polytechnic University, Fengwei Zhang Southern University of Science and Technology DOI | ||