38 lines
3.4 KiB
Typst
38 lines
3.4 KiB
Typst
#import "../lib.typ": etal
|
|
#import "X_var.typ": *
|
|
|
|
== Introduction
|
|
|
|
In this chapter, we study the reusability of open source static analysis tools that appeared between 2011 and 2017, on a recent Android dataset.
|
|
The scope of our study is *not* to quantify if the output results are accurate for ensuring reproducibility, because all the studied static analysis tools have different goals in the end.
|
|
On the contrary, we take as hypothesis that the provided tools compute the intended result but may crash or fail to compute a result due to the evolution of the internals of an Android application, raising unexpected bugs during an analysis.
|
|
This chapter intends to show that sharing the software artifacts of a paper may not be sufficient to ensure that the provided software would be reusable.
|
|
|
|
Thus, our contributions are the following.
|
|
We carefully retrieved static analysis tools for Android applications that were selected by Li #etal~@Li2017 between 2011 and 2017.
|
|
We contacted the authors, whenever possible, for selecting the best candidate versions and to confirm the good usage of the tools.
|
|
We rebuild the tools in their original environment and we plan to share our Docker images with this paper.
|
|
We evaluated the reusability of the tools by measuring the number of successful analysis of applications taken in the Drebin dataset~@Arp2014 and in a custom dataset that contains more recent applications (#NBTOTALSTRING in total).
|
|
The observation of the success or failure of these analysis enables us to answer the following research questions:
|
|
|
|
/ RQ1: What Android static analysis tools that are more than 5 years old are still available and can be reused without crashing with a reasonable effort?
|
|
/ RQ2: How the reusability of tools evolved over time, especially when analyzing applications that are more than 5 years far from the publication of the tool?
|
|
/ RQ3: Does the reusability of tools change when analyzing goodware compared to malware?
|
|
|
|
/*
|
|
As a summary, the contributions of this paper are the following:
|
|
|
|
- We provide containers with a compiled version of all studied analysis tools, which ensures the reproducibility of our experiments and an easy way to analyze applications for other researchers. Additionally receipts for rebuilding such containers are provided.
|
|
- We provide a recent dataset of #NBTOTALSTRING applications balanced over the time interval 2010-2023.
|
|
- We point out which static analysis tools of Li #etal SLR paper@Li2017 can safely be used and we show that #resultunusable of evaluated tools are unusable (considering that a tool that fails more than 50% of time is unusable). In total, the success rate of the tools we could run is #resultratio on our dataset.
|
|
- We discuss the effect of applications features (date, size, SDK version, goodware/malware) on static analysis tools and the nature of the issues we found by studying statistics on the errors captured during our experiments.
|
|
*/
|
|
|
|
The chapter is structured as follows.
|
|
@sec:rasta-soa presents a summary of previous works dedicated to Android static analysis tools.
|
|
@sec:rasta-methodology presents the methodology employed to build our evaluation process and @sec:rasta-xp gives the associated experimental results.
|
|
// @sec:rasta-discussion investigates the reasons behind the observed failures of some of the tools.
|
|
@sec:rasta-discussion discusses the limitations of this work and gives some takeaways for future contributions.
|
|
@sec:rasta-conclusion concludes the paper.
|
|
|
|
|