{"id":"https://openalex.org/W3126967000","doi":"https://doi.org/10.1145/3439802","title":"Systematic Mutation-Based Evaluation of the Soundness of Security-Focused Android Static Analysis Techniques","display_name":"Systematic Mutation-Based Evaluation of the Soundness of Security-Focused Android Static Analysis Techniques","publication_year":2021,"publication_date":"2021-02-09","ids":{"openalex":"https://openalex.org/W3126967000","doi":"https://doi.org/10.1145/3439802","mag":"3126967000"},"language":"en","primary_location":{"id":"doi:10.1145/3439802","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3439802","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2102.06829","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Amit Seal Ami","orcid":"https://orcid.org/0000-0002-9455-2230"},"institutions":[{"id":"https://openalex.org/I16285277","display_name":"William & Mary","ror":"https://ror.org/03hsf0573","country_code":"US","type":"education","lineage":["https://openalex.org/I16285277"]},{"id":"https://openalex.org/I267592682","display_name":"Williams (United States)","ror":"https://ror.org/007zhvp17","country_code":"US","type":"company","lineage":["https://openalex.org/I267592682"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Amit Seal Ami","raw_affiliation_strings":["Department of Computer Science, William & Mary, Williamsburg, USA"],"raw_orcid":"https://orcid.org/0000-0002-9455-2230","affiliations":[{"raw_affiliation_string":"Department of Computer Science, William & Mary, Williamsburg, USA","institution_ids":["https://openalex.org/I16285277","https://openalex.org/I267592682"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Kaushal Kafle","orcid":null},"institutions":[{"id":"https://openalex.org/I16285277","display_name":"William & Mary","ror":"https://ror.org/03hsf0573","country_code":"US","type":"education","lineage":["https://openalex.org/I16285277"]},{"id":"https://openalex.org/I267592682","display_name":"Williams (United States)","ror":"https://ror.org/007zhvp17","country_code":"US","type":"company","lineage":["https://openalex.org/I267592682"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kaushal Kafle","raw_affiliation_strings":["Department of Computer Science, William & Mary, Williamsburg, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, William & Mary, Williamsburg, USA","institution_ids":["https://openalex.org/I16285277","https://openalex.org/I267592682"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Kevin Moran","orcid":null},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kevin Moran","raw_affiliation_strings":["Department of Computer Science, George Mason University, Fairfax, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, George Mason University, Fairfax, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Adwait Nadkarni","orcid":null},"institutions":[{"id":"https://openalex.org/I16285277","display_name":"William & Mary","ror":"https://ror.org/03hsf0573","country_code":"US","type":"education","lineage":["https://openalex.org/I16285277"]},{"id":"https://openalex.org/I267592682","display_name":"Williams (United States)","ror":"https://ror.org/007zhvp17","country_code":"US","type":"company","lineage":["https://openalex.org/I267592682"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Adwait Nadkarni","raw_affiliation_strings":["Department of Computer Science, William & Mary, Williamsburg, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, William & Mary, Williamsburg, USA","institution_ids":["https://openalex.org/I16285277","https://openalex.org/I267592682"]}]},{"author_position":"last","author":{"id":null,"display_name":"Denys Poshyvanyk","orcid":null},"institutions":[{"id":"https://openalex.org/I16285277","display_name":"William & Mary","ror":"https://ror.org/03hsf0573","country_code":"US","type":"education","lineage":["https://openalex.org/I16285277"]},{"id":"https://openalex.org/I267592682","display_name":"Williams (United States)","ror":"https://ror.org/007zhvp17","country_code":"US","type":"company","lineage":["https://openalex.org/I267592682"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Denys Poshyvanyk","raw_affiliation_strings":["Department of Computer Science, William & Mary, Williamsburg, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science, William & Mary, Williamsburg, USA","institution_ids":["https://openalex.org/I16285277","https://openalex.org/I267592682"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.7945,"has_fulltext":false,"cited_by_count":14,"citation_normalized_percentile":{"value":0.84860502,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":98},"biblio":{"volume":"24","issue":"3","first_page":"1","last_page":"37"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9599000215530396,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9599000215530396,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.019700000062584877,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.006099999882280827,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/soundness","display_name":"Soundness","score":0.9344000220298767},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.8762999773025513},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.7509999871253967},{"id":"https://openalex.org/keywords/documentation","display_name":"Documentation","score":0.588699996471405},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.4442000091075897},{"id":"https://openalex.org/keywords/security-analysis","display_name":"Security analysis","score":0.43810001015663147},{"id":"https://openalex.org/keywords/data-flow-analysis","display_name":"Data-flow analysis","score":0.3718000054359436}],"concepts":[{"id":"https://openalex.org/C39920170","wikidata":"https://www.wikidata.org/wiki/Q693083","display_name":"Soundness","level":2,"score":0.9344000220298767},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.8762999773025513},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.7509999871253967},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7247999906539917},{"id":"https://openalex.org/C56666940","wikidata":"https://www.wikidata.org/wiki/Q788790","display_name":"Documentation","level":2,"score":0.588699996471405},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.4442000091075897},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.43810001015663147},{"id":"https://openalex.org/C88468194","wikidata":"https://www.wikidata.org/wiki/Q1172416","display_name":"Data-flow analysis","level":3,"score":0.3718000054359436},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.36250001192092896},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.35920000076293945},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.34310001134872437},{"id":"https://openalex.org/C3017891749","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android application","level":3,"score":0.3183000087738037},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.31529998779296875},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3073999881744385},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.3059999942779541},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.29840001463890076},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2946999967098236},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.29030001163482666},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2847999930381775},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.2623000144958496}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3439802","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3439802","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2102.06829","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2102.06829","pdf_url":"https://arxiv.org/pdf/2102.06829","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2102.06829","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2102.06829","pdf_url":"https://arxiv.org/pdf/2102.06829","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6200461544","display_name":"SaTC: CORE: Small: Enabling Systematic Evaluation of the Soundness of Android Security Analysis Techniques","funder_award_id":"1815336","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":65,"referenced_works":["https://openalex.org/W53797064","https://openalex.org/W124941384","https://openalex.org/W1264845515","https://openalex.org/W1567503821","https://openalex.org/W1972350641","https://openalex.org/W1985752637","https://openalex.org/W1988036170","https://openalex.org/W1988737164","https://openalex.org/W1989255032","https://openalex.org/W1994588724","https://openalex.org/W2003276999","https://openalex.org/W2008345765","https://openalex.org/W2008810193","https://openalex.org/W2014235365","https://openalex.org/W2041276426","https://openalex.org/W2044228862","https://openalex.org/W2045057497","https://openalex.org/W2049695835","https://openalex.org/W2061445336","https://openalex.org/W2065555413","https://openalex.org/W2071536101","https://openalex.org/W2073294836","https://openalex.org/W2073754016","https://openalex.org/W2091161634","https://openalex.org/W2092298276","https://openalex.org/W2101577935","https://openalex.org/W2103370348","https://openalex.org/W2105412867","https://openalex.org/W2113115074","https://openalex.org/W2114275288","https://openalex.org/W2121221235","https://openalex.org/W2122672392","https://openalex.org/W2123437505","https://openalex.org/W2125011234","https://openalex.org/W2125099630","https://openalex.org/W2126242334","https://openalex.org/W2129426180","https://openalex.org/W2140021378","https://openalex.org/W2140095007","https://openalex.org/W2154564703","https://openalex.org/W2158126684","https://openalex.org/W2166743230","https://openalex.org/W2334842536","https://openalex.org/W2376050373","https://openalex.org/W2400063502","https://openalex.org/W2463553622","https://openalex.org/W2488606493","https://openalex.org/W2496662957","https://openalex.org/W2510556079","https://openalex.org/W2515236103","https://openalex.org/W2535386169","https://openalex.org/W2619760961","https://openalex.org/W2620672884","https://openalex.org/W2739751633","https://openalex.org/W2739959195","https://openalex.org/W2760679152","https://openalex.org/W2796301966","https://openalex.org/W2853432192","https://openalex.org/W2985320478","https://openalex.org/W4232808563","https://openalex.org/W4242210993","https://openalex.org/W4243963980","https://openalex.org/W4245027182","https://openalex.org/W4251541794","https://openalex.org/W6676587270"],"related_works":[],"abstract_inverted_index":{"Mobile":[0],"application":[1,21],"security":[2,11],"has":[3],"been":[4,25],"a":[5,124,140,197],"major":[6,204],"area":[7],"of":[8,16,45,68,114,126,156,183,201,230,246],"focus":[9],"for":[10,48,163,241],"research":[12],"over":[13],"the":[14,17,46,59,66,90,111,157,179,234,239,254],"course":[15],"last":[18],"decade.":[19],"Numerous":[20],"analysis":[22,41,47,101,130,200],"tools":[23,70,102,131,175,205,251],"have":[24],"proposed":[26],"in":[27,65,137,153,206,224,249,256,260],"response":[28],"to":[29,79,103,123,147,173],"malicious,":[30],"curious,":[31],"or":[32,63,75,181,185],"vulnerable":[33],"apps.":[34,138,165],"However,":[35],"existing":[36],"tools,":[37,42],"and":[38,50,52,85,106,120,195,216,244,252],"specifically,":[39],"static":[40,100,129],"trade":[43],"soundness":[44],"precision":[49],"performance":[51],"are":[53,222],"hence":[54],"sound":[55],"y":[56],".":[57],"Unfortunately,":[58],"specific":[60],"unsound":[61,247],"choices":[62,248],"flaws":[64,152,170,215,221],"design":[67,180],"these":[69],"is":[71],"often":[72],"not":[73],"known":[74],"well":[76],"documented,":[77],"leading":[78],"misplaced":[80],"confidence":[81],"among":[82,233],"researchers,":[83],"developers,":[84],"users.":[86],"This":[87,188],"article":[88,189],"describes":[89],"Mutation-Based":[91],"Soundness":[92],"Evaluation":[93],"(\u03bcSE)":[94],"framework,":[95],"which":[96],"systematically":[97],"evaluates":[98],"Android":[99,128,164],"discover,":[104],"document,":[105],"fix":[107],"flaws,":[108],"by":[109],"leveraging":[110,257],"well-founded":[112],"practice":[113],"mutation":[115,258],"analysis.":[116],"We":[117],"implemented":[118],"\u03bcSE":[119,146,193],"applied":[121],"it":[122],"set":[125],"prominent":[127,159],"that":[132,169,176,218],"detect":[133],"private":[134],"data":[135,160],"leaks":[136],"In":[139],"study":[141],"conducted":[142],"previously,":[143],"we":[144,167,210],"used":[145],"discover":[148],"13":[149],"previously":[150],"undocumented":[151,214],"FlowDroid,":[154],"one":[155,227],"most":[158],"leak":[161],"detectors":[162],"Moreover,":[166],"discovered":[168],"also":[171],"propagated":[172],"other":[174],"build":[177],"upon":[178],"implementation":[182],"FlowDroid":[184],"its":[186],"components.":[187],"substantially":[190],"extends":[191],"our":[192,207],"framework":[194],"offers":[196],"new":[198],"in-depth":[199],"two":[202],"more":[203,225],"2020":[208],"study;":[209],"find":[211],"12":[212],"new,":[213],"demonstrate":[217,253],"all":[219],"25":[220],"found":[223],"than":[226],"tool,":[228],"regardless":[229],"any":[231],"inheritance-relation":[232],"tools.":[235],"Our":[236],"results":[237],"motivate":[238],"need":[240],"systematic":[242],"discovery":[243],"documentation":[245],"soundy":[250],"opportunities":[255],"testing":[259],"achieving":[261],"this":[262],"goal.":[263]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":2},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":2}],"updated_date":"2026-07-03T08:13:44.112507","created_date":"2021-02-15T00:00:00"}