{"id":"https://openalex.org/W7159664062","doi":"https://doi.org/10.48550/arxiv.2604.27830","title":"WOOTdroid: Whole-system Online On-device Tracing for Android","display_name":"WOOTdroid: Whole-system Online On-device Tracing for Android","publication_year":2026,"publication_date":"2026-04-30","ids":{"openalex":"https://openalex.org/W7159664062","doi":"https://doi.org/10.48550/arxiv.2604.27830"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.27830","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.27830","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.27830","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114287507","display_name":"Simon Althaus","orcid":null},"institutions":[{"id":"https://openalex.org/I31512782","display_name":"Technische Universit\u00e4t Darmstadt","ror":"https://ror.org/05n911h24","country_code":"DE","type":"education","lineage":["https://openalex.org/I31512782"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Althaus, Simon","raw_affiliation_strings":["Technical University of Darmstadt"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Darmstadt","institution_ids":["https://openalex.org/I31512782"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103083515","display_name":"\u039d\u03b9\u03ba\u03cc\u03bb\u03b1\u03bf\u03c2 \u0391\u03bb\u03b5\u03be\u03cc\u03c0\u03bf\u03c5\u03bb\u03bf\u03c2","orcid":"https://orcid.org/0000-0001-8383-4761"},"institutions":[{"id":"https://openalex.org/I73142707","display_name":"Athens University of Economics and Business","ror":"https://ror.org/03s262162","country_code":"GR","type":"education","lineage":["https://openalex.org/I73142707"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Alexopoulos, Nikolaos","raw_affiliation_strings":["Athens University of Economics and Business"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Athens University of Economics and Business","institution_ids":["https://openalex.org/I73142707"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021712397","display_name":"Max M\u00fchlh\u00e4user","orcid":"https://orcid.org/0000-0003-4713-5327"},"institutions":[{"id":"https://openalex.org/I31512782","display_name":"Technische Universit\u00e4t Darmstadt","ror":"https://ror.org/05n911h24","country_code":"DE","type":"education","lineage":["https://openalex.org/I31512782"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"M\u00fchlh\u00e4user, Max","raw_affiliation_strings":["Technical University of Darmstadt"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Darmstadt","institution_ids":["https://openalex.org/I31512782"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026464027","display_name":"Christian Reuter","orcid":"https://orcid.org/0000-0003-1920-038X"},"institutions":[{"id":"https://openalex.org/I31512782","display_name":"Technische Universit\u00e4t Darmstadt","ror":"https://ror.org/05n911h24","country_code":"DE","type":"education","lineage":["https://openalex.org/I31512782"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Reuter, Christian","raw_affiliation_strings":["Technical University of Darmstadt"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Darmstadt","institution_ids":["https://openalex.org/I31512782"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5027327665","display_name":"Ephraim Zimmer","orcid":"https://orcid.org/0000-0002-4262-6613"},"institutions":[{"id":"https://openalex.org/I31512782","display_name":"Technische Universit\u00e4t Darmstadt","ror":"https://ror.org/05n911h24","country_code":"DE","type":"education","lineage":["https://openalex.org/I31512782"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Zimmer, Ephraim","raw_affiliation_strings":["Technical University of Darmstadt"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technical University of Darmstadt","institution_ids":["https://openalex.org/I31512782"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9241999983787537,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9241999983787537,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.035999998450279236,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.007000000216066837,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.7810999751091003},{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.5098999738693237},{"id":"https://openalex.org/keywords/tracing","display_name":"Tracing","score":0.49300000071525574},{"id":"https://openalex.org/keywords/mobile-device","display_name":"Mobile device","score":0.39579999446868896},{"id":"https://openalex.org/keywords/linux-kernel","display_name":"Linux kernel","score":0.3873000144958496},{"id":"https://openalex.org/keywords/android-beam","display_name":"Android Beam","score":0.38600000739097595}],"concepts":[{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.7810999751091003},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7533000111579895},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.5378999710083008},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.5098999738693237},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.49300000071525574},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.39579999446868896},{"id":"https://openalex.org/C553261973","wikidata":"https://www.wikidata.org/wiki/Q14579","display_name":"Linux kernel","level":2,"score":0.3873000144958496},{"id":"https://openalex.org/C65902250","wikidata":"https://www.wikidata.org/wiki/Q4759452","display_name":"Android Beam","level":3,"score":0.38600000739097595},{"id":"https://openalex.org/C2778539339","wikidata":"https://www.wikidata.org/wiki/Q165970","display_name":"Touchscreen","level":2,"score":0.34850001335144043},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.3310999870300293},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.31209999322891235},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.2888999879360199},{"id":"https://openalex.org/C89505385","wikidata":"https://www.wikidata.org/wiki/Q47146","display_name":"User interface","level":2,"score":0.2669999897480011},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.2667999863624573},{"id":"https://openalex.org/C154504017","wikidata":"https://www.wikidata.org/wiki/Q853614","display_name":"Identifier","level":2,"score":0.2619999945163727},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.2574999928474426},{"id":"https://openalex.org/C2988045736","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android app","level":3,"score":0.2551000118255615}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.27830","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.27830","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.27830","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.27830","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"System":[0],"auditing":[1],"on":[2,125,147,186],"Android":[3,85,127,149,191],"faces":[4],"two":[5],"problems.":[6],"First,":[7],"existing":[8],"syscall":[9,45,144],"tracers":[10],"lose":[11],"events":[12,66],"under":[13],"load,":[14],"silently":[15],"overwriting":[16],"entries":[17],"faster":[18],"than":[19,161],"a":[20,62,118,175],"user":[21,102],"space":[22],"reader":[23],"can":[24,107],"drain":[25],"them.":[26],"Second,":[27],"security-relevant":[28,200],"application":[29,100,136],"behavior":[30,69],"is":[31,40],"mediated":[32],"through":[33],"Binder,":[34],"Android's":[35],"kernel":[36,52,169],"IPC":[37],"mechanism,":[38],"and":[39,67,120,156,170],"therefore":[41],"hidden":[42],"from":[43],"the":[44,51,72,78,84,98,111,168],"layer.":[46],"The":[47],"Binder":[48,165,201],"parcels":[49,166],"that":[50,128],"does":[53],"see":[54],"carry":[55],"no":[56],"method":[57],"names":[58],"or":[59,95,135],"typed":[60],"arguments,":[61],"disconnect":[63],"between":[64],"low-level":[65],"high-level":[68],"known":[70],"as":[71],"semantic":[73,79],"gap.":[74],"Existing":[75],"approaches":[76],"address":[77],"gap":[80],"either":[81],"by":[82,96,109],"modifying":[83],"platform,":[86],"making":[87],"them":[88,172],"difficult":[89],"to":[90,92],"adjust":[91],"OS":[93,133],"updates,":[94],"instrumenting":[97],"traced":[99],"in":[101,167],"space,":[103],"which":[104],"sophisticated":[105],"adversaries":[106],"evade":[108],"bypassing":[110],"instrumented":[112],"framework":[113,176],"APIs.":[114],"We":[115,183],"present":[116],"WOOTdroid,":[117],"design":[119],"prototype":[121],"for":[122],"on-device":[123],"tracing":[124],"stock":[126],"addresses":[129],"both":[130],"problems":[131],"without":[132],"modification":[134],"instrumentation.":[137],"WDSys,":[138],"an":[139,194],"eBPF":[140],"port":[141],"of":[142],"eAudit-style":[143],"auditing,":[145],"runs":[146],"current":[148],"with":[150,193],"at":[151],"most":[152],"3.6%":[153],"Geekbench":[154],"overhead":[155],"traces":[157],"33%":[158],"more":[159],"syscalls":[160],"ftrace.":[162],"WDBind":[163],"captures":[164],"decodes":[171],"out-of-process":[173],"against":[174],"signature":[177],"table":[178],"extracted":[179],"via":[180],"Java":[181],"reflection.":[182],"demonstrate":[184],"WOOTdroid":[185],"Pixel":[187],"9":[188],"devices":[189],"running":[190],"16":[192],"end-to-end":[195],"case":[196],"study":[197],"reconstructing":[198],"ten":[199],"transactions.":[202]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-02T00:00:00"}