InDroid: An Automated Online Analysis Framework for Android Applications Juanru Li Wenbo Yang Junliang Shu Yuanyuan Zhang, Dawu Gu Dept. of Computer Science School of Information Security Dept. of Computer Science Dept. of Computer Science and Engineering Shanghai Jiao Tong University and Engineering and Engineering Shanghai Jiao Tong University Shanghai, China Shanghai Jiao Tong University Shanghai Jiao Tong University Shanghai, China Shanghai, China Shanghai, China Abstract—Online program analysis aims to analyze a program monitor every execution details at the same time the analyzed as it executes. Traditional online program analysis is generally process is executing. And programmable analysis requires interactive and not automated. An automated online program code/script to operate the analyzed object rather than human analysis requires fine-grained yet flexible analyzing infrastructure to support. Android system, although providing many high- based interactive work. In detail, the proposed framework level debugging interfaces, lacks such functionality and is not should contain following features: (i) To achieve the goal of convenient for developing automated analysis tools. monitoring details of execution, the framework should provide In this paper we present InDroid, a flexible and extensible fine grained instrumentation on application for comprehensive framework for automated online analysis of Android appli- analysis. Program analysis is often asked to find the root cations. InDroid contains an introspection monitor and many analysis modules. Based on the introspection monitor and the cause of a problem inside a complex execution and numerous analysis modules, InDroid provides a set of analysis interfaces to instructions are to be analyzed. If the detail of the execution help access various types of runtime information and performs cannot be well monitored, analyst may fail to solve the automated online analysis. Automated program analysis is then problem. (ii) With the framework new analysis modules need accomplished using these interfaces. not to be built from the ground-up. Effective developing styles InDroid can monitor applications’ execution and understand their behavior, which is useful for profiling, debugging and such as using scripts and configuration file are expected to be security analysis. Moreover, InDroid’s analysis interface eases supported. (iii) Due to the weaker processing capability of the task of developing new online analysis functions. the mobile device, it is expected that the framework incurs reasonable overhead. I. INTRODUCTION There are commonly two approaches for Android applica- Android application nowadays are automated analyzed by tion’s online program analysis. The first approach is using many tools with in-depth static analysis techniques. How- bytecode rewriting to monitor sensitive API calls and de- ever, online analysis(a.k.a real-time dynamic program anal- ploying policy enforcement. The advantage of this approach ysis) technique of Android applications is less automated. is that it does not modify original Android system and the Developing automated online program analysis tool is still overhead is reasonable. The disadvantage is that it is less a tough yet attractive task. Unlike binary code instrumen- fine-grained(for bytecode level monitoring) and it breaks the tation and debugging techniques on commodity computer integrity of the application. The second approach is inserting platform[19][10][15] which are well supported by fundamen- analysis component to Android’s Dalvik VM to monitoring tal infrastructure, Android platform’s analyzing infrastructure the interpretation. This approach can monitor details of every such as ADB[1] and DDMS[7] currently lacks such auto- bytecode execution and need no modification of the analyzed mated analysis functionality for assessing and monitoring application. Although VM monitoring requires to modify the applications in a comprehensive way. A supportive framework original system, it contains a number of attractive advantages. is necessary to meet the requirements of automated online Monitoring at the VM layer brings minimal modification, and program analysis. An analysis framework boosts analyst’s makes the architecture of framework compact. Monitoring at work efficiency by providing abundant runtime information the VM layer provides better transparency for online analysis in a concise style. The framework encapsulates most low-level because analyzed app cannot be aware of the low-level mon- details so that even the OS is upgraded frequently, the existing itoring, while bytecode rewriting approach is easier to bring analysis tools are still available. And analysis based on this heisenbugs[17] due to the modification of the code and may specific framework is more robust than analysis that directly perturb application’s behavior. operates on system components. In this paper we present InDroid, an online program analy- Designing an online analysis framework for Android ap- sis framework for Android applications which helps analyst plication faces many challenges. Two essential factors of fulfil automated analysis. In general, InDroid contains an automated online program analysis are real-time monitoring introspection monitor and many analysis modules. Inside the and programmable analysis. Real-time monitoring requires to Dalvik VM of Android runtime, InDroid uses an introspection monitor to collect detail runtime information of application’s efficiency and avoids interactive overhead. bytecode interpretation process at the Dalvik VM layer. The monitoring code is attached to every key processing point of II. INDROID FRAMEWORK Dalvik VM to inspect the execution. Outside the Dalvik VM, A. Overview InDroid introduces analysis modules at the system service Figure 1 shows the overview of InDroid framework. Inside layer of Android to support automated analysis deal with the Dalvik VM is the introspection monitor of InDroid which the raw data collected by the introspection monitor, fulfilling monitors the execution of any analyzed application. The intro- complex task such as encapsulating the raw data into high- spection monitor inserts instrumentation interfaces to wherever level form or analyzing the status of execution. Analysis the bytecode is interpreted, monitors the execution process of modules can also export interfaces for other modules to use. the Dalvik VM. The VM-based monitoring guarantees trans- InDroid provides systematic methodology to achieve auto- parency to the analyzed applications when they are executed mated online program analysis of Android applications. In- with InDroid’s introspection. Connected with the introspection Droid supports automated analysis in two aspects: First, it pro- monitor, analysis modules of InDroid fulfil certain analysis vides different interfaces to help inspect runtime information tasks using the information from interfaces exported by the or manipulate the execution process. Interfaces with simple monitor. The framework is designed for general purpose function are provided by introspection monitor directly. Inter- analysis and can meet the requirements of almost all sorts faces with complex function are exported by modules to keep of automated online analysis on Android applications. introspection monitor compact. Second, the analysis module InDroid framework is compact for it uses one introspection enables analyst to interact with interfaces automatically. The core to monitor all kinds of information. A compact archi- philosophy of InDroid encourages analyst to develop module tecture makes InDroid independent of the change of system to extend the analysis functions based on existing interface. In environment and persists in high consistency. Thus InDroid this manner, InDroid eases the task of developing new analysis can support various kinds of Android devices well and is tools. Analysts need not to constantly re-implement the low- less affected by the upgrading of the operating system. And level analysis functions and may efficiently construct complex monitoring the Dalvik VM is efficient for collecting data with analysis tools to accomplish tasks such as application behavior minimum modification of the system. understanding and security checking. The hierarchy of InDroid(introspection monitor + analysis InDroid can be viewed as an extension of Android’s logging modules) isolates the analysis work and the execution of and debugging service. Rather than simply implementing Dalvik VM. This is important for keeping VM work stable online analysis, the main contribution of InDroid are: and proper. Moreover, analysis module can be extended by • Dalvik VM introspection. One of the most important fea- third party developers. It is much better for a framework tures of InDroid framework is that it analyze application to dynamically load new modules than integrate all sorts of through inspecting the Dalvik VM. Instead of inspecting functions in one module. system events only, InDroid could monitor details of every instruction’s execution. This gives analyst powerful B. Dalvik Introspection observation capability. Based on the introspection moni- InDroid uses an introspection monitor to observe the Dalvik tor, analysis modules can be used as information wrapper VM’s state and to record information during the execution. An to assemble low-level data into high-level semantic-rich online analysis on the Dalvik VM can effectively monitor the events, and perform advanced analysis functions. execution of an application for two reasons: