Mutation Testing to Support the Security Testing of Android Applications

The Android system has seen considerable growth in its vulnerability landscape due to an extensive application catalog catering to many user needs, many of which are security sensitive. This growth leads to an ever-increasing concern about security robustness; hence, security testing Android apps has gained substantial prominence in recent years. Many security professionals and tools specialize in security testing Android applications, but the quality of testing procedures varies significantly. In this paper, we present a preliminary study exploring the use of Mutation Testing to support Android security testing. We propose novel mutation operators, implement them in code, and conduct an experiment to evaluate their resemblance to real-world vulnerabilities.We test our mutants using a well-known open-source tool named mobsfscan. Our results indicate the adequacy of our operators for supporting security testing. Moreover, we reveal a potential design flaw in mobsfscan.