Data-flow analysis for heterogeneous programs

Android has an open communication structure among its programs and is an open-source operating system. Before 2015, third-party libraries were allowed to have the same permissions as apps. Even though this feature offers more development options, it may also expose users to more vulnerabilities. Moreover, the Android market is less strictly regulated compared to other mobile application stores. As a result, applications may demonstrate greater diversity in their requested permissions and other behavioral traits that are less likely to appear in more controlled environments. The aforementioned possibilities have also increased the number of developers and, consequently, the number of apps. In the meantime, the sizes of Google play store apps relaying on AndroZoo have expanded. Moreover, the highest penetration rate relying on category statistics shows that the "Tools" and "Communication and Business" apps percentage exceeds 99% of data based on a sample device count of 10,969 mobile devices, while the "Video Players & Edit", "Travel & Local", and "Social Media" apps percentage was more than 95% of the same 10,969 mobile devices. These categories use a high rate of communications worldwide. All of these factors have contributed to increasingly varied app structures and, consequently, communication patterns and data-flow within and between the apps. These changes are reflected in the objectives of our research: data-flow analysis and Android apps’ communication patterns. Even though other researchers utilized and improved data-flow analysis, the time and memory consumption limit their goals, which is why we use an incremental approach in our analysis. However, the research results were unexpected and interesting. The incremental approach did reduce the time and memory consumption, but only under the condition of small to medium data sizes. An incremental approach, following IncAs’ update method, consistently reduced the consumed memory, though not consequently the consumed run-time. Run-time reduction still suffered from scalability, and in some cases the regular analysis was faster, especially when the data exceeded a specific amount, depending on the device or server features. An inflection point appeared, where the incremental approach, namely IncA’s update method, was not the optimal solution. The results also showed changes in Androids’ app communication patterns during the last few years. Furthermore, they confirmed that Android OS changes affected these communication patterns, in other words, the data flow. This wide-angle investigation gives a clearer view to the developers of Android apps, as well as to research using system analysis including data-flow analysis, to accordingly establish their road map for future work.