Dynamic analyses for privacy and performance in mobile applications
Mingyuan Xia · 2017
Mobile applications (also called apps) have greatly extended and innovated users' daily tasks. The mobile programming model features event-driven execution, rapid changing APIs (about three generations per year) and ubiquitous accesses to user's personal data. These features enrich app functionalities but also give rise to many new software problems that impact performance or damage user privacy, many of which are not occasional programming mistakes. In this thesis, we systematically study these problems and develop dynamic program analyses to effectively detect, diagnose and fix these new problems. We start by researching the sensitive data leakage problem in apps. Since mobile apps can access various sensitive user data stored on the device, data leaks become a great concern for both end users and app market operators. Existing leak detecting approaches rely on static analysis that does not perform well on real-world apps with growing complexity, further limiting their adoption for real usage. We propose AppAudit, which embodies a novel dynamic analysis that can execute part of the app code while tracking the dissemination of sensitive data. AppAudit also has a static analysis to shrink analysis scope and boost analysis performance. The synergy of two analyses achieves higher detection accuracy, runs 8.3x faster and uses 90% less memory on real-world Android apps as compared to previous approaches. Based on the analysis building blocks from AppAudit, we further develop binary instrumentation to profile and improve app performance. We study 115 thousand apps and common performance anti-patterns from existing literature. Based on these understandings, we propose AppInspector, which instruments apps to profile a small set of methods while collecting various app runtime diagnostic data. These profiling data is transformed into a graph structure, where AppInspector programmatically diagnoses three common performance anti-patterns from this graph. We also develop AppSwift based on AppInspector, which transforms app code to automatically fix some performance anti-patterns and improve app performance. Both tools instrument app code automatically. Instrumented apps can run on unmodified Android OSes and thus being readily deployable to existing test environments. With extensive tests on real-world apps, AppInspector uncovers 22 performance issues per app, with detailed analysis results to guide developers to fix them; AppSwift automatically eliminates about 5 of such issues without any code modification from the app developer. We believe that the analysis methodologies, frameworks and tools developed in this thesis can assist developers in debugging various performance problems and better protecting user privacy.