Towards supporting software assurance assessments by detecting security patterns

摘要

Today, many tools exist that attempt to find possible vulnerabilities in Android applications, e.g., FlowDroid, Fortify, or AppScan. However, all these tools aim to detect vulnerabilities or (sometimes) tainted flows and present the reviewer detected possible issues of an analyzed Android application. None of these tools supports the identification of implemented security features in code, although this aspect is also relevant to developers as well as reviewers. To address this open problem, we present a program comprehension approach based on connected object process graphs (COPGs) containing interacting objects described by security patterns in this paper. The feasibility of our approach is evaluated qualitatively with 25 security-critical Android applications from Google Play with almost 7 million lines of code. We currently support 17 security pattern variants with about 199 correctly detected pattern instances in the apps. We also define a benchmark of non-trivial, security-critical Android apps, which can also be used for other security analysis tasks based on the static analysis framework Soot. With this benchmark, our analysis yields a precision of 99% and a recall of 80%. Finally, we discussed our approach and the developed tool with six software security experts from the SAFECode organization to obtain additional feedback.