Thesis: Master Thesis

Description:

Data exfiltration remains one of the central privacy risks in modern mobile applications. Research on data exfiltration in mobile applications typically relies on either static or dynamic analysis techniques. Static analysis can identify potential data flows in an app’s source code, but often produces false positives, as it cannot determine whether sensitive data is actually transmitted at runtime. In contrast, dynamic traffic analysis provides concrete evidence of transmitted data, yet may suffer from false negatives due to limited execution coverage.

This thesis aims to combine static and traffic analysis to improve the reliability of data exfiltration detection. The core idea is to cross-check statically identified data with observed network traffic in order to validate and refine static analysis results.

The project will involve partially implementing a traffic analysis pipeline for Android applications and evaluating it on a large dataset (e.g., approximately 1,000 apps). The results will then be systematically compared with those obtained from an existing static analysis pipeline. The goal is to better understand the strengths and limitations of both approaches and to develop techniques that reduce false positives and false negatives in practice.

Requirements:

• Interest in software security and privacy (required)
• Willingness to learn Android traffic analysis (required)
• Ability to work with large existing codebases (helpful)
• Prior knowledge of static analysis or network traffic analysis (helpful)
• Experience with software design and efficient programming (helpful)

Tasks:

• Partially implement a traffic analysis pipeline for Android apps.
• Construct a dataset of apps for evaluation.
• Conduct a systematic evaluation and compare results with an existing static analysis pipeline.
• Analyze and document strengths and limitations of both approaches.

Language:

The thesis will be written in English.

Learning Outcomes:

• Hands-on experience with both static and dynamic program analysis.
• Experience conducting large-scale empirical software evaluation.
• Exposure to collaborative research with the Max Planck Institute for Security and Privacy (MPI-SP) and the University of Innsbruck.