Mining Android crash fixes in the absence of issue- and change-tracking systems

Kong, Pingfan; Li, Li; Gao, Jun; Bissyandé, Tegawendé F.; Klein, Jacques

doi:10.1145/3293882.3330572

Cited by 15 publications

(12 citation statements)

References 47 publications

(54 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• We present the results of an empirical study performed on a set of 500 app crashes retrieved from the ReCBench dataset [4]. A key finding in this study is that we were able to identify that 37% crash root causes are associated with crash cases where the stack trace is not directly relevant for fault localization.…”

Section: Introductionmentioning

confidence: 93%

“…In this section, we present the results of an empirical study that we performed on a set of 500 app crashes retrieved from the ReCBench dataset [4]. This study aims at assessing to what extent the locations of crashing faults reside outside the stack trace.…”

Section: Empirical Study On Fault Locationsmentioning

confidence: 99%

“…In more recent work, Kong et al [4] have proposed an automated approach to mine fix patterns from the evolution of closed-source apps (despite the lack of change tracking systems). Tan et al [5] further presented an approach to repair Android crashing apps.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

ANCHOR: locating android framework-specific crashing faults

Kong

Gao

et al. 2021

Autom Softw Eng

Self Cite

View full text Add to dashboard Cite

Android framework-specific app crashes are hard to debug. Indeed, the callback-based event-driven mechanism of Android challenges crash localization techniques that are developed for traditional Java programs. The key challenge stems from the fact that the buggy code location may not even be listed within the stack trace. For example, our empirical study on 500 framework-specific crashes from an open benchmark has revealed that 37 percent of the crash types are related to bugs that are outside the stack traces. Moreover, Android programs are a mixture of code and extra-code artifacts such as the Manifest file. The fact that any artifact can lead to failures in the app execution creates the need to position the localization target beyond the code realm. In this paper, we propose Anchor, a two-phase suspicious bug location suggestion tool. Anchor specializes in finding crash-inducing bugs outside the stack trace. Anchor is lightweight and source code independent since it only requires the crash message and the apk file to locate the fault. Experimental results, collected via cross-validation and in-thewild dataset evaluation, show that Anchor is effective in locating Android framework-specific crashing faults.

show abstract

Section: Introductionmentioning

confidence: 93%

Section: Empirical Study On Fault Locationsmentioning

confidence: 99%

See 1 more Smart Citation

ANCHOR: locating android framework-specific crashing faults

Kong

Gao

et al. 2021

Autom Softw Eng

Self Cite

View full text Add to dashboard Cite

show abstract

“…In both scenarios of repair, the main issue is the need for more example data to drive the fix processes due to the high cost in time and effort needed to collect and identify fix examples. In an ISSTA 2019 paper [16], we proposed a scalable approach, CraftDroid, to mine crash fixes by leveraging a set of 28 thousand carefully reconstructed app lineages from app markets, without the need for the app source code or issue reports. We developed a replicative testing approach that locates fixes among app versions that output different runtime logs with the exact same test inputs.…”

Section: Other Static Analyses Performed On Android Appsmentioning

confidence: 99%

A Journey Through Android App Analysis: Solutions and Open Challenges

Klein¹

2021

Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems

Self Cite

View full text Add to dashboard Cite

Users can today download a wide variety of apps ranging from simple toy games to sophisticated business-critical apps. They rely on these apps daily to perform diverse tasks, some of them related to sensitive information such as their finance or health. Ensuring high-quality, reliable, and secure apps is thus key. In the TruX research group of the interdisciplinary center for Security, Reliability, and Trust (SnT) of the University of Luxembourg, we are working for about 10 years to deliver practical techniques, tools, and other artifacts (such as repositories) making the analysis of Android apps possible. In this paper, we will briefly introduce our key contributions in both (1) Android app static analysis to detect security issues, and (2) Android Malware Detection with machine learning. We will conclude by listing several open challenges that we are currently facing towards improving the analysis and security of Android apps. CCS CONCEPTS• Security and privacy → Software security engineering; • Software and its engineering → Software verification and validation.

show abstract

“…We remind that the Soot framework is also leveraged by DICIDer to detect the usage of DICIs. Static analysis has also been used by researchers to scan for (1) app defects including energy issues [49,50], (2) fix runtime crashes [51,52], (3) improve the realization of dynamic testing appraoches [53ś56].…”

Section: Related Workmentioning

confidence: 99%

Borrowing your enemy’s arrows: the case of code reuse in Android via direct inter-app code invocation

Gao

Kong

et al. 2020

Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Softw

Self Cite

View full text Add to dashboard Cite

The Android ecosystem offers different facilities to enable communication among app components and across apps to ensure that rich services can be composed through functionality reuse. At the heart of this system is the Inter-component communication (ICC) scheme, which has been largely studied in the literature. Less known in the community is another powerful mechanism that allows for direct inter-app code invocation which opens up for different reuse scenarios, both legitimate or malicious. This paper exposes the general workflow for this mechanism, which beyond ICCs, enables app developers to access and invoke functionalities (either entire Java classes, methods or object fields) implemented in other apps using official Android APIs. We experimentally showcase how this reuse mechanism can be leveraged to łplagiarize" supposedly-protected functionalities. Typically, we were able to leverage this mechanism to bypass security guards that a popular video broadcaster has placed for preventing access to its video database from outside its provided app. We further contribute with a static analysis toolkit, named DICIDer, for detecting direct inter-app code invocations in apps. An empirical analysis of the usage prevalence of this reuse mechanism is then conducted. Finally, we discuss the usage contexts as well as the implications of this studied reuse mechanism. CCS CONCEPTS • Security and privacy → Software security engineering.

show abstract

Mining Android crash fixes in the absence of issue- and change-tracking systems

Cited by 15 publications

References 47 publications

ANCHOR: locating android framework-specific crashing faults

ANCHOR: locating android framework-specific crashing faults

A Journey Through Android App Analysis: Solutions and Open Challenges

Borrowing your enemy’s arrows: the case of code reuse in Android via direct inter-app code invocation

Contact Info

Product

Resources

About