Critical review of static taint analysis of android applications for detecting information leakages

This paper presents a rigorous review of static taint analysis for inadvertently information leakage in Android applications. Static taint analysis is widely implemented to monitor and control privacy leaks. The surveyed studies are analyzed and evaluated based on techniques adopted, tools implemented, applications involved in experiments, leaks identified through experiments, and applications identified as infected. Most of the surveyed studies applied Call Graph (CG) or Control Flow Graph (CFG) to perform static taint analysis. We also conducted a number of experiments to further analyze the execution and effectiveness of FlowDroid on Android applications having both intra-component communications and inter-component communications. Although FlowDroid was developed to target only intra-component leaks, this does not limit its application on inter-component communications. However, its precision is reduced.