DroidSearch: A tool for scaling Android app triage to real-world app stores

The Android platform now features more than a million apps from thousands of developers. This abundance is convenient, as it caters to almost every need. But users and researchers also worry about the security and trustworthiness of these apps. While precise program-analysis tools are helpful in this context, unfortunately they do not scale to the large number of apps present in current app stores. In this work we thus present DroidSearch, a search engine that aids a multi-staged analysis in which fast pre-filtering techniques allow security experts to quickly retrieve candidate applications that should be subjected to further automated and/or manual analysis. DroidSearch is supported by DroidBase, a middleware and back-end database which associates apps with metadata and the results of lightweight analyses on bytecode and configuration files that DroidBase automatically manages and executes. Experiments on more than 235,000 applications from six different application stores including Google Play reveal many interesting findings. For instance, DroidSearch identifies 40 known malware applications in Google Play and detects over 35,000 applications that use both http and https connections for accessing the same resources, effectively rendering the https protection ineffective. It also reveals 11,995 applications providing access to potentially sensitive data through unprotected content providers.