大规模框架权限检查提取的静态分析：Android 分析的挑战与解决方案
Static Analysis for Extracting Permission Checks of a Large Scale Framework: The Challenges And Solutions for Analyzing Android
AI总结：
针对基于权限的框架需精确映射API方法与所需权限的问题，本文指出朴素静态分析在Android框架上失效，提出含类层次与字段敏感的先进静态分析及Android专属领域优化，可有效提取权限映射。
摘要：
一种常见的安全架构基于权限检查保护特定资源（例如在Android和Blackberry中使用）。它存在一些局限性，例如当应用被授予的权限超出实际所需时，会助长各类恶意使用行为（例如通过代码注入）。对基于权限的框架进行分析需要在框架的API方法与其所需权限之间建立精确映射。本文表明，将现成组件应用于Android框架时，朴素静态分析会彻底失效。随后我们提出了一套先进的类层次与字段敏感分析集来提取该映射。这些静态分析能够对Android框架进行分析，它们采用了专门针对Android的新型领域特定优化。
英文摘要：
A common security architecture is based on the protection of certain resources by permission checks (used e.g., in Android and Blackberry). It has some limitations, for instance, when applications are granted more permissions than they actually need, which facilitates all kinds of malicious usage (e.g., through code injection). The analysis of permission-based framework requires a precise mapping between API methods of the framework and the permissions they require. In this paper, we show that naive static analysis fails miserably when applied with off-the-shelf components on the Android framework. We then present an advanced class-hierarchy and field-sensitive set of analyses to extract this mapping. Those static analyses are capable of analyzing the Android framework. They use novel domain specific optimizations dedicated to Android.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
