Journal
ASIA CCS'22: PROCEEDINGS OF THE 2022 ACM ASIA CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY
Volume -, Issue -, Pages 1255-1257Publisher
ASSOC COMPUTING MACHINERY
DOI: 10.1145/3488932.3527290
Keywords
android; code vulnerability detection; static analysis; vulnerability dataset; machine learning; secure mobile apps
Categories
Funding
- University of Kelaniya
- AHEAD grant -Sri Lanka
Ask authors/readers for more resources
Mobile application developers may not always prioritize source code security when publishing apps to the marketplaces. This research proposes a highly accurate method based on Machine Learning (ML) to detect Android source code vulnerabilities, aiming to integrate security-by-design into the development practices.
Mobile application developers sometimes might not be serious about source code security and publish apps to the marketplaces. Therefore, it is essential to have a fully automated security solutions generator to integrate security-by-design into the development practices, especially for the Android platform. This research proposes a Machine Learning (ML) based highly accurate method to detect Android source code vulnerabilities. A new labelled dataset containing Android source code vulnerability samples was generated initially. The dataset was used to train binary and multi-class classification based ML models, to identify code issues by following a static analysis approach. The proposed model can detect code vulnerabilities with a 0.90 F1-Score and vulnerability categories (CWE) with a 0.96 F1-Score. By integrating this with the Android development environment, app developers can analyse source code and identify security vulnerabilities in real-time. The proposed framework can be extended to suggest suitable patches to overcome the source code issues by providing real-time fixes in future.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available