Android source code vulnerability detection: a systematic literature review

Article


Senanayake, J., Kalutarage, H., Al-Kadri, M.O., Petrovski, A. and Piras, L. 2023. Android source code vulnerability detection: a systematic literature review. ACM Computing Surveys. 55 (9). https://doi.org/10.1145/3556974
TypeArticle
TitleAndroid source code vulnerability detection: a systematic literature review
AuthorsSenanayake, J., Kalutarage, H., Al-Kadri, M.O., Petrovski, A. and Piras, L.
Abstract

The use of mobile devices is rising daily in this technological era. A continuous and increasing number of mobile applications are constantly offered on mobile marketplaces to fulfil the needs of smartphone users. Many Android applications do not address the security aspects appropriately. This is often due to a lack of automated mechanisms to identify, test, and fix source code vulnerabilities at the early stages of design and development. Therefore, the need to fix such issues at the initial stages rather than providing updates and patches to the published applications is widely recognized. Researchers have proposed several methods to improve the security of applications by detecting source code vulnerabilities and malicious codes. This Systematic Literature Review (SLR) focuses on Android application analysis and source code vulnerability detection methods and tools by critically evaluating 118 carefully selected technical studies published between 2016 and 2022. It highlights the advantages, disadvantages, applicability of the proposed techniques and potential improvements of those studies. Both Machine Learning (ML) based methods and conventional methods related to vulnerability detection are discussed while focusing more on ML-based methods since many recent studies conducted experiments with ML. Therefore, this paper aims to enable researchers to acquire in-depth knowledge in secure mobile application development while minimizing the vulnerabilities by applying ML methods. Furthermore, researchers can use the discussions and findings of this SLR to identify potential future research and development directions.

KeywordsSource code vulnerability; vulnerability detection; software security; Android security; machine learning
Sustainable Development Goals9 Industry, innovation and infrastructure
Middlesex University ThemeCreativity, Culture & Enterprise
LanguageEnglish
PublisherAssociation for computing machinery
JournalACM Computing Surveys
ISSN0360-0300
Electronic1557-7341
Publication dates
Online16 Jan 2023
Print30 Sep 2023
Publication process dates
Deposited13 Oct 2022
Submitted04 Dec 2021
Accepted08 Aug 2022
Accepted author manuscript
Copyright Statement

© 2022 Association for Computing Machinery. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in ACM Computing Surveys, http://dx.doi.org/10.1145/10.1145/3556974

Digital Object Identifier (DOI)https://doi.org/10.1145/3556974
Web of Science identifierWOS:000924882300013
Permalink -

https://repository.mdx.ac.uk/item/89zv0

Download files

  • 53
    total views
  • 181
    total downloads
  • 8
    views this month
  • 8
    downloads this month

Export as

Related outputs

Android code vulnerabilities early detection using AI-powered ACVED plugin
Senanayake, J., Kalutarage, H., Al-Kadri, M.O., Petrovski, A. and Piras, L. 2023. Android code vulnerabilities early detection using AI-powered ACVED plugin. Atluri, V. and Ferrara, A. (ed.) 37th Annual IFIP WG 11.3 Conference (DBSec 2023). Sophia-Antipolis, France 19 - 21 Jul 2023 Cham Springer. pp. 339–357 https://doi.org/10.1007/978-3-031-37586-6_20
FedREVAN: real-time detection of vulnerable Android source code through federated neural network with XAI
Senanayake, J., Kalutarage, H., Petrovski, A., Al-Kadri, M.O. and Piras, L. 2023. FedREVAN: real-time detection of vulnerable Android source code through federated neural network with XAI. ESORICS Workshop on Attacks and Software Protection (WASP). The Hague, The Netherlands 25 - 29 Sep 2023 Springer.
Labelled vulnerability dataset on Android source code (LVDAndro) to develop AI-based code vulnerability detection models
Senanayake, J., Kalutarage, H., Al-Kadri, M.O., Piras, L. and Petrovski, A. 2023. Labelled vulnerability dataset on Android source code (LVDAndro) to develop AI-based code vulnerability detection models. International Conference on Security and Cryptography (SECRYPT) 2023. Rome, Italy 10 - 12 Jul 2023 Rome (IT) SciTePress. pp. 659-666 https://doi.org/10.5220/0012060400003555
Goal-modeling privacy-by-design patterns for supporting GDPR compliance
Al-Obeidallah, M., Piras, L., Iloanugo, O., Mouratidis, H., Alkubaisy, D and Dellagiacoma, D. 2023. Goal-modeling privacy-by-design patterns for supporting GDPR compliance. International Conference on Software Technologies (ICSOFT). Rome (Italy) 10 - 12 Jul 2023 Rome (IT) SciTePress. https://doi.org/10.5220/0012080700003538
Supporting the individuation, analysis and gamification of software components for acceptance requirements fulfilment
Calabrese, F., Piras, L. and Giorgini, P. 2022. Supporting the individuation, analysis and gamification of software components for acceptance requirements fulfilment. Barn, B. and Sandkuhl, K (ed.) IFIP Working Conference on The Practice of Enterprise Modeling. London 23 - 25 Nov 2022 Springer. pp. 33-48 https://doi.org/10.1007/978-3-031-21488-2_3
Goal models for acceptance requirements analysis and gamification design
Piras, L., Paja, E., Giorgini, P. and Mylopoulos, J. 2017. Goal models for acceptance requirements analysis and gamification design. Mayr, H.C., Guizzardi, G., Ma, H. and Pastor, O. (ed.) 36th International Conference on Conceptual Modeling. Valencia 2017 Cham Springer. pp. 223-230 https://doi.org/10.1007/978-3-319-69904-2_18
Using gamification to incentivize sustainable urban mobility
Kazhamiakin, Raman, Marconi, Annapaola, Perillo, Mirko, Pistore, Marco, Valetto, Giuseppe, Piras, Luca, Avesani, Francesco and Perri, Nicola 2015. Using gamification to incentivize sustainable urban mobility. IEEE International Smart Cities Conference. IEEE. https://doi.org/10.1109/ISC2.2015.7366196