1. NCCU Academic Hub
  2. Publications
  3. College of Commerce
  4. Theses
  5. Item

Publications-Theses

Article View/Open

Publication Export

Google ScholarTM

NCCU Library

Citation Infomation

Related Publications in TAIR

題名 靜態廣告欺詐行為偵測技術研究-以 iOS 為例
Static ad fraud detection on iOS applications
作者 黃存宇
Huang, Cun-Yu
貢獻者 郁方
Yu, Fang
黃存宇
Huang, Cun-Yu
關鍵詞 靜態分析
廣告欺詐檢測
iOS
行動應用程式
資訊安全
Static analysis
Ad fraud detection
iOS
Mobile application
Software security
日期 2019
上傳時間 5-Feb-2020 17:26:32 (UTC+8)
摘要 手機App成為最受歡迎和占主導地位的軟體應用程式之一，應用程序開發人員從應用程序廣告中獲得了可觀的利潤。在應用程式中，以適當的方式呈現廣告對客戶和廣告商都有好處，但是在我們的研究中，卻發現各種廣告欺詐。廣告欺詐會破壞用戶體驗或廣告效果，但是開發人員可以從中獲得更多的利潤。在我們研究中，提出了一種靜態分析技術來檢查iOS應用程式上的廣告欺詐行為。我們會檢測出插頁式廣告，尺寸違反廣告，多重廣告和重疊式廣告的廣告欺詐行為。為了檢測這些違規，它需要使用應用程序中的特定參數來識別廣告API調用，通過動態調用很難檢測到，因為確切的調用及其參數取決於嵌套參數的運行時候的值。我們在iOS的可執行文件上採用靜態分析技術，通過該技術我們可以對目標函數的參數構建依賴關係圖。然後，我們對依賴關係圖進行字串分析，以呈現潛在的API調用及其對廣告欺詐違規的參數值。
我們已經分析了上千個應用程序，這些應用程序由我們之前的應用程序靜態分析工具Binflow構造了控制流程圖，並發現208個應用程序使用了與廣告相關API的動態調用。我們進一步發現了70個具有插頁式廣告欺詐，48個具有尺寸違反廣告欺詐，31個具有多重廣告欺詐和19個具有重疊式廣告廣告欺詐。
While mobile applications (apps) become one of the most popular and dominant software applications, app developers (particularly for those who deliver free apps) gain considerable parts of profits from advertisements on apps. Demonstrating ads on apps in a suitable way benefits both customers and advertisers. Various ad frauds have been identified with which developers may gain extra benefits but damage user experience or advertisement effects. We present a static analysis technique to check ad frauds of iOS apps in this work. Particularly, we detect apps that have their ads against interstitial violation, size violation, multi-view and overlap violation. To detect these violations, it requires to identify advertisement API invocation with specific arguments in apps. It becomes hard to detect with dynamic invocation where exact calls and their arguments depend on runtime values of nested parameters. We adopt static flow analysis techniques on iOS executable with which we build dependency graphs on parameters of target functions. We then conduct string analysis on dependency graphs to reveal potential API invocations with their argument values on ad fraud violations.
We have analyzed more than one thousand apps that have their control flow graphs constructed by our previous app static analysis tool Binflow, and found 208 apps using dynamic invocations on Ad related API calls. We further identified 70 apps having interstitial-violation ads, 48 apps having size violation ads, 31 apps having multi-view violation ads, and 19 apps having overlay violation ads.
參考文獻 [1] M. C. Grace, W. Zhou, X. Jiang, and A.-R. Sadeghi, \\Unsafe exposure analysis
of mobile in-app advertisements," in Proceedings of the Lfth ACM conference on
Security and Privacy in Wireless and Mobile Networks, pp. 101{112, ACM, 2012.
[2] D. Graziano, \\Android and iOS Still Rule the Mobile World;Microsoft and RIM Have
Long Roads Ahead." https://www.appannie.com/en/insights/market-data/
app-advertising-spend-2021/, 2012.
[3] Google, \\Google Admob." https://admob.google.com/, 2019.
[4] Apple, \\Apple Search Ads." https://searchads.apple.com/, 2019.
[5] Facebook, \\Facebook Ad." https://www.facebook.com/business/ads, 2019.
[6] A. Mamiit, \\Google
ags preinstalled malware as hidden threat on mil-
lions of Android phones." https://www.digitaltrends.com/mobile/
android-phones-preinstalled-malware, 2019.
[7] Google, \\Google Behavioral policies." https://support.google.com/admob/
answer/2753860, 2019.
[8] B. Liu, S. Nath, R. Govindan, and J. Liu, \\fDECAFg: Detecting and characterizing
ad fraud in mobile apps," in 11th fUSENIXg Symposium on Networked Systems
Design and Implementation (fNSDIg 14), pp. 57{70, 2014.
[9] F. Dong, H. Wang, L. Li, Y. Guo, T. F. BissyandSe, T. Liu, G. Xu, and J. Klein,
\\Frauddroid: Automated ad fraud detection for android apps," in Proceedings of the
2018 26th ACM Joint Meeting on European Software Engineering Conference and
Symposium on the Foundations of Software Engineering, pp. 257{268, ACM, 2018.
[10] B. Wang, F. Wu, and G. Chen, \\Placement fraud detection on smart phones: A joint
crowdsourcing and data analyzing based approach," in International Conference on
Mobile Ad-Hoc and Sensor Networks, pp. 163{179, Springer, 2017.
[11] V. Dave, S. Guha, and Y. Zhang, \\Viceroi: Catching click-spam in search ad net-
works," in Proceedings of the 2013 ACM SIGSAC conference on Computer & com-
munications security, pp. 765{776, ACM, 2013.
[12] \\Google AD Size." https://developers.google.com/admob/ios/banner.
[13] V. Dave, S. Guha, and Y. Zhang, \\Measuring and Lngerprinting click-spam in ad
networks," in Proceedings of the ACM SIGCOMM 2012 conference on Applications,
technologies, architectures, and protocols for computer communication, pp. 175{186,
ACM, 2012.
[14] T. Yeh, T.-H. Chang, and R. C. Miller, \\Sikuli: using gui screenshots for search and
automation," in Proceedings of the 22nd annual ACM symposium on User interface
software and technology, pp. 183{192, ACM, 2009.
[15] Apple, \\Apple Developer Documentation." https://developer.apple.com/
documentation/, 2019.
[16] P. Z. Ian Beer, \\A very deep dive into iOS Exploit chains found
in the wild." https://googleprojectzero.blogspot.com/2019/08/
a-very-deep-dive-into-ios-exploit.html, 2019.
[17] W. Wang, I. L. Kim, and Y. Zheng, \\Adjust: runtime mitigation of resource abus-
ing third-party online ads," in Proceedings of the 41st International Conference on
Software Engineering, pp. 1005{1015, IEEE Press, 2019.
[18] W. Yang, M. Prasad, and T. Xie, \\Enmobile: Entity-based characterization and
analysis of mobile malware," in 2018 IEEE/ACM 40th International Conference on
Software Engineering (ICSE), pp. 384{394, IEEE, 2018.
[19] P. Z. Ian Beer, \\In-the-wild iOS Exploit Chain 1." https://googleprojectzero.
blogspot.com/2019/08/in-wild-ios-exploit-chain-1.html, 2019.
[20] H.Wang and Y. Guo, \\Understanding third-party libraries in mobile app analysis," in
2017 IEEE/ACM 39th International Conference on Software Engineering Companion
(ICSE-C), pp. 515{516, IEEE, 2017.
[21] D. M. Lazer, M. A. Baum, Y. Benkler, A. J. Berinsky, K. M. Greenhill, F. Menczer,
M. J. Metzger, B. Nyhan, G. Pennycook, D. Rothschild, et al., \\The science of fake
news," Science, vol. 359, no. 6380, pp. 1094{1096, 2018.
[22] A. Kantchelian, M. C. Tschantz, S. Afroz, B. Miller, V. Shankar, R. Bachwani, A. D.
Joseph, and J. D. Tygar, \\Better malware ground truth: Techniques for weighting
anti-virus vendor labels," in Proceedings of the 8th ACM Workshop on Articial
Intelligence and Security, pp. 45{56, ACM, 2015.
[23] B. J. Kwon, J. Mondal, J. Jang, L. Bilge, and T. DumitraXs, \\The dropper effect:
Insights into malware distribution with downloader graph analytics," in Proceedings
of the 22nd ACM SIGSAC Conference on Computer and Communications Security,
pp. 1118{1129, ACM, 2015.
[24] K. Chen, X. Wang, Y. Chen, P. Wang, Y. Lee, X. Wang, B. Ma, A. Wang, Y. Zhang,
and W. Zou, \\Following devil`s footprints: Cross-platform analysis of potentially
harmful libraries on android and ios," in 2016 IEEE Symposium on Security and
Privacy (SP), pp. 357{376, IEEE, 2016.
[25] X. Liao, K. Yuan, X.Wang, Z. Pei, H. Yang, J. Chen, H. Duan, K. Du, E. Alowaisheq,
S. Alrwais, et al., \\Seeking nonsense, looking for trouble: Efficient promotional-
infection detection through semantic inconsistency search," in 2016 IEEE Symposium
on Security and Privacy (SP), pp. 707{723, IEEE, 2016.
[26] S. Roy, J. DeLoach, Y. Li, N. Herndon, D. Caragea, X. Ou, V. P. Ranganath, H. Li,
and N. Guevara, \\Experimental study with real-world data for android app secu-
rity analysis using machine learning," in Proceedings of the 31st Annual Computer
Security Applications Conference, pp. 81{90, ACM, 2015.
[27] F. Wei, S. Roy, X. Ou, et al., \\Amandroid: a precise and general inter-component
data
ow analysis framework for security vetting of android apps," ACM Transactions
on Privacy and Security (TOPS), vol. 21, no. 3, p. 14, 2018.
[28] H. Chen, H.-f. Leung, B. Han, and J. Su, \\Automatic privacy leakage detection
for massive android apps via a novel hybrid approach," in 2017 IEEE International
Conference on Communications (ICC), pp. 1{7, IEEE, 2017.
[29] X. Pan, X. Wang, Y. Duan, X. Wang, and H. Yin, \\Dark hazard: Learning-based,
large-scale discovery of hidden sensitive operations in android apps.," in NDSS, 2017.
[30] A. Armando, G. Costa, A. Merlo, and L. Verderame, \\Enabling byod through secure
meta-market," in Proceedings of the 2014 ACM conference on Security and privacy
in wireless & mobile networks, pp. 219{230, ACM, 2014.
[31] Y. Nan, M. Yang, Z. Yang, S. Zhou, G. Gu, and X. Wang, \\Uipicker: User-input pri-
vacy identifcation in mobile applications," in 24th fUSENIXg Security Symposium
(fUSENIXg Security 15), pp. 993{1008, 2015.
[32] J. Huang, Z. Li, X. Xiao, Z. Wu, K. Lu, X. Zhang, and G. Jiang, \\fSUPORg: Precise
and scalable sensitive user input detection for android apps," in 24th fUSENIXg
Security Symposium (fUSENIXg Security 15), pp. 977{992, 2015.
[33] Z. Qu, V. Rastogi, X. Zhang, Y. Chen, T. Zhu, and Z. Chen, \\Autocog: Measur-
ing the description-to-permission ldelity in android applications," in Proceedings of
the 2014 ACM SIGSAC Conference on Computer and Communications Security,
pp. 1354{1365, ACM, 2014.
[34] R. Pandita, X. Xiao, W. Yang, W. Enck, and T. Xie, \\fWHYPERg: Towards au-
tomating risk assessment of mobile applications," in Presented as part of the 22nd
fUSENIXg Security Symposium (fUSENIXg Security 13), pp. 527{542, 2013.
[35] P. Suciu, \\The Biggest Cybercrime Threats of 2019." https://www.
ecommercetimes.com/story/85782.html, 2019.
[36] A. Metwally, D. Agrawal, and A. El Abbadi, \\Detectives: detecting coalition hit
in
ation attacks in advertising networks streams," in Proceedings of the 16th inter-
national conference on World Wide Web, pp. 241{250, ACM, 2007.
[37] A. Metwally, F. Emekci, D. Agrawal, and A. El Abbadi, \\Sleuth: Single-publisher
attack detection using correlation hunting," Proceedings of the VLDB Endowment,
vol. 1, no. 2, pp. 1217{1228, 2008.
[38] F. Yu, Y. Xie, and Q. Ke, \\Sbotminer: large scale search bot detection," in Pro-
ceedings of the third ACM international conference on Web search and data mining,
pp. 421{430, ACM, 2010.
[39] S. A. Alrwais, A. Gerber, C. W. Dunn, O. Spatscheck, M. Gupta, and E. Osterweil,
\\Dissecting ghost clicks: Ad fraud via misdirected human clicks," in Proceedings of
the 28th Annual Computer Security Applications Conference, pp. 21{30, ACM, 2012.
[40] T. Blizard and N. Livic, \\Click-fraud monetizing malware: A survey and case study,"
in 2012 7th International Conference on Malicious and Unwanted Software, pp. 67{
72, IEEE, 2012.
[41] J. Crussell, R. Stevens, and H. Chen, \\Madfraud: Investigating ad fraud in android
applications," in Proceedings of the 12th annual international conference on Mobile
systems, applications, and services, pp. 123{134, ACM, 2014.
[42] X. Xiao, X. Wang, Z. Cao, H. Wang, and P. Gao, \\Iconintent: automatic identi-
cation of sensitive ui widgets based on icon classication for android apps," in Pro-
ceedings of the 41st International Conference on Software Engineering, pp. 257{268,
IEEE Press, 2019.
[43] P. Wang, D. Wu, Z. Chen, and T. Wei, \\Protecting million-user ios apps with ob-
fuscation: motivations, pitfalls, and experience," in 2018 IEEE/ACM 40th Interna-
tional Conference on Software Engineering: Software Engineering in Practice Track
(ICSE-SEIP), pp. 235{244, IEEE, 2018.
[44] A. P. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner, \\A survey of mobile
malware in the wild," in Proceedings of the 1st ACM Workshop on Security and
Privacy in Smartphones and Mobile Devices, SPSM `11, pp. 3{14, 2011.
[45] S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. L. Traon,
D. Octeau, and P. McDaniel, \\Flowdroid: precise context,
ow, eld, object-sensitive
and lifecycle-aware taint analysis for android apps," in ACM SIGPLAN Conference
on Programming Language Design and Implementation, PLDI `14, Edinburgh, United
Kingdom - June 09 - 11, 2014, p. 29, 2014.
[46] L. Li, T. F. Bissyande, D. Octeau, and J. Klein, \\Droidra: taming re
ection to
support whole-program analysis of android apps," in Proceedings of the 25th Inter-
national Symposium on Software Testing and Analysis, pp. 318{329, ACM, 2016.
[47] W. Enck, P. Gilbert, S. Han, V. Tendulkar, B.-G. Chun, L. P. Cox, J. Jung, P. Mc-
Daniel, and A. N. Sheth, \\Taintdroid: an information-
ow tracking system for real-
time privacy monitoring on smartphones," ACM Transactions on Computer Systems
(TOCS), vol. 32, no. 2, p. 5, 2014.
[48] T. Bao, J. Burket, M. Woo, R. Turner, and D. Brumley, \\Byteweight: Learning to
recognize functions in binary code," in Proceedings of the 23rd USENIX Conference
on Security Symposium, SEC`14, pp. 845{860, USENIX Association, 2014.
[49] X. Meng and B. P. Miller, \\Binary code is not easy," in Proceedings of the 25th
International Symposium on Software Testing and Analysis, ISSTA 2016, pp. 24{35,
ACM, 2016.
[50] Y. Shoshitaishvili, R. Wang, C. Salls, N. Stephens, M. Polino, A. Dutcher, J. Grosen,
S. Feng, C. Hauser, C. Kruegel, et al., \\Sok:(state of) the art of war: Offensive
techniques in binary analysis," in 2016 IEEE Symposium on Security and Privacy
(SP), pp. 138{157, IEEE, 2016.
[51] T. Reinbacher and J. Brauer, \\Precise control
ow reconstruction using boolean
logic," in Proceedings of the Ninth ACM International Conference on Embedded Soft-
ware, EMSOFT `11, pp. 117{126, ACM, 2011.
[52] D. Brumley, I. Jager, T. Avgerinos, and E. J. Schwartz, \\BAP: A binary analysis
platform," in Computer Aided Verication - 23rd International Conference, CAV
2011, Snowbird, UT, USA, July 14-20, 2011. Proceedings, pp. 463{469, 2011.
[53] Dynist, \\Dynist: Tools for binary instrumentation, analysis, and modication."
https://github.com/dyninst.
[54] D. Song, D. Brumley, H. Yin, J. Caballero, I. Jager, M. G. Kang, Z. Liang, J. New-
some, P. Poosankam, and P. Saxena, \\Bitblaze: A new approach to computer security
via binary analysis," in Proceedings of the 4th International Conference on Informa-
tion Systems Security, ICISS `08, pp. 1{25, 2008.
[55] Y. Lee, X. Wang, K. Lee, X. Liao, X. Wang, T. Li, and X. Mi, \\Understanding
ios-based crowdturng through hidden fUIg analysis," in 28th fUSENIXg Security
Symposium (fUSENIXg Security 19), pp. 765{781, 2019.
[56] C. Xiao, \\Pirated iOS App Stores Client Successfully Evaded Ap-
ple iOS Code Review." https://unit42.paloaltonetworks.com/
pirated-ios-app-stores-client-successfully-evaded-apple-ios-code-review/,
2016.
[57] N. Statt, \\This illicit iPhone app store has been hiding in
plain sight." https://www.theverge.com/2019/2/20/18232140/
apple-tutuapp-piracy-ios-apps-developer-enterprise-program-misuse,
2019.
[58] C.-H. Lin, F. Yu, J.-H. R. Jiang, and T. Bultan, \\Static detection of api call vulner-
abilities in ios executables," in 2018 IEEE/ACM 40th International Conference on
Software Engineering: Companion (ICSE-Companion), pp. 394{395, IEEE, 2018.
[59] M. Egele, C. Kruegel, E. Kirda, and G. Vigna, \\Pios: Detecting privacy leaks in ios
applications.," in NDSS, 2011.
[60] T.Werthmann, R. Hund, L. Davi, A.-R. Sadeghi, and T. Holz, \\Psios: bring your own
privacy & security to ios devices," in Proceedings of the 8th ACM SIGSAC symposium
on Information, computer and communications security, pp. 13{24, ACM, 2013.
[61] L. Davi, A. Dmitrienko, M. Egele, T. Fischer, T. Holz, R. Hund, S. Nurnberger,
and A.-R. Sadeghi, \\Moc: A framework to mitigate control-
ow attacks on smart-
phones.," in NDSS, 2012.
[62] Z. Deng, B. Saltaformaggio, X. Zhang, and D. Xu, \\iris: Vetting private api abuse in
ios applications," in Proceedings of the 22nd ACM SIGSAC Conference on Computer
and Communications Security, pp. 44{56, ACM, 2015.
[63] F. Yu, Y.-C. Lee, S. Tai, and W.-S. Tang, \\Appbeach: Characterizing app behaviors
via static binary analysis," in Proceedings of the 2013 IEEE Second International
Conference on Mobile Services, p. 86, IEEE Computer Society, 2013.
[64] Z. R. Fang, S. W. Huang, and F. Yu, \\Appreco: Behavior-aware recommendation for
ios mobile applications," in 2016 IEEE International Conference on Web Services
(ICWS), pp. 492{499, June 2016.
[65] A. S. Christensen, A. Mller, and M. I. Schwartzbach, \\Precise analysis of
string expressions," in Proc. 10th International Static Analysis Symposium (SAS),
vol. 2694 of LNCS, pp. 1{18, Springer-Verlag, June 2003. Available from
http://www.brics.dk/JSA/.
[66] C. Gould, Z. Su, and P. Devanbu, \\Static checking of dynamically generated queries
in database applications," in Software Engineering, 2004. ICSE 2004. Proceedings.
26th International Conference on, pp. 645{654, IEEE, 2004.
[67] P. A. Abdulla, M. F. Atig, Y.-F. Chen, L. Holk, A. Rezine, P. Rummer, and J. Sten-
man, \\String constraints for verication," in International Conference on Computer
Aided Verication, pp. 150{166, Springer, 2014.
[68] A. Das, S. K. Lahiri, A. Lal, and Y. Li, \\Angelic verication: Precise verication
modulo unknowns," in International Conference on Computer Aided Verication,
pp. 324{342, Springer, 2015.
[69] J. Schutte and D. Titze, \\lios: Lifting ios apps for fun and prot," 2019.
[70] \\Hex-Rays Decompiler Manual." https://www.hex-rays.com/products/
decompiler/manual/tricks.shtml.
[71] J. Webber, \\A programmatic introduction to neo4j," in Proceedings of the 3rd an-
nual conference on Systems, programming, and applications: software for humanity,
pp. 217{218, ACM, 2012.
[72] Facebook, \\Facebook Infer: Linters bug types-Unavailable api in supported ios
sdk ." https://fbinfer.com/docs/linters-bug-types.html#UNAVAILABLE_API_
IN_SUPPORTED_IOS_SDK, 2019.
[73] C. Calcagno, D. Distefano, J. Dubreil, D. Gabi, P. Hooimeijer, M. Luca, P. OHearn,
I. Papakonstantinou, J. Purbrick, and D. Rodriguez, \\Moving fast with software
verication," in NASA Formal Methods Symposium, pp. 3{11, Springer, 2015.
[74] D. Distefano, P. W. Ohearn, and H. Yang, \\A local shape analysis based on separation
logic," in International Conference on Tools and Algorithms for the Construction and
Analysis of Systems, pp. 287{302, Springer, 2006.
[75] C. Calcagno, D. Distefano, P. W. Ohearn, and H. Yang, \\Compositional shape anal-
ysis by means of bi-abduction," Journal of the ACM (JACM), vol. 58, no. 6, p. 26,
2011.
[76] J. Berdine, C. Calcagno, and P. W. Ohearn, \\Smallfoot: Modular automatic assertion
checking with separation logic," in International Symposium on Formal Methods for
Components and Objects, pp. 115{137, Springer, 2005.
[77] P. Cousot, \\Abstract interpretation in a nutshell," howpublished, 7th October, 2012.
[78] Facebook, \\Facebook Infer: linters.al." https://github.com/facebook/infer/
blob/472f155a7a1a5afa95f46d4300137e58cb1fa643/infer/lib/linter_rules/
linters.al, 2019.
[79] Facebook, \\Facebook Infer: cPredicates.ml." https://github.com/facebook/
infer/blob/86140581d5e8690ac8ba82965aaa9d970acbb78e/infer/src/al/
cPredicates.ml, 2019.
[80] M. Pradel and K. Sen, \\Deepbugs: A learning approach to name-based bug detec-
tion," Proceedings of the ACM on Programming Languages, vol. 2, no. OOPSLA,
p. 147, 2018.
[81] R. van Tonder and C. Le Goues, \\Static automated program repair for heap prop-
erties," in 2018 IEEE/ACM 40th International Conference on Software Engineering
(ICSE), pp. 151{162, IEEE, 2018.
[82] M. Harman and P. O`Hearn, \\From start-ups to scale-ups: Opportunities and open
problems for static and dynamic program analysis," in 2018 IEEE 18th International
Working Conference on Source Code Analysis and Manipulation (SCAM), pp. 1{23,
IEEE, 2018.
[83] N. Alshahwan, X. Gao, M. Harman, Y. Jia, K. Mao, A. Mols, T. Tei, and I. Zorin,
\\Deploying search based software engineering with sapienz at facebook," in Interna-
tional Symposium on Search Based Software Engineering, pp. 3{45, Springer, 2018.
[84] Facebook, \\Facebook Infer: AL-examples." https://fbinfer.com/docs/linters.
html#examples, 2019.
[85] Apple, \\App Store Review Guidelines." https://developer.apple.com/
app-store/review/guidelines, 2019.
[86] ARM, \\ARM Information Center." http://infocenter.arm.com/help/index.jsp,
2009.
[87] soslab nccu, \\Github: Static Ad Fraud Detection on iOS Applications." https:
//github.com/soslab-nccu/detect-adfraud, 2019.
[88] soslab nccu, \\Github: BinFlow-Static Detection of API Call Vulnerabilities in iOS
Executables." https://github.com/soslab-nccu/binflow, 2018.
[89] C. Y. Huang, \\Video link of App 1077052682." https://drive.google.com/drive/
folders/1ep4RiMFPcL4CbfY05ZGc11UMAYGqHkA3?usp=sharing, 2019.
描述 碩士
國立政治大學
資訊管理學系
106356036
資料來源 http://thesis.lib.nccu.edu.tw/record/#G0106356036
資料類型 thesis
dc.contributor.advisor 郁方zh_TW
dc.contributor.advisor Yu, Fangen_US
dc.contributor.author (Authors) 黃存宇zh_TW
dc.contributor.author (Authors) Huang, Cun-Yuen_US
dc.creator (作者) 黃存宇zh_TW
dc.creator (作者) Huang, Cun-Yuen_US
dc.date (日期) 2019en_US
dc.date.accessioned 5-Feb-2020 17:26:32 (UTC+8)-
dc.date.available 5-Feb-2020 17:26:32 (UTC+8)-
dc.date.issued (上傳時間) 5-Feb-2020 17:26:32 (UTC+8)-
dc.identifier (Other Identifiers) G0106356036en_US
dc.identifier.uri (URI) http://nccur.lib.nccu.edu.tw/handle/140.119/128563-
dc.description (描述) 碩士zh_TW
dc.description (描述) 國立政治大學zh_TW
dc.description (描述) 資訊管理學系zh_TW
dc.description (描述) 106356036zh_TW
dc.description.abstract (摘要) 手機App成為最受歡迎和占主導地位的軟體應用程式之一，應用程序開發人員從應用程序廣告中獲得了可觀的利潤。在應用程式中，以適當的方式呈現廣告對客戶和廣告商都有好處，但是在我們的研究中，卻發現各種廣告欺詐。廣告欺詐會破壞用戶體驗或廣告效果，但是開發人員可以從中獲得更多的利潤。在我們研究中，提出了一種靜態分析技術來檢查iOS應用程式上的廣告欺詐行為。我們會檢測出插頁式廣告，尺寸違反廣告，多重廣告和重疊式廣告的廣告欺詐行為。為了檢測這些違規，它需要使用應用程序中的特定參數來識別廣告API調用，通過動態調用很難檢測到，因為確切的調用及其參數取決於嵌套參數的運行時候的值。我們在iOS的可執行文件上採用靜態分析技術，通過該技術我們可以對目標函數的參數構建依賴關係圖。然後，我們對依賴關係圖進行字串分析，以呈現潛在的API調用及其對廣告欺詐違規的參數值。
我們已經分析了上千個應用程序，這些應用程序由我們之前的應用程序靜態分析工具Binflow構造了控制流程圖，並發現208個應用程序使用了與廣告相關API的動態調用。我們進一步發現了70個具有插頁式廣告欺詐，48個具有尺寸違反廣告欺詐，31個具有多重廣告欺詐和19個具有重疊式廣告廣告欺詐。		zh_TW
dc.description.abstract (摘要) While mobile applications (apps) become one of the most popular and dominant software applications, app developers (particularly for those who deliver free apps) gain considerable parts of profits from advertisements on apps. Demonstrating ads on apps in a suitable way benefits both customers and advertisers. Various ad frauds have been identified with which developers may gain extra benefits but damage user experience or advertisement effects. We present a static analysis technique to check ad frauds of iOS apps in this work. Particularly, we detect apps that have their ads against interstitial violation, size violation, multi-view and overlap violation. To detect these violations, it requires to identify advertisement API invocation with specific arguments in apps. It becomes hard to detect with dynamic invocation where exact calls and their arguments depend on runtime values of nested parameters. We adopt static flow analysis techniques on iOS executable with which we build dependency graphs on parameters of target functions. We then conduct string analysis on dependency graphs to reveal potential API invocations with their argument values on ad fraud violations.
We have analyzed more than one thousand apps that have their control flow graphs constructed by our previous app static analysis tool Binflow, and found 208 apps using dynamic invocations on Ad related API calls. We further identified 70 apps having interstitial-violation ads, 48 apps having size violation ads, 31 apps having multi-view violation ads, and 19 apps having overlay violation ads.		en_US
dc.description.tableofcontents Contents
1 Introduction 1
1.1 Ad fraud 1
1.2 Discoveries 3
1.3 Contributions 4
2 Related Works 5
2.1 Mobile Security 5
2.2 Detecting Ad fraud 7
2.3 Static analysis 8
2.4 Static analysis on iOS application 10
3 A Motivating Example 14
4 Ad fraud detection analysis 19
4.1 Static Analysis on iOS application 19
4.1.1 Preprocessing 20
4.1.2 Control Flow Graph Construction 20
4.1.3 Dependency Graph Construction 22
4.2 Overview of Ad fraud detection analysis 23
4.3 Find the Ad Related API 25
4.4 Check Ad fraud 26
4.4.1 Interstitial violation Ad fraud 27
4.4.2 Size violation Ad fraud 28
4.4.3 Multi-view violation Ad fraud 30
4.4.4 Overlay-view violation Ad fraud 31
5 Evaluation 31
5.1 Environment 31
5.2 Result of detecting Ad related API 33
5.3 Result of Ad fraud detection 34
5.3.1 Result of Interstitial violation Ad fraud 34
5.3.2 Result of Size violation Ad fraud 38
5.3.3 Result of Multi-view violation Ad fraud 43
5.3.4 Result of Overlay-view violation Ad fraud 47
5.4 Result of Pirate App Store 51
6 Conclusion 53
References 54		zh_TW
dc.format.extent 4948718 bytes-
dc.format.mimetype application/pdf-
dc.source.uri (資料來源) http://thesis.lib.nccu.edu.tw/record/#G0106356036en_US
dc.subject (關鍵詞) 靜態分析zh_TW
dc.subject (關鍵詞) 廣告欺詐檢測zh_TW
dc.subject (關鍵詞) iOSzh_TW
dc.subject (關鍵詞) 行動應用程式zh_TW
dc.subject (關鍵詞) 資訊安全zh_TW
dc.subject (關鍵詞) Static analysisen_US
dc.subject (關鍵詞) Ad fraud detectionen_US
dc.subject (關鍵詞) iOSen_US
dc.subject (關鍵詞) Mobile applicationen_US
dc.subject (關鍵詞) Software securityen_US
dc.title (題名) 靜態廣告欺詐行為偵測技術研究-以 iOS 為例zh_TW
dc.title (題名) Static ad fraud detection on iOS applicationsen_US
dc.type (資料類型) thesisen_US
dc.relation.reference (參考文獻) [1] M. C. Grace, W. Zhou, X. Jiang, and A.-R. Sadeghi, \\Unsafe exposure analysis
of mobile in-app advertisements," in Proceedings of the Lfth ACM conference on
Security and Privacy in Wireless and Mobile Networks, pp. 101{112, ACM, 2012.
[2] D. Graziano, \\Android and iOS Still Rule the Mobile World;Microsoft and RIM Have
Long Roads Ahead." https://www.appannie.com/en/insights/market-data/
app-advertising-spend-2021/, 2012.
[3] Google, \\Google Admob." https://admob.google.com/, 2019.
[4] Apple, \\Apple Search Ads." https://searchads.apple.com/, 2019.
[5] Facebook, \\Facebook Ad." https://www.facebook.com/business/ads, 2019.
[6] A. Mamiit, \\Google
ags preinstalled malware as hidden threat on mil-
lions of Android phones." https://www.digitaltrends.com/mobile/
android-phones-preinstalled-malware, 2019.
[7] Google, \\Google Behavioral policies." https://support.google.com/admob/
answer/2753860, 2019.
[8] B. Liu, S. Nath, R. Govindan, and J. Liu, \\fDECAFg: Detecting and characterizing
ad fraud in mobile apps," in 11th fUSENIXg Symposium on Networked Systems
Design and Implementation (fNSDIg 14), pp. 57{70, 2014.
[9] F. Dong, H. Wang, L. Li, Y. Guo, T. F. BissyandSe, T. Liu, G. Xu, and J. Klein,
\\Frauddroid: Automated ad fraud detection for android apps," in Proceedings of the
2018 26th ACM Joint Meeting on European Software Engineering Conference and
Symposium on the Foundations of Software Engineering, pp. 257{268, ACM, 2018.
[10] B. Wang, F. Wu, and G. Chen, \\Placement fraud detection on smart phones: A joint
crowdsourcing and data analyzing based approach," in International Conference on
Mobile Ad-Hoc and Sensor Networks, pp. 163{179, Springer, 2017.
[11] V. Dave, S. Guha, and Y. Zhang, \\Viceroi: Catching click-spam in search ad net-
works," in Proceedings of the 2013 ACM SIGSAC conference on Computer & com-
munications security, pp. 765{776, ACM, 2013.
[12] \\Google AD Size." https://developers.google.com/admob/ios/banner.
[13] V. Dave, S. Guha, and Y. Zhang, \\Measuring and Lngerprinting click-spam in ad
networks," in Proceedings of the ACM SIGCOMM 2012 conference on Applications,
technologies, architectures, and protocols for computer communication, pp. 175{186,
ACM, 2012.
[14] T. Yeh, T.-H. Chang, and R. C. Miller, \\Sikuli: using gui screenshots for search and
automation," in Proceedings of the 22nd annual ACM symposium on User interface
software and technology, pp. 183{192, ACM, 2009.
[15] Apple, \\Apple Developer Documentation." https://developer.apple.com/
documentation/, 2019.
[16] P. Z. Ian Beer, \\A very deep dive into iOS Exploit chains found
in the wild." https://googleprojectzero.blogspot.com/2019/08/
a-very-deep-dive-into-ios-exploit.html, 2019.
[17] W. Wang, I. L. Kim, and Y. Zheng, \\Adjust: runtime mitigation of resource abus-
ing third-party online ads," in Proceedings of the 41st International Conference on
Software Engineering, pp. 1005{1015, IEEE Press, 2019.
[18] W. Yang, M. Prasad, and T. Xie, \\Enmobile: Entity-based characterization and
analysis of mobile malware," in 2018 IEEE/ACM 40th International Conference on
Software Engineering (ICSE), pp. 384{394, IEEE, 2018.
[19] P. Z. Ian Beer, \\In-the-wild iOS Exploit Chain 1." https://googleprojectzero.
blogspot.com/2019/08/in-wild-ios-exploit-chain-1.html, 2019.
[20] H.Wang and Y. Guo, \\Understanding third-party libraries in mobile app analysis," in
2017 IEEE/ACM 39th International Conference on Software Engineering Companion
(ICSE-C), pp. 515{516, IEEE, 2017.
[21] D. M. Lazer, M. A. Baum, Y. Benkler, A. J. Berinsky, K. M. Greenhill, F. Menczer,
M. J. Metzger, B. Nyhan, G. Pennycook, D. Rothschild, et al., \\The science of fake
news," Science, vol. 359, no. 6380, pp. 1094{1096, 2018.
[22] A. Kantchelian, M. C. Tschantz, S. Afroz, B. Miller, V. Shankar, R. Bachwani, A. D.
Joseph, and J. D. Tygar, \\Better malware ground truth: Techniques for weighting
anti-virus vendor labels," in Proceedings of the 8th ACM Workshop on Articial
Intelligence and Security, pp. 45{56, ACM, 2015.
[23] B. J. Kwon, J. Mondal, J. Jang, L. Bilge, and T. DumitraXs, \\The dropper effect:
Insights into malware distribution with downloader graph analytics," in Proceedings
of the 22nd ACM SIGSAC Conference on Computer and Communications Security,
pp. 1118{1129, ACM, 2015.
[24] K. Chen, X. Wang, Y. Chen, P. Wang, Y. Lee, X. Wang, B. Ma, A. Wang, Y. Zhang,
and W. Zou, \\Following devil`s footprints: Cross-platform analysis of potentially
harmful libraries on android and ios," in 2016 IEEE Symposium on Security and
Privacy (SP), pp. 357{376, IEEE, 2016.
[25] X. Liao, K. Yuan, X.Wang, Z. Pei, H. Yang, J. Chen, H. Duan, K. Du, E. Alowaisheq,
S. Alrwais, et al., \\Seeking nonsense, looking for trouble: Efficient promotional-
infection detection through semantic inconsistency search," in 2016 IEEE Symposium
on Security and Privacy (SP), pp. 707{723, IEEE, 2016.
[26] S. Roy, J. DeLoach, Y. Li, N. Herndon, D. Caragea, X. Ou, V. P. Ranganath, H. Li,
and N. Guevara, \\Experimental study with real-world data for android app secu-
rity analysis using machine learning," in Proceedings of the 31st Annual Computer
Security Applications Conference, pp. 81{90, ACM, 2015.
[27] F. Wei, S. Roy, X. Ou, et al., \\Amandroid: a precise and general inter-component
data
ow analysis framework for security vetting of android apps," ACM Transactions
on Privacy and Security (TOPS), vol. 21, no. 3, p. 14, 2018.
[28] H. Chen, H.-f. Leung, B. Han, and J. Su, \\Automatic privacy leakage detection
for massive android apps via a novel hybrid approach," in 2017 IEEE International
Conference on Communications (ICC), pp. 1{7, IEEE, 2017.
[29] X. Pan, X. Wang, Y. Duan, X. Wang, and H. Yin, \\Dark hazard: Learning-based,
large-scale discovery of hidden sensitive operations in android apps.," in NDSS, 2017.
[30] A. Armando, G. Costa, A. Merlo, and L. Verderame, \\Enabling byod through secure
meta-market," in Proceedings of the 2014 ACM conference on Security and privacy
in wireless & mobile networks, pp. 219{230, ACM, 2014.
[31] Y. Nan, M. Yang, Z. Yang, S. Zhou, G. Gu, and X. Wang, \\Uipicker: User-input pri-
vacy identifcation in mobile applications," in 24th fUSENIXg Security Symposium
(fUSENIXg Security 15), pp. 993{1008, 2015.
[32] J. Huang, Z. Li, X. Xiao, Z. Wu, K. Lu, X. Zhang, and G. Jiang, \\fSUPORg: Precise
and scalable sensitive user input detection for android apps," in 24th fUSENIXg
Security Symposium (fUSENIXg Security 15), pp. 977{992, 2015.
[33] Z. Qu, V. Rastogi, X. Zhang, Y. Chen, T. Zhu, and Z. Chen, \\Autocog: Measur-
ing the description-to-permission ldelity in android applications," in Proceedings of
the 2014 ACM SIGSAC Conference on Computer and Communications Security,
pp. 1354{1365, ACM, 2014.
[34] R. Pandita, X. Xiao, W. Yang, W. Enck, and T. Xie, \\fWHYPERg: Towards au-
tomating risk assessment of mobile applications," in Presented as part of the 22nd
fUSENIXg Security Symposium (fUSENIXg Security 13), pp. 527{542, 2013.
[35] P. Suciu, \\The Biggest Cybercrime Threats of 2019." https://www.
ecommercetimes.com/story/85782.html, 2019.
[36] A. Metwally, D. Agrawal, and A. El Abbadi, \\Detectives: detecting coalition hit
in
ation attacks in advertising networks streams," in Proceedings of the 16th inter-
national conference on World Wide Web, pp. 241{250, ACM, 2007.
[37] A. Metwally, F. Emekci, D. Agrawal, and A. El Abbadi, \\Sleuth: Single-publisher
attack detection using correlation hunting," Proceedings of the VLDB Endowment,
vol. 1, no. 2, pp. 1217{1228, 2008.
[38] F. Yu, Y. Xie, and Q. Ke, \\Sbotminer: large scale search bot detection," in Pro-
ceedings of the third ACM international conference on Web search and data mining,
pp. 421{430, ACM, 2010.
[39] S. A. Alrwais, A. Gerber, C. W. Dunn, O. Spatscheck, M. Gupta, and E. Osterweil,
\\Dissecting ghost clicks: Ad fraud via misdirected human clicks," in Proceedings of
the 28th Annual Computer Security Applications Conference, pp. 21{30, ACM, 2012.
[40] T. Blizard and N. Livic, \\Click-fraud monetizing malware: A survey and case study,"
in 2012 7th International Conference on Malicious and Unwanted Software, pp. 67{
72, IEEE, 2012.
[41] J. Crussell, R. Stevens, and H. Chen, \\Madfraud: Investigating ad fraud in android
applications," in Proceedings of the 12th annual international conference on Mobile
systems, applications, and services, pp. 123{134, ACM, 2014.
[42] X. Xiao, X. Wang, Z. Cao, H. Wang, and P. Gao, \\Iconintent: automatic identi-
cation of sensitive ui widgets based on icon classication for android apps," in Pro-
ceedings of the 41st International Conference on Software Engineering, pp. 257{268,
IEEE Press, 2019.
[43] P. Wang, D. Wu, Z. Chen, and T. Wei, \\Protecting million-user ios apps with ob-
fuscation: motivations, pitfalls, and experience," in 2018 IEEE/ACM 40th Interna-
tional Conference on Software Engineering: Software Engineering in Practice Track
(ICSE-SEIP), pp. 235{244, IEEE, 2018.
[44] A. P. Felt, M. Finifter, E. Chin, S. Hanna, and D. Wagner, \\A survey of mobile
malware in the wild," in Proceedings of the 1st ACM Workshop on Security and
Privacy in Smartphones and Mobile Devices, SPSM `11, pp. 3{14, 2011.
[45] S. Arzt, S. Rasthofer, C. Fritz, E. Bodden, A. Bartel, J. Klein, Y. L. Traon,
D. Octeau, and P. McDaniel, \\Flowdroid: precise context,
ow, eld, object-sensitive
and lifecycle-aware taint analysis for android apps," in ACM SIGPLAN Conference
on Programming Language Design and Implementation, PLDI `14, Edinburgh, United
Kingdom - June 09 - 11, 2014, p. 29, 2014.
[46] L. Li, T. F. Bissyande, D. Octeau, and J. Klein, \\Droidra: taming re
ection to
support whole-program analysis of android apps," in Proceedings of the 25th Inter-
national Symposium on Software Testing and Analysis, pp. 318{329, ACM, 2016.
[47] W. Enck, P. Gilbert, S. Han, V. Tendulkar, B.-G. Chun, L. P. Cox, J. Jung, P. Mc-
Daniel, and A. N. Sheth, \\Taintdroid: an information-
ow tracking system for real-
time privacy monitoring on smartphones," ACM Transactions on Computer Systems
(TOCS), vol. 32, no. 2, p. 5, 2014.
[48] T. Bao, J. Burket, M. Woo, R. Turner, and D. Brumley, \\Byteweight: Learning to
recognize functions in binary code," in Proceedings of the 23rd USENIX Conference
on Security Symposium, SEC`14, pp. 845{860, USENIX Association, 2014.
[49] X. Meng and B. P. Miller, \\Binary code is not easy," in Proceedings of the 25th
International Symposium on Software Testing and Analysis, ISSTA 2016, pp. 24{35,
ACM, 2016.
[50] Y. Shoshitaishvili, R. Wang, C. Salls, N. Stephens, M. Polino, A. Dutcher, J. Grosen,
S. Feng, C. Hauser, C. Kruegel, et al., \\Sok:(state of) the art of war: Offensive
techniques in binary analysis," in 2016 IEEE Symposium on Security and Privacy
(SP), pp. 138{157, IEEE, 2016.
[51] T. Reinbacher and J. Brauer, \\Precise control
ow reconstruction using boolean
logic," in Proceedings of the Ninth ACM International Conference on Embedded Soft-
ware, EMSOFT `11, pp. 117{126, ACM, 2011.
[52] D. Brumley, I. Jager, T. Avgerinos, and E. J. Schwartz, \\BAP: A binary analysis
platform," in Computer Aided Verication - 23rd International Conference, CAV
2011, Snowbird, UT, USA, July 14-20, 2011. Proceedings, pp. 463{469, 2011.
[53] Dynist, \\Dynist: Tools for binary instrumentation, analysis, and modication."
https://github.com/dyninst.
[54] D. Song, D. Brumley, H. Yin, J. Caballero, I. Jager, M. G. Kang, Z. Liang, J. New-
some, P. Poosankam, and P. Saxena, \\Bitblaze: A new approach to computer security
via binary analysis," in Proceedings of the 4th International Conference on Informa-
tion Systems Security, ICISS `08, pp. 1{25, 2008.
[55] Y. Lee, X. Wang, K. Lee, X. Liao, X. Wang, T. Li, and X. Mi, \\Understanding
ios-based crowdturng through hidden fUIg analysis," in 28th fUSENIXg Security
Symposium (fUSENIXg Security 19), pp. 765{781, 2019.
[56] C. Xiao, \\Pirated iOS App Stores Client Successfully Evaded Ap-
ple iOS Code Review." https://unit42.paloaltonetworks.com/
pirated-ios-app-stores-client-successfully-evaded-apple-ios-code-review/,
2016.
[57] N. Statt, \\This illicit iPhone app store has been hiding in
plain sight." https://www.theverge.com/2019/2/20/18232140/
apple-tutuapp-piracy-ios-apps-developer-enterprise-program-misuse,
2019.
[58] C.-H. Lin, F. Yu, J.-H. R. Jiang, and T. Bultan, \\Static detection of api call vulner-
abilities in ios executables," in 2018 IEEE/ACM 40th International Conference on
Software Engineering: Companion (ICSE-Companion), pp. 394{395, IEEE, 2018.
[59] M. Egele, C. Kruegel, E. Kirda, and G. Vigna, \\Pios: Detecting privacy leaks in ios
applications.," in NDSS, 2011.
[60] T.Werthmann, R. Hund, L. Davi, A.-R. Sadeghi, and T. Holz, \\Psios: bring your own
privacy & security to ios devices," in Proceedings of the 8th ACM SIGSAC symposium
on Information, computer and communications security, pp. 13{24, ACM, 2013.
[61] L. Davi, A. Dmitrienko, M. Egele, T. Fischer, T. Holz, R. Hund, S. Nurnberger,
and A.-R. Sadeghi, \\Moc: A framework to mitigate control-
ow attacks on smart-
phones.," in NDSS, 2012.
[62] Z. Deng, B. Saltaformaggio, X. Zhang, and D. Xu, \\iris: Vetting private api abuse in
ios applications," in Proceedings of the 22nd ACM SIGSAC Conference on Computer
and Communications Security, pp. 44{56, ACM, 2015.
[63] F. Yu, Y.-C. Lee, S. Tai, and W.-S. Tang, \\Appbeach: Characterizing app behaviors
via static binary analysis," in Proceedings of the 2013 IEEE Second International
Conference on Mobile Services, p. 86, IEEE Computer Society, 2013.
[64] Z. R. Fang, S. W. Huang, and F. Yu, \\Appreco: Behavior-aware recommendation for
ios mobile applications," in 2016 IEEE International Conference on Web Services
(ICWS), pp. 492{499, June 2016.
[65] A. S. Christensen, A. Mller, and M. I. Schwartzbach, \\Precise analysis of
string expressions," in Proc. 10th International Static Analysis Symposium (SAS),
vol. 2694 of LNCS, pp. 1{18, Springer-Verlag, June 2003. Available from
http://www.brics.dk/JSA/.
[66] C. Gould, Z. Su, and P. Devanbu, \\Static checking of dynamically generated queries
in database applications," in Software Engineering, 2004. ICSE 2004. Proceedings.
26th International Conference on, pp. 645{654, IEEE, 2004.
[67] P. A. Abdulla, M. F. Atig, Y.-F. Chen, L. Holk, A. Rezine, P. Rummer, and J. Sten-
man, \\String constraints for verication," in International Conference on Computer
Aided Verication, pp. 150{166, Springer, 2014.
[68] A. Das, S. K. Lahiri, A. Lal, and Y. Li, \\Angelic verication: Precise verication
modulo unknowns," in International Conference on Computer Aided Verication,
pp. 324{342, Springer, 2015.
[69] J. Schutte and D. Titze, \\lios: Lifting ios apps for fun and prot," 2019.
[70] \\Hex-Rays Decompiler Manual." https://www.hex-rays.com/products/
decompiler/manual/tricks.shtml.
[71] J. Webber, \\A programmatic introduction to neo4j," in Proceedings of the 3rd an-
nual conference on Systems, programming, and applications: software for humanity,
pp. 217{218, ACM, 2012.
[72] Facebook, \\Facebook Infer: Linters bug types-Unavailable api in supported ios
sdk ." https://fbinfer.com/docs/linters-bug-types.html#UNAVAILABLE_API_
IN_SUPPORTED_IOS_SDK, 2019.
[73] C. Calcagno, D. Distefano, J. Dubreil, D. Gabi, P. Hooimeijer, M. Luca, P. OHearn,
I. Papakonstantinou, J. Purbrick, and D. Rodriguez, \\Moving fast with software
verication," in NASA Formal Methods Symposium, pp. 3{11, Springer, 2015.
[74] D. Distefano, P. W. Ohearn, and H. Yang, \\A local shape analysis based on separation
logic," in International Conference on Tools and Algorithms for the Construction and
Analysis of Systems, pp. 287{302, Springer, 2006.
[75] C. Calcagno, D. Distefano, P. W. Ohearn, and H. Yang, \\Compositional shape anal-
ysis by means of bi-abduction," Journal of the ACM (JACM), vol. 58, no. 6, p. 26,
2011.
[76] J. Berdine, C. Calcagno, and P. W. Ohearn, \\Smallfoot: Modular automatic assertion
checking with separation logic," in International Symposium on Formal Methods for
Components and Objects, pp. 115{137, Springer, 2005.
[77] P. Cousot, \\Abstract interpretation in a nutshell," howpublished, 7th October, 2012.
[78] Facebook, \\Facebook Infer: linters.al." https://github.com/facebook/infer/
blob/472f155a7a1a5afa95f46d4300137e58cb1fa643/infer/lib/linter_rules/
linters.al, 2019.
[79] Facebook, \\Facebook Infer: cPredicates.ml." https://github.com/facebook/
infer/blob/86140581d5e8690ac8ba82965aaa9d970acbb78e/infer/src/al/
cPredicates.ml, 2019.
[80] M. Pradel and K. Sen, \\Deepbugs: A learning approach to name-based bug detec-
tion," Proceedings of the ACM on Programming Languages, vol. 2, no. OOPSLA,
p. 147, 2018.
[81] R. van Tonder and C. Le Goues, \\Static automated program repair for heap prop-
erties," in 2018 IEEE/ACM 40th International Conference on Software Engineering
(ICSE), pp. 151{162, IEEE, 2018.
[82] M. Harman and P. O`Hearn, \\From start-ups to scale-ups: Opportunities and open
problems for static and dynamic program analysis," in 2018 IEEE 18th International
Working Conference on Source Code Analysis and Manipulation (SCAM), pp. 1{23,
IEEE, 2018.
[83] N. Alshahwan, X. Gao, M. Harman, Y. Jia, K. Mao, A. Mols, T. Tei, and I. Zorin,
\\Deploying search based software engineering with sapienz at facebook," in Interna-
tional Symposium on Search Based Software Engineering, pp. 3{45, Springer, 2018.
[84] Facebook, \\Facebook Infer: AL-examples." https://fbinfer.com/docs/linters.
html#examples, 2019.
[85] Apple, \\App Store Review Guidelines." https://developer.apple.com/
app-store/review/guidelines, 2019.
[86] ARM, \\ARM Information Center." http://infocenter.arm.com/help/index.jsp,
2009.
[87] soslab nccu, \\Github: Static Ad Fraud Detection on iOS Applications." https:
//github.com/soslab-nccu/detect-adfraud, 2019.
[88] soslab nccu, \\Github: BinFlow-Static Detection of API Call Vulnerabilities in iOS
Executables." https://github.com/soslab-nccu/binflow, 2018.
[89] C. Y. Huang, \\Video link of App 1077052682." https://drive.google.com/drive/
folders/1ep4RiMFPcL4CbfY05ZGc11UMAYGqHkA3?usp=sharing, 2019.		zh_TW
dc.identifier.doi (DOI) 10.6814/NCCU202000021en_US