Enabling Automatic Protocol Behavior Analysis for Android Applications

Abstract

Understanding app-specific behavior is important for network operation and management. However, it is often difficult because it requires an in-depth application-layer protocol analysis due to the common use of HTTP(S) and standard data representations (e.g., JSON). This paper presents Extractocol, the first system to offer an automatic and comprehensive analysis of application protocol behaviors for Android applications. Extractocol only uses Android application binary as input and accurately reconstructs HTTP transactions (request-response pairs) and identifies their message formats and relationships using binary analysis. Our evaluation and in-depth case studies on closed-source and open-source apps demonstrate that Extractocol accurately reconstructs network message formats and characterizes network-related application behaviors.