Dynamic analysis with Android container: Challenges and opportunities

Abstract

Until now, researchers have been analyzing Android applications dynamically with the use of either emulators or real devices. Emulators are an option that testers currently have to achieve scalability. Besides, these approaches can also take snapshots which help to revert back to a known state in a matter of seconds. However, emulators are often slow in performance and contain heuristic emulation traces. As for the case of real devices, restoring mechanism and hardware utilization are limitations for increasing analysis productivity. In this paper, we developed C-Android with the motivation to seek an alternative solution to solve the existing problems. C-Android leverages Linux container technology to provide restore mechanism on the bare-metal device and to utilize the most from existing hardware. To study on the opportunities of applying Android container into the analysis, we have performed several comparative implementations between C-Android and other existing approaches. The purpose of our first comparison is to assess the compatibility between container-based (C-Android) and existing solutions. The following test is related to performance between our approach and other platforms. Lastly, the utilization test is established in order to assess the possibility to optimize C-Android hardware without causing too much reduction in the performance. The challenges of applying container technology to Android analysis are also discussed in the paper as a result of our study. © 2018 The Authors