paper

Effective Inter-Component Communication Mapping in Android with Epicc: An Essential Step Towards Holistic Security Analysis

  • Authors:
Read the paper

📜 Abstract

Many threats present in smartphones are the result of interactions between application components, not just artifacts of single components. However, current techniques for identifying inter-application communication are ad hoc and do not scale to large numbers of applications. In this paper, we reduce the discovery of inter-component communication (ICC) in smartphones to an instance of the Interprocedural Distributive Environment (IDE) problem, and develop a sound static analysis technique targeted to the Android platform. We apply this analysis to 1,200 applications selected from the Play store and characterize the locations and substance of their ICC. Experiments show that full specifications for ICC can be identified for over 93% of ICC locations for the applications studied. Further the analysis scales well; analysis of each application took on average 113 seconds to complete. Epicc, the resulting tool, finds ICC vulnerabilities with far fewer false positives than the next best tool. In this way, we develop a scalable vehicle to extend current security analysis to entire collections of applications as well as the interfaces they export.

✨ Summary

Summary

The paper formalizes Android Intent-based inter-component communication (ICC) analysis as an Interprocedural Distributive Environment problem and introduces Epicc, a static-analysis tool for recovering ICC source and sink specifications. The analysis models explicit, implicit, mixed, and dynamically registered broadcast communication, including component targets, actions, categories, permissions, and extra-data keys. It combines string analysis, points-to and call-graph construction, IDE-based interprocedural data-flow analysis, and database-backed matching of component entry and exit points.

In experiments on 1,200 Google Play applications, Epicc recovered unambiguous ICC specifications for 91.65% of locations in a random sample and 94.18% in a popular-application sample. The reported average processing time was approximately 38 seconds per application for the random sample and 144 seconds per application for the larger popular-application sample. Compared with ComDroid, Epicc reported 32% fewer potential vulnerabilities, which the authors attribute primarily to more precise call-graph construction and flow-, branch-, and context-sensitive tracking. The main limitations were incomplete handling of URIs and Content Providers, plus potential unsoundness involving reflection, native code, and approximated component lifecycles.

Influence on subsequent research

  • Epicc established a reusable foundation for Android ICC resolution. IccTA later combined Epicc-derived ICC information with FlowDroid-style taint analysis to detect privacy leaks across Android components and applications. (publica.fraunhofer.de)
  • The authors’ subsequent IC3 work replaced Epicc’s specialized object models with composite constant propagation and the COAL specification language. That work explicitly compares itself with Epicc and reports substantially fewer potential component links, improving precision for downstream analyses. (docteau.github.io)
  • PRIMO extended this line of work to market-scale ICC analysis by ranking likely false-positive links. Its authors describe Epicc and IC3 as the ICC-value computation components underlying later large-scale link analysis. (patrickmcdaniel.org)
  • Later research continued to use Epicc as a reference point while addressing its coverage limitations. RAICC, for example, identifies that established tools including Epicc primarily model documented ICC APIs and proposes techniques for revealing atypical ICC paths. (github.com)
  • Subsequent evaluations have treated Epicc, or its successor IC3, as a baseline ICC-resolution technique and have identified remaining completeness and precision challenges for static Android ICC analysis. (arxiv.org)

The search found clear influence on subsequent Android program-analysis research, including ICC resolution, privacy-leak detection, large-scale analysis, and atypical-communication modeling. It did not provide reliable evidence of a specific commercial or industry deployment of Epicc itself.