{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,24]],"date-time":"2025-06-24T07:09:57Z","timestamp":1750748997502,"version":"3.40.3"},"publisher-location":"Cham","reference-count":45,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783031171420"},{"type":"electronic","value":"9783031171437"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"DOI":"10.1007\/978-3-031-17143-7_34","type":"book-chapter","created":{"date-parts":[[2022,9,23]],"date-time":"2022-09-23T04:04:22Z","timestamp":1663905862000},"page":"701-722","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Reach Me if\u00a0You Can: On Native Vulnerability Reachability in\u00a0Android Apps"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7198-5175","authenticated-orcid":false,"given":"Luca","family":"Borzacchiello","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8094-871X","authenticated-orcid":false,"given":"Emilio","family":"Coppa","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2640-4663","authenticated-orcid":false,"given":"Davide","family":"Maiorca","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrea","family":"Columbu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4686-6745","authenticated-orcid":false,"given":"Camil","family":"Demetrescu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5759-3017","authenticated-orcid":false,"given":"Giorgio","family":"Giacinto","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2022,9,24]]},"reference":[{"key":"34_CR1","doi-asserted-by":"publisher","unstructured":"Abraham, A., Andriatsimandefitra, R., Brunelat, A., Lalande, J., Tong, V.V.T.: GroddDroid: a gorilla for triggering malicious behaviors. In: 10th International Conference on Malicious and Unwanted Software. MALWARE 2015 (2015). https:\/\/doi.org\/10.1109\/MALWARE.2015.7413692","DOI":"10.1109\/MALWARE.2015.7413692"},{"key":"34_CR2","unstructured":"Almanee, S.: Librarian dataset (2021). https:\/\/github.com\/salmanee\/Librarian"},{"key":"34_CR3","doi-asserted-by":"publisher","unstructured":"Almanee, S., \u00dcnal, A., Payer, M., Garcia, J.: Too quiet in the library: an empirical study of security updates in android apps\u2019 native code. In: 43rd IEEE\/ACM International Conference on Software Engineering. ICSE 2021 (2021). https:\/\/doi.org\/10.1109\/ICSE43902.2021.00122","DOI":"10.1109\/ICSE43902.2021.00122"},{"key":"34_CR4","doi-asserted-by":"publisher","unstructured":"Amalfitano, D., Fasolino, A.R., Tramontana, P., De Carmine, S., Memon, A.M.: Using GUI ripping for automated testing of android applications. In: Proceedings of the 27th IEEE\/ACM International Conference on Automated Software Engineering. ASE 2012 (2012). https:\/\/doi.org\/10.1145\/2351676.2351717","DOI":"10.1145\/2351676.2351717"},{"key":"34_CR5","unstructured":"Android: Native libraries (2021). https:\/\/developer.android.com\/training\/articles\/perf-jni#native-libraries"},{"key":"34_CR6","unstructured":"Android Developers: UI\/Application Exerciser Monkey (2021)"},{"key":"34_CR7","doi-asserted-by":"publisher","unstructured":"Arzt, S., et al.: FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps. In: Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation (2014). https:\/\/doi.org\/10.1145\/2594291.2594299","DOI":"10.1145\/2594291.2594299"},{"key":"34_CR8","doi-asserted-by":"publisher","unstructured":"Bello, L., Pistoia, M.: Ares: triggering payload of evasive android malware. In: Proceedings of the 5th International Conference on Mobile Software Engineering and Systems. MOBILESoft 2018 (2018). https:\/\/doi.org\/10.1145\/3197231.3197239","DOI":"10.1145\/3197231.3197239"},{"key":"34_CR9","unstructured":"Borzacchiello, L.: DroidReach (2022). https:\/\/github.com\/season-lab\/DroidReach"},{"key":"34_CR10","unstructured":"Borzacchiello, L.: DroidReach Benchmarks (2022). https:\/\/github.com\/season-lab\/DroidReachBenchmarks"},{"key":"34_CR11","doi-asserted-by":"publisher","unstructured":"Borzacchiello, L., Coppa, E., Demetrescu, C.: Fuzzing symbolic expressions. In: Proceedings of the 43rd International Conference on Software Engineering (ICSE 2021) (2021). https:\/\/doi.org\/10.1109\/ICSE43902.2021.00071","DOI":"10.1109\/ICSE43902.2021.00071"},{"key":"34_CR12","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102368","author":"L Borzacchiello","year":"2021","unstructured":"Borzacchiello, L., Coppa, E., Demetrescu, C.: FUZZOLIC: mixing fuzzing and concolic execution. Comput. Secur. (2021). https:\/\/doi.org\/10.1016\/j.cose.2021.102368","journal-title":"Comput. Secur."},{"key":"34_CR13","doi-asserted-by":"publisher","unstructured":"Bosu, A., Liu, F., Yao, D.D., Wang, G.: Collusive data leak and more: large-scale threat analysis of inter-app communications. In: Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security (2017). https:\/\/doi.org\/10.1145\/3052973.3053004","DOI":"10.1145\/3052973.3053004"},{"key":"34_CR14","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2012.02.006","author":"T Chen","year":"2013","unstructured":"Chen, T., Zhang, X.S., Guo, S.Z., Li, H.Y., Wu, Y.: State of the art: dynamic symbolic execution for automated test generation. Futur. Gener. Comput. Syst. (2013). https:\/\/doi.org\/10.1016\/j.future.2012.02.006","journal-title":"Futur. Gener. Comput. Syst."},{"key":"34_CR15","doi-asserted-by":"publisher","unstructured":"Choi, W., Necula, G., Sen, K.: Guided GUI testing of android apps with minimal restart and approximate learning. In: Proceedings of the 2013 ACM SIGPLAN International Conference on Object Oriented Programming Systems Languages & Applications. OOPSLA 2013 (2013). https:\/\/doi.org\/10.1145\/2509136.2509552","DOI":"10.1145\/2509136.2509552"},{"key":"34_CR16","unstructured":"CVE: CVE-2016-2182 (2016). https:\/\/www.cvedetails.com\/cve\/CVE-2016-2182\/"},{"key":"34_CR17","doi-asserted-by":"publisher","unstructured":"Derr, E., Bugiel, S., Fahl, S., Acar, Y., Backes, M.: Keep me updated: an empirical study of third-party library updatability on android. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. CCS 2017 (2017). https:\/\/doi.org\/10.1145\/3133956.3134059","DOI":"10.1145\/3133956.3134059"},{"key":"34_CR18","unstructured":"Desnos, A.: Androguard (2021). https:\/\/github.com\/androguard\/androguard"},{"key":"34_CR19","doi-asserted-by":"publisher","unstructured":"Enck, W., et al.: TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones. ACM Trans. Comput. Syst. (2014). https:\/\/doi.org\/10.1145\/2619091","DOI":"10.1145\/2619091"},{"key":"34_CR20","doi-asserted-by":"publisher","unstructured":"Eschweiler, S., Yakdan, K., Gerhards-Padilla, E.: Discovre: efficient cross-architecture identification of bugs in binary code. In: 23rd Annual Network and Distributed System Security Symposium (2016). https:\/\/doi.org\/10.14722\/ndss.2016.23185","DOI":"10.14722\/ndss.2016.23185"},{"key":"34_CR21","doi-asserted-by":"publisher","unstructured":"Gao, J., Yang, X., Fu, Y., Jiang, Y., Shi, H., Sun, J.: Vulseeker-pro: enhanced semantic learning based binary vulnerability seeker with emulation. In: Proceedings of the 2018 ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering ESEC\/FSE 2018 (2018). https:\/\/doi.org\/10.1145\/3236024.3275524","DOI":"10.1145\/3236024.3275524"},{"key":"34_CR22","doi-asserted-by":"publisher","unstructured":"Gordon, M.I., Kim, D., Perkins, J., Gilham, L., Nguyen, N., Rinard, M.: Information-Flow Analysis of Android Applications in DroidSafe. In: Proceedings of the 2015 Network and Distributed System Security Symposium (2015). https:\/\/doi.org\/10.14722\/ndss.2015.23089","DOI":"10.14722\/ndss.2015.23089"},{"key":"34_CR23","doi-asserted-by":"publisher","unstructured":"Gu, Y., et al.: JGRE: an analysis of JNI global reference exhaustion vulnerabilities in android. In: 2017 47th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 427\u2013438 (2017). https:\/\/doi.org\/10.1109\/DSN.2017.40","DOI":"10.1109\/DSN.2017.40"},{"key":"34_CR24","doi-asserted-by":"publisher","unstructured":"Hao, S., Liu, B., Nath, S., Halfond, W.G., Govindan, R.: Puma: programmable ui-automation for large-scale dynamic analysis of mobile apps. In: Proceedings of the 12th Annual International Conference on Mobile Systems, Applications, and Services. MobiSys 2014 (2014). https:\/\/doi.org\/10.1145\/2594368.2594390","DOI":"10.1145\/2594368.2594390"},{"key":"34_CR25","doi-asserted-by":"publisher","unstructured":"Hwang, S., Lee, S., Kim, J., Ryu, S.: Justgen: effective test generation for unspecified JNI behaviors on JVMs. In: 2021 43rd International Conference on on Software Engineering (ICSE 2021) (2021). https:\/\/doi.org\/10.1109\/ICSE43902.2021.00151","DOI":"10.1109\/ICSE43902.2021.00151"},{"key":"34_CR26","doi-asserted-by":"publisher","unstructured":"Klieber, W., Flynn, L., Bhosale, A., Jia, L., Bauer, L.: Android taint flow analysis for app sets. In: Proceedings of the 3rd ACM SIGPLAN International Workshop on the State of the Art in Java Program Analysis. SOAP 2014 (2014). https:\/\/doi.org\/10.1145\/2614628.2614633","DOI":"10.1145\/2614628.2614633"},{"key":"34_CR27","doi-asserted-by":"publisher","unstructured":"Lee, S., Lee, H., Ryu, S.: Broadening horizons of multilingual static analysis: semantic summary extraction from c code for JNI program analysis. In: 2020 35th IEEE\/ACM International Conference on Automated Software Engineering (ASE 2020) (2020). https:\/\/doi.org\/10.1145\/3324884.3416558","DOI":"10.1145\/3324884.3416558"},{"key":"34_CR28","doi-asserted-by":"publisher","unstructured":"Li, L., et al.: IccTA: detecting inter-component privacy leaks in android apps. In: 37th IEEE International Conference on Software Engineering (ASE 2015) (2015). https:\/\/doi.org\/10.1109\/ICSE.2015.48","DOI":"10.1109\/ICSE.2015.48"},{"key":"34_CR29","doi-asserted-by":"publisher","unstructured":"Li, S., Tan, G.: Finding bugs in exceptional situations of JNI programs. In: Proceedings of the 16th ACM Conference on Computer and Communications Security, pp. 442\u2013452. CCS 2009 (2009). https:\/\/doi.org\/10.1145\/1653662.1653716","DOI":"10.1145\/1653662.1653716"},{"key":"34_CR30","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"66","DOI":"10.1007\/978-3-319-99073-6_4","volume-title":"Computer Security","author":"Y Liao","year":"2018","unstructured":"Liao, Y., Cai, R., Zhu, G., Yin, Y., Li, K.: MobileFindr: function similarity identification for reversing mobile binaries. In: Lopez, J., Zhou, J., Soriano, M. (eds.) ESORICS 2018. LNCS, vol. 11098, pp. 66\u201383. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-319-99073-6_4"},{"key":"34_CR31","unstructured":"Ming, J., Xu, D., Jiang, Y., Wu, D.: BinSim: trace-based semantic binary diffing via system call sliced segment equivalence checking. In: 26th USENIX Security Symposium (USENIX Security 17) (2017)"},{"key":"34_CR32","unstructured":"NSA: Ghidra (2016). https:\/\/ghidra-sre.org\/"},{"key":"34_CR33","doi-asserted-by":"publisher","unstructured":"Shoshitaishvili, Y., et al.: SOK: (state of) the art of war: offensive techniques in binary analysis. In: IEEE SP 2016 (2016). https:\/\/doi.org\/10.1109\/SP.2016.17","DOI":"10.1109\/SP.2016.17"},{"key":"34_CR34","doi-asserted-by":"publisher","unstructured":"Sun, M., Wei, T., Lui, J.C.: TaintART: a practical multi-level information-flow tracking system for android RunTime. In: Proceedings of the 2016 Conference on Computer and Communications Security CCS 2016 (2016). https:\/\/doi.org\/10.1145\/2976749.2978343","DOI":"10.1145\/2976749.2978343"},{"key":"34_CR35","unstructured":"Tan, G., Chakradhar, S., Srivaths, R., Wang, R.D.: Safe java native interface. In: In Proceedings of the 2006 IEEE International Symposium on Secure Software Engineering, pp. 97\u2013106 (2006)"},{"key":"34_CR36","doi-asserted-by":"publisher","unstructured":"Tan, G., Croft, J.: An empirical security study of the native code in the JDK. In: Proceedings of the 17th Conference on Security Symposium. SS 2008, USENIX (2008). https:\/\/doi.org\/10.5555\/1496711.1496736","DOI":"10.5555\/1496711.1496736"},{"key":"34_CR37","doi-asserted-by":"publisher","unstructured":"Wang, X., Zhu, S., Zhou, D., Yang, Y.: Droid-AntiRM: taming control flow anti-analysis to support automated dynamic analysis of android malware. In: Proceedings of the 33rd Annual Computer Security Applications Conference (2017). https:\/\/doi.org\/10.1145\/3134600.3134601","DOI":"10.1145\/3134600.3134601"},{"key":"34_CR38","doi-asserted-by":"publisher","unstructured":"Wei, F., Lin, X., Ou, X., Chen, T., Zhang, X.: JN-SAF: precise and efficient NDK\/JNI-aware inter-language static analysis framework for security vetting of android applications with native code. In: Proceedings of the 2018 ACM SIGSAC Conf. on Computer and Communications Security. CCS 2018 (2018). https:\/\/doi.org\/10.1145\/3243734.3243835","DOI":"10.1145\/3243734.3243835"},{"key":"34_CR39","doi-asserted-by":"publisher","DOI":"10.1145\/3183575","author":"F Wei","year":"2018","unstructured":"Wei, F., Roy, S., Ou, X.: Robby: amandroid: a precise and general inter-component data flow analysis framework for security vetting of android apps. ACM Trans. Priv. Secur. (2018). https:\/\/doi.org\/10.1145\/3183575","journal-title":"ACM Trans. Priv. Secur."},{"key":"34_CR40","doi-asserted-by":"publisher","unstructured":"Wong, M.Y., Lie, D.: IntelliDroid: a targeted input generator for the dynamic analysis of android malware. In: Proceedings 2016 Network and Distributed System Security Symposium (2016). https:\/\/doi.org\/10.14722\/ndss.2016.23118","DOI":"10.14722\/ndss.2016.23118"},{"key":"34_CR41","doi-asserted-by":"publisher","unstructured":"Xu, Y., Xu, Z., Chen, B., Song, F., Liu, Y., Liu, T.: Patch based vulnerability matching for binary programs. In: Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis. ISSTA 2020 (2020). https:\/\/doi.org\/10.1145\/3395363.3397361","DOI":"10.1145\/3395363.3397361"},{"key":"34_CR42","doi-asserted-by":"publisher","unstructured":"Xue, L., et al.: NDroid: toward tracking information flows across multiple android contexts. IEEE Trans. Inf. Forensics Secur. (2019). https:\/\/doi.org\/10.1109\/TIFS.2018.2866347","DOI":"10.1109\/TIFS.2018.2866347"},{"key":"34_CR43","unstructured":"Xue, L., Zhou, Y., Chen, T., Luo, X., Gu, G.: Malton: towards on-device non-invasive mobile malware analysis for ART. In: 26th USENIX Security Symposium (USENIX Security 17). USENIX Association (2017)"},{"key":"34_CR44","unstructured":"Yan, L.K., Yin, H.: DroidScope: seamlessly reconstructing the OS and Dalvik semantic views for dynamic android malware analysis. In: 21st USENIX Security Symposium (USENIX Security 12) (2012)"},{"key":"34_CR45","doi-asserted-by":"publisher","unstructured":"Li, Y., Yang, Z., Guo, Y., Chen, X.: DroidBot: a lightweight UI-Guided test input generator for android. In: 2017 IEEE\/ACM 39th International Conference on Software Engineering Companion (2017). https:\/\/doi.org\/10.1109\/ICSE-C.2017.8","DOI":"10.1109\/ICSE-C.2017.8"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2022"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-17143-7_34","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,23]],"date-time":"2022-09-23T04:13:02Z","timestamp":1663906382000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-17143-7_34"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783031171420","9783031171437"],"references-count":45,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-17143-7_34","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"24 September 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Copenhagen","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Denmark","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2022","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 September 2022","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30 September 2022","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2022","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/esorics2022.compute.dtu.dk\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"562","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"104","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"6","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"19% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3.4","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"12","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}