{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T10:09:12Z","timestamp":1779098952363,"version":"3.51.4"},"reference-count":53,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2019,10,22]],"date-time":"2019-10-22T00:00:00Z","timestamp":1571702400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>The security of mobile applications has become a major research field which is associated with a lot of challenges. The high rate of developing mobile applications has resulted in less secure applications. This is due to what is called the \u201crush to release\u201d as defined by Ponemon Institute. Security testing\u2014which is considered one of the main phases of the development life cycle\u2014is either not performed or given minimal time; hence, there is a need for security testing automation. One of the techniques used is Automated Vulnerability Detection. Vulnerability detection is one of the security tests that aims at pinpointing potential security leaks. Fixing those leaks results in protecting smart-phones and tablet mobile device users against attacks. This paper focuses on building a hybrid approach of static and dynamic analysis for detecting the vulnerabilities of Android applications. This approach is capsuled in a usable platform (web application) to make it easy to use for both public users and professional developers. Static analysis, on one hand, performs code analysis. It does not require running the application to detect vulnerabilities. Dynamic analysis, on the other hand, detects the vulnerabilities that are dependent on the run-time behaviour of the application and cannot be detected using static analysis. The model is evaluated against different applications with different security vulnerabilities. Compared with other detection platforms, our model detects information leaks as well as insecure network requests alongside other commonly detected flaws that harm users\u2019 privacy. The code is available through a GitHub repository for public contribution.<\/jats:p>","DOI":"10.3390\/info10100326","type":"journal-article","created":{"date-parts":[[2019,10,23]],"date-time":"2019-10-23T11:46:59Z","timestamp":1571831219000},"page":"326","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":41,"title":["AndroShield: Automated Android Applications Vulnerability Detection, a Hybrid Static and Dynamic Analysis Approach"],"prefix":"10.3390","volume":"10","author":[{"given":"Amr","family":"Amin","sequence":"first","affiliation":[{"name":"Faculty of Computer &amp; Information Sciences, Ain Shams University, Cairo 11566, Egypt"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Amgad","family":"Eldessouki","sequence":"additional","affiliation":[{"name":"Faculty of Computer &amp; Information Sciences, Ain Shams University, Cairo 11566, Egypt"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Menna Tullah","family":"Magdy","sequence":"additional","affiliation":[{"name":"Faculty of Computer &amp; Information Sciences, Ain Shams University, Cairo 11566, Egypt"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2748-5055","authenticated-orcid":false,"given":"Nouran","family":"Abdeen","sequence":"additional","affiliation":[{"name":"Faculty of Computer &amp; Information Sciences, Ain Shams University, Cairo 11566, Egypt"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5195-8193","authenticated-orcid":false,"given":"Hanan","family":"Hindy","sequence":"additional","affiliation":[{"name":"Faculty of Computer &amp; Information Sciences, Ain Shams University, Cairo 11566, Egypt"},{"name":"Division of Cyber-Security, Abertay University, Dundee DD1 1HG, UK"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1572-463X","authenticated-orcid":false,"given":"Islam","family":"Hegazy","sequence":"additional","affiliation":[{"name":"Faculty of Computer &amp; Information Sciences, Ain Shams University, Cairo 11566, Egypt"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2019,10,22]]},"reference":[{"key":"ref_1","unstructured":"Clement, J. (2019, October 12). Annual number of mobile app downloads worldwide 2018 | Statista. Available online: https:\/\/www.statista.com\/statistics\/271644\/worldwide-free-and-paid-mobile-app-store-downloads\/."},{"key":"ref_2","unstructured":"Ponemon Institute, LLC (2015). The State of Mobile Application Insecurity, Ponemon Institute, Sponsored by IBM. Technical Report."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Wang, X., Zhu, S., Zhou, D., and Yang, Y. (2017, January 4\u20138). Droid-AntiRM: Taming Control Flow Anti-analysis to Support Automated Dynamic Analysis of Android Malware. Proceedings of the 33rd Annual Computer Security Applications Conference, Orlando, FL, USA.","DOI":"10.1145\/3134600.3134601"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1016\/j.infsof.2017.04.001","article-title":"Static analysis of android apps: A systematic literature review","volume":"88","author":"Li","year":"2017","journal-title":"Inf. Softw. Technol."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Meng, Z., Xiong, Y., Huang, W., Miao, F., Jung, T., and Huang, J. (2018). Divide and Conquer: Recovering Contextual Information of Behaviors in Android Apps around Limited-quantity Audit Logs. arXiv.","DOI":"10.1109\/ICSE-Companion.2019.00089"},{"key":"ref_6","first-page":"14","article-title":"Amandroid: A precise and general inter-component data flow analysis framework for security vetting of Android apps","volume":"21","author":"Wei","year":"2018","journal-title":"ACM Trans. Priv. Secur. (TOPS)"},{"key":"ref_7","unstructured":"Dean, J., Grove, D., and Chambers, C. (1995, January 7\u201311). Optimization of object-oriented programs using static class hierarchy analysis. Proceedings of the European Conference on Object-Oriented Programming, \u00c5arhus, Denmark."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"324","DOI":"10.1145\/236338.236371","article-title":"Fast static analysis of C++ virtual function calls","volume":"31","author":"Bacon","year":"1996","journal-title":"ACM Sigplan Not."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Sundaresan, V., Hendren, L., Razafimahefa, C., Vall\u00e9e-Rai, R., Lam, P., Gagnon, E., and Godin, C. (2000). Practical Virtual Method Call Resolution for Java, ACM.","DOI":"10.1145\/353171.353189"},{"key":"ref_10","unstructured":"Andersen, L.O. (1994). Program Analysis and Specialization for the C Programming Language. [Ph.D. Thesis, University of Cophenhagen]."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Steensgaard, B. (1996, January 21\u201324). Points-to analysis in almost linear time. Proceedings of the 23rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, St. Petersburg Beach, FL, USA.","DOI":"10.1145\/237721.237727"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Mohanty, H., Mohanty, J., and Balakrishnan, A. (2017). Trends in Software Testing, Springer.","DOI":"10.1007\/978-981-10-1415-4"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Mahmood, R., Esfahani, N., Kacem, T., Mirzaei, N., Malek, S., and Stavrou, A. (2012, January 2\u20133). A whitebox approach for automated security testing of Android applications on the cloud. Proceedings of the 7th International Workshop on Automation of Software Test, Zurich, Switzerland.","DOI":"10.1109\/IWAST.2012.6228986"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Godefroid, P., Kiezun, A., and Levin, M.Y. (2008, January 7\u201313). Grammar-based Whitebox Fuzzing. Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation, Tucson, AZ, USA.","DOI":"10.1145\/1375581.1375607"},{"key":"ref_15","unstructured":"Edalat, E., Sadeghiyan, B., and Ghassemi, F. (2018). ConsiDroid: A Concolic-based Tool for Detecting SQL Injection Vulnerability in Android Apps. arXiv."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Majumdar, R., and Sen, K. (2007). Hybrid Concolic Testing. Proceedings of the 29th International Conference on Software Engineering, IEEE Computer Society.","DOI":"10.1109\/ICSE.2007.41"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"McMinn, P. (2011). Search-Based Software Testing: Past, Present and Future. Proceedings of the 2011 IEEE Fourth International Conference on Software Testing, Verification and Validation Workshops, Berlin, Germany, 21\u201325 March 2011, IEEE Computer Society.","DOI":"10.1109\/ICSTW.2011.100"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Rasthofer, S., Arzt, S., and Bodden, E. (2014, January 23\u201326). A Machine-Learning Approach for Classifying and Categorizing Android Sources and Sinks. Proceedings of the 2014 Network and Distributed System Security (NDSS) Symposium, NDSS 2014, San Diego, CA, USA.","DOI":"10.14722\/ndss.2014.23039"},{"key":"ref_19","unstructured":"Ostorlab (2019, October 12). Ostorlab - Continuous Mobile Application Security Testing. Available online: https:\/\/www.ostorlab.co\/."},{"key":"ref_20","unstructured":"LinkedIn (2018, December 06). Tool to Look for Several Security Related Android Application Vulnerabilities. Available online: https:\/\/github.com\/linkedin\/qark."},{"key":"ref_21","unstructured":"Group, S.R. (2018, November 20). Soot\u2014A Java Optimization Framework. Available online: https:\/\/github.com\/Sable\/soot."},{"key":"ref_22","unstructured":"Acpm (2018, December 06). Inspeckage: Android Package Inspector\u2014Dynamic Analysis with Api Hooks, Start Unexported Activities and More. Available online: https:\/\/github.com\/ac-pm\/Inspeckage."},{"key":"ref_23","unstructured":"Tungstwenty, and Rovo89 (2019, October 12). Xposed Module Repository. Available online: https:\/\/repo.xposed.info\/module\/de.robv.android.xposed.installer."},{"key":"ref_24","unstructured":"Tumbleson, C., and Wi\u015bniewski, R. (2018, December 06). Apktool\u2014A Tool for Reverse Engineering 3rd Party, Closed, Binary Android Apps. Available online: https:\/\/ibotpeaches.github.io\/Apktool\/."},{"key":"ref_25","unstructured":"Gruver, B. (2018, December 06). Smali: Smali\/Baksmali. Available online: https:\/\/github.com\/JesusFreke\/smali."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Deshotels, L., Notani, V., and Lakhotia, A. (2014). DroidLegacy: Automated Familial Classification of Android Malware. Proceedings of ACM SIGPLAN on Program Protection and Reverse Engineering Workshop, San Diego, CA, USA, 22\u201324 January 2014, ACM.","DOI":"10.1145\/2556464.2556467"},{"key":"ref_27","unstructured":"Group, S.S.E. (2018, November 20). FlowDroid: FlowDroid Static Data Flow Tracker. Available online: https:\/\/github.com\/secure-software-engineering\/FlowDroid."},{"key":"ref_28","unstructured":"Li, L. (2018, December 06). Soot-Infoflow-Android-Iccta: Inter-Component Communication Taint Analysis for Android. Available online: https:\/\/github.com\/lilicoding\/soot-infoflow-android-iccta."},{"key":"ref_29","unstructured":"Flankerhqd (2018, December 06). JAADAS: Joint Advanced Defect Assesment for Android Applications. Available online: https:\/\/github.com\/flankerhqd\/JAADAS."},{"key":"ref_30","unstructured":"Androguard (2018, December 06). Reverse Engineering, Malware and Goodware Analysis of Android Applications \u2026 and More (ninja !). Available online: https:\/\/github.com\/androguard\/androguard."},{"key":"ref_31","unstructured":"Framework, M.S. (2018, December 06). MobSF. Available online: https:\/\/github.com\/MobSF\/Mobile-Security-Framework-MobSF."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Au, K.W.Y., Zhou, Y.F., Huang, Z., and Lie, D. (2012, January 16\u201318). Pscout: Analyzing the android permission specification. Proceedings of the 2012 ACM Conference on Computer and Communications Security, Raleigh, NC, USA.","DOI":"10.1145\/2382196.2382222"},{"key":"ref_33","unstructured":"TACIXAT (2018, December 06). CFGScanDroid: Control Flow Graph Scanning for Android. Available online: https:\/\/github.com\/TACIXAT\/CFGScanDroid."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Li, L., Bissyand\u00e9, T.F., Octeau, D., and Klein, J. (2016, January 18\u201320). DroidRA: Taming Reflection to Support Whole-Program Analysis of Android Apps. Proceedings of the The 2016 International Symposium on Software Testing and Analysis (ISSTA 2016), Saarbr\u00fccken, Germany.","DOI":"10.1145\/2931037.2931044"},{"key":"ref_35","unstructured":"Maldroid (2018, December 06). Maldrolyzer: Simple Framework to Extract \u201cActionable\u201d Data from Android Malware (C&Cs, Phone Numbers etc.). Available online: https:\/\/github.com\/maldroid\/maldrolyzer."},{"key":"ref_36","unstructured":"Merlo, A., and Georgiu, G.C. (2017). RiskInDroid: Machine Learning-Based Risk Analysis on Android. Proceedings of the ICT Systems Security and Privacy Protection: 32nd IFIP TC 11 International Conference, SEC 2017, Rome, Italy, 29\u201331 May 2017, Springer."},{"key":"ref_37","unstructured":"Debize, T. (2018, December 06). Androwarn: Yet Another Static Code Analyzer for Malicious Android Applications. Available online: https:\/\/github.com\/maaaaz\/androwarn."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Rastogi, V., Chen, Y., and Enck, W. (2013, January 18\u201320). AppsPlayground: Automatic security analysis of smartphone applications. Proceedings of the third ACM conference on Data and Application Security and Privacy, San Antonio, TX, USA.","DOI":"10.1145\/2435349.2435379"},{"key":"ref_39","unstructured":"XposedBridge (2018, December 06). The Java Part of the Xposed Framework. Available online: https:\/\/github.com\/rovo89\/XposedBridge."},{"key":"ref_40","unstructured":"Idanr (2018, December 06). CuckooDroid\u2014Automated Android Malware Analysis with Cuckoo Sandbox. Available online: https:\/\/github.com\/idanr1986\/cuckoo-droid."},{"key":"ref_41","unstructured":"Sandbox, C. (2018, December 06). Automated Malware Analysis. Available online: https:\/\/cuckoosandbox.org\/."},{"key":"ref_42","unstructured":"Developers, A. (2018, November 20). Apkanalyzer. Available online: https:\/\/developer.android.com\/studio\/command-line\/apkanalyzer."},{"key":"ref_43","unstructured":"Group, S.S.E. (2018, November 20). SuSi: SuSi\u2014Our Tool to Automatically Discover Sources and Sinks in the Android Framework. Available online: https:\/\/github.com\/secure-software-engineering\/SuSi."},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A., Klein, J., Le Traon, Y., Octeau, D., and McDaniel, P. (2014). Flowdroid: Precise Context, Flow, Field, Object-Sensitive and Lifecycle-Aware Taint Analysis for Android Apps, ACM. ACM Sigplan Notices.","DOI":"10.1145\/2594291.2594299"},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Reps, T., Horwitz, S., and Sagiv, M. (1995, January 23\u201325). Precise interprocedural dataflow analysis via graph reachability. Proceedings of the 22nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, San Francisco, CA, USA.","DOI":"10.1145\/199448.199462"},{"key":"ref_46","unstructured":"Bauerei\u00df, T., Greiner, S., Herda, M., Kirsten, M., Li, X., Mantel, H., Mohr, M., Perner, M., Schneider, D., and Tasch, M. (2017). RIFL 1.1: A Common Specification Language for Information-Flow Requirements, TU Darmstadt. Technical Report, Technical report TUD-CS-2017-0225."},{"key":"ref_47","unstructured":"Gu, J., and Shen, S. (2019, October 09). CVE-2017-0780: Denial-of-Service Vulnerability Can Crash Android Messages App\u2014TrendLabs Security Intelligence Blog, Mobile Threat Response Team. Available online: https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/cve-2017-0780-denial-service-vulnerability-android-messages-app\/."},{"key":"ref_48","unstructured":"HackingLoops (2019, October 12). Android Exploitation Bypassing Android Permission Model. Available online: https:\/\/www.hackingloops.com\/android-exploitation-bypassing-android-permission-model\/."},{"key":"ref_49","unstructured":"Melamed, T. (2019, October 10). Hacking Android Apps Through Exposed Components. Available online: https:\/\/www.linkedin.com\/pulse\/hacking-android-apps-through-exposed-components-tal-melamed\/."},{"key":"ref_50","unstructured":"Developers, A. (2018, November 20). Android Debug Bridge (adb). Available online: https:\/\/developer.android.com\/studio\/command-line\/adb."},{"key":"ref_51","unstructured":"Project, T.H. (2018, November 20). Droidbot: A Lightweight Test Input Generator for Android. Similar to Monkey, But with More Intelligence and Cool Features!. Available online: https:\/\/github.com\/honeynet\/droidbot."},{"key":"ref_52","unstructured":"Wikipedia (2018, November 20). Strace. Available online: https:\/\/en.wikipedia.org\/wiki\/Strace."},{"key":"ref_53","unstructured":"Fritz, C., Arzt, S., and Rasthofer, S. (2019, October 08). DroidBench: A micro-Benchmark Suite to Assess the Stability of Taint-Analysis Tools for Android. Secure Software Engineering Group at Paderborn University and Fraunhofer IEM. Available online: https:\/\/github.com\/secure-software-engineering\/DroidBench."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/10\/10\/326\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T13:28:22Z","timestamp":1760189302000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/10\/10\/326"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,10,22]]},"references-count":53,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2019,10]]}},"alternative-id":["info10100326"],"URL":"https:\/\/doi.org\/10.3390\/info10100326","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,10,22]]}}}