{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T15:26:01Z","timestamp":1781105161727,"version":"3.54.1"},"reference-count":33,"publisher":"IGI Global Scientific Publishing","issue":"1","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017,1]]},"abstract":"<jats:p>Android stores and users need mechanisms to evaluate whether their applications are secure or not. Although various previous works use data and control flow techniques to evaluate security features of Android applications, this paper extends those works by using Jif to verify compliance of information flow policies. To do so, the authors addressed some challenges that emerge in Android environments, like automatizing generation of Jif labels for Android applications, and defining translations for Java instructions that are not currently supported by the Jif compiler. Results show that a Jif-based analysis is faster and has a better recall than other available mechanisms, but it also has a slightly lower precision. Jif also provides an open source compiler, generates executable code for an application only if such application meets a defined policy, and checks implicit flows which may be relevant for highly sensitive applications.<\/jats:p>","DOI":"10.4018\/ijsse.2017010102","type":"journal-article","created":{"date-parts":[[2017,3,10]],"date-time":"2017-03-10T12:32:43Z","timestamp":1489149163000},"page":"28-42","source":"Crossref","is-referenced-by-count":0,"title":["Jif-Based Verification of Information Flow Policies for Android Apps"],"prefix":"10.4018","volume":"8","author":[{"given":"Lina M.","family":"Jimenez","sequence":"first","affiliation":[{"name":"Systems and Computing Engineering Department, Universidad de los Andes, Bogot\u00e1, Colombia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Martin","family":"Ochoa","sequence":"additional","affiliation":[{"name":"Singapore University of Technology and Design, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sandra J.","family":"Rueda","sequence":"additional","affiliation":[{"name":"Systems and Computing Engineering Department, Universidad de los Andes, Bogot\u00e1, Colombia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"2432","reference":[{"key":"IJSSE.2017010102-0","doi-asserted-by":"crossref","unstructured":"Andriatsimandefitra, R., Geller, S., & Viet Triem Tong, V. (2012). Designing information flow policies for Android's operating system. International Conference on Communications ICC. Android Developers. Retrieved from http:\/\/developer.android.com","DOI":"10.1109\/ICC.2012.6364161"},{"key":"IJSSE.2017010102-1","unstructured":"BBC News. (March, 2012). Mobile firms back new GSMA app privacy guidelines. Retrieved from http:\/\/www.bbc.com\/news\/technology-17178954"},{"key":"IJSSE.2017010102-2","unstructured":"Bhosale, A. (2014). Precise static analysis of taint flow for android application sets [Master\u2019s thesis]. Carnegie Mellon University, Heinz College."},{"key":"IJSSE.2017010102-3","doi-asserted-by":"publisher","DOI":"10.1145\/1554339.1554341"},{"key":"IJSSE.2017010102-4","unstructured":"Chong, S., Myers, A., Vikram, K., & Zheng, L. (2014). Retrieved 2015. Jif: Java + information flow: http:\/\/www.cs.cornell.edu\/jif\/doc\/jif-3.3.0\/language.html#unsupported-java"},{"key":"IJSSE.2017010102-5","doi-asserted-by":"publisher","DOI":"10.1145\/1273463.1273490"},{"key":"IJSSE.2017010102-6","unstructured":"Cornell, J. (s.f.). Jif. Recuperado el 2015, de Jif: Java information flow: www.cs.cornell.edu\/jif"},{"key":"IJSSE.2017010102-7","unstructured":"Enck, W., Gilbert, P., Chun, B., Cox, P., Jung, J., & McDaniel, P., y otros. (2010). Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones. Proceedings of the9th USENIX Symposium on Operating Systems Design and Implementation."},{"key":"IJSSE.2017010102-8","unstructured":"Ernst, M. (2003). Static and dynamic analysis: synergy and duality. Proceedings of the International Conference on Software Engineering (ICSE)Workshop on Dynamic Analysis."},{"key":"IJSSE.2017010102-9","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660343"},{"key":"IJSSE.2017010102-10","unstructured":"Fritz, C. (2013). Flowdroid: A precise and scalable data flow analysis for android. Master\u2019s thesis, Technische Universitat Darmstadt."},{"key":"IJSSE.2017010102-11","doi-asserted-by":"publisher","DOI":"10.1145\/2093328.2093332"},{"key":"IJSSE.2017010102-12","unstructured":"Gartner Inc. (2015a). Gartner Says Smartphone Sales Surpassed One Billion Units in 2014. Retrieved from http:\/\/www.gartner.com\/newsroom\/id\/2996817"},{"key":"IJSSE.2017010102-13","unstructured":"Gartner Inc. (2015b). Gartner Says Worldwide Device Shipments to Grow 1.5 Percent, to Reach 2.5 Billion Units in 2015. Retrieved from http:\/\/www.gartner.com\/newsroom\/id\/3088221"},{"key":"IJSSE.2017010102-14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23089"},{"key":"IJSSE.2017010102-15","unstructured":"Graf, J., Hecker, M., & Mohr, M. (2013). Using joana for information flow control in java programs \u2014 a practical guide. Proceedings of the6th Working Conference on Programming Languages."},{"key":"IJSSE.2017010102-16","unstructured":"Graf, J., Hecker, M., & Mohr, M. (2015). Jodroid: Adding android support to a static information flow control tool. Proceedings of the8th Working Conference on Programming Languages."},{"key":"IJSSE.2017010102-17","unstructured":"GSMA. (2015). Mobile Privacy Initiative. Retrieved from http:\/\/www.gsma.com\/publicpolicy\/mobile-and-privacy\/gsma-mobile-privacy-initiative"},{"key":"IJSSE.2017010102-18","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-009-0086-1"},{"key":"IJSSE.2017010102-19","author":"C.Hammer","year":"2013","journal-title":"Formal characterization of illegal control flow in android system. Signal-Image Technology Internet-Based Systems"},{"key":"IJSSE.2017010102-20","unstructured":"Interacting with java classes. (s.f.). Recuperado el Julio de 2015, de Jif: Java + information flow: http:\/\/www.cs.cornell.edu\/jif\/doc\/jif-3.3.0\/misc.html#java-classes"},{"key":"IJSSE.2017010102-21","article-title":"Dissecting Android Malware","author":"X.Jiang","year":"2012","journal-title":"Characterization and Evolution. Proceedings of the IEEE Symposium on Security and Privacy"},{"key":"IJSSE.2017010102-22","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382223"},{"key":"IJSSE.2017010102-23","doi-asserted-by":"crossref","unstructured":"Myers, A., & Liskov, B. (2000). Protecting Privacy Using the Decentralized Label Model. ACM Trans. Softw. Eng. Methodol.","DOI":"10.1145\/363516.363526"},{"key":"IJSSE.2017010102-24","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23039"},{"key":"IJSSE.2017010102-25","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2014.13"},{"key":"IJSSE.2017010102-26","doi-asserted-by":"crossref","unstructured":"Reps, T., Horwitz, S., & Sagiv, M. (1995). Precise interprocedural dataflow analysis via graph reachability. Proceedings of the 22nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages.","DOI":"10.1145\/199448.199462"},{"key":"IJSSE.2017010102-27","doi-asserted-by":"crossref","unstructured":"Rocha, B., Conti, M., Etalle, S., & Crispo, B. (2013). Hybrid Static-Runtime Information Flow and Declassification Enforcement. IEEE Transactions on Information Forensics and Security, 8(8).","DOI":"10.1109\/TIFS.2013.2267798"},{"key":"IJSSE.2017010102-28","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2002.806121"},{"key":"IJSSE.2017010102-29","unstructured":"Secure Software Engineering Group at EC SPRIDE. (2013). Obtenido de Droidbench \u2013 benchmarks. Retrieved from https:\/\/github.com\/secure-software-engineering\/DroidBench\/blob\/e64bf483949bf4cb91af642a415fadc9c65e4be5\/README.md"},{"key":"IJSSE.2017010102-30","unstructured":"Symantec. (2014). Symantec Security Threat Report."},{"key":"IJSSE.2017010102-31","unstructured":"Symantec. (2015). Symantec Security Threat Report."},{"key":"IJSSE.2017010102-32","doi-asserted-by":"publisher","DOI":"10.1145\/2351676.2351689"}],"container-title":["International Journal of Secure Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.igi-global.com\/viewtitle.aspx?TitleId=179642","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2018,11,13]],"date-time":"2018-11-13T14:20:46Z","timestamp":1542118846000},"score":1,"resource":{"primary":{"URL":"http:\/\/services.igi-global.com\/resolvedoi\/resolve.aspx?doi=10.4018\/IJSSE.2017010102"}},"subtitle":[""],"short-title":[],"issued":{"date-parts":[[2017,1]]},"references-count":33,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.4018\/ijsse.2017010102","relation":{},"ISSN":["1947-3036","1947-3044"],"issn-type":[{"value":"1947-3036","type":"print"},{"value":"1947-3044","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,1]]}}}