Implementation and Evaluation of a Static Backwards Data Flow Analysis in FlowDroid

In the last decade, many static taint analysis tools based on IFDS have been proposed. Nearly all of them only have a single analysis direction, with most opting for a forward-directed analysis and some for a backward-directed analysis. In this thesis, we investigate the effect of the analysis direction on the runtime and memory consumption. We extended FlowDroid to feature a backward-directed analysis, which is equally precise as FlowDroid's forward analysis. We evaluated both implementations on DroidBench and 200 real-world apps. The results show that there is a favorable analysis direction for many apps and the right choice can reduce the runtime dramatically

Path-sensitive data flow analysis simplified

Path-sensitive data flow analysis pairs classical data flow analysis with an analysis of feasibility of paths to improve precision. In this paper we propose a framework for path-sensitive backward data flow analysis that is enhanced with an abstraction of the predicate domain. The abstraction is based on a three-valued logic. It follows the strategy that path predicates are simplified if possible (without calling an external predicate solver) and every predicate that could not be reduced to a simple predicate is abstracted to the unknown value, for which the feasibility is undecided. The implementation of the framework scales well and delivers promising results