FlowCog: Context-aware Semantics Extraction and Analysis of Information Flow Leaks in Android Apps
summary
FlowCog extracts flow-level semantics by pairing static data-flow analysis (FlowDroid-based) with a view-dependency walker that finds UI views related to a tainted flow, then pulls text/images (OCR when needed) and converts them into verb–noun pairs via NLP. Classification uses tf-idf vectors with SVM and gradient boosting plus a learning-free word2vec similarity check. Implementation is Java/Python (~16k LOC, ~3k for classifiers), open-source on GitHub, and reports 90.1% precision and 93.1% recall on a 4,500/1,500 app corpus.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:33Motivating Example
- 2:50How To Detect Such Data Flow
- 6:31Data Flow Analysis
- 8:42Semantic Extractor
- 10:57Design Details
- 14:52Implantation
- 16:08Evaluation
- 19:59Conclusion
related talks
22mGo Flow Safe
15mFlowCFL: Generalized Type-Based Reachability Analysis: Graph Reduction and Equivalence of CFL-Based
20mSoK: On the Effectiveness of Control-Flow Integrity in Practice
17mStatic Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android
27mFlowFence: Practical Data Protection for Emerging IoT Application Frameworks
42mVISUALIZING KOTLIN FLOW IN ANDROID
41mTrueseeing: Effective Dataflow Analysis over Dalvik Opcodes
14mCloudFlow: Identifying Security-sensitive Data Flows in Serverless