Chinese Journal of Electronics
Vol.26, No.5, Sept. 2017
Dynamic Loading Vulnerability Detection for
Android Applications Through Ensemble
Learning
∗
YANG Tianchang, CUI Haoliang and NIU Shaozhang
(Beijing Key Lab of Intelligent Telecommunication Software and Multimedia, Beijing University of Posts and
Telecommunications, Beijing 100876, China)
Abstract — Valid authentication and security protec-
tion measures are not provided for external code and re-
sources executed by dynamic loading technology during the
runtime in Android. In this paper, a new method of detect-
ing vulnerabilities related to dynamic loading technology
is proposed. Two phases are included in the detection pro-
cess. Static analysis phase determines the location informa-
tion of the loading point and extracts the feature vector for
each loading procedure. Identification phase classifies the
extracted feature vector by means of constructed multi-
label classification ensemble learning algorithm. According
to the examination result on 4464 Android applications,
37.8% of all applications use the dynamic loading tech-
nology, and more than 12% of total test applications are
detected with related security deficiencies. Experimental
result shows that the detection method can detect vulner-
abilities of dynamic loading effectively and is more com-
prehensive.
Key words — Dynamic loading, Android application,
Vulnerability, Ensemble learning.
I. Introduction
Similar to the dynamic loading way for DLL and lib
file in Windows platform, Android platform also supports
the mechanism of dynamic loading. Loaded object can be
the ‘.so’ libraries developed by C/C++ for dynamic link,
jar package developed by Java, packaged APK or Dex
file, code from remote network. Android dynamic loading
allows applications to achieve external links to resources
at run time with the help of APIs provided by system.
Specifically, Dalvik virtual machine will load the target
into memory at runtime and provide addressable external
interface for the application. Dynamic loading process in
Android as shown in Fig.1.
Fig. 1. Dynamic loading
Dynamic loading can increase the function diversity of
applications, protecting the content for the provider, and
bring great convenience for developers simultaneously. As
is known, libraries can become malicious for modifica-
tions and masquerading, but Android system does not
provide valid authentication and security protection mea-
sures for external loaded resources. Although the loca-
tion of the loaded object and the access permission are
restricted, risks still may be introduced by the loading
process, even malicious code developed by attacker can
be loaded. The technology, dynamic loading of arbitrary
code during run-time, can break through the online and
offline safety inspection. This may lead to incalculable
consequences. As the test result of Ref.[1], by means of
dynamic loading technology malware can not only bypass
the Android sandbox protection mechanism, but also can
avoid the safety inspection of Google Bouncer. Accord-
ing to the survey of Ref.[2], 16% of top 50 applications
in Google store load external code in an unsafe way. To
achieve ulterior purpose, attackers will focus on the anal-
ysis of the defects existing in dynamic loading process.
Therefore, studying the hazards introduced by dynamic
loading technology is of great significance.
∗
Manuscript Received Jan. 9, 2017; Accepted Jan. 26, 2017. This work is supported by The National Natural Science Foundation of
China (No.61370195, No.U1536121).
c
2017 Chinese Institute of Electronics. DOI:10.1049/cje.2017.07.001