PiPLAnD's architecture

PiPLAnD: A Pipeline for inspecting Pre-installed apps in Low-cost Android Devices used in Africa.

PiPLAnD's description

Phase 1: Extraction of the pre-installed apps

Usage:

cd src/
python3 mainFile.py

Phase 2: Analysis of the APK files

This phase is structured in three (3) independent modules.

Module 1: Data leak detection

Step 1: Identifying apps accessing the Internet (Internet apps)

cd src/module/
python3 appAccessInternet.py

You will get a file named InternetApps.txt as a result. See an example in the report/Infinixs/Infinix X6525/File_Intrenet folder.

Step 2: Extracting methods from Internet apps

python3 extractMethods.py

This Python program will extract methods from the Internet apps based on the InternetApps.txt file. As results, you will have, for each Internet app, a file containing methods. See examples in the report/Infinixs/Infinix X6525/Methods from Internet apps folder.

Step 3: Grouping the methods in a single file

python3 method_only.py

You will have a CSV file named androidMethods.csv as a result. See an example in the report/Infinixs/Infinix X6525 folder.

Step 4: Categorizing methods as Sources/Sinks with LLM

The androidMethods.csv file will be given to the LLM for Source and Sink labelling

cd src/module/LabellingSourceSinks/1_Code/AndroidMethodsLabelling
python3 labellingNotebook.py

Tips:

• Use a virtual environment before running the program.
• Read the README file in the src/module/LabellingSourceSinks folder for more information

Step 5: After having the complete list of Sources and Sinks, run the FlowDroid analyzer:

cd src/module
python3 flowDroid.py

Module 2: Suspicious behaviors

Usage:

cd src/module/MaliciousBehaviour
python3 malBahavAnalysis2.py

Module 3: Exported sensitive components

Step 1: Identifying all the exported components from the pre-installed apps

cd src/module/ExportedSensitiveComponent
python3 all_exported_comp.py

Step 2: Identifying the exported components without security protection (no permissions)

python3 exported_components_no_permission.py

On Mac OS:

javac -cp ".:json-simple-1.1.1.jar:soot-4.3.0-jar-with-dependencies.jar" CallGraphAnalysis.java
java -cp ".:json-simple-1.1.1.jar:soot-4.3.0-jar-with-dependencies.jar" CallGraphAnalysis

On Windows:

javac -cp ".;json-simple-1.1.1.jar;soot-4.3.0-jar-with-dependencies.jar" CallGraphAnalysis.java
java -cp ".;json-simple-1.1.1.jar;soot-4.3.0-jar-with-dependencies.jar" CallGraphAnalysis