Publikationen

Autor	Alecci, Marco; Samhi, Jordan; Miltenberger, Marc; Arzt, Steven; Bissyandé, Tegawendé F.; Klein, Jacques
Datum	2026
Art	Journal Article
Abstrakt	Taint analysis is a widely used technique to analyze Android apps, enabling the tracking of data flow within an app. A key step consists in identifying which methods act as SOURCEs (i.e., where a data of interest originates) and SINKs (where data might be exposed). Existing approaches typically fall into two categories: ➀ Handcrafted lists, which suffer from incompleteness and quickly become outdated; and ➁ Automated techniques, which, although scalable, over-approximate and produce many false positives, primarily due to the challenge of defining what qualifies as a SOURCE. While identifying SINKs is generally more straightforward (as they correspond to explicit exposure points), defining a universal criterion for what constitutes a SOURCE remains inherently challenging. For example, isMicrophoneMute() may not typically be considered a SOURCE, yet in specific contexts it could represent a significant privacy concern. This context dependence highlights the limitations of static, generic lists of SOURCE methods. We present TaskFlow, a novel LLM-driven framework for generating task-specific lists of SOURCE (or SINK) methods aligned with specific analysis goals. By reasoning over API semantics and contextual usage, TaskFlow ➀ mitigates the noise commonly introduced by overly broad lists, leading to more precise taint analyses; and ➁ addresses the incompleteness of manual approaches.
Publisher	Association for Computing Machinery (ACM)
Url	https://publica.fraunhofer.de/handle/publica/520971