LIReDroid: LLM-Enhanced Test Case Generation for Static Sensitive Behavior Replication

Malicious Android applications often employ covert behaviors to exfiltrate sensitive data, thereby compromising user privacy. Traditional detection techniques predominantly utilize static analysis of the source code to detect such sensitive behaviors, yet they are frequently plagued by elevated false positive rates. While dynamic analysis methods offer greater precision, they contend with the challenge of limited coverage. This paper introduces LIReDroid, a hybrid testing approach that aims to replicate sensitive behaviors identified in static analysis call chains. LIReDroid firstly analyze the application’s static invocation chain. Then LIReDroid devises a prompt word model for the generation of test instructions and injection script code. Ultimately, sensitive API call chains are dynamically invoked through code injection, with their activation being meticulously recorded. We presented preliminary experimental results to substantiate the efficacy of LIReDroid. Given these results, we outline future research directions for LIReDroid.