Nothing Special   »   [go: up one dir, main page]

skip to main content
research-article

Automatically Detecting Incompatible Android APIs

Published: 23 November 2023 Publication History

Abstract

Fragmentation is a serious problem in the Android ecosystem, which is mainly caused by the fast evolution of the system itself and the various system customizations. Many efforts have attempted to mitigate its impact via approaches to automatically pinpointing compatibility issues in Android apps. We conducted a literature review to identify all the currently available approaches to addressing this issue. Within the nine identified approaches, the four issue detection tools and one incompatible API harvesting tool could be successfully executed. We tried to reproduce them based on their original datasets and then empirically compared those approaches against common datasets. Our experimental results show that existing tool capabilities are quite distinct with only a small overlap in the compatibility issues being identified. Moreover, these detection tools commonly detect compatibility issues via two separate steps including incompatible APIs gathering and compatibility issues (induced by the incorrect invocations of the identified incompatible APIs) determination. To help developers better identify compatibility issues in Android apps, we developed a new approach, AndroMevol, to systematically spot incompatible APIs as they play a crucial role in issue detection. AndroMevol was able to pinpoint 397,678 incompatible APIs against the full history of the official Android framework and 52 customized Android frameworks spanning five popular device manufacturers. Our approach could enhance the ability of the state-of-the-art detection tools by identifying many more incompatible APIs that may cause compatibility issues in Android apps and foster more advanced approaches to pinpointing all types of compatibility issues.

References

[5]
2021. Download Pivot. Retrieved from https://ficissuepivot.github.io/Pivot/
[6]
2021. FicFinder Project Homepage. Retrieved from http://sccpu2.cse.ust.hk/ficfinder/
[7]
[8]
2021. OPPO’s Share of Smartphone Shipments Worldwide. Retrieved from https://www.statista.com/statistics/628545/global-market-share-held-by-oppo-smartphones/
[13]
[14]
2022. Official Android API Reference. Retrieved from https://developer.android.com/reference
[15]
2022. Oppo firmware update site. Retrieved from https://support.oppo.com/au/software-update/
[16]
2022. Sample Size Calculator. Retrieved from https://www.surveysystem.com/sscalc.htm
[17]
2022. Soot Framework. Retrieved from http://soot-oss.github.io/soot/
[18]
2022. Various firmware hosting site. Retrieved from https://firmwarefile.com/
[19]
2022. Xiaomi firmware update site. Retrieved from https://c.mi.com/global/miuidownload/index
[20]
Serge Abiteboul, Richard Hull, and Victor Vianu. 1995. Foundations of Databases. Vol. 8. Addison-Wesley Reading.
[21]
Steven Arzt, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, and Patrick McDaniel. 2014. Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps. ACM SIGPLAN Not. 49, 6 (2014), 259–269.
[22]
Gabriele Bavota, Mario Linares-Vasquez, Carlos Eduardo Bernal-Cardenas, Massimiliano Di Penta, Rocco Oliveto, and Denys Poshyvanyk. 2014. The impact of api change-and fault-proneness on the user ratings of android apps. IEEE Trans. Softw. Eng. 41, 4 (2014), 384–407.
[23]
Eric Bodden. 2012. Inter-procedural data-flow analysis with ifds/ide and soot. In Proceedings of the ACM SIGPLAN International Workshop on State of the Art in Java Program Analysis. 3–8.
[24]
Pearl Brereton, Barbara A. Kitchenham, David Budgen, Mark Turner, and Mohamed Khalil. 2007. Lessons from applying the systematic literature review process within the software engineering domain. J. Syst. Softw. 80, 4 (2007), 571–583.
[25]
Gleison Brito, Andre Hora, Marco Tulio Valente, and Romain Robbes. 2016. Do developers deprecate apis with replacement messages? a large-scale analysis on java systems. In Proceedings of the IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER’16), Vol. 1. IEEE, 360–369.
[26]
Haipeng Cai, Ziyi Zhang, Li Li, and Xiaoqin Fu. 2019. A large-scale study of application incompatibilities in android. In Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis. 216–227.
[27]
Lingchao Chen, Foyzul Hassan, Xiaoyin Wang, and Lingming Zhang. 2020. Taming behavioral backward incompatibilities via cross-project testing and analysis. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering. 112–124.
[28]
Mattia Fazzini, Qi Xin, and Alessandro Orso. 2019. Automated API-usage update for android Apps. In Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis. Association for Computing Machinery, New York, NY, 204–215.
[29]
Jeanne Ferrante, Karl J Ottenstein, and Joe D. Warren. 1987. The program dependence graph and its use in optimization. ACM Trans. Program. Lang. Syst. 9, 3 (1987), 319–349.
[30]
Michael I. Gordon, Deokhwan Kim, Jeff H. Perkins, Limei Gilham, Nguyen Nguyen, and Martin C. Rinard. 2015. Information flow analysis of android applications in droidsafe. In Proceedings of the Network and Distributed System Security Symposium (NDSS’15), Vol. 15. 110.
[31]
Todd J. Green, Molham Aref, and Grigoris Karvounarakis. 2012. Logicblox, platform and language: A tutorial. In Datalog in Academia and Industry: Proceedings of the 2nd International Workshop. Springer, 1–8.
[32]
Dongjie He, Lian Li, Lei Wang, Hengjie Zheng, Guangwei Li, and Jingling Xue. 2018. Understanding and detecting evolution-induced compatibility issues in Android apps. In Proceedings of the 33rd IEEE/ACM International Conference on Automated Software Engineering (ASE’18). IEEE, 167–177.
[33]
André Hora, Romain Robbes, Nicolas Anquetil, Anne Etien, Stéphane Ducasse, and Marco Tulio Valente. 2015. How do developers react to API evolution? The Pharo ecosystem case. In Proceedings of the IEEE International Conference on Software Maintenance and Evolution (ICSME’15). IEEE, 251–260.
[34]
Huaxun Huang, Lili Wei, Yepang Liu, and Shing-Chi Cheung. 2018. Understanding and detecting callback compatibility issues for android applications. In Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering. 532–542.
[35]
Hong Jin Kang, Ferdian Thung, Julia Lawall, Gilles Muller, Lingxiao Jiang, and David Lo. 2019. Semantic patches for Java program transformation (experience report). In Proceedings of the 33rd European Conference on Object-Oriented Programming (ECOOP’19). Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik.
[36]
Staffs Keele et al. 2007. Guidelines for Performing Systematic Literature Reviews in Software Engineering. Technical Report. Citeseer.
[37]
Taeyeon Ki, Chang Min Park, Karthik Dantu, Steven Y. Ko, and Lukasz Ziarek. 2019. Mimic: UI compatibility testing system for Android apps. In Proceedings of the IEEE/ACM 41st International Conference on Software Engineering (ICSE’19). IEEE, 246–256.
[38]
Pingfan Kong, Li Li, Jun Gao, Kui Liu, Tegawendé F Bissyandé, and Jacques Klein. 2018. Automated testing of android apps: A systematic literature review. IEEE Transactions on Reliability 68, 1 (2018), 45–66.
[39]
Julia Lawall and Gilles Muller. 2018. Coccinelle: 10 years of automated evolution in the Linux kernel. In Proceedings of the USENIX Annual Technical Conference (USENIX ATC’18). 601–614.
[40]
Li Li, Alexandre Bartel, Tegawendé F. Bissyandé, Jacques Klein, Yves Le Traon, Steven Arzt, Siegfried Rasthofer, Eric Bodden, Damien Octeau, and Patrick McDaniel. 2015. Iccta: Detecting inter-component privacy leaks in android apps. In Proceedings of the IEEE/ACM 37th IEEE International Conference on Software Engineering, Vol. 1. IEEE, 280–291.
[41]
Li Li, Tegawendé F Bissyandé, and Jacques Klein. 2018. MoonlightBox: Mining android api histories for uncovering release-time inconsistencies. In Proceedings of the 29th IEEE International Symposium on Software Reliability Engineering (ISSRE’18).
[42]
Li Li, Tegawendé F Bissyandé, Yves Le Traon, and Jacques Klein. 2016. Accessing inaccessible android APIs: An empirical study. In Proceedings of the 32nd International Conference on Software Maintenance and Evolution (ICSME’16).
[43]
Li Li, Tegawendé F Bissyandé, Damien Octeau, and Jacques Klein. 2016. DroidRA: Taming reflection to support whole-program analysis of android Apps. In Proceedings of the 2016 International Symposium on Software Testing and Analysis (ISSTA’16).
[44]
Li Li, Tegawendé F Bissyandé, Mike Papadakis, Siegfried Rasthofer, Alexandre Bartel, Damien Octeau, Jacques Klein, and Yves Le Traon. 2017. Static analysis of android Apps: A systematic literature review. Inf. Softw. Technol. (2017).
[45]
Li Li, Tegawendé F Bissyandé, Haoyu Wang, and Jacques Klein. 2018. Cid: Automating the detection of api-related compatibility issues in android apps. In Proceedings of the 27th ACM SIGSOFT International Symposium on Software Testing and Analysis. 153–163.
[46]
Li Li, Jun Gao, Tegawendé F. Bissyandé, Lei Ma, Xin Xia, and Jacques Klein. 2018. Characterising deprecated android apis. In Proceedings of the 15th International Conference on Mining Software Repositories. 254–264.
[47]
Li Li, Jun Gao, Tegawendé F. Bissyandé, Lei Ma, Xin Xia, and Jacques Klein. 2020. Cda: Characterising deprecated android apis. Empir. Softw. Eng. (2020), 1–41.
[48]
Mario Linares-Vásquez, Gabriele Bavota, Carlos Bernal-Cárdenas, Massimiliano Di Penta, Rocco Oliveto, and Denys Poshyvanyk. 2013. API change and fault proneness: A threat to the success of android Apps. In Proceedings of the 9th Joint Meeting on Foundations of Software Engineering. ACM, 477–487.
[49]
Pei Liu, Mattia Fazzini, John Grundy, and Li Li. 2022. Do customized android frameworks keep pace with android? In Proceedings of the 19th International Conference on Mining Software Repositories (MSR’22).
[50]
Pei Liu, Li Li, Yichun Yan, Mattia Fazzini, and John Grundy. 2021. Identifying and characterizing silently-evolved methods in the android API. In Proceedings of the 43rd ACM/IEEE International Conference on Software Engineering, SEIP Track (ICSE-SEIP’21).
[51]
Pei Liu, Yanjie Zhao, Haipeng Cai, Mattia Fazzini, John Grundy, and Li Li. 2022. Automatically detecting api-induced compatibility issues in android Apps: A comparative analysis (replicability studies). In Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA’22).
[52]
Yue Liu, Chakkrit Tantithamthavorn, Li Li, and Yepang Liu. 2021. Deep learning for android malware defenses: A systematic literature review. arXiv:2103.05292. Retrieved from https://arxiv.org/abs/2103.05292
[53]
Tarek Mahmud, Meiru Che, and Guowei Yang. 2021. Android compatibility issue detection using API differences. In Proceedings of the IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER’21). IEEE, 480–490.
[54]
Tyler McDonnell, Baishakhi Ray, and Miryung Kim. 2013. An empirical study of api stability and adoption in the android ecosystem. In Proceedings of the 29th IEEE International Conference on Software Maintenance. IEEE, 70–79.
[55]
Marco Mobilio, Oliviero Riganelli, Daniela Micucci, and Leonardo Mariani. 2020. FILO: FIx-LOcus localization for backward incompatibilities caused by Android framework upgrades. In Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering. 1292–1296.
[56]
Sebastian Nielebock, Paul Blockhaus, Jacob Krüger, and Frank Ortmeier. 2021. AndroidCompass: A dataset of android compatibility checks in code repositories. arXiv:2103.09620. Retrieved from https://arxiv.org/abs/2103.09620
[57]
Lina Qiu, Yingying Wang, and Julia Rubin. 2018. Analyzing the analyzers: Flowdroid/iccta, amandroid, and droidsafe. In Proceedings of the 27th ACM SIGSOFT International Symposium on Software Testing and Analysis. 176–186.
[58]
Romain Robbes, Mircea Lungu, and David Röthlisberger. 2012. How do developers react to API deprecation? The case of a Smalltalk ecosystem. In Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering. 1–11.
[59]
Reudismam Rolim, Gustavo Soares, Loris D’Antoni, Oleksandr Polozov, Sumit Gulwani, Rohit Gheyi, Ryo Suzuki, and Björn Hartmann. 2017. Learning syntactic program transformations from examples. In Proceedings of the IEEE/ACM 39th International Conference on Software Engineering (ICSE’17). IEEE, 404–415.
[60]
Anand Ashok Sawant, Romain Robbes, and Alberto Bacchelli. 2018. On the reaction to deprecation of clients of 4+ 1 popular Java APIs and the JDK. Empir. Softw. Eng. 23, 4 (2018), 2158–2197.
[61]
Simone Scalabrino, Gabriele Bavota, Mario Linares-Vásquez, Michele Lanza, and Rocco Oliveto. 2019. Data-driven solutions to detect api compatibility issues in android: An empirical study. In Proceedings of the IEEE/ACM 16th International Conference on Mining Software Repositories (MSR’19). IEEE, 288–298.
[62]
Simone Scalabrino, Gabriele Bavota, Mario Linares-Vásquez, Valentina Piantadosi, Michele Lanza, and Rocco Oliveto. 2020. API compatibility issues in Android: Causes and effectiveness of data-driven detection techniques. Empir. Softw. Eng. 25, 6 (2020), 5006–5046.
[63]
Md. Shamsujjoha, John Grundy, Li Li, Hourieh Khalajzadeh, and Qinghua Lu. 2021. Developing mobile applications via model driven development: A systematic literature review. Inf. Softw. Technol. (2021).
[64]
Yannis Smaragdakis and Martin Bravenboer. 2011. Using Datalog for fast and easy program analysis. In Datalog Reloaded: Proceedings of the 1st International Workshop (Datalog’10). Springer, 245–251.
[65]
Ting Su, Jue Wang, and Zhendong Su. 2021. Benchmarking automated GUI testing for Android against real-world bugs. In Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 119–130.
[66]
Xiaoyu Sun, Li Li, Tegawendé F. Bissyandé, Jacques Klein, Damien Octeau, and John Grundy. 2020. Taming reflection: An essential step towards whole-program analysis of android Apps. ACM Trans. Softw. Eng. Methodol. (2020).
[67]
Raja Vallée-Rai, Phong Co, Etienne Gagnon, Laurie Hendren, Patrick Lam, and Vijay Sundaresan. 2010. Soot: A Java bytecode optimization framework. In CASCON First Decade High Impact Papers. 214–224.
[68]
Haoyu Wang, Hongxuan Liu, Xusheng Xiao, Guozhu Meng, and Yao Guo. 2019. Characterizing Android app signing issues. In Proceedings of the 34th IEEE/ACM International Conference on Automated Software Engineering (ASE’19). IEEE, 280–292.
[69]
Fengguo Wei, Sankardas Roy, and Xinming Ou. 2014. Amandroid: A precise and general inter-component data flow analysis framework for security vetting of android apps. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. 1329–1341.
[70]
Fengguo Wei, Sankardas Roy, and Xinming Ou. 2018. Amandroid: A precise and general inter-component data flow analysis framework for security vetting of android apps. ACM Trans. Priv. Secur. 21, 3 (2018), 1–32.
[71]
Lili Wei, Yepang Liu, and Shing-Chi Cheung. 2016. Taming Android fragmentation: Characterizing and detecting compatibility issues for Android apps. In Proceedings of the 31st IEEE/ACM International Conference on Automated Software Engineering. 226–237.
[72]
Lili Wei, Yepang Liu, and Shing-Chi Cheung. 2019. Pivot: Learning api-device correlations to facilitate android compatibility issue detection. In Proceedings of the IEEE/ACM 41st International Conference on Software Engineering (ICSE’19). IEEE, 878–888.
[73]
Lili Wei, Yepang Liu, Shing-Chi Cheung, Huaxun Huang, Xuan Lu, and Xuanzhe Liu. 2018. Understanding and detecting fragmentation-induced compatibility issues for android apps. IEEE Trans. Softw. Eng. 46, 11 (2018), 1176–1199.
[74]
Hao Xia, Yuan Zhang, Yingtian Zhou, Xiaoting Chen, Yang Wang, Xiangyu Zhang, Shuaishuai Cui, Geng Hong, Xiaohan Zhang, Min Yang, et al. 2020. How Android developers handle evolution-induced API compatibility issues: A large-scale study. In Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering (ICSE’20). IEEE, 886–898.
[75]
Guowei Yang, Jeffrey Jones, Austin Moninger, and Meiru Che. 2018. How do android operating system updates impact Apps?. In Proceedings of the IEEE/ACM 10th International Conference on Mobile Software Engineering and Systems (MobileSoft’18). ACM, New York, NY, 156–160.
[76]
Shishuai Yang, Rui Li, Jiongyi Chen, Wenrui Diao, and Shanqing Guo. 2022. Demystifying android non-SDK APls: Measurement and understanding. In 2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE’22), IEEE Computer Society, 647–658.
[77]
Shengqian Yang, Dacong Yan, Haowei Wu, Yan Wang, and Atanas Rountev. 2015. Static control-flow analysis of user-driven callbacks in Android applications. In Proceedings of the IEEE/ACM 37th IEEE International Conference on Software Engineering, Vol. 1. IEEE, 89–99.
[78]
Xian Zhan, Tianming Liu, Lingling Fan, Li Li, Sen Chen, Xiapu Luo, and Yang Liu. 2021. Research on third-party libraries in Android Apps: A taxonomy and systematic literature review. IEEE Trans. Softw. Eng. (2021).
[79]
Yanjie Zhao, Li Li, Kui Liu, and John Grundy. 2022. Towards automatically repairing compatibility issues in published android Apps. In Proceedings of the 44th International Conference on Software Engineering (ICSE’22).
[80]
Jing Zhou and Robert J. Walker. 2016. API deprecation: A retrospective analysis and detection method for code examples on the web. In Proceedings of the 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering. 266–277.

Cited By

View all
  • (2025)Testing infrastructures to support mobile application testing: A systematic mapping studyInformation and Software Technology10.1016/j.infsof.2024.107573177(107573)Online publication date: Jan-2025
  • (2023)Potential Risks Arising from the Absence of Signature Verification in Miniapp PluginsProceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps10.1145/3605762.3624433(59-64)Online publication date: 26-Nov-2023

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image ACM Transactions on Software Engineering and Methodology
ACM Transactions on Software Engineering and Methodology  Volume 33, Issue 1
January 2024
933 pages
EISSN:1557-7392
DOI:10.1145/3613536
  • Editor:
  • Mauro Pezzè
Issue’s Table of Contents

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 23 November 2023
Online AM: 18 September 2023
Accepted: 10 July 2023
Revised: 27 June 2023
Received: 06 August 2022
Published in TOSEM Volume 33, Issue 1

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Fragmentation
  2. compatibility issue
  3. Android frameworks

Qualifiers

  • Research-article

Funding Sources

  • Australian Research Council (ARC) under a Laureate Fellowship project
  • Discovery Early Career Researcher Award (DECRA) project
  • Discovery project

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)328
  • Downloads (Last 6 weeks)42
Reflects downloads up to 16 Dec 2024

Other Metrics

Citations

Cited By

View all
  • (2025)Testing infrastructures to support mobile application testing: A systematic mapping studyInformation and Software Technology10.1016/j.infsof.2024.107573177(107573)Online publication date: Jan-2025
  • (2023)Potential Risks Arising from the Absence of Signature Verification in Miniapp PluginsProceedings of the 2023 ACM Workshop on Secure and Trustworthy Superapps10.1145/3605762.3624433(59-64)Online publication date: 26-Nov-2023

View Options

Login options

Full Access

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Full Text

View this article in Full Text.

Full Text

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media