android app development

This study presents the first systematic security and privacy assessment of preinstalled applications on mainstream low-cost Android devices in Africa. To address the lack of empirical evidence on such risks, we construct a static analysis framework integrating sensitive permission detection, exposed component identification, and dangerous behavior pattern matching. Applied to 1,544 preinstalled APKs across 14 commercially available devices, our analysis reveals widespread vulnerabilities: 145 apps leak sensitive data; 249 expose critical components (e.g., Activities, Services); 226 execute privileged shell commands; 79 manipulate SMS messages; and 33 support silent installation. Critically, multiple vendor-specific packages were found to persistently transmit device location and unique identifiers (e.g., IMEI, Android ID) to third-party domains. These findings expose systemic, previously overlooked security deficiencies in mobile ecosystems serving low-income markets. The work provides the first large-scale empirical foundation for mobile security governance in emerging economies and delivers a reusable, automated static analysis methodology for scalable preinstalled app auditing.

This paper exposes the covert exploitation of Android wireless scanning SDKs (BLE/WiFi) to harvest device identifiers (AAID), GPS coordinates, and wireless scan data, enabling cross-SDK data sharing and identifier bridging to construct persistent user mobility profiles—severely undermining long-term anonymity. We conduct the first empirical privacy analysis of 52 commercial SDKs, developing an automated pipeline integrating wireless event injection, dynamic instrumentation (Frida/adb), and network traffic capture. Our analysis reveals that 86% of apps integrating these SDKs transmit sensitive data, with multiple major vendors actively engaged in identifier synchronization and cross-app tracking. Key contributions include: (1) empirical validation that identifier bridging systematically breaks anonymity guarantees; and (2) three actionable mitigation strategies—sandbox hardening, strict policy enforcement, and transparent disclosure—to curb such abuses.

This work investigates the effectiveness of recent Android privacy protections against stalkerware and stalkerware’s adaptive evolution. We conduct a large-scale empirical study on contemporary stalkerware samples using static analysis, dynamic behavioral monitoring, permission invocation tracing, and cross-version time-series modeling. Results show that platform security updates significantly degrade certain high-risk tracking capabilities—e.g., background location access and call interception—yet attackers increasingly circumvent restrictions via legitimate API abuse, covert service persistence, and strategic permission combinations. We present the first systematic characterization of stalkerware’s novel evasion paradigm masked by regulatory compliance, challenging the conventional “detect-and-remove” defense paradigm. Our key contributions include: (1) a new proactive defense framework centered on API usage intent inference, runtime permission context modeling, and cross-app behavioral correlation; and (2) empirically grounded design principles for robust anti-stalking mechanisms.

To address the tension between the rapid evolution of mobile security protocols and the scarcity of high-quality encrypted traffic datasets, this paper proposes a reproducible, portable Android application traffic collection system built on Android Virtual Devices (AVDs). The system innovatively integrates mitmproxy with automated SSL/TLS key extraction, enabling dual-mode capture—with and without man-in-the-middle decryption—and incorporates QUIC/TLS protocol parsing alongside DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) analysis. We collected traffic from 80 mainstream Android applications and publicly release the first open dataset accompanied by complete session decryption keys. Empirical analysis reveals that, as of 2025, TLS 1.3 accounts for 90% of TLS connections, QUIC adoption reaches 100%, and DoT has become the dominant DNS encryption mechanism. This work provides critical empirical data and a methodological framework for studying encrypted protocol evolution in mobile environments.

Academic researchers face significant challenges in collecting mobile screen data—including limited access due to proprietary platform restrictions, stringent commercial monopolies, and heightened privacy compliance requirements. Existing open-source frameworks predominantly focus on sensor data and lack robust, privacy-compliant, and flexible mechanisms for capturing screen content. Method: We propose Crepe, the first no-code Android screen data collection tool designed specifically for academic research. It introduces a novel graph-query-based UI structural representation to enable semantic identification and high-precision localization of screen elements. Crepe integrates declarative demonstration learning, on-device processing, and a permission sandbox to ensure informed consent and real-time user opt-out. Contribution/Results: Empirical evaluation across diverse applications demonstrates that Crepe achieves zero-configuration extraction of dynamic text and UI controls with high accuracy, effectively circumventing data monopolies while enabling privacy-preserving screen-content research.

This study addresses the scarcity of large-scale, reproducible, fine-grained data on third-party SDK dependencies in mobile applications, which hinders research into technical ecosystems and privacy infrastructures. The authors construct a public dataset comprising 334,719 app-version observations by combining static APK analysis, code-signing matching, and an automated processing pipeline, leveraging AndroZoo and Exodus Privacy rules to achieve code-level SDK identification. Covering nearly 100,000 distinct applications and 246 SDKs, the dataset enables the construction of an app–SDK bipartite network and maps SDKs to their operating companies, thereby revealing upstream technological control structures. This resource provides a reusable infrastructure for empirical studies on third-party dependencies and privacy practices in the Android ecosystem.

This work addresses the semantic gap in Android system auditing caused by system call event loss under high load and the lack of Binder IPC semantics. The authors propose a whole-system, online tracing solution that requires no modification to the OS or applications, integrating kernel-level eBPF-based system call auditing with in-kernel Binder communication capture. By leveraging framework signature tables extracted via Java reflection and an out-of-process decoding technique, the approach achieves, for the first time on stock Android devices, comprehensive behavior tracing with low overhead and high coverage. Evaluation on a Pixel 9 running Android 16 shows a 33% increase in captured system calls over ftrace, less than 3.6% performance overhead on Geekbench, and successful reconstruction of ten security-critical Binder transactions, effectively bridging the semantic gap while mitigating evasion risks.

This work addresses the complexity of developing edge-to-cloud sensor applications, which typically requires cross-domain collaboration and hinders efficient transformation of raw data into actionable insights. To streamline this process, the authors propose an intent-driven, AI-assisted rapid development methodology that integrates reusable workflow patterns with intelligent configuration, enabling seamless edge adaptation and deployment without code rewriting. Built upon the Pegasus workflow system and deployed on the FABRIC testbed, the approach supports heterogeneous edge resources such as BlueField-3 DPUs and Raspberry Pi devices. Users can construct multi-stage sensing applications within 1–1.5 days, and the framework’s robustness and portability have been validated through real-world deployments in air quality, seismic activity, and soil moisture monitoring scenarios.

This study addresses the challenges in testing Internet of Things (IoT) software, particularly the complexity of external dependencies and insufficient test case effectiveness, which have lacked systematic empirical investigation. It presents the first large-scale analysis of testing practices in open-source IoT projects, integrating assessments of test effectiveness, categorization of testing challenges, and mining of mock usage patterns. The findings reveal that despite the substantial volume of tests, their effectiveness is generally limited, with managing external dependencies emerging as a central difficulty. Moreover, the judicious application of mock objects significantly enhances test coverage and quality. This work establishes the first empirical benchmark for IoT software testing and offers concrete directions for improving testing practices in this domain.