Code Coverage Measurement for Android Dynamic Analysis Tools

It is common to inspect an Android application using static or dynamic analysis techniques. Most traditional tools adopt static analysis techniques due to its low cost and high performance properties. However, since an inspected target could be obfuscated, it is also common to work with dynamic analysis techniques so that complete runtime information can be obtained to provide in-depth application behavior. Although there are already a lot of tools based on dynamic analysis techniques, the capability of such a tool is unknown. It is straightforward to understand the capability of a dynamic analysis tool by measuring its code coverage. However, to our knowledge, there is not a universal approach for measuring code coverage for all dynamic analysis tools, especially when a tool is only accessible remotely. In this paper, we propose an approach to measure code coverage for dynamic analysis tools. We design and implement the approach to measure code coverage for both online and off-line dynamic analysis tools. We then pick online tools including ABM, Anubis, Copper Droid, Tracedroid, as well as off-line tools including standard Android emulator, Droid Box, and Droid Scope. Our measurement results show that the average coverage rate for each tool lies between 20% and 60%.We believe that our approach can provide more information for researchers and developers to better understand and improve the capability of dynamic analysis techniques.