Optimizing native analysis with android container

Abstract

Demystifying an Android shared library is always a challenging task. In order to inspect a native shared library, analyzers have to execute the application that will load the target library on runtime. Executing the whole application code for the purpose of debugging only a single native library is a waste of computing resource. To solve that problem, we consider deploying Java virtual machine only for hosting the target library a promising approach. Java virtual machine is designed to support both Dalvik and ART runtime. Other contribution is the design of a suitable environment for hosting Java virtual machine. Since the deployment of an Android environment, from either by using virtualized or real devices, is either too costly for virtualization approach or waste of resources in real device. For optimizing computing and hardware resources, the authors have proposed a lightweight environment that suitable for native analysis that based on container technology. Compare to virtualization technology, containerization has the performance advantage. Container technology also a better option than the use of real device since it could provide more than one Android containers at the same time with the same device. The implementation results have shown results from running native analysis on multiple runtime and in different Android version. Because a full Android environment is too heavy for a lightweight sandbox like Java virtual machine, we have stripped most of the components and provide only components that are related to analysis work. The result provided from our experiment shows that stripped Android container has a significant improvement in performance compared with other solutions.