PerformanceBoosting Sparsification of the IFDS Algorithm with Applications to Taint Analysis The IFDS algorithm can be computeand memoryintensive for some large programs, often running for a long time (more than expected) or terminating prematurely after some time andor memory budgets have been exhausted. In the latter case, the corresponding IFDS dataflow analyses may suffer from false negatives andor false positives. To improve this, we introduce a sparse alternative to the traditional IFDS algorithm. Instead of propagating the dataflow facts across all the program points along the programxe2x80x99s (interprocedural) control flow graph, we propagate every dataflow fact directly to its next possible use points along its own sparse control flow graph constructed on the fly, thus reducing significantly both the time and memory requirements incurred by the traditional IFDS algorithm. In our evaluation, we compare FLOWDROID, a taint analysis performed by using the traditional IFDS algorithm, with our sparse incarnation, SPARSEDROID, on a set of 40 Android apps selected. For the time budget (5 hours) and memory budget (220GB) allocated per app, SPARSEDROID can run every app to completion but FLOWDROID terminates prematurely for 9 apps, resulting in an average speedup of 22.0x. This implies that when used as a marketlevel vetting tool, SPARSEDROID can finish analyzing these 40 apps in 2.13 hours (by issuing 228 leak warnings) while FLOWDROID manages to analyze only 30 apps in the same time period (by issuing only 147 leak warnings).

KerTSDroid: Detecting Android Malware at Scale through Kernel Task Structures The explosive growth of data makes static and dynamic analysis in an individual machine difficult to detect Android malware. Hence many popular opensource frameworks for largescale data processing have been used to deal with iterative machine learning tasks due to the efficient parallel computation and the inmemory abstraction. In this paper we first propose KerTSDroid, a novel Android malware detection framework, to predict the malicious applications in parallel through kernel task structures in Android kernel layer. Then a data provider is orchestrated and implemented to construct the realworld dataset of 112 kernel features from 12,750 Android applications. A parallel predictor is also provided to identify Android malicious applications. Our experiments demonstrate that a Decision Tree method of KerTSDroid can achieve the best precision rate (96%99%) with a lower overhead on average, the other three methods (Naive Bayes, Logistic Regression, and Support Vector Machine) lead to lower precision rate while discriminating abnormal behaviors with the inmemory paralleldata.