Towards LLM-Enhanced Android Taint Analysis

2026-08-25

AI Summary

研究探讨了使用大型语言模型(LLMs)来改善安卓应用程序中的污点分析问题，通过迭代探索代码和数据流，以解决传统静态工具如FlowDroid在处理复杂框架时遇到的挑战。

Abstract

Taint analysis is a fundamental technique for detecting sensitive data leaks in Android apps. However, traditional static tools, such as FlowDroid, still face well-known challenges due to the complexity of accurately modeling the Android framework. In this paper, we investigate whether off-the-shelf Large Language Models (LLMs) can effectively reason about taint flows in Android apps. Our preliminary approach relies on an agentic interaction strategy, enabling the LLM to iteratively explore code and reason about data flows. We conduct an initial evaluation on the DroidBench benchmark against FlowDroid, where our approach outperforms the baseline: Gemini-3 Flash achieves an F1-score of 0.96, compared to 0.55 for FlowDroid. In particular, we observe improvements in challenging categories such as inter-component communication (0.95 vs. 0.17), implicit flows (0.94 vs. 0.00), and reflection (1.00 vs. 0.50), where FlowDroid typically struggles. On a small set of real-world apps, the LLM-based approach also identifies additional potential data leaks not reported by FlowDroid. These preliminary findings suggest that LLM reasoning may effectively complement traditional static taint analysis, motivating future research on hybrid LLM-enhanced taint analysis pipelines.

Problem

• Taint Analysis
• Android Apps
• Sensitive Data Leaks
• LLMs
• FlowDroid

Innovation

• Large Language Models
• Taint Analysis
• Agentic Interaction Strategy
• Android Framework