1. ProfileDroid: Multi-layer Profiling of Android Applications
Xuetao Wei, Loreno Gomez, Iulian Neamtiu,
and Michalis Faloutsos 
(University of California, Riverside, USA)
Mobicom 2012

2. Introiduction
There is no approach focusing on profilling the behavior of and Android app itself in all its complexity
Mostly on traffic or security issues for personal device information

3. Introiduction Who would be interested in ?
the app developer
the owner of an Android app market
A system administrator
the end user
What properties of app would be profiled?
how apps use resources, expressed in terms of network data and system calls
the types of device resources (e.g., camera, telephony) an app accesses, and whether it is allowed to, and
what entities an app communicates with

4. Overview of Approach Measure and profile apps at four different Layers
static, or app specication
user interaction
operating system
network.

5. Overview of Approach

6. Implementation and Challenge
Static Layer
Analyze the APK file by using apktool
Unpack the APK file to extract Manifest.xml and the bytecode files contained in the /smali

7. Implementation and Challenge
User Layer
Focusing on user-generated events
To gather the data, they use a combination of the logcat and getevent tools of adb
Logcat – system debug , log message from app
Getevent – capture user events from input

8. Implementation and Challenge
Operating System Layer
Android-specific version of strace
Categorize the system calls into four
Filesystem
Network
VM/IPC
miscellaneous

9. Implementation and Challenge
Network Layer
tcpdump

10. Experimental Setup Android Devices App Selection Motorola Droid
Dual Cortex A9
Ginger bread
App Selection

11. Experimental Setup Conducting the experiment
One app on the phone at a time
Capture-and-replay user interaction
Each user ran each app one time for 5 minutes; we capture the user interaction using event logging. Then, using a replay tool we created, each recorded run was replayed back 5 times in the morning and 5 times at night, for a total of 10 runs each per user per app.

12. Analyzing Each Layer
Static Layer
Functionality Usage
Intent Usage

13. Analyzing Each Layer
User Layer

14. Analyzing Each Layer Operating System Layer R/W via file system
R/W via socket
VM&IPC
Series of system calls
MISC
R/W /proc file system

15. Network Layer

16. Network Layer
The origin of trac means the percentage of the network trac that comes from the servers owned by the app provider.
Third-party Traffic
From various ad services and anlytical service

17. Profiling APP
Capturing Multi-layer Intensity
By five number summery

18. Profiling APP Cross-layer Analysis
Network traffic disambiguation ( ex > ads)
Distinguished by user interaction
Application disambiguation
Distinguished by monitoring operating system

19. Profiling APP
Free Versions of Apps Could End Up Costing More Than Their Paid Versions
At the user-layer, Figure 2 shows that most of behaviors are similar between free and paid version of the apps
Differences are visible at the OS layer as well
As shown in Table 4, we find that the majority of the paid apps indeed exhibit dramatically reduced network traffic intensity

20. Profiling APP
Heavy VM&IPC Usage Reveals a Security-Performance Trade-off
Android apps are isolated from the hardware via the VM, and isolated from each other by running on separate VM copies in separate processes with different UIDs.

21. Profiling APP
How Predominant is Google Traffic in the Overall Network Traffic?
Android apps are relying on many Google services such as Google maps, YouTube video, AdMob advertising, Google Analytics, and Google App Engine.

22. Related Work Smartphone Measurements and Profiling
Android Security Related Work

23. Conclusions
Proposed an ensemble of metrics at each layer to capture the essential characteristics of app specication, user activities, OS and network statistics.
Behavior of Android apps are well-captured by the metrics selected in proposed profiling methodology and able to uncover surprising behavioral characteristics.