Publication Type

PhD Dissertation

Publication Date



Mobile systems are generally composed of three layers of software: application layer where third-party applications are installed, framework layer where Application Programming Interfaces (APIs) are exposed, and kernel layer where low-level system operations are executed. In this dissertation, we focus on security and vulnerability analysis of framework and application layers. Security mechanisms, such as Android’s sandbox and permission systems, exist in framework layer, while malware scanners protects application layer. However, there are rooms for improvement in both mechanisms. For instance, Android’s permission system is known to be implemented in ad-hoc manner and not well-tested for vulnerabilities. Application layer also focuses mainly on malware application detection, while different types of harmful applications exist on application markets. This dissertation aims to close these security gaps by performing vulnerability analysis on mobile frameworks and detecting policy-violating applications. As a result of our analysis, we find various framework-level vulnerabilities and we are able to launch serious proof-of-concept attacks on both iOS and Android platforms. We also propose mechanisms for detecting policy-violating applications and camouflaged applications. Our techniques are shown to improve the security of mobile systems and have several impacts on mobile industry.


mobile, security, framework, vulnerability

Degree Awarded

PhD in Information Systems


OS and Networks | Programming Languages and Compilers | Software Engineering


LI, Yingjiu; DENG, Huijie Robert

Research Areas

School of Information Systems (SIS)


Singapore Management University

City or Country


Creative Commons License

Creative Commons Attribution-Noncommercial-No Derivative Works 4.0 License
This work is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 4.0 License.