  Today's mobile platforms provide only coarse-grained permissions to users
with regard to how third- party applications use sensitive private data.
Unfortunately, it is easy to disguise malware within the boundaries of
legitimately-granted permissions. For instance, granting access to "contacts"
and "internet" may be necessary for a text-messaging application to function,
even though the user does not want contacts transmitted over the internet. To
understand fine-grained application use of permissions, we need to statically
analyze their behavior. Even then, malware detection faces three hurdles: (1)
analyses may be prohibitively expensive, (2) automated analyses can only find
behaviors that they are designed to find, and (3) the maliciousness of any
given behavior is application-dependent and subject to human judgment. To
remedy these issues, we propose semantic-based program analysis, with a human
in the loop as an alternative approach to malware detection. In particular, our
analysis allows analyst-crafted semantic predicates to search and filter
analysis results. Human-oriented semantic-based program analysis can
systematically, quickly and concisely characterize the behaviors of mobile
applications. We describe a tool that provides analysts with a library of the
semantic predicates and the ability to dynamically trade speed and precision.
It also provides analysts the ability to statically inspect details of every
suspicious state of (abstract) execution in order to make a ruling as to
whether or not the behavior is truly malicious with respect to the intent of
the application. In addition, permission and profiling reports are generated to
aid analysts in identifying common malicious behaviors.
