Mobile App Analysis in the New Era: Challenges and the Road Ahead
arXiv:2610.17872 · doi:10.1145/3819579
Abstract
Mobile applications (apps) have grown into complex, multi-platform systems that support diverse services and operate within varying regulatory and distribution contexts. Traditional analysis techniques have established a strong foundation for ensuring quality, security, and compliance, but face increasing challenges as mobile apps evolve. This article presents a three-layer perspective to examine these challenges. The Artifact Layer highlights how heterogeneous code bases and protection mechanisms reduce the analyzability of packaged apps. The Runtime Layer addresses growing execution complexity, from multi-modal interactions and super-app architectures to AI-driven autonomous operations. The Ecosystem Layer considers broader contexts, including emerging platforms, fragmented distribution channels, and region-specific regulatory requirements. New characteristics across these layers interact and compound, creating difficulties that existing approaches are not designed to handle. For each layer, we identify key challenges and potential research directions, including framework-aware analysis, adaptive testing, and policy-aware compliance verification. We also discuss how large language models bring new analytical capabilities to the field, while their integration into apps raises new security and privacy concerns. This article aims to clarify where established methods fall short and highlight directions for future research in this evolving field.
35 pages. Minor correction: removed a sentence in Section 6.1.1 that contains an incorrect citation
References in corpus (65)
- Universal and Transferable Adversarial Attacks on Aligned Language Models
- Large Language Models for Software Engineering: A Systematic Literature Review
- Prompt Injection attack against LLM-integrated Applications
- AppPoet: Large Language Model based Android malware detection via multi-view prompt engineering
- LLM4Decompile: Decompiling Binary Code with Large Language Models
- "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models
- Large Language Models for Software Engineering: Survey and Open Problems
- Feedback-Driven Automated Whole Bug Report Reproduction for Android Apps
- Large Language Model-Based Agents for Software Engineering: A Survey
- Mobile-Agent: Autonomous Multi-Modal Mobile Device Agent with Visual Perception
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models
- AppAgent: Multimodal Agents as Smartphone Users
- Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents
- A Comprehensive Survey of Agents for Computer Use: Foundations, Challenges, and Future Directions
- Black-box Adversarial Example Attack towards FCG Based Android Malware Detection under Incomplete Feature Information
- XUAT-Copilot: Multi-Agent Collaborative System for Automated User Acceptance Testing with Large Language Model
- GUI Test Migration via Abstraction and Concretization
- Large Language Models for Mobile GUI Text Input Generation: An Empirical Study
- Measuring the Leakage and Exploitability of Authentication Secrets in Super-apps: The WeChat Case
- Make LLM a Testing Expert: Bringing Human-like Interaction to Mobile GUI Testing via Functionality-aware Decisions
- Testing the Limits: Unusual Text Inputs Generation for Mobile App Crash Detection with Large Language Model
- Signed-Prompt: A New Approach to Prevent Prompt Injection Attacks Against LLM-Integrated Applications
- On the (In)Security of LLM App Stores
- Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories
- Mobile-Agent-E: Self-Evolving Mobile Assistant for Complex Tasks
- CrashTranslator: Automatically Reproducing Mobile Application Crashes Directly from Stack Trace
- Large Language Model for Vulnerability Detection and Repair: Literature Review and the Road Ahead
- Towards Action Hijacking of Large Language Model-based Agent
- PoliGraph: Automated Privacy Policy Analysis using Knowledge Graphs (Journal Version)
- When LLMs Go Online: The Emerging Threat of Web-Enabled LLMs
- A Study of Using Multimodal LLMs for Non-Crash Functional Bug Detection in Android Apps
- LLM-Powered GUI Agents in Phone Automation: Surveying Progress and Prospects
- Mobile-Agent-v2: Mobile Device Operation Assistant with Effective Navigation via Multi-Agent Collaboration
- An Empirical Study on Oculus Virtual Reality Applications: Security and Privacy Perspectives
- LLM for Mobile: An Initial Roadmap
- ReuNify: A Step Towards Whole Program Analysis for React Native Android Apps
- System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective
- GUI Agents with Foundation Models: A Comprehensive Survey
- Evaluation Methodologies in Software Protection Research
- Can LLMs Obfuscate Code? A Systematic Analysis of Large Language Models into Assembly Code Obfuscation
- Fill in the Blank: Context-aware Automated Text Input Generation for Mobile GUI Testing
- ARAP: Demystifying Anti Runtime Analysis Code in Android Apps
- Forewarned is Forearmed: A Survey on Large Language Model-based Agents in Autonomous Cyberattacks
- Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineering
- Privacy-Aware Decoding: Mitigating Privacy Leakage of Large Language Models in Retrieval-Augmented Generation
- A Decade of Privacy-Relevant Android App Reviews: Large Scale Trends
- Enhancing Android Malware Detection: The Influence of ChatGPT on Decision-centric Task
- Do as You Say: Consistency Detection of Data Practice in Program Code and Privacy Policy in Mini-App
- Evaluating the Robustness of Multimodal Agents Against Active Environmental Injection Attacks
- TraceRAG: A LLM-Based Framework for Explainable Android Malware Detection and Behavior Analysis
- Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns
- LLMAID: Identifying AI Capabilities in Android Apps with LLMs
- LLMs in Mobile Apps: Practices, Challenges, and Opportunities
- JsDeObsBench: Measuring and Benchmarking LLMs for JavaScript Deobfuscation
- From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents
- AndroByte: LLM-Driven Privacy Analysis through Bytecode Summarization and Dynamic Dataflow Call Graph Generation
- Beyond App Markets: Demystifying Underground Mobile App Distribution Via Telegram
- EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage
- AdvAgent: Controllable Blackbox Red-teaming on Web Agents
- AutoGLM: Autonomous Foundation Agents for GUIs
- Evaluating Large Language Models in detecting Secrets in Android Apps
- APEX: Automatic Event Sequence Generation for Android Applications
- Enabling Cost-Effective UI Automation Testing with Retrieval-Based LLMs: A Case Study in WeChat
- GUIPilot: A Consistency-based Mobile GUI Testing Approach for Detecting Application-specific Bugs
- ArkAnalyzer: The Static Analysis Framework for OpenHarmony