1. Dynodroid: An Input Generation System for Android Apps
FSE’13
Presented by Haocheng Huang

2. Introduction
Static analyses are hindered by features commonly used by mobile apps such as code obfuscation, native libraries, and a complex SDK framework
Key challenge of dynamic analyses is obtaining program inputs that adequately exercise the program's functionality

3. Contribution
Propose an effective system for generating inputs to mobile apps
Show how to observe, select, and execute system events for Android in a mobile device emulator without modifying the app
Present extensive empirical evaluation of the system

4. System Architecture
observe-select-execute cycle

5. Executor
Combine the benefits of automated and manual input generation

6. Observer
The goal of the observer is to efficiently compute as small a set of relevant events as possible without missing any
Observer computes relevant UI events and relevant system events

7. Observer UI Events
Supports two input mechanisms: touchscreen and navigation buttons
First, it deems clicking each navigation button as a relevant UI event
Second, it inspects the view hierarchy

8. Observer UI Events

9. Observer System Events
Broadcast Receiver Events
Choose 25 intents to be considered
The executor serializes the appropriate intent along with a Bundle object that has a key named “pdus” mapped to a byte array denoting an array of SmsMessage objects

10. Observer System Events
System Service Events
Can be divided into internally and externally
We considered externally
If the selector selects this event, then the executor triggers it by sending telnet command

11. Selector
The selector selects an event for the executor to execute from the set of relevant events E computed by the observer
Implemented three different selection strategies in the selector
Frequency, UniformRandom, and BiasedRandom
The Frequency strategy selects an event from E that has been selected least frequently by it so far
The UniformRandom strategy selects an event from E uniformly at random(like monkey)

12. Selector
The final and default selection strategy BiasedRandom

13. Evaluation Experiment environment Emulator configuration
64-bit Linux machines with 128GB memory and dual-socket 16-core AMD Opteron 3.0GHz processors
Emulator configuration

14. Evaluation App Source Code Coverage
Evaluate 5 approaches on 50 apps

15. Evaluation App Source Code Coverage
Dynodroid & Human
4-91%(51%)
Dynodroid can be used to automate to a significant degree the tedious testing done by humans
Dynodroid & Monkey
4-81%(47%)
Dynodroid and Monkey get comparable coverage

16. Evaluation App Source Code Coverage
Monkey requires 20X more events than BiasedRandom on average
Of the three selection strategies in Dynodroid, BiasedRandom performs the best, with each of the other two strategies requiring 2X more events than it on average

17. Evaluation Bugs Found in Apps
Bugs found by Dynodroid in the 50 open-source apps from F-Droid and the 1,000 top free apps from Google Play

18. Limitation 5X slower than Monkey due to heavy use of reflection
Use DUMPQ can make ViewServer run 20X-40X faster
Dynodroid currently supports only the Gingerbread version of Android

19. Conclusion
Presented a practical system Dynodroid for generating relevant inputs to mobile apps on the dominant Android platform
Dynodroid can generate both UI inputs and system inputs, and it allows combining inputs from human and machine