  Android users are now suffering severe threats from unwanted behaviors of
various apps. The analysis of apps' audit logs is one of the essential methods
for some device manufacturers to unveil the underlying malice within apps. We
propose and implement AppAngio, a novel system that reveals contextual
information in Android app behaviors by API-level audit logs. Our goal is to
help analysts of device manufactures understand what has happened on users'
devices and facilitate the identification of the malice within apps. The key
module of AppAngio is identifying the path matched with the logs on the app's
control-flow graph (CFG). The challenge, however, is that the limited-quantity
logs may incur high computational complexity in the log matching, where there
are a large number of candidates caused by the coupling relation of successive
logs. To address the challenge, we propose a divide and conquer strategy that
precisely positions the nodes matched with log records on the corresponding
CFGs and connects the nodes with as few backtracks as possible. Our experiments
show that AppAngio reveals the contextual information of behaviors in
real-world apps. Moreover, the revealed results assist the analysts in
identifying malice of app behaviors and complement existing analysis schemes.
Meanwhile, AppAngio incurs negligible performance overhead on the Android
device.
