Jul 2026· Annual International Computer Software and Applications Conference· pp. 2557-2562· 0 citations· 19 references
Computer Science
Abstract
Cross-platform frameworks such as Flutter and React Native are increasingly adopted in Android application development, yet their security characteristics at scale remain insufficiently understood. In this paper, we present an empirical security characterization of 3,000 Android applications, consisting of 1,000 Flutter-based applications, 1,000 React Native apps, and 1,000 Kotlin-based native applications used as a baseline. Using MobSF and FlowDroid static analysis, we analyze security assessment scores as well as the prevalence of warning-level and high-severity findings across these development ecosystems. The results show consistent but modest differences in average scores and reported finding distributions, with cross-platform applications exhibiting distinct distributional patterns compared to native Kotlin applications. These observations do not imply framework-level vulnerabilities. Rather, they reflect ecosystemlevel tendencies associated with framework architectures, build configurations, and commonly used dependencies. This study characterizes Android security traits reported by static analysis tools and demonstrates that cross-platform and native applications should be interpreted with framework context in mind.
Whether off-the-shelf Large Language Models (LLMs) can effectively reason about taint flows in Android apps is investigated, and preliminary findings suggest that LLM reasoning may effectively complement traditional static taint analysis.
Nicholas Miazzo, Marco Alecci, Jordan Samhi et al.· 0 citations
Software security has been a long-standing and prominent topic in both industry and academia. However, with the increasing deployment of smart devices across various architectures, there is now a significant demand for cross-architecture software. For instance, the Heartbleed vulnerability (CVE-2014-0160), classified as CWE-125 (Out-of-bounds Read) and disclosed in the OpenSSL library in 2014, serves as a prime example of a widely-deployed software vulnerability capable of affecting systems across diverse computing environments due to OpenSSL’s broad adoption. More broadly, memory-related vulnerabilities remain a persistent and significant threat, accounting for a substantial proportion of reported CVEs in recent years. Moreover, performing static cross-architecture vulnerability analysis on binary code poses particular challenges due to the variations in instruction sets across different architectures. In this paper, we present a novel static approach, called BinCros, to identify known vulnerabilities across different optimization levels and CPU architectures in binary code. It mainly consists of three phases: 1) Generating ground-truth intermediate representation (IR) data from binary code based on domain knowledge. To address the cross-architecture problem, we consider IR, which is a set of smaller, lower-level instructions that break down, describe, and capture all the effects of an instruction from standard architectures like x86, ARM, and MIPS; 2) Learning good embeddings based on the cross-architecture ground-truth datasets. We employ a code-code learning method to capture the semantic differences and maximize the distribution divergences between vulnerable and non-vulnerable samples; 3) Building a prediction model based on high-level feature representations. To demonstrate the effectiveness of BinCros, we conducted experiments with a series of baselines including single architecture-based techniques, cross-architecture-based techniques, and so on. Experimental results show that BinCros outperforms the baselines by at least 15% in terms of F1-measure in almost all cases. We believe this work will inspire other researchers to consider natural language processing-related techniques for cross-architecture software vulnerability detection.
Shigang Liu, Di Cao, Chao Chen et al.· IEEE Transactions on Informa...· 0 citations
An automated testing tool named R8Scan is developed that utilizes a novel idea to synthesize seeds from prioritized real-world functions and construct the corresponding arguments empowered by Large Language Models to test R8, thus enabling the exploration of a broader range of semantics.
Zifan Xie, Ming Wen, Shiyu Qiu et al.· ACM Transactions on Software...· 0 citations
The rapid adoption of Android applications in mobile commerce has increased exposure to sophisticated malware capable of bypassing traditional security mechanisms through code obfuscation, dynamic code loading, and runtime-triggered malicious behaviors. Although static analysis offers efficient large-scale detection, it often fails to identify concealed runtime activities, while dynamic analysis provides richer behavioral evidence but suffers from limited execution coverage and high computational overhead. To address these complementary limitations, this paper proposes FusionDroid, a lightweight multimodal Android malware detection framework that integrates permission-based static features, permission co-occurrence graph representations, and engineered runtime behavioral features through probability-level ensemble fusion. The framework was evaluated using Android applications collected from the AndroZoo repository, comprising 24,055 valid applications for static analysis and a balanced paired benchmark of 1716 applications for multimodal evaluation. The experimental results show that complementary static and dynamic representations can improve Android malware detection, although the magnitude and nature of the improvement depend on class distribution and evaluation metric. The best-performing model, StackedFusion-LightGBM, achieved 93.31% accuracy, 96.86% precision, 89.53% recall, a 93.05% F1 score, 97.69% ROC–AUC, and 98.14% PR–AUC. A controlled five-fold evaluation on the common paired benchmark further showed an F1 score of 0.9175±0.0176 for the full Static+Graph+Dynamic configuration compared with 0.8781±0.0081 for the Static-only baseline. Paired statistical analysis further supported the improvement. These findings show that multimodal fusion can improve Android malware detection while preserving low-complexity manifest-derived representations. The results support FusionDroid as a staged, sandbox-assisted framework in which lightweight static analysis is complemented by runtime behavioral evidence when deeper inspection is required.
Cross-platform frameworks and cross-language programming techniques have become the foundation for building modern mobile, desktop, IoT, and cloud applications, while large language models (LLMs) are increasingly used to generate and translate their code. These technologies promise “write once, run anywhere” development and rapid multi-language integration, but they also introduce new attack surfaces at abstraction layers, language boundaries, and AI-assisted tooling. This paper presents a comprehensive security-centric survey of cross-platform and cross-language technologies, with a particular focus on how emerging code LLMs reshape the threat landscape. We first provide a unified taxonomy of cross-platform approaches (native, Web, hybrid, interpreted, cross-compiled, and model-driven) and cross-language mechanisms (source-to-source translation, foreign-function interfaces, inter-process communication, and multi-language runtimes), highlighting their security assumptions and typical attack surfaces. We then systematically review security threats to cross-platform frameworks, cross-language interactions, and LLM-based code generation, including permission misuse, remote code execution, cross-language attacks, data and cryptographic weaknesses, supply-chain compromise, reverse engineering, and AI-induced vulnerabilities. Building on this analysis, we organize existing defenses into a “prevention–detection–remediation–audit” lifecycle, covering framework hardening, unified cross-language analysis, supply-chain governance, and LLM-aware safeguards. Finally, we distill best practices for engineering reliable cross-platform and cross-language applications and outline key open research directions.
M. Zhou, Yu-Tong Zhang, Jia-Tong Han et al.· ACM Transactions on Software...· 0 citations
This study conducts a large-scale empirical security analysis of the web-based management interfaces of ten widely used open-source Infrastructure-as-a-Service (IaaS) platforms, identifying 16 vulnerabilities spanning nine classes, including high-severity flaws that enable account takeover.
Alexandros Perrakis, Efstratios Chatzoglou, Vyron Kampourakis et al.· International Journal of Inf...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
