Context: During the last years, developers of mobile applications have the possibility to use new paradigms and tools for developing mobile applications. For instance, since 2017 Android developers have the official support to write Android applications using Kotlin language. Kotlin is programming language fully interoperable with Java that combines object-oriented and functional features. Objective: The goal of this paper is twofold. First, it aims to study the degree of adoption of Kotlin language on development of open-source Android applications and to measure the amount of Kotlin code inside Android applications. Secondly, it aims to measure the quality of Android applications that are written using Kotlin and to compare it with the quality of Android applications written using Java. Method: We first defined a method to detect Kotlin applications from a dataset of open-source Android applications. Then, we analyzed those applications to detect instances of code smells and computed an estimation of quality of the applications. Finally, we studied how the introduction of Kotlin code impacts on the quality of an Android application. Results: Our experiment found that 11.26 of applications from a dataset with 2,167 open-source applications have been written (partially or fully) using Kotlin language. We found that the introduction of Kotlin code increases the quality (in terms of presence of code smells) of the majority of the Android applications initially written in Java.
@cite_10 proposed a catalog of 30 quality smells dedicated to Android. These code smells are mainly originated from the good and bad practices documented online in the official Android documentation or by developers reporting their experiences on blogs. @cite_4 @cite_15 proposed a tooled approach, named Paprika, to identify object-oriented and Android-specific code smells from binaries (apk) of mobile applications. @cite_1 proposed a detection tool, called aDoctor, to detect 15 Android code smells using static analysis code techniques. They tested aDoctor on a testbed of 18 Android applications and attained a detection precision close to 100 While @cite_22 and @cite_6 focused on detection of object-oriented smells in mobile applications, @cite_10 proposed a catalog of smells dedicated to Android. Moreover, @cite_15 @cite_4 and @cite_1 proposed tools to identify Android smells.
@cite_4 @cite_22 @cite_1 @cite_6 @cite_15 @cite_10
2735562533 2741764761 2166743230 2087804676
The evolution rate of mobile applications is much higher than regular software applications having shorter release deadlines and smaller code base. Mobile applications tend to be evolved quickly by developers to meet several new customer requirements and fix discovered bugs. However, evolving the existing features and design may introduce bad design practices, also called code smells, which can highly decrease the maintainability and performance of these mobile applications. However, unlike the area of object-oriented software systems, the detection of code smells in mobile applications received a very little of attention. Recent, few studies defined a set of quality metrics for Android applications and proposed a support to manually write a set of rules to detect code smells by combining these quality metrics. However, finding the best combination of metrics and their thresholds to identify code smells is left to the developer as a manual process. In this paper, we propose to automatically generate rules for the detection of code smells in Android applications using a multi-objective genetic programming algorithm (MOGP). The MOGP algorithm aims at finding the best set of rules that cover a set of code smell examples of Android applications based on two conflicting objective functions of precision and recall. We evaluate our approach on 184 Android projects with source code hosted in GitHub. The statistical test of our results show that the generated detection rules identified 10 Android smell types on these mobile applications with an average correctness higher than 82 and an average relevance of 77 based on the feedback of active developers of mobile apps. Nowadays, Android represents the most popular mobile platform with a market share of around 80 . Previous research showed that data contained in user reviews and code change history of mobile apps represent a rich source of information for reducing software maintenance and development effort, increasing customers' satisfaction. Stemming from this observation, we present in this paper a large dataset of Android applications belonging to 23 different apps categories, which provides an overview of the types of feedback users report on the apps and documents the evolution of the related code metrics. The dataset contains about 395 applications of the F-Droid repository, including around 600 versions, 280,000 user reviews and more than 450,000 user feedback (extracted with specific text mining approaches). Furthermore, for each app version in our dataset, we employed the Paprika tool and developed several Python scripts to detect 8 different code smells and compute 22 code quality indicators. The paper discusses the potential usefulness of the dataset for future research in the field. Today's smartphones are a ubiquitous source of private and confidential data. At the same time, smartphone users are plagued by carelessly programmed apps that leak important data by accident, and by malicious apps that exploit their given privileges to copy such data intentionally. While existing static taint-analysis approaches have the potential of detecting such data leaks ahead of time, all approaches for Android use a number of coarse-grain approximations that can yield high numbers of missed leaks and false alarms. In this work we thus present FlowDroid, a novel and highly precise static taint analysis for Android applications. A precise model of Android's lifecycle allows the analysis to properly handle callbacks invoked by the Android framework, while context, flow, field and object-sensitivity allows the analysis to reduce the number of false alarms. Novel on-demand algorithms help FlowDroid maintain high efficiency and precision at the same time. We also propose DroidBench, an open test suite for evaluating the effectiveness and accuracy of taint-analysis tools specifically for Android apps. As we show through a set of experiments using SecuriBench Micro, DroidBench, and a set of well-known Android test applications, FlowDroid finds a very high fraction of data leaks while keeping the rate of false positives low. On DroidBench, FlowDroid achieves 93 recall and 86 precision, greatly outperforming the commercial tools IBM AppScan Source and Fortify SCA. FlowDroid successfully finds leaks in a subset of 500 apps from Google Play and about 1,000 malware apps from the VirusShare project. In recent years, there has been explosive growth in smartphone sales, which is accompanied with the availability of a huge number of smartphone applications (or simply apps). End users or consumers are attracted by the many interesting features offered by these devices and the associated apps. The developers of these apps are also benefited by the prospect of financial compensation, either by selling their apps directly or by embedding one of the many ad libraries available on smartphone platforms. In this paper, we focus on potential privacy and security risks posed by these embedded or in-app advertisement libraries (henceforth "ad libraries," for brevity). To this end, we study the popular Android platform and collect 100,000 apps from the official Android Market in March-May, 2011. Among these apps, we identify 100 representative in-app ad libraries (embedded in 52.1 of them) and further develop a system called AdRisk to systematically identify potential risks. In particular, we first decouple the embedded ad libraries from host apps and then apply our system to statically examine the ad libraries, ranging from whether they will upload privacy-sensitive information to remote (ad) servers or whether they will download untrusted code from remote servers. Our results show that most existing ad libraries collect private information: some of them may be used for legitimate targeting purposes (i.e., the user's location) while others are hard to justify by invasively collecting the information such as the user's call logs, phone number, browser bookmarks, or even the list of installed apps on the phone. Moreover, additional ones go a step further by making use of an unsafe mechanism to directly fetch and run code from the Internet, which immediately leads to serious security risks. Our investigation indicates the symbiotic relationship between embedded ad libraries and host apps is one main reason behind these exposed risks. These results clearly show the need for better regulating the way ad libraries are integrated in Android apps.