search menu icon-carat-right cmu-wordmark


March 2015 Software

DidFail uses static analysis to detect potential leaks of sensitive information within a set of Android apps.


Software Engineering Institute


DidFail (Droid Intent Data Flow Analysis for Information Leakage) combines and augments FlowDroid (which identifies intra-component information flows) and Epicc (which identifies properties of intents such as its action string) to track both inter-component and intra-component data flow in a set of Android applications.

DidFail's two-phase analysis allows for fast user-response time by using precomputed phase-1 analysis results. The two phases of DidFail are (1) determine (for a set of applications) the data flows enabled individually by each application and the conditions under which these are possible, and (2) build on these results to enumerate the potentially dangerous data flows enabled by the set of applications as a whole.

Download DidFail >


Additional DidFail Resources