This paper proposes a policy-based framework to enforce security policies by intercepting system calls to the Linux kernel beneath the Android operating system (OS). By using this approach it is possible to detect security breaches by third-party apps, pre-installed apps by Google or the device vendors, but also malicious native code activity. The framework states several advantages, including the total transparency of the system to the application itself as well as to the Android OS.

FireDroid works on every process that is spawned by the Android main process Zygote. FireDroid basically performs the following four features: it attaches to, identifies, monitors, and most importantly executes policies on a target process. Due to the fact that defining policies for low-level vetting mechanisms is very error-prone, the paper proposes a novel policy language for specifying high-level policies that are then mapped to policies enforceable at the level of the intercepted system calls.

Furthermore, the paper carries out an extensive performance analysis, which can be summarized as follows: there is a total performance overhead of about 12 percent over the measured factors central processing unit (CPU), memory, input/output (I/O), 2D, and 3D. Regarding the executed application programming interface (API) operations under FireDroid, HttpGet produces an overhead of one percent, BroadcastIntent produces an overhead of five percent, QueryContact produces an overhead of four percent, and GetLastLocation produces an overhead of 30 percent, which seems reasonable.

Compared to related approaches, FireDroid is totally complementary, as in the case of ComDroid [1] and Woodpecker [2], which can be used by system administrators to detect vulnerabilities and then specify FireDroid policies to prevent successful exploitation. Finally, FireDroid works similar to other projects, like Aurasium [3], which also detects a system call (dlopen) but with improvements regarding robustness and extensiveness.

FireDroid gives a company complete control over device applications and therefore the company is not forced to trust the user.