GAPS Framework Combines Static Analysis With Dynamic Testing to Pinpoint Android App Methods

Directing automated testing to specific methods within Android applications has been a persistent hurdle for developers and security researchers. Most existing testing tools prioritize broad code coverage rather than precision, making it difficult to examine particular functionality in detail—a shortcoming that complicates vulnerability discovery, code understanding, and deeper dynamic analysis.

A New Synthesis Approach#

Researchers have introduced GAPS (Graph-based Automated Path Synthesizer), a system that unites static program analysis with interactive GUI-driven exploration to achieve targeted method execution. The approach begins by analyzing an app's code structure without running it—using graph traversal and data-flow tracking to determine which user interactions could theoretically activate a given target method. These feasible paths are then converted into concrete execution instructions that guide the testing tool through the app's graphical interface.

Performance on Standard Benchmarks#

Testing on the AndroTest benchmark revealed that GAPS successfully reconstructs execution paths to 88.24% of target methods, processing each app in roughly 12.67 seconds on average. When performing actual dynamic execution—interacting with running apps—GAPS successfully reached 56.93% of target methods. This substantially outpaced competing solutions: the GUI-oriented tool APE managed 11.12%, the hybrid framework GoalExplorer achieved 4.75%, and a recent language-model-powered approach called Guardian reached 34%.

Real-World Scalability#

The team also tested their framework against the 50 most-downloaded applications on the Google Play Store to assess real-world viability. In this larger-scale evaluation, GAPS reconstructed paths to 62.03% of target methods, requiring an average of 278.9 seconds per application, and dynamically reached 54.80% of them. These outcomes demonstrate that the hybrid strategy of combining static code analysis with dynamically guided exploration provides a practical and scalable method for reliably executing specific methods in real Android apps.

Implications#

The ability to target specific methods has downstream benefits for security research, program analysis, and comprehensive app testing. By bridging the gap between static understanding and dynamic execution, GAPS offers a more precise toolkit for understanding and validating Android application behavior.