Security Testing of Android and iOS Applications Using Static, Dynamic, and Hybrid Analysis Techniques: A Comprehensive

Abstract

Mobile applications have become central to critical digital infrastructure,
handling sensitive financial, personal, and enterprise data across billions of
handheld devices worldwide. However, the distinct architectural paradigms,
runtime sandboxing models, and execution frameworks of the two dominant
operating systems—Android and iOS—present multifaceted attack surfaces for malicious actors. Security testing methodologies are essential for identifying vulnerabilities before deployment. This paper presents an extensive, journallevel critical review of mobile application security testing techniques, specifically evaluating Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Hybrid Application Security Testing (HAST) approaches. We provide an in-depth analysis of decompilation, abstract syntax tree (AST) evaluation, dynamic instrumentation (e.g., Frida, Xposed), API hooking, automated fuzzing, and hybrid taint-tracking frameworks across both platforms. Furthermore, we quantitatively compare static, dynamic, and hybrid methodologies in terms of vulnerability detection coverage, false positive rates, computational overhead, and resistance to code obfuscation and anti-analysis mechanisms. Our findings demonstrate that while static analysis achieves comprehensive code coverage, it suffers from high false-positive rates (up to 34.2%) and struggles against dynamic code loading and obfuscation. Dynamic analysis yields near-zero false positives for executed paths but exhibits limited code coverage (average 45–60%). Hybrid frameworks successfully bridge this gap, achieving detection rates exceeding 95% with low false positives (3.8%). Finally, we outline key research gaps, practical engineering trade-offs, and future research directions including AI driven automated hybrid fuzzing and cross-platform unified security verification.

KEYWORDS: Android Security, iOS Security, Static Application Security
Testing (SAST), Dynamic Application Security Testing (DAST), Hybrid
Analysis, Mobile Vulnerability Assessment, Taint Tracking, Dynamic
Instrumentation.