Large-Scale Third-Party Library Detection in Android Markets
Large-Scale Third-Party Library Detection in Android Markets
复制标题
DOI：
10.1109/tse.2018.2872958
复制
发表时间：
2020-09
影响因子：
7.4
通讯作者：
Menghao Li;Pei Wang;Wei Wang;Shuai Wang;Dinghao Wu;Jian Liu;Rui Xue;Wei Huo;Wei Zou
中科院分区：
文献类型：
--
作者：
Menghao Li;Pei Wang;Wei Wang;Shuai Wang;Dinghao Wu;Jian Liu;Rui Xue;Wei Huo;Wei Zou
随着移动的应用市场的蓬勃发展，第三方库在Android应用中得到了广泛的应用。这些库提供广告、位置和社交网络服务等功能，使应用程序开发更加高效。然而，脆弱和有害的第三方库的传播也会伤害移动的生态系统，导致各种安全问题。因此，第三方库识别已成为一个重要的问题，是许多安全应用程序，如重新包装检测，漏洞识别和恶意软件分析的基础。之前，我们提出了一种新的方法来大规模识别第三方Android库。我们的方法使用应用程序的内部代码依赖关系来识别库候选项并对其进行进一步分类。使用细粒度的特性散列策略，我们可以更好地处理包和方法名称被混淆的代码，而不是历史工作。我们开发了一个名为LibD的原型工具，并使用包含1，427，395个Android应用程序的最新数据集对其进行了评估。我们的实验结果表明，LibD优于现有的工具，在检测多包的第三方库与基于名称的混淆的存在，导致显着提高精度，而不损失的可扩展性。在本文中，我们通过调查采用有效和可扩展的库检测来提高真实的世界中大规模应用程序分析的性能的可能性，扩展了我们的早期工作。LibD技术可用于加速整个应用程序的Android漏洞检测，并快速识别易受攻击的第三方库的变体。这篇扩展论文揭示了我们以前的研究的实用价值。
With the thriving of mobile app markets, third-party libraries are pervasively used in Android applications. The libraries provide functionalities such as advertising, location, and social networking services, making app development much more productive. However, the spread of vulnerable and harmful third-party libraries can also hurt the mobile ecosystem, leading to various security problems. Therefore, third-party library identification has emerged as an important problem, being the basis of many security applications such as repackaging detection, vulnerability identification, and malware analysis. Previously, we proposed a novel approach to identifying third-party Android libraries at a massive scale. Our method uses the internal code dependencies of an app to recognize library candidates and further classify them. With a fine-grained feature hashing strategy, we can better handle code whose package and method names are obfuscated than historical work. We have developed a prototypical tool called LibD and evaluated it with an up-to-date dataset containing 1,427,395 Android apps. Our experiment results show that LibD outperforms existing tools in detecting multi-package third-party libraries with the presence of name-based obfuscation, leading to significantly improved precision without the loss of scalability. In this paper, we extend our early work by investigating the possibility of employing effective and scalable library detection to boost the performance of large-scale app analyses in the real world. We show that the technique of LibD can be used to accelerate whole-app Android vulnerability detection and quickly identify variants of vulnerable third-party libraries. This extension paper sheds light on the practical value of our previous research.