DroidNative: A Greedy-Constructed Large-Scale Indexing for Android Native Libraries
This program is tentative and subject to change.
Native libraries are widely used in Android applications for performance optimization; however, their integration also introduces significant security risks. While existing research has explored the adoption, management, and ecosystem evolution of third-party libraries (TPLs) in Android, studies focusing specifically on Android native libraries remain scarce. This gap has led to limited understanding and awareness of the potential threats associated with native libraries. A key challenge is that Android native libraries are distributed by diverse suppliers through various channels, resulting in the absence of a comprehensive registry indexing commonly used native libraries for further investigation. To address this issue, we developed DroidNative, the first comprehensive native library database for Android, by employing a greedy and aggressive strategy to identify repository sources and collect Android native libraries. DroidNative comprises over 60,000 libraries and 292,000 versions. Experimental results demonstrate its completeness—85.1% of binaries in real-world applications can be successfully traced in DroidNative, while 10.1% of the remainder are suspected to be non–third-party native libraries. Moreover, DroidNative has been shown to enhance existing software composition analysis (SCA) detection tools such as LibRARIAN, outperforming state-of-the-art (SOTA) solutions with at least a 78.4% improvement in recognition rate.