Leveraging Visible Widget Sizes for Detecting Repackaged Android Apps
Android currently holds a significant share of the mobile market. However, the repackaging of Android applications is a widespread issue. Attackers can use repackaging to crack applications, insert malicious code, and add or replace advertisements. This poses a serious threat to the Android ecosystem. As such, detecting repackaged applications is of great importance. Noticing that repackaged applications seldom modify the GUI of the original applications, in recent years, researchers have proposed a series of dynamic software birthmarks based on the runtime GUI of the application to detect repackaged applications. However, existing dynamic GUI-based software falls short in three areas: (1) unreliable GUI dumping channel, (2) sensitive to widget position, and (3) slow birthmark generation. To address these limits, in this paper, we propose Box- Droid. In summary, BoxDroid offers a more reliable GUI dumping channel by disregarding transparent widgets or layouts. Additionally, it significantly increases the speed of birthmark generation through a DFS exploration strategy. Finally, it generates birthmarks using the distribution of the bounding boxes of widgets in each layout encountered at runtime. We have evaluated BoxDroid on 499 repackaging pairs and it shows a precision of 0.955 and a recall of 0.926. BoxDroid also detected 1,441 undocumented repackaging pairs in a dataset sampled from the RePack repository.
Fri 20 JunDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
11:00 - 13:00 | Keynote & Session1: Software Vulnerability and Security IResearch Track / Plenary Events at Cosmos 3A Chair(s): William Chu Tunghai University | ||
11:00 60mKeynote | Keynote 2: Coding with the Machine: Promises and Perils in AI-Driven Software Engineering Plenary Events Leon Moonen Simula Research Laboratory | ||
12:00 15mTalk | Towards understanding the security issues of Python programs Research Track Hongcheng Fan Nanjing University, di liu Jiangsu Police Institute, Jielun Wu Nanjing University, Yang Feng Nanjing University, Qingkai Shi Nanjing University, Baowen Xu Nanjing University | ||
12:15 15mTalk | A Novel LLM Approach of Cybersecurity Threat Analysis and Response Research Track TIAN HU Institute of Information Engineering, Chinese Academy of Sciences;School of Cyber Security, University of Chinese Academy of Sciences, Shangyuan Zhuang Institute of Information Engineering, Chinese Academy of Sciences;School of Cyber Security, University of Chinese Academy of Sciences, zhaorui Guo Institute of Information Engineering, Chinese Academy of Sciences;School of Cyber Security, University of Chinese Academy of Sciences, Jiyan Sun Institute of Information Engineering, Chinese Academy of Sciences,School of Cyber Security, University of Chinese Academy of Sciences, Yinlong Liu Institute of Information Engineering, Chinese Academy of Sciences,School of Cyber Security, University of Chinese Academy of Sciences, Wei Ma Institute of Information Engineering, Chinese Academy of Sciences;School of Cyber Security, University of Chinese Academy of Sciences, Hongchao Wang Institute of Information Engineering, Chinese Academy of Sciences;School of Cyber Security, University of Chinese Academy of Sciences, zhaolingfeng Innovation Academy for Microsatellites of Chinese Academy of Science, zhangxiaojie Innovation Academy for Microsatellites of Chinese Academy of Science | ||
12:30 15mTalk | Measuring and Explaining the Effects of Android App Transformations in Online Malware Detection Research Track Guozhu Meng Institute of Information Engineering, Chinese Academy of Sciences, Zhixiu Guo Institute of Information Engineering, Chinese Academy of Sciences, China, Xiaodong Zhang University of Chinese Academy of Science, Haoyu Wang Huazhong University of Science and Technology, Kai Chen Institute of Information Engineering at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Yang Liu Nanyang Technological University Pre-print | ||
12:45 15mTalk | Leveraging Visible Widget Sizes for Detecting Repackaged Android Apps Research Track Pre-print | ||
Cosmos 3A is the first room in the Cosmos 3 wing.
When facing the main Cosmos Hall, access to the Cosmos 3 wing is on the left, close to the stairs. The area is accessed through a large door with the number “3”, which will stay open during the event.