LibID: Reliable Identification of Obfuscated Third-Party Android Libraries
Third-party libraries are vital components of Android apps, yet they can also introduce serious security threats and impede the accuracy and reliability of app analysis tasks, such as app clone detection. Several library detection approaches have been proposed to address these problems. However, we show these techniques are not robust against popular code obfuscators, such as ProGuard, which is now used in nearly half of all apps. We then present LibID, a library detection tool that is more resilient to code shrinking and package modification than state-of-the-art tools. We show that the library identification problem can be formulated using binary integer programming models. LibID is able to identify specific versions of third-party libraries in candidate apps through static analysis of app binaries coupled with a database of third-party libraries. We propose a novel approach to generate synthetic apps to tune the detection thresholds. Then, we use F-Droid apps as the ground truth to evaluate LibID under different obfuscation settings, which shows that LibID is more robust to code obfuscators than state-of-the-art tools. Finally, we demonstrate the utility of LibID by detecting the use of a vulnerable version of the OkHttp library in nearly 10% of 3,958 most popular apps on the Google Play Store.
Wed 17 JulDisplayed time zone: Beijing, Chongqing, Hong Kong, Urumqi change
14:00 - 15:30 | Mobile App TestingTechnical Papers at Grand Ballroom Chair(s): Xiaoyin Wang University of Texas at San Antonio, USA | ||
14:00 22mTalk | LibID: Reliable Identification of Obfuscated Third-Party Android Libraries Technical Papers Jiexin Zhang University of Cambridge, Alastair R. Beresford University of Cambridge, UK, Stephan A. Kollmann University of Cambridge DOI Pre-print | ||
14:22 22mTalk | QADroid: Regression Event Selection for Android Applications Technical Papers | ||
14:45 22mTalk | Mining Android Crash Fixes in the Absence of Issue- and Change-Tracking Systems Technical Papers Pingfan Kong Interdisciplinary Centre for Security, Reliability and Trust, University of Luxembourg, Li Li Monash University, Australia, Jun Gao University of Luxembourg, SnT, Tegawendé F. Bissyandé SnT, University of Luxembourg, Jacques Klein University of Luxembourg, SnT | ||
15:07 22mTalk | SARA: Self-replay Augmented Record and Replay for Android in Industrial Cases Technical Papers Jiaqi Guo Xi'an Jiaotong University, Shuyue Li Xi'an Jiaotong University, Jian-Guang Lou Microsoft Research, Zijiang Yang Western Michigan University, Ting Liu MOEKLINNS Lab, Department of Computer Science and Technology, Xi'an Jiaotong University, 710049, China |