ISSTA 2019
Mon 15 - Fri 19 July 2019 Beijing, China
Wed 17 Jul 2019 14:00 - 14:22 at Grand Ballroom - Mobile App Testing Chair(s): Xiaoyin Wang

Third-party libraries are vital components of Android apps, yet they can also introduce serious security threats and impede the accuracy and reliability of app analysis tasks, such as app clone detection. Several library detection approaches have been proposed to address these problems. However, we show these techniques are not robust against popular code obfuscators, such as ProGuard, which is now used in nearly half of all apps. We then present LibID, a library detection tool that is more resilient to code shrinking and package modification than state-of-the-art tools. We show that the library identification problem can be formulated using binary integer programming models. LibID is able to identify specific versions of third-party libraries in candidate apps through static analysis of app binaries coupled with a database of third-party libraries. We propose a novel approach to generate synthetic apps to tune the detection thresholds. Then, we use F-Droid apps as the ground truth to evaluate LibID under different obfuscation settings, which shows that LibID is more robust to code obfuscators than state-of-the-art tools. Finally, we demonstrate the utility of LibID by detecting the use of a vulnerable version of the OkHttp library in nearly 10% of 3,958 most popular apps on the Google Play Store.

Wed 17 Jul

Displayed time zone: Beijing, Chongqing, Hong Kong, Urumqi change

14:00 - 15:30
Mobile App TestingTechnical Papers at Grand Ballroom
Chair(s): Xiaoyin Wang University of Texas at San Antonio, USA
14:00
22m
Talk
LibID: Reliable Identification of Obfuscated Third-Party Android Libraries
Technical Papers
Jiexin Zhang University of Cambridge, Alastair R. Beresford University of Cambridge, UK, Stephan A. Kollmann University of Cambridge
DOI Pre-print
14:22
22m
Talk
QADroid: Regression Event Selection for Android ApplicationsArtifacts ReusableArtifacts Functional
Technical Papers
Aman Sharma IIT Madras, Rupesh Nasre IIT Madras, India
14:45
22m
Talk
Mining Android Crash Fixes in the Absence of Issue- and Change-Tracking Systems
Technical Papers
Pingfan Kong Interdisciplinary Centre for Security, Reliability and Trust, University of Luxembourg, Li Li Monash University, Australia, Jun Gao University of Luxembourg, SnT, Tegawendé F. Bissyandé SnT, University of Luxembourg, Jacques Klein University of Luxembourg, SnT
15:07
22m
Talk
SARA: Self-replay Augmented Record and Replay for Android in Industrial Cases
Technical Papers
Jiaqi Guo Xi'an Jiaotong University, Shuyue Li Xi'an Jiaotong University, Jian-Guang Lou Microsoft Research, Zijiang Yang Western Michigan University, Ting Liu MOEKLINNS Lab, Department of Computer Science and Technology, Xi'an Jiaotong University, 710049, China