Attack of the Clones: Detecting Cloned Applications on Android Markets

Crussell, Jonathan; Gibler, Clint; Chen, Hao

doi:10.1007/978-3-642-33167-1_3

Cited by 200 publications

(167 citation statements)

References 7 publications

Supporting

Mentioning

165

Contrasting

Unclassified

Order By: Relevance

“…However, like trees, graph similarity suffers from a high computational complexity. Algorithms for graph comparison are mostly NP-complete (Liu et al 2006;Crussell et al 2012;Krinke 2001;Chae et al 2013). In clone and plagiarism detection, a few specific types of graphs are used, e.g.…”

Section: Code Similarity Measurementmentioning

confidence: 99%

A comparison of code similarity analysers

2017

View full text Add to dashboard Cite

Copying and pasting of source code is a common activity in software engineering. Often, the code is not copied as it is and it may be modified for various purposes; e.g. refactoring, bug fixing, or even software plagiarism. These code modifications could affect the performance of code similarity analysers including code clone and plagiarism detectors to some certain degree. We are interested in two types of code modification in this study: pervasive modifications, i.e. transformations that may have a global effect, and local modifications, i.e. code changes that are contained in a single method or code block. We evaluate 30 code similarity detection techniques and tools using five experimental scenarios for Java source code. These are (1) pervasively modified code, created with tools for source code and bytecode obfuscation, and boiler-plate code, (2) source code normalisation through compilation and decompilation using different decompilers, (3) reuse of optimal configurations over different data sets, (4) tool evaluation using ranked-based measures, and (5) local + global code modifications. Our experimental results show that in the presence of pervasive modifications, some of the general textual similarity measures can offer similar performance to specialised code similarity tools, whilst in the presence of boiler-plate code, highly specialised source code similarity detection techniques and tools outperform textual similarity measures. Our study strongly validates the use of compilation/decompilation as a normalisation technique. Its use reduced false classifications to zero for three of the tools. Moreover, we demonstrate that optimal configurations are very sensitive to a specific data set. After directly applying optimal configurations derived from one data set to another, the tools perform poorly on the new data set. The code similarity analysers are thoroughly evaluated not only based on several well-known pair-based and query-based error measures but also on each specific type of pervasive code modification. This broad, thorough study is the largest in existence and potentially an invaluable guide for future users of similarity detection in source code.

show abstract

Section: Code Similarity Measurementmentioning

confidence: 99%

A comparison of code similarity analysers

2017

View full text Add to dashboard Cite

show abstract

“…This is problematic because app similarity detection tools should not consider library code when analyzing apps for similarity. Prior approaches [16,33] identified libraries using white lists and manual efforts; however, these approaches are inherently not scalable and prone to omission. In contrast, AnDarwin automatically detects libraries by leveraging the results of its clustering of similar code (Section 4.2).…”

Section: Excluding Library Codementioning

confidence: 99%

“…Full App Similarity Detection To measure the false positive rate of AnDarwin's full app similarity detection, we leverage DNADroid [16], a tool that robustly compares Android apps pairwise for code reuse. DNADroid uses subgraph isomorphism to detect similarity between the PDGs of two apps.…”

Section: Accuracymentioning

confidence: 99%

“…Apps are then compared pairwise for repackaging by calculating the edit distance between the overall fingerprint of each app. DNADroid [16] compares apps based on the PDGs of their methods. Juxtapp [22] disassembles each app and creates k-grams over the opcodes inside the app's methods.…”

Section: Related Workmentioning

confidence: 99%

“…There are several ways developers may lose potential revenue: a paid app may be "cracked" and released for free or a free app may be copied, or "cloned", and re-released with changes to the ad libraries that cause ad revenue to go to the plagiarist [21]. App cloning has been widely reported by developers, smart phone security companies and the academic community [8,10,11,16,22,34,33]. Unfortunately, the openness of Android markets and the ease of repackaging apps contribute to the ability of plagiarists to clone apps and resubmit them to markets.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

AnDarwin: Scalable Detection of Semantically Similar Android Applications

Crussell

Gibler

Chen

2013

Lecture Notes in Computer Science

Self Cite

112

View full text Add to dashboard Cite

Abstract. The popularity and utility of smartphones rely on their vibrant application markets; however, plagiarism threatens the long-term health of these markets. We present a scalable approach to detecting similar Android apps based on their semantic information. We implement our approach in a tool called AnDarwin and evaluate it on 265,359 apps collected from 17 markets including Google Play and numerous thirdparty markets. In contrast to earlier approaches, AnDarwin has four advantages: it avoids comparing apps pairwise, thus greatly improving its scalability; it analyzes only the app code and does not rely on other information -such as the app's market, signature, or descriptionthus greatly increasing its reliability; it can detect both full and partial app similarity; and it can automatically detect library code and remove it from the similarity analysis. We present two use cases for AnDarwin: finding similar apps by different developers ("clones") and similar apps from the same developer ("rebranded"). In ten hours, AnDarwin detected at least 4,295 apps that have been the victims of cloning and 36,106 apps that are rebranded. By analyzing the clusters found by AnDarwin, we found 88 new variants of malware and identified 169 malicious apps based on differences in the requested permissions. Our evaluation demonstrates AnDarwin's ability to accurately detect similar apps on a large scale.

show abstract

An accurate and efficient two‐phase scheme for detecting Android cloned applications

Xie

Yan

Lin

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

Summary The fast‐growing Android application market has attracted more and more application developers. However, many plagiarists use decompiled tools to modify original applications to get clones, which has become a serious threat. For detecting cloned applications, most of the existing schemes do not consider the detected accuracy and time consumption at the same time. In this article, we propose a two‐phase detection scheme to achieve fast and accurate clone detection in large‐scale applications. In the rapid screening phase, a fix‐length minhash summary is constructed for each application and the locality‐sensitive hashing (LSH) algorithm is used to obtain suspicious cloned applications quickly. In the accurate detection phase, by merging and pruning the layout and interaction information of all user interfaces (UIs) at the application runtime, we obtain the birthmark named merged layout tree (MLT), which can resist nested obfuscation and repacking attack. Finally, cloned apps are detected by calculating the similarity between MLTs from suspicious cloned apps. We evaluate our detection scheme in two app datasets (nearly 170,000 Android applications) and compare it with the state‐of‐the‐art clone detection methods. Extensive experiments show that our method has high accuracy and efficiency for clone detection in large‐scale apps.

show abstract

Attack of the Clones: Detecting Cloned Applications on Android Markets

Cited by 200 publications

References 7 publications

A comparison of code similarity analysers

A comparison of code similarity analysers

AnDarwin: Scalable Detection of Semantically Similar Android Applications

An accurate and efficient two‐phase scheme for detecting Android cloned applications

Contact Info

Product

Resources

About