Detecting Clones in Android Applications through Analyzing User Interfaces

Soh, Chee Kiong; Tan, Hee Beng Kuan; Arnatovich, Yauhen Leanidavich; Wang, Lipo

doi:10.1109/icpc.2015.25

Cited by 40 publications

(45 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The definition of isomorphic part in layout tree is generalized. According to the functionality [14], we divide the element into four categories: "clickable," " checkable," " editable," and "scrollable." Nodes that belong to the same categories while with the same depth in one layout tree are identified as isomorphic parts.…”

Section: Modify Layout Treesmentioning

confidence: 99%

“…ℎ () do (9) ℎ .setParent ( ); (10) end (11) .getParent ().removeChild ( ); (12) end (13) end (14) return ; Algorithm 1: Merge two layout trees.…”

Section: Similarity Measurementmentioning

confidence: 99%

“…FSquaDRA [17] detects app clones by comparing the resource files in app which is fast but not robust against modifications to the resource files. Soh et al [14] and Malisa et al [15] try to execute app on a specific simulator to extract run-time UI information to construct birthmark for Android apps, which is robust to malicious modifications but the time-consuming execution ruined their scalability in large-scale scenario. FUIDroid is similar to their approaches in the sense that they all rely on UI information.…”

Section: Related Workmentioning

confidence: 99%

“…Although few latest UI-based approaches can detect the packed apps, they are not scalable in real-world scenario, because all of these approaches heavily depend on either 2 Mobile Information Systems complex computation based on app's resource files [13,17], or app's run-time information [14,15] which is difficult to be extracted and time-consuming.…”

Section: Introductionmentioning

confidence: 99%

“…These approaches can be divided into two categories: codebased techniques [3][4][5][6][7][8] and UI-based techniques [9][10][11][12][13][14][15][16][17]. Code-based methods focus on detecting the code reuse in repackaged apps, while UI-based methods analyze the similarity of app's user interface.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

An Efficient and Packing-Resilient Two-Phase Android Cloned Application Detection Approach

Lyu¹,

Lin²,

Yang³

2017

Mobile Information Systems

View full text Add to dashboard Cite

The huge benefit of mobile application industry has attracted a large number of developers and attendant attackers. Application repackaging provides help for the distribution of most Android malware. It is a serious threat to the entire Android ecosystem, as it not only compromises the security and privacy of the app users but also plunders app developers' income. Although massive approaches have been proposed to address this issue, plagiarists try to fight back through packing their malicious code with the help of commercial packers. Previous works either do not consider the packing issue or rely on time-consuming computations, which are not scalable for large-scale real-world scenario. In this paper, we propose FUIDroid, a novel two-phase app clones detection system that can detect the packed cloned app. FUIDroid includes a function-based fast selection phase to quickly select suspicious apps by analyzing apps' description and a further UI-based accurate detection phase to refine the detection result. We evaluate our system on two sets of apps. The result from experiment on 320 packed samples demonstrates that FUIDroid is resilient to packed apps. The evaluation on more than 150,000 real-world apps shows the efficiency of FUIDroid in large-scale scenario.

show abstract

Section: Modify Layout Treesmentioning

confidence: 99%

“…ℎ () do (9) ℎ .setParent ( ); (10) end (11) .getParent ().removeChild ( ); (12) end (13) end (14) return ; Algorithm 1: Merge two layout trees.…”

Section: Similarity Measurementmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

An Efficient and Packing-Resilient Two-Phase Android Cloned Application Detection Approach

Lyu¹,

Lin²,

Yang³

2017

Mobile Information Systems

View full text Add to dashboard Cite

show abstract

An accurate and efficient two‐phase scheme for detecting Android cloned applications

Xie

Yan

Lin

et al. 2020

Concurrency and Computation

View full text Add to dashboard Cite

Summary The fast‐growing Android application market has attracted more and more application developers. However, many plagiarists use decompiled tools to modify original applications to get clones, which has become a serious threat. For detecting cloned applications, most of the existing schemes do not consider the detected accuracy and time consumption at the same time. In this article, we propose a two‐phase detection scheme to achieve fast and accurate clone detection in large‐scale applications. In the rapid screening phase, a fix‐length minhash summary is constructed for each application and the locality‐sensitive hashing (LSH) algorithm is used to obtain suspicious cloned applications quickly. In the accurate detection phase, by merging and pruning the layout and interaction information of all user interfaces (UIs) at the application runtime, we obtain the birthmark named merged layout tree (MLT), which can resist nested obfuscation and repacking attack. Finally, cloned apps are detected by calculating the similarity between MLTs from suspicious cloned apps. We evaluate our detection scheme in two app datasets (nearly 170,000 Android applications) and compare it with the state‐of‐the‐art clone detection methods. Extensive experiments show that our method has high accuracy and efficiency for clone detection in large‐scale apps.

show abstract

Detection of clone scammers in Android markets using IoT‐based edge computing

Ullah

Naeem

et al. 2019

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Pirated application developers find an alternate way to publish pirated versions of the same Android mobile applications (apps) on different Android markets.Therefore, a centralized, automated scrutiny system among multiple app stores is inevitable to prevent publishing pirated or cloned version of these Android applications. In this paper, we proposed an Android clone detection system for Internet of things (IoT) (Droid-IoT) devices. First, the proposed system receives an original Android application package (APK) file along with possible candidate cloned APKs over the cloud network. The system uses an apkExtractor tool to extract Dalvik Executable (DEX) files for each subject program. The Jdex decompiler is used to extract Java source files from DEXs. Then, the bag-of-word model is used to extract tokenized features from source files. Further, the weighting filters are used to zoom the importance of each token. Moreover, Synthetic Minority Oversampling is applied to retrieve balanced features for better training of data. Finally, TensorFlow with Keras deep learning model is designed to predict clones in Android applications. The experimental results have shown that Droid-IoT can successfully detect cloned apps with an accuracy of up to 96%.The primary purpose of this system is to prevent the publishing of pirated apps among different app stores under different pirated names.

show abstract

Detecting Clones in Android Applications through Analyzing User Interfaces

Cited by 40 publications

References 12 publications

An Efficient and Packing-Resilient Two-Phase Android Cloned Application Detection Approach

An Efficient and Packing-Resilient Two-Phase Android Cloned Application Detection Approach

An accurate and efficient two‐phase scheme for detecting Android cloned applications

Detection of clone scammers in Android markets using IoT‐based edge computing

Contact Info

Product

Resources

About