LibSift: Automated Detection of Third-Party Libraries in Android Applications

Soh, Chee Kiong; Tan, Hee Beng Kuan; Arnatovich, Yauhen Leanidavich; Narayanan, Annamalai; Wang, Lipo

doi:10.1109/apsec.2016.017

Cited by 11 publications

(10 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to improve the detection performance, various research [13][14][15][16][17][18][19] have emerged one after another and adopt different techniques to identify in-app TPLs. However, there are still many mysteries about previous TPL detection tools.…”

Section: Motivationmentioning

confidence: 99%

“…A TPL can be uniquely defined by its "group ID", "artifact ID", and version number [24]. In Android app development, if an app uses TPLs, the app code can be divided into two parts, the logic module from the host app (i.e., primary) and the supplementary modules (i.e., non-primary) from TPLs [13,18]. TPL detection aims to identify TPLs in non-primary modules.…”

Section: Preliminary 21 Android Third-party Librarymentioning

confidence: 99%

“…Strictly speaking, various TPL detection techniques began to appear one after another since 2016 because Ad-Detect [13] and LibSift [18] cannot identify specific TPLs. AdDetect just picks ad libraries from the host app by using a binary classification algorithm (i.e., SVM [65]).…”

Section: Overview Of Tpl Detection Toolsmentioning

confidence: 99%

“…• Package Dependency Graph (PDG) includes the class dependency and intra-package homogeny relation [18] at the same time. The class dependency includes member field reference relation, method invocation relation, class interface and inheritance relation.…”

Section: Library Instance Construction Comparisonmentioning

confidence: 99%

See 3 more Smart Citations

A Systematic Assessment on Android Third-party Library Detection Tools

Zhan

Liu

et al. 2021

Preprint

View full text Add to dashboard Cite

Third-party libraries (TPLs) have become a significant part of the Android ecosystem. Developers can employ various TPLs to facilitate their app development. Unfortunately, the popularity of TPLs also brings new security issues. For example, TPLs may carry malicious or vulnerable code, which can infect popular apps to pose threats to mobile users. Furthermore, TPL detection is essential for downstream tasks, such as vulnerabilities and malware detection. Thus, various tools have been developed to identify TPLs. However, no existing work has studied these TPL detection tools in detail, and different tools focus on different applications and techniques with performance differences. A comprehensive understanding of these tools will help us make better use of them. To this end, we conduct a comprehensive empirical study to fill the gap by evaluating and comparing all publicly available TPL detection tools based on six criteria: accuracy of TPL construction, effectiveness, efficiency, accuracy of version identification, resiliency to code obfuscation, and ease of use. Besides, we enhance these open-source tools by fixing their limitations, to improve their detection ability. Finally, we build an extensible framework that integrates all existing available TPL detection tools, providing an online service for the research community. We release the evaluation dataset and enhanced tools. According to our study, we also present the essential findings and discuss promising implications to the community; e.g., 1) Most existing TPL detection techniques more or less depend on package structure to construct in-app TPL candidates. However, using package structure as the module decoupling feature is error-prone. We hence suggest future researchers using the class dependency to substitute package structure. 2) Extracted features include richer semantic information (e.g., class dependencies) can achieve better resiliency to code obfuscation. 3) Existing tools usually have a low recall; that is because previous tools ignore some features of Android apps and TPLs, such as the compilation mechanism, the new format of TPLs, TPL dependency. Most existing tools cannot effectively find partial import TPLs, obfuscated TPLs, which directly limit their capability. 4) Existing tools are complementary to each other; we can build a better tool via combining the advantages of each tool. We believe our work provides a clear picture of existing TPL detection techniques and also gives a road-map for future research.

show abstract

Section: Motivationmentioning

confidence: 99%

Section: Preliminary 21 Android Third-party Librarymentioning

confidence: 99%

Section: Overview Of Tpl Detection Toolsmentioning

confidence: 99%

Section: Library Instance Construction Comparisonmentioning

confidence: 99%

See 2 more Smart Citations

A Systematic Assessment on Android Third-party Library Detection Tools

Zhan

Liu

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…LibD [19] detected and classified library candidates based on dependencies between methods and packages. LibSift [29] performed library detection by comparing the primary components of the PDG. In addition, machine learning techniques have been applied to detect third-party libraries [20,22].…”

Section: Related Workmentioning

confidence: 99%

LibID: reliable identification of obfuscated third-party Android libraries

Zhang

Beresford

Kollmann

2019

Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

Third-party libraries are vital components of Android apps, yet they can also introduce serious security threats and impede the accuracy and reliability of app analysis tasks, such as app clone detection. Several library detection approaches have been proposed to address these problems. However, we show these techniques are not robust against popular code obfuscators, such as ProGuard, which is now used in nearly half of all apps. We then present LibID, a library detection tool that is more resilient to code shrinking and package modification than state-of-the-art tools. We show that the library identification problem can be formulated using binary integer programming models. LibID is able to identify specific versions of third-party libraries in candidate apps through static analysis of app binaries coupled with a database of third-party libraries. We propose a novel approach to generate synthetic apps to tune the detection thresholds. Then, we use F-Droid apps as the ground truth to evaluate LibID under different obfuscation settings, which shows that LibID is more robust to code obfuscators than state-of-the-art tools. Finally, we demonstrate the utility of LibID by detecting the use of a vulnerable version of the OkHttp library in nearly 10% of 3,958 most popular apps on the Google Play Store.

show abstract