【20221129第五期分享】 今天我们介绍一篇针对Android平台三方库检测工具的横向测评论文（值得注意是，本文是ASE 2020论文 Automated third-party library detection for android applications: Are we there yet? 的期刊扩展版）： <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GO8L7KFmT0933sDZAxWTAsHoBibtEDgvYWZx6Vy052fpPbs4DA6pxaH8Az6AOOOiajqZxxOiaNKUWAA.png" alt="" data-href="" style="width: 596px !important;height: auto !important;">本文主要比较对象是Android平台应用APP中的三方库（third party library）检测工具。三方库检测工具在现实应用中主要存在的两个问题是如何有效对抗代码混淆，以及如何识别特定的三方库版本。通常来说，第三方库的识别遵循如下流程：<img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPFeZic0lAmHgZSSnfxovCtrdcQNxvqY6DLGJBibmxlBn3yhTd744s1icYQ.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> 为了分析APP中的三方库，对其进行分解的技术路线如下图所示 <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GO8L7KFmT0933sDZAxWTAsPicgslYf9dpfyfJ5ulO7RX5otuzcx2Ef8GiaGXvDlMpRqvD5ibCHFPWMQ.png" alt="" data-href="" style="width: 541px !important;height: auto !important;"> 论文总共比较了12款相关工具： <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPjn1aWIRn7NRDIwsZ6suDkmPsfyxreDtqib81jFtE1EZtXrSiczbeEoXw.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> 从准确性上考虑，作者认为工具里面最好的是LibScout <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDP5pRcKugLKpAcVZibTRcccRCIlIr2ycwq3Iy7d5ejMdsBLibibnrgJAPVg.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPugUDZXn2icBUqFjwMGicWUXNj30UcBlgicicLzSRBm6SAicVribYiagNLP4Tw.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> 从分析效率上考虑，作者认为LibRadar最佳（每个app分析平均只花费了5.53秒！） <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPQkeduRyzPplPm8R4o0NwS4lF6f46sWvGGYvU1vlkCUCYw9SIHJ8dbA.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> 从识别三方库版本的角度，作者认为大家都做得不咋地…… <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPqQzlvhMDVavRKCiaLeFJstGk0Txnn8cfKnlPcw3X0oCPdykFru3hqyA.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> 在对抗代码混淆方面，作者的结论是各有千秋，ORLIS对不同的混淆器都有比较好的效果，而LibPecker是其中综合表现最好的一款 <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPYEbPkgCgScJKs0WnJyVzWPt4UibJ9IjjJ30tt6j71N0T0Hg6c48oQPg.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPicvYibibKTQ5qRFpdInFicUqlXDjMytJQ8Q2CHjAD2yGCfgwWL9CoicvVGQ.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> 作者还对工具的易用性进行了评估（泪奔），然后强烈安利大家使用LibRadar！ <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPEZoEWGPafGJhMb1PB3thb0NUqe06lboWRgicWBEI9Zibg7ygt5cYyDMA.png" alt="" data-href="" style="width: 596px !important;height: auto !important;"> <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/uicdfzKrO21GMC7rknqNt3MWMo8KpvxDPRSvIrFCsfCvA6UqMFnbQsb1t0bKofUJXqanibIQC02BZeA4pT6VTWAA.png" alt="" data-href="" style="width: 596px !important;height: auto !important;">论文网站：https://sites.google.com/view/libdetect/论文PDF：https://arxiv.org/pdf/2108.01964.pdfEND添加DataCon小助手微信微信号：DataConofficial获取更多学习资料 <img src="https://datacon-pro-public.oss-cn-shenzhen.aliyuncs.com/rich_text_image/DataCon%E5%A4%A7%E6%95%B0%E6%8D%AE%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%E7%AB%9E%E8%B5%9B/imgs/RicNZQMn3FU404mXGBJyHLlibG1NK555Q9O0gshBicsAUGLEfxH8SIRickqZI5MbKnB8bM2h2cg47eEf717ltsyB8g.png" alt="" data-href="" style="width: 676.991px !important;height: auto !important;"> 报名时间：11月1日-11月29日竞赛时间：12月1日-12月10日报名链接：https://datacon.qianxin.com/datacon2022QQ交流群：962067583

Xian Zhan

Tianming Liu

Yepang Liu

Yang Liu

Li Li

Haoyu Wang

Xiapu Luo

The IEEE/ACM Automated Software Engineering (ASE) Conference series is the premier research forum for automated software engineering. Each year, it brings together researchers and practitioners from academia and industry to discuss foundations, techniques, and tools for automating the analysis, design, implementation, testing, and maintenance of large software systems.

Third-party libraries (TPLs) have become a significant part of the Android ecosystem. Developers can employ various TPLs to facilitate their app development. Unfortunately, the popularity of TPLs also brings new security issues. For example, TPLs may carry malicious or vulnerable code, which can infect popular apps to pose threats to mobile users. Furthermore, TPL detection is essential for downstream tasks, such as vulnerabilities and malware detection. Thus, various tools have been developed to identify TPLs. However, no existing work has studied these TPL detection tools in detail, and different tools focus on different applications and techniques with performance differences. A comprehensive understanding of these tools will help us make better use of them.
To this end, we conduct a comprehensive empirical study to fill the gap by evaluating and comparing all publicly available TPL detection tools based on six criteria: accuracy of TPL construction, effectiveness, efficiency, accuracy of version identification, resiliency to code obfuscation, and ease of use. Besides, we enhance these open-source tools by fixing their limitations, to improve their detection ability. Finally, we build an extensible framework that integrates all existing available TPL detection tools, providing an online service for the research community. We release the evaluation dataset and enhanced tools. According to our study, we also present the essential findings and discuss promising implications to the community; e.g., 1) Most existing TPL detection techniques more or less depend on package structure to construct in-app TPL candidates. However, using package structure as the module decoupling feature is error-prone. We hence suggest future researchers using the class dependency to substitute package structure. 2) Extracted features include richer semantic information (e.g., class dependencies) can achieve better resiliency to code obfuscation. 3) Existing tools usually have a low recall; that is because previous tools ignore some features of Android apps and TPLs, such as the compilation mechanism, the new format of TPLs, TPL dependency. Most existing tools cannot effectively find partial import TPLs, obfuscated TPLs, which directly limit their capability. 4) Existing tools are complementary to each other; we can build a better tool via combining the advantages of each tool. We believe our work provides a clear picture of existing TPL detection techniques and also gives a road-map for future research.


A Systematic Assessment on Android Third-party Library Detection Tools

今天我们介绍一篇针对Android平台三方库检测工具的横向测评论文（值得注意是，本文是ASE 2020论文 Automated third-party library detection for android applications: Are we there yet 的期刊扩展版）

论文分享 | 针对Android平台三方库检测工具的横向测评

A Systematic Assessment on Android Third-party Library Detection Tools查看来源