With the thriving of mobile app markets, third-party libraries are pervasively used in Android applications. The libraries provide functionalities such as advertising, location, and social networking services, making app development much more productive. However, the spread of vulnerable and harmful third-party libraries can also hurt the mobile ecosystem, leading to various security problems. Therefore, third-party library identification has emerged as an important problem, being the basis of many security applications such as repackaging detection, vulnerability identification, and malware analysis. Previously, we proposed a novel approach to identifying third-party Android libraries at a massive scale. Our method uses the internal code dependencies of an app to recognize library candidates and further classify them. With a fine-grained feature hashing strategy, we can better handle code whose package and method names are obfuscated than historical work. We have developed a prototypical tool called LibD and evaluated it with an up-to-date dataset containing 1,427,395 Android apps. Our experiment results show that LibD outperforms existing tools in detecting multi-package third-party libraries with the presence of name-based obfuscation, leading to significantly improved precision without the loss of scalability. In this paper, we extend our early work by investigating the possibility of employing effective and scalable library detection to boost the performance of large-scale app analyses in the real world. We show that the technique of LibD can be used to accelerate whole-app Android vulnerability detection and quickly identify variants of vulnerable third-party libraries. This extension paper sheds light on the practical value of our previous research.

中文翻译：

---

Android Market 中的大规模第三方库检测

随着移动应用市场的蓬勃发展，Android 应用程序中普遍使用第三方库。这些库提供广告、位置和社交网络服务等功能，使应用程序开发更加高效。然而，易受攻击和有害的第三方库的传播也会损害移动生态系统，导致各种安全问题。因此，第三方库识别已经成为一个重要的问题，是重新打包检测、漏洞识别和恶意软件分析等许多安全应用的基础。之前，我们提出了一种新方法来大规模识别第三方 Android 库。我们的方法使用应用程序的内部代码依赖项来识别候选库并对其进行进一步分类。通过细粒度的特征散列策略，我们可以比历史工作更好地处理包名和方法名被混淆的代码。我们开发了一个名为 LibD 的原型工具，并使用包含 1,427,395 个 Android 应用程序的最新数据集对其进行了评估。我们的实验结果表明，LibD 在检测存在基于名称的混淆的多包第三方库方面优于现有工具，从而在不损失可扩展性的情况下显着提高了精度。在本文中，我们通过研究采用有效且可扩展的库检测来提高现实世界中大规模应用程序分析的性能的可能性来扩展我们的早期工作。我们展示了 LibD 技术可用于加速整个应用程序的 Android 漏洞检测并快速识别易受攻击的第三方库的变体。这篇扩展论文阐明了我们之前研究的实用价值。