一句话：提出 LibID，用静态分析与二进制整数规划识别混淆 Android 应用中的第三方库及其版本。
第三方库是 Android 应用的关键组件，但也带来安全风险并干扰克隆检测等分析任务；现有库检测方法面对 ProGuard 等流行混淆器并不鲁棒。LibID 通过静态分析应用二进制并结合第三方库数据库，将库识别问题形式化为二进制整数规划模型，从而更好抵抗代码压缩和包名修改。作者提出用合成应用调参检测阈值，并以 F-Droid 应用为 ground truth，在不同混淆设置下评估，显示 LibID 比当前最佳工具更鲁棒。最后，LibID 在 Google Play 最热门应用中发现近 10% 使用了含漏洞的 OkHttp 版本。
Third-party libraries are vital components of Android apps, yet they can also introduce serious security threats and impede the accuracy and reliability of app analysis tasks, such as app clone detection. Several library detection approaches have been proposed to address these problems. However, we show these techniques are not robust against popular code obfuscators, such as ProGuard, which is now used in nearly half of all apps. We then present LibID, a library detection tool that is more resilient to code shrinking and package modification than state-of-the-art tools. We show that the library identification problem can be formulated using binary integer programming models. LibID is able to identify specific versions of third-party libraries in candidate apps through static analysis of app binaries coupled with a database of third-party libraries. We propose a novel approach to generate synthetic apps to tune the detection thresholds. Then, we use F-Droid apps as the ground truth to evaluate LibID under different obfuscation settings, which shows that LibID is more robust to code obfuscators than state-of-the-art tools. Finally, we demonstrate the utility of LibID by detecting the use of a vulnerable version of the OkHttp library in nearly 10% of 3,958 most popular apps on the Google Play Store.