一句话：指出现有 Android 第三方库检测工具缺乏系统研究，其应用场景与性能差异尚不明确。
第三方库（TPL）已成为 Android 生态的重要组成部分，开发者利用不同功能的 TPL 加速应用开发。然而 TPL 的流行也带来恶意或脆弱代码传播等威胁，并会在恶意软件检测、重打包应用检测等下游任务中引入噪声。为此，研究者开发了多种 TPL 检测工具。但现有工作尚未对这些工具进行详细研究；不同工具面向不同应用场景，性能存在差异，而社区对其了解甚少。本文聚焦 Android 应用中的自动化 TPL 检测，围绕现有 TPL 检测工具展开梳理与研究，旨在揭示其应用定位与性能差异。
Third-party libraries (TPLs) have become a significant part of the Android ecosystem. Developers can employ various TPLs with different functionalities to facilitate their app development. Unfortunately, the popularity of TPLs also brings new challenges and even threats. TPLs may carry malicious or vulnerable code, which can infect popular apps to pose threats to mobile users. Besides, the code of third-party libraries could constitute noises in some downstream tasks (e.g., malware and repackaged app detection). Thus, researchers have developed various tools to identify TPLs. However, no existing work has studied these TPL detection tools in detail; different tools focus on different applications with performance differences, but little is known about them.
DOI 原文 ·
@inproceedings{paperbot5881,
title = {Automated third-party library detection for Android applications},
author = {Xian Zhan and Lingling Fan and Tianming Liu and Sen Chen and Li Li and Haoyu Wang and Yifei Xu and Xiapu Luo and Yang Liu},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3416582}
}