一句话：提出首个检测 iOS 应用中第三方库名称与版本的指纹匹配工具 LibKit。
iOS 应用常经 CocoaPods 引入第三方库，但仅从可执行文件识别其名称与版本十分困难，尤其面对 Swift/Objective-C、静态/动态链接、部分包含库及不同编译器配置产生的变体。LibKit 自动为 CocoaPods 上 86K 个库版本构建指纹，并在解密后的应用可执行文件中匹配，从而识别所使用第三方库的名称与版本。在 95 个开源应用标注上，精确率 0.911、召回率 0.839，识别库边界显著优于 CRiOS；对 1,500 个 iTunes 应用检测出 47,015 个库版本，发现含旧版本库的流行应用。
We present LibKit, the first approach and tool for detecting the name and version of third-party libraries (TPLs) present in iOS apps. LibKit automatically builds fingerprints for 86K library versions available through the CocoaPods dependency manager and matches them on the decrypted app executables to identify the TPLs (name and version) an iOS app uses. LibKit supports apps written in Swift and Objective-C, detects statically and dynamically linked libraries, and addresses challenges such as partially included libraries and different compiler versions and configurations producing variants of the same library version. On a ground truth of 95 open-source apps, LibKit identifies libraries with a precision of 0.911 and a recall of 0.839. LibKit also significantly outperforms the state-of-the-art CRiOS tool for identifying TPL boundaries. When applied to 1,500 apps from the iTunes Store, LibKit detects 47,015 library versions, identifying popular apps that contain old library versions.
@inproceedings{Dominguez-Alvarez23,
title = {LibKit: Detecting Third-Party Libraries in iOS Apps},
author = {Daniel Domínguez-Álvarez and Alejandro de la Cruz and Alessandra Gorla and Juan Caballero},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3616344}
}