一句话：系统研究代码优化对 Android 第三方库检测的影响，并提出抗优化、混淆与缩减的检测工具 LibHunter。
Android 应用广泛复用第三方库（TPL），但其中的漏洞版本会带来安全风险，现有 TPL 版本检测工具虽声称抗混淆，却未考虑发布过程中常见的代码优化，导致检测效果下降。本文系统研究不同优化策略如何以及在多大程度上影响现有工具，并据此设计 LibHunter，以抵抗内联、CallSite 优化等主流优化，同时兼顾混淆和代码缩减。在同时启用优化、混淆与缩减的数据集上，LibHunter 在库级和版本级的 F1 分别比最佳工具提高 29.3% 和 36.1%。作者还将其用于 Google Play 热门应用中的易受攻击 TPL 检测，验证了可扩展性及辅助恶意软件检测的潜力。
Android applications (apps) widely use third-party libraries (TPLs) to reuse functionalities and simplify the development process. Unfortunately, these TPLs often suffer from vulnerabilities that attackers can exploit, leading to catastrophic consequences for app users. To mitigate this threat, researchers have developed tools to detect TPL versions in the app. If an app is found using a TPL vulnerable version, these tools will issue warnings. Although these tools claim to resist the effects of code obfuscation, our preliminary study indicates that code optimization is common during the app release process. A lack of consideration for the impact of code optimizations significantly reduces the effectiveness of existing tools. To fill this gap, this work systematically investigates how and to what extent different optimization strategies affect existing tools. Our findings have led to a new tool named LibHunter, designed to against major code optimization strategies (e.g., Inlining and CallSite Optimization) while also resisting code obfuscation and shrinking. Extensive evaluations on a dataset of apps with optimization, obfuscation, and shrinking enabled show LibHunter significantly outperforms existing tools. It achieves F1 value that surpass the best tools by 29.3% and 36.1% at the library and version levels, respectively. We also applied LibHunter to detect vulnerable TPLs in the top Google Play apps, which shows the scalability of our approach, as well as the potential of our approach to facilitate malware detection.
DOI 原文 ·
@inproceedings{paperbot8343,
title = {How Does Code Optimization Impact Third-party Library Detection for Android Applications?},
author = {Zifan Xie and Ming Wen and Tinghan Li and Yiding Zhu and Qinsheng Hou and Hai Jin},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695554}
}