一句话：提出 TacDroid，融合动静态分析构建 UI 转换图并用图自编码器补全，精准检测非法 Android 应用。
非法应用（色情、赌博、诈骗等）已形成地下产业，但现有检测多依赖静态分析；当应用通过动态资源加载实现核心功能时，静态分析覆盖与准确率不足。TacDroid 融合动静态分析：分别构建 Android 应用的动态与静态 UI 转换图（UTG），关联为中间 UTG，并嵌入图结构，用增强图自编码器（GAE）做链路预测，删除静态误判的假阳性边、补充遗漏的假阴性边，得到完整准确 UTG，据此判断合法性并识别类别。评估显示 F1 达 96.73%，显著优于现有最优方法。
Illicit apps have emerged as a thriving underground industry, driven by their substantial profitability. These apps either offer users restricted services (e.g., porn and gambling) or engage in fraudulent activities like scams. Despite the widespread presence of illicit apps, scant attention has been directed towards this issue, with several existing detection methods predominantly relying on static analysis alone. However, given the burgeoning trend wherein an increasing number of mobile apps achieve their core functionality through dynamic resource loading, depending solely on static analysis proves inadequate. To address this challenge, in this paper, we introduce Tac-droid,a novel approach that integrates dynamic analysis for dynamic content retrieval with static analysis to mitigate the limitations inherent in both methods, i.e., the low coverage of dynamic analysis and the low accuracy of static analysis. Specifically, Tacdroid conducts both dynamic and static analyses on an Android app to construct dynamic and static User Interface Transition Graphs (UTGs), respectively. These two UTGs are then correlated to create an intermediate UTG. Subsequently, Tacdroid embeds graph structure and utilizes an enhanced Graph Autoencoder (GAE) model to predict transitions between nodes. Through link prediction, Tacdroid effectively eliminates false positive transition edges stemming from misjudgments in static analysis and supplements false negative transition edges overlooked in the intermediate UTG, thereby generating a comprehensive and accurate UTG. Finally, Tacdroid determines the legitimacy of an app and identifies its category based on the app's UTG. Our evaluation results highlight the outstanding accuracy of Tacdroid in detecting illicit apps. It significantly surpasses the state-of-the-art work, achieving an F1-score of 96.73%. This work represents a notable advancement in the identification and categorization of illicit apps.
DOI 原文 ·
@inproceedings{paperbot8893,
title = {TacDroid: Detection of Illicit Apps Through Hybrid Analysis of UI-Based Transition Graphs},
author = {Yanchen Lu and Hongyu Lin and Zehua He and Haitao Xu and Zhao Li and Shuai Hao and Liu Wang and Haoyu Wang and Kui Ren},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00111}
}