Research Article
Detection and Privacy Leakage Analysis of Third-Party Libraries in Android Apps
@INPROCEEDINGS{10.1007/978-3-031-25538-0_30, author={Xiantong Hao and Dandan Ma and Hongliang Liang}, title={Detection and Privacy Leakage Analysis of Third-Party Libraries in Android Apps}, proceedings={Security and Privacy in Communication Networks. 18th EAI International Conference, SecureComm 2022, Virtual Event, October 2022, Proceedings}, proceedings_a={SECURECOMM}, year={2023}, month={2}, keywords={Android Third-party library detection Clustering Privacy leakage analysis}, doi={10.1007/978-3-031-25538-0_30} }- Xiantong Hao
Dandan Ma
Hongliang Liang
Year: 2023
Detection and Privacy Leakage Analysis of Third-Party Libraries in Android Apps
SECURECOMM
Springer
DOI: 10.1007/978-3-031-25538-0_30
Abstract
Third-party libraries (TPL) make Apps’ functionality diversified but introduce severe security risks. Precisely detecting and analyzing TPLs is challenging because their code usually is not publicly available or obfuscated. Prior studies do not perform well in detecting closed-source or obfuscated TPLs and analyzing their privacy risks.
In this paper, we propose a novel approach to detect TPLs in Android Apps and analyze privacy leakage caused by TPLs. The key idea of our approach is that it leverages the call frequencies of different types of APIs as features and conducts a clustering algorithm on these features, our approach works well on obfuscated TPLs, especially those with dead code removal and control flow randomization. We also analyze whether there is privacy leakage in a TPL by dynamically instrumenting privacy-related APIs and inspecting its call stack. We implement our approach in a tool named Libmonitor and evaluate it on 162 obfuscated Apps and 217 real-world Apps. Experimental results show that Libmonitor outperforms two state-of-the-art tools on two datasets. With obfuscated TPLs, Libmonitor improves 394.08% over Libradar and 26.32% over LibD on F1 metric, respectively. With closed-source TPLs, Libmonitor increases 18.66% over Libradar and 150.15% over LibD on F1 metric, respectively. Besides, Libmonitor found 5809 pieces of privacy leakage risks caused by 152 TPLs in 64 real-world Apps.
