Context aware method models improve Android library detection accuracy
Context-Aware Functional Modeling for Android Third-Party Library Detection
Cryptography and SecuritySoftware Engineering
Summary
Android apps often reuse pieces of code from third-party libraries, but this can cause security problems and make analysis harder. The authors made a tool called LibFan that better detects these libraries, even when parts are changed or only some parts are used. LibFan learns about how functions relate to each other and breaks libraries into smaller meaningful parts to identify them more accurately. Their tests showed that LibFan outperforms existing methods, especially on apps that have been heavily modified.
What this means in practice
- •For mobile app developers: Identify reused library code accurately even after obfuscation or partial inclusion to better manage security risks during development.
- •For software security analysts: Detect vulnerable third-party libraries in Android apps more reliably despite code transformations and partial reuse to improve vulnerability assessments.
Authors
Dihao Fan, Jian Zhang, Yasai Shi, Chuan Luo, Xudong Liu, Yang Liu, Chunming Hu, Xu Wang
Abstract
Third-party libraries (TPLs) are widely used in Android apps, but their reuse can introduce security risks and interfere with downstream program analyses. Existing Android TPL detection approaches face two key limitations: their hand-crafted features are fragile under aggressive code transformations, and their whole-library matching strategies are ineffective when apps retain only part of a TPL. In this paper, we propose LibFan, a learning-based Android TPL detection approach based on context-aware functional modeling. It realizes this modeling through two complementary components: context-aware contrastive learning at the method level and functional partitioning at the library level. At the method level, it learns semantic representations through contrastive training while incorporating outgoing call relationships and class-level context, improving robustness to obfuscation, shrinking, and optimization. At the library level, it partitions each TPL into functionally coherent units and determines library presence using the best-matching partition, thereby accommodating partial library reuse. To evaluate LibFan, we construct a new benchmark comprising 200 apps and 46 vulnerable TPLs, with each app compiled under four transformation configurations. Under the most challenging R8 full mode, LibFan achieves F1 scores of 81.3% at the library level and 47.6% at the version level, representing relative improvements of 64.9% and 35.6% over the state of the art, respectively.