PROJECT TITLE :

LibRoad: Rapid, Online, and Accurate Detection of TPLs on Android

ABSTRACT:

The detection of third-party libraries, also known as TPLs, is an extremely important part of Android malware analysis. The signature-based approach has become the primary concentration of attention in recent works. Previous methods, on the other hand, have a number of drawbacks, including a high time complexity and a low precision, particularly when there are multiple versions of a TPL and TPLs that are very similar to one another. Our solution to these problems is an approach to TPL detection that is quick, online, and accurate. We have given it the name LibRoad, and it follows the line of research that signature-based research has been taking. Our strategy incorporates a component for application preprocessing as well as a component for pairwise package matching in order to cut down on the time investment required. The first method partitions an application into primary modules and non-primary modules, allowing us to concentrate our attention on the packages contained in the non-primary modules that are most likely to have been imported from a TPL. The latter makes use of a combination of the package name based matching policy for non-obfuscated packages and the signature-based matching policy for obfuscated packages, with the package name based matching policy having a lower time complexity than the signature based one. In addition, in order to boost performance, our method incorporates a package and TPL determination component that is perfectly matched to each other. This component utilizes a package filter mechanism, online TPL detection, and local TPL discovery in order to identify TPLs that have a low rate of false positives and false negatives. Several different groups of experiments are carried out on real-world applications, in addition to two ground truth bases. According to the findings of various experiments, LibRoad is capable of achieving a high recall of 99.86 percent and a low false positive rate of 11.48 percent without sacrificing efficiency when compared to methods that are currently considered to be state of the art.