Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark

Abstract

Repackaging is a serious threat to the Android ecosystem as it deprives app developers of their benefits, contributes to spreading malware on users' devices, and increases the workload of market maintainers. In the space of six years, the research around this specific issue has produced 57 approaches which do not readily scale to millions of apps or are only evaluated on private datasets without, in general, tool support available to the community. Through a systematic literature review of the subject, we argue that the research is slowing down, where many state-of-the-art approaches have reported high-performance rates on closed datasets, which are unfortunately difficult to replicate and to compare against. In this work, we propose to reboot the research in repackaged app detection by providing a literature review that summarises the challenges and current solutions for detecting repackaged apps and by providing a large dataset that supports replications of existing solutions and implications of new research directions. We hope that these contributions will re-activate the direction of detecting repackaged apps and spark innovative approaches going beyond the current state-of-the-art.

On Transparency and Accountability of Smart Assistants in Smart Cities

“…The purpose of data collection was to observe user decisions for learning their permission expectations against given functions. These data would help us determine the gap among user expectations and the actual permission requirements of GA. We determined this gap by analyzing the responses to learn their similarities with the permission requirements of GA. To achieve this, we calculated Jaccard similarity among the responses and the actual permission requirements of GA. Jaccard similarity has been used in research addressing decision-making issues, and discovering harmful behaviors of Android apps [70][71][72]. Measuring the Jaccard similarity coefficient j between two datasets A and B is the result of the division between the number of features that are common to all divided by the total number of properties [73].…”

Mining Android crash fixes in the absence of issue- and change-tracking systems

“…Static analysis has been also a popular technique to dissect Android apps [23,24,38,41]. For example, researchers have used static taint analysis to discovery privacy leaks in Android apps [4] and leveraged model checking techniques to verify Android apps in terms of their security properties [6].…”

Detecting Repackaged Android Applications Using Perceptual Hashing

“…More recently, Nguyen et al [15] demonstrated the complete ineffectiveness of commercial and open-source anti-virus Android apps in detecting a malicious repackaged application (Snapchatz). Li et al [16] in a 2019 survey-based study also highlighted the shutdown by federal authorities of alternative Android market places because of app plagiarism (repackaging or cloning) [17]. The same survey [16] also recounted reports by Ustwo Games that only 5% of the Android installations for one of its more popular games were legitimate (as in paid for, and not repackaged or cloned).…”

“…Li et al [16] in a 2019 survey-based study also highlighted the shutdown by federal authorities of alternative Android market places because of app plagiarism (repackaging or cloning) [17]. The same survey [16] also recounted reports by Ustwo Games that only 5% of the Android installations for one of its more popular games were legitimate (as in paid for, and not repackaged or cloned).…”

“…The predominance of repackaged apps and their effect on the Android user community has thus spurred considerable study, as researchers continue to look for better methods for detecting repackaged applications and techniques for code cloning or reuse detection. As Li et al [16] report in a recent survey, a six-year window has produced 57 different proposed approaches, most of which involve the use of static techniques based on code similarity or heterogeneity. Static techniques are most negatively affected by code obfuscation and could be completely defeated by packing whereby the code base is encrypted until execution.…”