SimiDroid: Identifying and Explaining Similarities in Android Apps

Abstract

Abstract-App updates and repackaging are recurrent in the Android ecosystem, filling markets with similar apps that must be identified and analyzed to accelerate user adoption, improve development efforts, and prevent malware spreading. Despite the existence of several approaches to improve the scalability of detecting repackaged/cloned apps, researchers and practitioners are eventually faced with the need for a comprehensive pairwise comparison to understand and validate the similarities among apps. This paper describes the design of SimiDroid, a framework for multi-level comparison of Android apps. SimiDroid is built with the aim to support the understanding of similarities/changes among app versions and among repackaged apps. In particular, we demonstrate the need and usefulness of such a framework based on different case studies implementing different analyzing scenarios for revealing various insights on how repackaged apps are built. We further show that the similarity comparison plugins implemented in SimiDroid yield more accurate results than the state-of-the-art.

Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark

“…In particular, we check that the proposed approach/methodology 1) meets market constraints (in terms of scalability and usability in practice), 2) is evaluated based on a constructed reference dataset (whatever its size and representativeness), 3) explicitly accounts for app obfuscation (to any extent), and 4) attempts to reduce the noise of common libraries. Details in Table 3 show that no approach addresses all challenges, with Market-scale constraints being the least tackled in the [36] Symptom discovery string offset order CodeMatch [19] Similarity Comparison code fuzzy hash FUIDroid [22] Similarity Comparison layout tree APPraiser [23] Similarity Comparison resource files RepDroid [24] Similarity Comparison layout group graph SimiDroid [25] Similarity Comparison method statements, resource files, components GroupDroid [26] Similarity Comparison control flow graph CLANdroid [27] Similarity Comparison Identifiers, APIs, Intents, Permissions, and Sensors Li et al [31] Similarity Comparison method-level signature RepDetector [33] Similarity Comparison inputs/outputs of methods Wu et al [44] Similarity Comparison HTTP distance FSquaDRA2 [30] Similarity Comparison signature of resource files SUIDroid [34] Similarity Comparison layout tree DroidClone [29] Similarity Comparison control flow pattern Niu et al [32] Similarity Comparison method-level signature AndroSimilar2 [37] Similarity Comparison entropy of byte block AndroSimilar [62] Similarity Comparison entropy of byte block DroidEagle [39] Similarity Comparison visual resources ImageStruct [40] Similarity Comparison images Soh et al [43] Similarity Comparison user interfaces Chen et al [38] Similarity Comparison method-level signature powered by NiCad [89] MassVet [41] Similarity Comparison centroid of UI structures, method-call graphs DroidKin [50] Similarity Comparison meta-info and n-gram bytecode/opcode Ruiz et al [58] Similarity Comparison count-, set-, sequence-, and relationship-based objects Linares-Vásquez et al [55] Similarity Comparison count-, set-, sequence-, and relationship-based objects Chen et al…”

“…Finally, we investigate how the accuracy of repackaged [19] (10000,100000) DR-Droid2 [20] (1000,10000) DAPASA [21] (10000,100000) FUIDroid [22] (10000,100000) APPraiser [23] (1000000, ∞) RepDroid [24] (100,1000) SimiDroid [25] (1000,10000) GroupDroid [26] (1000,10000) CLANdroid [27] (10000,100000) DR-Droid [28] (1000,10000) DroidClone [29] (100,1000) FSquaDRA2 [30] (1000,10000) Li et al [31] α (1000000, ∞) Niu et al [32] -RepDetector [33] (1000,10000) SUIDroid [34] (100000,1000000) Kim et al [35] (100,1000) AndroidSOO [36] (10000,100000) AndroSimilar2 [37] (10000,100000) Chen et al [38] (1000,10000) DroidEagle [39] (1000000, ∞) ImageStruct [40] (10000,100000) MassVet [41] (1000000, ∞) PICARD [42] (0,100) Soh et al [43] (100,1000) Wu et al [44] (1000,10000) WuKong [45] (100000,1000000) AnDarwin2 [46] (100000,1000000) AndRadar [47] (100000,1000000) Chen et al [48] (10000,100000) DIVILAR [49] (0,100) DroidKin [50] (1000,10000) DroidLegacy [51] (1000,10000) DroidMarking [9] (100,1000) DroidSim [52] (100,1000) FSquaDRA [53] (10000,100000) Kywe et al [54] (10000,100000) Linares-Vásquez et al [55] α (10000,100000) PlayDrone [56] α (1000000, ∞) ResDroid [57] (1000...…”

“…Distance metrics used in Similarity computation approaches.PLayDrone[56], FSquaDRA[53], ViewDroid[59], PiggyApp[66], Jux-tApp[71], Wu et al[44], Ruiz et al[73], Ruiz et al[58], Linares-Vásquez et al[55], Li et al[31], SimiDroid[25], APPraiser[23], Kim et al[35] 13 Euclidean n 1 (x i − y i )2 Potharaju et al[72], Soh et al [43] 2 Normalized Compression L X|Y −min{L X ,L Y } max{L X ,L Y } Chen et al [38], Chen et al [48], FSquaDRA2 [30], AndroSimilar [62], CodeMatch [19] 1 x i , y i are elements of feature set X, Y . 2 s i in Mahalanobis algorithm is the standard deviation of x i , y i over the sample set.…”

Mining AndroZoo: A Retrospect

“…We present a research framework called SimiDroid [22] that supports multi-level pairwise similarity comparison of Android apps, aiming at supporting the understanding of similarities or changes among app versions and among repackaged apps. SimiDroid is designed as a plugin-based framework that has already integrated various comparison methods such as code-based or resource-based comparisons.…”

The Multi-Generation Repackaging Hypothesis

“…Fortunately, state-of-the-art works have put a lot of effort in proposing new approaches for detecting repackaged apps. Existing techniques perform pairwise similarity comparisons [3], [4], build on unsupervised learning [5] and supervised learning [6], leverage runtime monitoring [7], or focus on symptoms identification [8], [9], [?] to detect repackaged apps.…”