SUIDroid: An Efficient Hardening-Resilient Approach to Android App Clone Detection

The huge benefit of mobile application industry has attracted a large number of developers. However, application cloning is becoming a serious threat to the entire Android ecosystem, as it not only compromises the security and privacy of the app users but also robs app developers' revenue. As massive approaches have been proposed to address this issue, plagiarists also fight back through hardening their malicious code with the help of commercial packers. Previous work either not considers the hardening issue or just simply cracks the entire packed app, which may threat the security of legitimate packed app. In this paper, we propose SUIDroid, a novel app clone detection approach that can accurately detect the packed clone app without compromising the app hardening strategy. Another advantage of our detection approach is the accuracy. We propose a counting based technique to effectively filter the noisy-layout that can cause deviation. We evaluate our approach on two sets of app dataset. The experimental results on 160 packed malware samples demonstrate that SUIDroid is resilient to app hardening, and the evaluation on more than 100,000 real-world apps shows the efficiency of SUIDroid in real-world scenario.