LibRoad: Rapid, Online, and Accurate Detection of TPLs on Android

Third-party library (TPL) detection plays a very important role in Android malware analysis. The focus of recent works has been shifted to the signature-based approach. However, previous methods have several limitations such as high time complexity and low precision, especially with the presence of similar TPLs and various versions of a TPL. To solve these issues, we propose a rapid, online, and accurate TPL detection approach, named LibRoad, which also follows the line of the signature-based research. To reduce the time cost, our approach integrates an application preprocessing component and a pairwise package matching component. The former divides an application into primary modules and non-primary modules to enable us to focus on analyzing packages in non-primary modules that are the most possibly imported from a TPL. The latter adopts a combination of the package name based matching policy for non-obfuscated packages and the signature-based matching policy for obfuscated packages, where the package name based matching policy has a lower time complexity than the signature based one. Further, to improve performance, our approach integrates a perfectly matched package and TPL determination component, which adopts the package filter mechanism, online TPL detection, and local TPL discovery to identify TPLs with low false positive and false negative. We conduct several groups of experiments on real-world applications and two ground truth bases. Experimental results show that compared to state-of-the-art approaches, LibRoad can achieve a high recall of 99.86 percent and a low false positive rate of 11.48 percent without the loss of efficiency.