Obfuscation-Resilient Code Recognition in Android Apps

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Many Android developers take advantage of third-party libraries and code snippets from public sources to add functionality to apps. Besides making development more productive, external code can also be harmful, introduce vulnerabilities, or raise critical privacy issues that threaten the security of sensitive user data and amplify an app's attack surface. Reliably recognizing such code fragments in Android applications is challenging due to the widespread use of obfuscation techniques and a variety of ways, how developers can express semantically similar program statements.

We propose a code recognition technique that is resilient against common code transformations and that excels in identifying code fragments and libraries in Android applications. Our method relies on obfuscation-resilient features from the Abstract Syntax Tree of methods and uses them in combination with invariant attributes from method signatures to derive well-characterizing fingerprints. To identify similar code, we elaborate an effective scoring metric that reliably compares fingerprints at method, class, and package level. We investigate how well our solution tackles obfuscated, shrunken, and optimized code by applying our technique to real-world applications. We thoroughly evaluate our solution and demonstrate its practical ability to fingerprint and recognize code with high precision and recall.
Original languageEnglish
Title of host publication14th International Conference on Availability, Reliability and Security (ARES 2019)
Place of PublicationNew York
PublisherAssociation of Computing Machinery
Number of pages10
ISBN (Print)978-1-4503-7164-3/19/08
DOIs
Publication statusPublished - 2019
EventInternational Conference on Availability, Reliability and Security - University of Kent, Canterbury, United Kingdom
Duration: 26 Aug 201929 Aug 2019
https://www.ares-conference.eu/

Conference

ConferenceInternational Conference on Availability, Reliability and Security
Abbreviated titleARES 2019
CountryUnited Kingdom
CityCanterbury
Period26/08/1929/08/19
Internet address

Keywords

  • Android
  • Abstract Syntax Tree
  • Fingerprinting
  • Library Detection
  • Code Similarity
  • Code Recognition
  • Obfuscation

Fingerprint Dive into the research topics of 'Obfuscation-Resilient Code Recognition in Android Apps'. Together they form a unique fingerprint.

  • Projects

    A-SIT - Secure Information Technology Center Austria

    Stranacher, K., Dominikus, S., Leitold, H., Marsalek, A., Teufl, P., Bauer, W., Aigner, M. J., Rössler, T., Neuherz, E., Dietrich, K., Zefferer, T., Mangard, S., Payer, U., Orthacker, C., Lipp, P., Reiter, A., Knall, T., Bratko, H., Bonato, M., Suzic, B., Zwattendorfer, B., Kreuzhuber, S., Oswald, M. E., Tauber, A., Posch, R., Bratko, D., Feichtner, J., Ivkovic, M., Reimair, F., Wolkerstorfer, J. & Scheibelhofer, K.

    21/05/996/08/20

    Project: Research area

    Cite this

    Feichtner, J., & Rabensteiner, C. (2019). Obfuscation-Resilient Code Recognition in Android Apps. In 14th International Conference on Availability, Reliability and Security (ARES 2019) New York: Association of Computing Machinery. https://doi.org/10.1145/3339252.3339260