Libra: Library Identification in Obfuscated Android Apps

Abstract

In the Android apps ecosystem, third-party libraries play a crucial role in providing common services and features. However, these libraries introduce complex dependencies that can impact stability, performance, and security. Therefore, detecting libraries used in Android apps is critical for understanding functionality, compliance, and security risks. Existing library identification approaches face challenges when obfuscation is applied to apps, leading to performance degradation. In this study, we propose Libra, a novel solution for library identification in obfuscated Android apps. Libra leverages method headers and bodies, encodes instructions compactly, and employs piecewise fuzzy hashing for effective detection of libraries in obfuscated apps. Our two-phase approach achieves high F1 scores of $88\%$ for non-obfuscated and 50–87% for obfuscated apps, surpassing previous works by significant margins. Extensive evaluations demonstrate Libra’s effectiveness and robustness against various obfuscation techniques.

K. Nwodo—This work was done as part of an internship at Quokka.

Appendices

A Method Encoding Codebook

Table 10 shows the codebook used by Libra to encode method instructions. We conducted feature selection to determine the best mapping using Fisher’s score [18] to gain insights into the most discriminatory instructions. Our analysis revealed that field getters, setters, and arithmetic operators exhibited low variance, making them less useful for discrimination. Consequently, we decided to combine these arithmetic instructions into a single move instruction.

Table 10. Bytecode encoding codebook used by Libra.

B Search Space Reduction from Library Pairing

The pairing size complexity for pairs that satisfy condition one is O(k), where n is the number of libraries in the database, and $k \ll n$ represents the group size. On the other hand, the pairing size complexity for condition two is $O(|P_{C2}|)$, where $P_{C2}$ is defined as:

$$ P_{C2} = \left\{ \langle C, L \rangle \mid C \in A, L \in D, \frac{{{\,\textrm{abs}\,}}(|A| - |D|)}{\max (|A|, |D|)} < \tau \right\} $$

where C is the library candidate, L is the library, A is the app, and D is the database. If no conditions are met, the library candidate is paired with the entire database, resulting in a pairing size complexity of O(n). Note that this is unlikely as there are a wide range of library sizes from the order of $10^0$ to $10^3$ and condition two is likely to be met.