Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> 1) Comprehending Repackaging Processes: <s> Over the last decade many techniques and tools for software clone detection have been proposed. In this paper, we provide a qualitative comparison and evaluation of the current state-of-the-art in clone detection techniques and tools, and organize the large amount of information into a coherent conceptual framework. We begin with background concepts, a generic clone detection process and an overall taxonomy of current techniques and tools. We then classify, compare and evaluate the techniques and tools in two different dimensions. First, we classify and compare approaches based on a number of facets, each of which has a set of (possibly overlapping) attributes. Second, we qualitatively evaluate the classified techniques and tools with respect to a taxonomy of editing scenarios designed to model the creation of Type-1, Type-2, Type-3 and Type-4 clones. Finally, we provide examples of how one might use the results of this study to choose the most appropriate clone detection tool or technique in the context of a particular set of goals and constraints. The primary contributions of this paper are: (1) a schema for classifying clone detection techniques and tools and a classification of current clone detectors based on this schema, and (2) a taxonomy of editing scenarios that produce different clone types and a qualitative evaluation of current clone detectors based on this taxonomy. <s> BIB001 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> 1) Comprehending Repackaging Processes: <s> With increased popularity and wide adoption of smartphones and mobile devices, recent years have seen a new burgeoning economy model centered around mobile apps. However, app repackaging, among many other threats, brings tremendous risk to the ecosystem, including app developers, app market operators, and end users. To mitigate such threat, we propose and develop a watermarking mechanism for Android apps. First, towards automatic watermark embedding and extraction, we introduce the novel concept of manifest app, which is a companion of a target Android app under protection. We then design and develop a tool named AppInk, which takes the source code of an app as input to automatically generate a new app with a transparently-embedded watermark and the associated manifest app. The manifest app can be later used to reliably recognize embedded watermark with zero user intervention. To demonstrate the effectiveness of AppInk in preventing app repackaging, we analyze its robustness in defending against distortive, subtractive, and additive attacks, and then evaluate its resistance against two open source repackaging tools. Our results show that AppInk is easy to use, effective in defending against current known repackaging threats on Android platform, and introduces small performance overhead. <s> BIB002 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> 1) Comprehending Repackaging Processes: <s> During repackaging, malware writers statically inject malcode and modify the control flow to ensure its execution. Repackaged malware is difficult to detect by existing classification techniques, partly because of their behavioral similarities to benign apps. By exploring the app's internal different behaviors, we propose a new Android repackaged malware detection technique based on code heterogeneity analysis. Our solution strategically partitions the code structure of an app into multiple dependence-based regions (subsets of the code). Each region is independently classified on its behavioral features. We point out the security challenges and design choices for partitioning code structures at the class and method level graphs, and present a solution based on multiple dependence relations. We have performed experimental evaluation with over 7,542 Android apps. For repackaged malware, our partition-based detection reduces false negatives (i.e., missed detection) by 30-fold, when compared to the non-partition-based approach. Overall, our approach achieves a false negative rate of 0.35% and a false positive rate of 2.97%. <s> BIB003 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> 1) Comprehending Repackaging Processes: <s> App repackaging remains a serious threat to the emerging mobile app ecosystem. Previous solutions have mostly focused on the postmortem detection of repackaged apps by measuring similarity among apps. In this paper, we propose DIVILAR, a virtualization-based protection scheme to enable self-defense of Android apps against app repackaging. Specifically, it re-encodes an Android app in a diversified virtual instruction set and uses a specialized execute engine for these virtual instructions to run the protected app. However, this extra layer of execution may cause significant performance overhead, rendering the solution unacceptable for daily use. To address this challenge, we leverage a light-weight hooking mechanism to hook into Dalvik VM, the execution engine for Dalvik bytecode, and piggy-back the decoding of virtual instructions to that of Dalvik bytecode. By compositing virtual and Dalvik instruction execution, we can effectively eliminate this extra layer of execution and significantly reduce the performance overhead. We have implemented a prototype of DIVILAR. Our evaluation shows that DIVILAR is resilient against existing static and dynamic analysis, including these specific to VM-based protection. Further performance evaluation demonstrates its efficiency for daily use (an average of 16.2 and 8.9 increase to the start time and run time, respectively). <s> BIB004
As discussed previously, machine-learning approaches are appealing to ensure scalability and practicality in repackaged app detection. Nevertheless, their design must be based on a solid feature engineering process which should identify features that are truly representative of the repackaging phenomenon. In this work, we have proposed preliminary investigations into such features and focused on features which were easy and fast to extract. More extensive analyses into a large ground truth of repackaging pairs can provide more insights on novel and discriminative features. For example, we have not studied the impact of repackaging on the density of call graphs (since edges are inserted/deleted by modifications of original apps). A more extensive investigation into repackaging processes can further provide a taxonomy of repackaging similar to the types of code clones surveyed by Roy et al. BIB001 . Such a taxonomy can help researchers more precisely inform readers on the target of their research. 2) Graph Analysis: In static analysis, call/dependency graphs are known to be a reliable representation of app structure. Since repackaging is mostly not invasive, a repackaged app may be formed by loosely-coupled modules BIB003 . An efficient analysis of call/ dependency graphs can thus be leveraged in a precise and practical means to detect repackaged apps, i.e., without relying on the availability of the original apps for comparison. 3) Dynamic Analysis: Dynamic analysis, although accurate, is expensive to implement by all market maintainers. Furthermore, because malware can now easily detect when they are run in a sandboxed environment, they may hide the behaviour implemented in the payload added via repackaging. Nevertheless, new avenues of research involved a form of crowdsourcing can be explored, where market maintainers collect runtime information from users' devices for posterior analyses of similar/divergent app behaviour. 4) Repackaging Deterrence: Finally, besides providing market maintainers with means to screen markets for repackaged apps, researchers should provide repackaged app detection in markets, developers should be provided with means for protecting their apps from repackagers. AppInk BIB002 and DIVILAR BIB004 are rare examples of research work attempting to propose approaches for repackaged deterrence in the security community. We feel that the Software engineering community can heavily contribute in this area as well with watermarking techniques.