Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> Fast, approximate, brute-force similarity comparison <s> We present DNADroid, a tool that detects Android application copying, or “cloning”, by robustly computing the similarity between two applications. DNADroid achieves this by comparing program dependency graphs between methods in candidate applications. Using DNADroid, we found at least 141 applications that have been the victims of cloning, some as many as seven times. DNADroid has a very low false positive rate — we manually confirmed that all the applications detected are indeed clones by either visual or behavioral similarity. We present several case studies that give insight into why applications are cloned, including localization and redirecting ad revenue. We describe a case of malware being added to an application and show how DNADroid was able to detect two variants of the same malware. Lastly, we offer examples of an open source cracking tool being used in the wild. <s> BIB001 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> Fast, approximate, brute-force similarity comparison <s> The ease of Android applications repackaging and proliferation of application clones in Google Play and other markets call for new effective techniques to detect repackaged code and combat distribution of cloned applications. Today all existing techniques for repackaging detection are based on code similarity or feature e.g., permission set similarity evaluation. We propose a new approach to detect repackaging based on the resource files available in application packages. Our tool called FSquaDRA performs a quick pairwise application comparison full pairwise comparison for 55,000 applications in just 80 hours on a laptop, as it measures how many identical resources are present inside both packages under analysis. The intuition behind our approach is that malicious repackaged applications still need to maintain the "look and feel" of the originals by including the same images and other resource files, even though they might have additional code included or some of the original code removed. ::: ::: To evaluate the reliability of our approach we perform a comparison of the FSquaDRA similarity scores with the code-based similarity scores of AndroGuard for a dataset of randomly selected application pairs, and our results demonstrate strong positive correlation of the FSquaDRA resource-based score with the code-based similarity score. <s> BIB002
Given a candidate pair of apps (app 1 , app 2 ) found in a cluster, we compute four similarity metrics, and calculate a score based on Formula (1). • identical (I), which represents the number of methods (signature + body) which are shared by both apps; • similar (S), representing the number of similar (same signature but different body contents) methods between two apps; To ensure a fast computation of the above metrics, we use an approximative representation of app method contents by mapping the different statement types to alphabet characters. For example, the simplified code snippet presented in Listing 1 could be represented by string acc, where an interface and virtual invocation statement are respectively mapped to character a and c. All variables are thus dropped from the comparison. The contents of the different methods thus go through a code-to-text transformation leading to short strings for which efficient similarity analysis algorithms exist. By ignoring easily-manipulable variable names, our code-to-text transformation enables the brute-force comparison to be resilient to simple obfuscations which are commonly performed during repackaging. Although we have attempted to fasten the pairwise comparisons, our similarity analysis still takes roughly one month to finish on all the candidate pairs. Finally, after confirming the effectiveness of our pairwise comparison methodology, we further set the similarity threshold to 80% to decide that a pair of apps is a repackaging pair. We aim to be conservative by selecting a threshold that is more strict than those used in the literature BIB002 , BIB001 . We have performed experiments to validate that the approximation in Phase 2 of the approach is preserving similarity scores, which basically are in line with the scores computed by comparing the exact statements. Furthermore, we also validate that the scores that we obtain is similar to those obtained with state-of-the-art tools such as AndroGuard, which is basically in agreement with our collected pairs (more details are given in Section 5.5).