Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> We present DNADroid, a tool that detects Android application copying, or “cloning”, by robustly computing the similarity between two applications. DNADroid achieves this by comparing program dependency graphs between methods in candidate applications. Using DNADroid, we found at least 141 applications that have been the victims of cloning, some as many as seven times. DNADroid has a very low false positive rate — we manually confirmed that all the applications detected are indeed clones by either visual or behavioral similarity. We present several case studies that give insight into why applications are cloned, including localization and redirecting ad revenue. We describe a case of malware being added to an application and show how DNADroid was able to detect two variants of the same malware. Lastly, we offer examples of an open source cracking tool being used in the wild. <s> BIB001 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> Malicious activities involving Android applications are rising rapidly. As prior work on cyber-crimes suggests, we need to understand the economic incentives of the criminals to design the most effective defenses. In this paper, we investigate application plagiarism on Android markets at a large scale. We take the first step to characterize plagiarized applications and estimate their impact on the original application developers. We first crawled 265,359 free applications from 17 Android markets around the world and ran a tool to identify similar applications ("clones"). Based on the data, we examined properties of the cloned applications, including their distribution across different markets, application categories, and ad libraries. Next, we examined how cloned applications affect the original developers. We captured HTTP advertising traffic generated by mobile applications at a tier-1 US cellular carrier for 12 days. To associate each Android application with its advertising traffic, we extracted a unique advertising identifier (called the client ID) from both the applications and the network traces. We estimate a lower bound on the advertising revenue that cloned applications siphon from the original developers, and the user base that cloned applications divert from the original applications. To the best of our knowledge, this is the first large scale study on the characteristics of cloned mobile applications and their impact on the original developers. <s> BIB002 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> Although anyone can easily publish Android applications (or apps) in an app marketplace according to an open policy, decompiling the apps is also easy due to the structural characteristics of the app building process, making them very vulnerable to forgery or modification attacks. In particular, users may suffer direct financial loss if this vulnerability is exploited in security-critical private and business applications, such as online banking. In this paper, some of the major Android-based smartphone banking apps in Korea being distributed on either the Android Market or the third party market were tested to verify whether a money transfer could be made to an unintended recipient. The experimental results with real Android banking apps showed that an attack of this kind is possible without having to illegally obtain any of the sender's personal information, such as the senders public key certificate, the password to their bank account, or their security card. In addition, the cause of this vulnerability is analyzed and some technical countermeasures are discussed. <s> BIB003 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> With increased popularity and wide adoption of smartphones and mobile devices, recent years have seen a new burgeoning economy model centered around mobile apps. However, app repackaging, among many other threats, brings tremendous risk to the ecosystem, including app developers, app market operators, and end users. To mitigate such threat, we propose and develop a watermarking mechanism for Android apps. First, towards automatic watermark embedding and extraction, we introduce the novel concept of manifest app, which is a companion of a target Android app under protection. We then design and develop a tool named AppInk, which takes the source code of an app as input to automatically generate a new app with a transparently-embedded watermark and the associated manifest app. The manifest app can be later used to reliably recognize embedded watermark with zero user intervention. To demonstrate the effectiveness of AppInk in preventing app repackaging, we analyze its robustness in defending against distortive, subtractive, and additive attacks, and then evaluate its resistance against two open source repackaging tools. Our results show that AppInk is easy to use, effective in defending against current known repackaging threats on Android platform, and introduces small performance overhead. <s> BIB004 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> Software plagiarism in Android markets (app repackaging) is raising serious concerns about the health of the Android ecosystem. Existing app repackaging detection techniques fall short in detection efficiency and in resilience to circumventing attacks; this allows repackaged apps to be widely propagated and causes extensive damages before being detected. To overcome these difficulties and instantly thwart app repackaging threats, we devise a new dynamic software watermarking technique - Droidmarking - for Android apps that combines the efforts of all stakeholders and achieves the following three goals: (1) copyright ownership assertion for developers, (2) real-time app repackaging detection on user devices, and (3) resilience to evading attacks. Distinct from existing watermarking techniques, the watermarks in Droidmarking are non-stealthy, which means that watermark locations are not intentionally concealed, yet still are impervious to evading attacks. This property effectively enables normal users to recover and verify watermark copyright information without requiring a confidential watermark recognizer. Droidmarking is based on a primitive called self-decrypting code (SDC). Our evaluations show that Droidmarking is a feasible and robust technique to effectively impede app repackaging with relatively small performance overhead. <s> BIB005 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> To devise e cient approaches and tools for detecting malicious code in the Android ecosystem, researchers are increasingly required to have deep understanding of malware. There is thus a need to provide a framework for dissecting malware and localizing malicious program fragments within app code in order to build a comprehensive dataset of malicious samples. In this paper we address this need with an approach for listing malicious packages in an app based on code graph analysis. To that end we focus on piggybacked apps, which are benign apps repackaged with malicious payload. Our approach classifies each app independently from its potential clones based on machine learning, and detects piggybacked apps with a precision of about 97%. With the built classifier we were also able to find new piggybacked apps in market datasets, outside our ground truth. We also identify malicious packages with an accuracy@5 of 83% and an accuracy@1 of around 68%. We further demonstrate the importance of collecting malicious packages by using them to build a performant malware detection system. <s> BIB006 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> We present a growing collection of Android Applications col-lected from several sources, including the official GooglePlay app market. Our dataset, AndroZoo, currently contains more than three million apps, each of which has beenanalysed by tens of different AntiVirus products to knowwhich applications are detected as Malware. We provide thisdataset to contribute to ongoing research efforts, as well asto enable new potential research topics on Android Apps.By releasing our dataset to the research community, we alsoaim at encouraging our fellow researchers to engage in reproducible experiments. <s> BIB007 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> We present a growing collection of Android apps collected from several sources, including the official Google Play app market and a growing collection of various metadata of those collected apps aiming at facilitating the Android-relevant research works. Our dataset by far has collected over five million apps and over 20 types of metadata such as VirusTotal reports. Our objective of collecting this dataset is to contribute to ongoing research efforts, as well as to enable new potential research topics on Android Apps. By releasing our app and metadata set to the research community, we also aim at encouraging our fellow researchers to engage in reproducible experiments. ::: This article will be continuously updated based on the growing apps and metadata collected in the AndroZoo project. If you have specific metadata that you want to collect from AndroZoo and which are not yet provided by far, please let us know. We will thereby prioritise it in our collecting process so as to provide it to our fellow researchers in a short manner. <s> BIB008 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> INTRODUCTION <s> To ensure the quality and trustworthiness of the apps within its app market (i.e., Google Play), Google has released a series of policies to regulate app developers. As a result, policy-violating apps (e.g., malware, low-quality apps, etc.) have been removed by Google Play periodically. In reality, we have found that the number of removed apps are actually much more than what we have expected, as almost half of all the apps have been removed or replaced from Google Play during a two year period from 2015 to 2017. However, despite the significant number of removed apps, there are almost no study on the characterization of these removed apps. To this end, this paper takes the first step to understand why Android apps are removed from Google Play, aiming at observing promising insights for both market maintainers and app developers towards building a better app ecosystem. By leveraging two app sets crawled from Google Play in 2015 (over 1.5 million) and 2017 (over 2.1 million), we have identified a set of over 790K removed apps, which are then thoroughly investigated in various aspects. The experimental results have revealed various interesting findings, as well as insights for future research directions. <s> BIB009
Mobile applications, especially Android apps, are straightforward to reverse engineer, copy and resubmit to markets BIB002 . The Android application packaging system indeed relies on the ZIP open compression format to archive apps' resource files and decompilable bytecode, making it easy for anyone with the adequate tool support to unpack any app, modify its contents, and repackage it. Repackaging is thus a common threat to the Android ecosystem, where it is used by plagiarists who clone apps from other developers, e.g., in order to redirect advertisement revenue BIB002 , BIB001 , and by malware writers who piggyback malicious payloads on popular apps to spread malware BIB006 . Android app repackaging has been raised as a serious problem by various authors in the literature as well as by different stakeholders in the app development industry. For example, large-scale application plagiarism  has led to the shutdown of several non-official app markets. Last year, Ustwo Games, developer of the popular "Monument Valley" game, has reported that only 5% of Monument Valley installations on Android are paid for [5] , with various copies being available from different "authors" in the same market. Very recently, the famous Pokemon Go app has been repackaged in different ways and for different reasons as mentioned in the Lookout blog  . In a different category, Jung et al. BIB003 have presented a serious case of repackaging attacks on Korea's Banking Android apps, demonstrating how it was possible to redirect money transfers without having to illegally obtain any of the sender's personal information such as bank accounts. • L. Li is with the Faculty of Information Technology, Monash University, Australia. • T. Bissyandé and J. Klein are with the Interdisciplinary Centre for Security, Reliability and Trust, University of Luxembourg, Luxembourg. Manuscript received XXX; revised XXX. To limit repackaging and its impacts, different steps must be taken by all concerned parties. For example, developers may explore different techniques for watermarking their apps and denying some functionalities when it becomes obvious that the running copy is a cloned version BIB004 , BIB005 . Nevertheless, most of the workload is carried by market maintainers who must employ powerful tools to catch repackaged apps in a fast and accurate way so as to remove them from markets BIB009 . A number of research studies in the literature have investigated a variety of repackaging detection approaches without convincingly demonstrating that the problem is now well addressed. In this paper, we revisit the state of research on repackaged app detection, insisting on the practical challenges that the community must focus on for implementing effective repackaged app detection solutions for Android markets. Overall we make the following contributions: • We propose a systematic review of the state-of-the-art literature on repackaged app detection and highlight their shortcomings in terms of the impracticality of the approaches, lack of reproducibility, and suboptimal evaluation scenarios. • We build the RePack dataset and release it to the community to encourage proper assessment of repackaged app detection approaches. Our work builds upon the popular AndroZoo repository BIB007 , BIB008 , which can serve as an exchange repository for describing one's dataset using the hash values of apps. We also enumerate research directions that the community should take up for advancing the state-of-the-art in the topic. The remainder of this paper is organised as follows. Section 2 clarifies the terminology used, and explains the procedure for the Systematic Literature Review (SLR) that we have conducted on the topic of Android repackaged app detection. Section 3 discusses the prominent challenges in arXiv:1811.08520v1 [cs.SE] 20 Nov 2018 taming app repackaging. Then, Section 4 summarises the different contributions made in the literature and highlight some issues in their approaches and evaluations. Section 5 describes our efforts in addressing some important challenges. Notably, we discuss the construction of a large dataset of repackaging pairs from the AndroZoo app repository. Sections 6 and 7 discuss priority research directions and potential threats to validity of this study respectively. Section 8 enumerates closely related work and Section 9 finally provides concluding remarks. All artefacts of our research are available in the RePack repository at: https://github.com/serval-snt-uni-lu/RePack