Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> Supporting Replication and Comparison of Stateof-the-art work <s> Software plagiarism in Android markets (app repackaging) is raising serious concerns about the health of the Android ecosystem. Existing app repackaging detection techniques fall short in detection efficiency and in resilience to circumventing attacks; this allows repackaged apps to be widely propagated and causes extensive damages before being detected. To overcome these difficulties and instantly thwart app repackaging threats, we devise a new dynamic software watermarking technique - Droidmarking - for Android apps that combines the efforts of all stakeholders and achieves the following three goals: (1) copyright ownership assertion for developers, (2) real-time app repackaging detection on user devices, and (3) resilience to evading attacks. Distinct from existing watermarking techniques, the watermarks in Droidmarking are non-stealthy, which means that watermark locations are not intentionally concealed, yet still are impervious to evading attacks. This property effectively enables normal users to recover and verify watermark copyright information without requiring a confidential watermark recognizer. Droidmarking is based on a primitive called self-decrypting code (SDC). Our evaluations show that Droidmarking is a feasible and robust technique to effectively impede app repackaging with relatively small performance overhead. <s> BIB001 </s> Rebooting Research on Detecting Repackaged Android Apps: Literature Review and Benchmark <s> Supporting Replication and Comparison of Stateof-the-art work <s> The Android packaging model offers ample opportunities for malware writers to piggyback malicious code in popular apps, which can then be easily spread to a large user base. Although recent research has produced approaches and tools to identify piggybacked apps, the literature lacks a comprehensive investigation into such phenomenon. We fill this gap by: 1) systematically building a large set of piggybacked and benign apps pairs, which we release to the community; 2) empirically studying the characteristics of malicious piggybacked apps in comparison with their benign counterparts; and 3) providing insights on piggybacking processes. Among several findings providing insights analysis techniques should build upon to improve the overall detection and classification accuracy of piggybacked apps, we show that piggybacking operations not only concern app code, but also extensively manipulates app resource files, largely contradicting common beliefs. We also find that piggybacking is done with little sophistication, in many cases automatically, and often via library code. <s> BIB002
Towards demonstrating the ability to support replication and comparison studies, we revisit a couple of literature approaches for repackaging detection which have made their associated tools available. As shown in Table 5 , only seven research approaches have made some tools available. Nevertheless, not all of them are applicable for our study: CLANdroid, CodeMatch and RepDroid cannot be directly executed as they former two approaches require a corpus preprocessing step and while the last one expects a complicated runtime environment with hard-coded platform dependencies. FSquaDRA2 and FSquaDRA share the same basics in their approaches, experimenting one of them should be enough. As a result, we focus on replicating the experiments of FSquaDRA (resource-based comparison), Androguard (approximate code-based comparison), and SimiDroid (exact code-based comparison) based on our RePack dataset. In this work, we use recall to characterise the ability of state-of-the-art tools to detect repackaged apps BIB001 . If a pair in the RePack benchmark is flagged as a repackaged pair, we consider it as a True Positive (TP) result. Otherwise, if the pair is flagged as a non-repackaged pair, we consider it as a False Negative (FN) result. Then, the recall of a given tool can be computed based on the following formula: Due to exceptions thrown by AndroGuard, FSquaDRA and SimiDroid, we eventually consider results for 8,078 pairs, among the pairs in RePack, where all the three tools have successfully finished their analyses. Given the same threshold at 80%, AndroGuard is in agreement with our collected dataset for 86% pairs while FSquaDRA only agrees for 11% pairs. In other words, while similarity scores by AndroGuard would allow identifying 86% of pairs in our dataset (i.e., recall is 86%), similarity by FSquaDRA is only aligned for 11% of the RePack pairs (i.e., recall is 11%). Regarding the similarity results of SimiDroid, we only observe seven pairs (out of in total 11,255 successfully finished analyses) that have their similarity scores less than 80%, resulting in almost 100% recall. Fig. 9 further plots the results of FSquaDRA by different thresholds. The lower threshold considered, the higher the results achieved. Nonetheless, even with lower thresholds, the results of FSquaDRA are still not comparable to that of AndroGuard and SimiDroid. These results show that the similarity analysis we have performed for building possible repackaging pairs is highly in line with the analysis of AndroGuard and SimiDroid but not in line with the analysis of FSquaDRA. The disagreement of FSquaDRA could be explained by one of the findings BIB001 . The reason why precision is not considered is that in this work we assume all the repackaged pairs in our benchmark are true positives. Therefore, there will be no false positives reported and hence the precision of state-of-the-art tools will be always 100%. summarized by Li et al. BIB002 , where the authors experimentally demonstrate that repackaging may also largely manipulate the resource files which would thus lead to poor results for resource-based similarity analysis tools. Fig. 10  further shows q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q q Finally, we proceed ourselves to propose a straightforward scalable repackaged app detection approach based on our insights on analysing repackaging pairs in the RePack dataset. This approach uses classification technique based on symptoms (i.e., component capability declaration, app permission requests, mismatch between package and Launcher component names, package name diversity, favoured sensitive apis) of the repackaging process appearing in apps. Overall, this straightforward approach achieves 81% F-Measure for distinguishing repackaged apps from non-repackaged ones. Although these performance scores are lower than many performances (up to 100%) recorded in the literature, they are obtained, to the best of our knowledge, from the first readily reproducible experiments with an approach that is not based on pairwise similarity computation. The performance of this technique, measured on RePack, can be considered as a reasonable baseline to improve within the community. For the sake of space, we provide the details of this approach as a supplementary document for interested readers to refer to.