Juxtapp and DStruct: Detection of Similarity Among Android Applications

摘要: In recent years, we have witnessed an incredible growth in the adoption of smartphones, which has been accompanied by influx applications. Users can purchase or download applications for free onto their mobile phones from centralized application markets such as Google’s Android Market and Amazon’s third party market. Despite rapidly increasing volume available on markets, these marketplaces often only cursorily review applications, many are unreviewed due to vast number submissions. Markets largely rely user policing reporting detect that may be misleading its functionality misbehaving. This reactive approach is neither scalable nor reliable incidence piracy malware increased, putting too much responsibility end users. To automate process identifying problematic previously proposed Juxtapp, a infrastructure code similarity analysis among Juxtapp able find instances malware, piracy, vulnerable detecting reuse Such system must fast, so this paper discuss distributed implementation Juxtapp. We evaluate Juxtapp’s performance up 95,000 parallelized analyze rapidly. aid users analysis, introduce web service automatically manages resources required run service. For complementary approach, propose DStruct, tool similar based directory structures. DStruct provides another method performing address problems security, including determining if pirated contain known malware. our using more than 58,000 official market Chinese experiments, 3 variants popular paid game 9 malicious Furthermore, market, detected 4 legitimate authors had used repackage with efficacy provide further insights into improving detection tools ours.