Measuring code reuse in Android apps
Hugo Gonzalez, Natalia Stakhanova, Ali Akbar Ghorbani · 2016
The appearance of the Android platform and its popularity has resulted in a sharp rise in the number of reported vulnerabilities and consequently in the number of mobile threats. Leveraging openness of Android app markets and the lack of security testing, malware authors commonly plagiarize Android applications through code reuse, boosting the amount of malware on the markets and consequently the infection rate. In the last few years the number of studies focused on detection of mobile app code reuse has drastically increased. Ranging from lightweight detection of suspicious signs to more sophisticated and computationally expensive methods assessing apps' similarity, the studies treated the presence of code reuse as a sign of plagiarized apps and maliciousness. In this work, we revisit this assumption and investigate code reuse in legitimate and malicious mobile apps. The main questions that this study aims to answer are what it is that is being reused, what we can learn from this reuse and consequently how we can use this knowledge. To answer these questions we measure code uniqueness and identify common components originating from third-party sources. We further analyze and correlate reused code extracted from over 60,000 apps from ten markets around the world and commonly used app repositories. As our analysis shows, understanding code reuse can shed some light on app origin and evolution.