IEICE TRANSACTIONS on Information
APPraiser: A Large Scale Analysis of Android Clone Apps
Summary :
Android is one of the most popular mobile device platforms. However, since Android apps can be disassembled easily, attackers inject additional advertisements or malicious codes to the original apps and redistribute them. There are a non-negligible number of such repackaged apps. We generally call those malicious repackaged apps “clones.” However, there are apps that are not clones but are similar to each other. We call such apps “relatives.” In this work, we developed a framework called APPraiser that extracts similar apps and classifies them into clones and relatives from the large dataset. We used the APPraiser framework to study over 1.3 million apps collected from both official and third-party marketplaces. Our extensive analysis revealed the following findings: In the official marketplace, 79% of similar apps were attributed to relatives, while in the third-party marketplace, 50% of similar apps were attributed to clones. The majority of relatives are apps developed by prolific developers in both marketplaces. We also found that in the third-party market, of the clones that were originally published in the official market, 76% of them are malware.
- Publication
- IEICE TRANSACTIONS on Information Vol.E100-D No.8 pp.1703-1713
- Publication Date
- 2017/08/01
- Publicized
- 2017/05/18
- Online ISSN
- 1745-1361
- DOI
- 10.1587/transinf.2016ICP0012
- Type of Manuscript
- Special Section PAPER (Special Section on Information and Communication System Security)
- Category
- Program Analysis
Authors
Yuta ISHII
Waseda University
Takuya WATANABE
NTT Secure Platform Laboratories
Mitsuaki AKIYAMA
NTT Secure Platform Laboratories
Tatsuya MORI
Waseda University
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Yuta ISHII, Takuya WATANABE, Mitsuaki AKIYAMA, Tatsuya MORI, "APPraiser: A Large Scale Analysis of Android Clone Apps" in IEICE TRANSACTIONS on Information,
vol. E100-D, no. 8, pp. 1703-1713, August 2017, doi: 10.1587/transinf.2016ICP0012.
Abstract: Android is one of the most popular mobile device platforms. However, since Android apps can be disassembled easily, attackers inject additional advertisements or malicious codes to the original apps and redistribute them. There are a non-negligible number of such repackaged apps. We generally call those malicious repackaged apps “clones.” However, there are apps that are not clones but are similar to each other. We call such apps “relatives.” In this work, we developed a framework called APPraiser that extracts similar apps and classifies them into clones and relatives from the large dataset. We used the APPraiser framework to study over 1.3 million apps collected from both official and third-party marketplaces. Our extensive analysis revealed the following findings: In the official marketplace, 79% of similar apps were attributed to relatives, while in the third-party marketplace, 50% of similar apps were attributed to clones. The majority of relatives are apps developed by prolific developers in both marketplaces. We also found that in the third-party market, of the clones that were originally published in the official market, 76% of them are malware.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.2016ICP0012/_p
Copy
@ARTICLE{e100-d_8_1703,
author={Yuta ISHII, Takuya WATANABE, Mitsuaki AKIYAMA, Tatsuya MORI, },
journal={IEICE TRANSACTIONS on Information},
title={APPraiser: A Large Scale Analysis of Android Clone Apps},
year={2017},
volume={E100-D},
number={8},
pages={1703-1713},
abstract={Android is one of the most popular mobile device platforms. However, since Android apps can be disassembled easily, attackers inject additional advertisements or malicious codes to the original apps and redistribute them. There are a non-negligible number of such repackaged apps. We generally call those malicious repackaged apps “clones.” However, there are apps that are not clones but are similar to each other. We call such apps “relatives.” In this work, we developed a framework called APPraiser that extracts similar apps and classifies them into clones and relatives from the large dataset. We used the APPraiser framework to study over 1.3 million apps collected from both official and third-party marketplaces. Our extensive analysis revealed the following findings: In the official marketplace, 79% of similar apps were attributed to relatives, while in the third-party marketplace, 50% of similar apps were attributed to clones. The majority of relatives are apps developed by prolific developers in both marketplaces. We also found that in the third-party market, of the clones that were originally published in the official market, 76% of them are malware.},
keywords={},
doi={10.1587/transinf.2016ICP0012},
ISSN={1745-1361},
month={August},}
Copy
TY - JOUR
TI - APPraiser: A Large Scale Analysis of Android Clone Apps
T2 - IEICE TRANSACTIONS on Information
SP - 1703
EP - 1713
AU - Yuta ISHII
AU - Takuya WATANABE
AU - Mitsuaki AKIYAMA
AU - Tatsuya MORI
PY - 2017
DO - 10.1587/transinf.2016ICP0012
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E100-D
IS - 8
JA - IEICE TRANSACTIONS on Information
Y1 - August 2017
AB - Android is one of the most popular mobile device platforms. However, since Android apps can be disassembled easily, attackers inject additional advertisements or malicious codes to the original apps and redistribute them. There are a non-negligible number of such repackaged apps. We generally call those malicious repackaged apps “clones.” However, there are apps that are not clones but are similar to each other. We call such apps “relatives.” In this work, we developed a framework called APPraiser that extracts similar apps and classifies them into clones and relatives from the large dataset. We used the APPraiser framework to study over 1.3 million apps collected from both official and third-party marketplaces. Our extensive analysis revealed the following findings: In the official marketplace, 79% of similar apps were attributed to relatives, while in the third-party marketplace, 50% of similar apps were attributed to clones. The majority of relatives are apps developed by prolific developers in both marketplaces. We also found that in the third-party market, of the clones that were originally published in the official market, 76% of them are malware.
ER -
English
