分析五百万个安卓应用，发现代码混淆率八年升13%。
An Empirical Study of Code Obfuscation Practices in the Google Play Store
- 构建分类器识别混淆工具与技术，追踪八年间趋势。
- 2016至2023年混淆率上升13%，ProGuard和Allatori最常用。
- 头部应用和赌场类游戏更倾向使用混淆，适合安全研究者参考。
Android生态易受应用重组、仿冒和盗版威胁，损害开发者与用户利益。为应对风险，开发者常采用代码混淆技术。但混淆虽能保护合法应用，也常被恶意利用，阻碍安全调查。本文分析了来自Google Play的超过50万份Android APK文件，覆盖八年时间，研究混淆技术的演变与普及程度。我们提出一组分类器以检测混淆代码、工具与技术，并进行纵向分析。结果显示，2016至2023年间混淆率上升13%，其中ProGuard和Allatori是最常用的工具。此外，高排名应用及博彩类应用中混淆现象更为普遍。本研究是首个针对Google Play商店混淆实践的大规模分析，为开发者与安全分析师提供重要洞见。
原文摘要 · Abstract (English)
The Android ecosystem is vulnerable to issues such as app repackaging, counterfeiting, and piracy, threatening both developers and users. To mitigate these risks, developers often employ code obfuscation techniques. However, while effective in protecting legitimate applications, obfuscation also hinders security investigations as it is often exploited for malicious purposes. As such, it is important to understand code obfuscation practices in Android apps. In this paper, we analyze over 500,000 Android APKs from Google Play, spanning an eight-year period, to investigate the evolution and prevalence of code obfuscation techniques. First, we propose a set of classifiers to detect obfuscated code, tools, and techniques and then conduct a longitudinal analysis to identify trends. Our results show a 13% increase in obfuscation from 2016 to 2023, with ProGuard and Allatori as the most commonly used tools. We also show that obfuscation is more prevalent in top-ranked apps and gaming genres such as Casino apps. To our knowledge, this is the first large-scale study of obfuscation adoption in the Google Play Store, providing insights for developers and security analysts.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。