Revisiting Third-Party Library Detection: A Ground Truth Dataset and Its Implications Across Security Tasks
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866908521032843264 |
|---|---|
| author | Gu, Jintao Lu, Haolang Nan, Guoshun Lin, Yihan Wang, Kun Guo, Yuchun Cao, Yigui Liu, Yang |
| author_facet | Gu, Jintao Lu, Haolang Nan, Guoshun Lin, Yihan Wang, Kun Guo, Yuchun Cao, Yigui Liu, Yang |
| contents | Accurate detection of third-party libraries (TPLs) is fundamental to Android security, supporting vulnerability tracking, malware detection, and supply chain auditing. Despite many proposed tools, their real-world effectiveness remains unclear. We present the first large-scale empirical study of ten state-of-the-art TPL detection techniques across over 6,000 apps, enabled by a new ground truth dataset with precise version-level annotations for both remote and local dependencies. Our evaluation exposes tool fragility to R8-era transformations, weak version discrimination, inaccurate correspondence of candidate libraries, difficulty in generalizing similarity thresholds, and prohibitive runtime/memory overheads at scale. Beyond tool assessment, we further analyze how TPLs shape downstream tasks, including vulnerability analysis, malware detection, secret leakage assessment, and LLM-based evaluation. From this perspective, our study provides concrete insights into how TPL characteristics affect these tasks and informs future improvements in security analysis. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2509_04091 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Revisiting Third-Party Library Detection: A Ground Truth Dataset and Its Implications Across Security Tasks Gu, Jintao Lu, Haolang Nan, Guoshun Lin, Yihan Wang, Kun Guo, Yuchun Cao, Yigui Liu, Yang Cryptography and Security 68M25 K.6.5; D.2.7 Accurate detection of third-party libraries (TPLs) is fundamental to Android security, supporting vulnerability tracking, malware detection, and supply chain auditing. Despite many proposed tools, their real-world effectiveness remains unclear. We present the first large-scale empirical study of ten state-of-the-art TPL detection techniques across over 6,000 apps, enabled by a new ground truth dataset with precise version-level annotations for both remote and local dependencies. Our evaluation exposes tool fragility to R8-era transformations, weak version discrimination, inaccurate correspondence of candidate libraries, difficulty in generalizing similarity thresholds, and prohibitive runtime/memory overheads at scale. Beyond tool assessment, we further analyze how TPLs shape downstream tasks, including vulnerability analysis, malware detection, secret leakage assessment, and LLM-based evaluation. From this perspective, our study provides concrete insights into how TPL characteristics affect these tasks and informs future improvements in security analysis. |
| title | Revisiting Third-Party Library Detection: A Ground Truth Dataset and Its Implications Across Security Tasks |
| topic | Cryptography and Security 68M25 K.6.5; D.2.7 |
| url | https://arxiv.org/abs/2509.04091 |