Towards Global Matches for Third-Party Library Detection in Android

The detection of third-party libraries (TPLs) is pivotal in upholding the security of Android supply chains. A significant hurdle in this domain pertains to ensuring accurate detection, particularly in the face of prevalent code obfuscation techniques. Recently, multiple research endeavors have advocated for the adoption of fuzzy library signatures to accommodate specific code features that can be affected by code obfuscation. Despite the potential promise of this approach, the use of such abstractions often results in the identification of multiple candidates that bear a striking resemblance. Unfortunately, prevailing methodologies tend to rely on local maxima of similarity matches, disregarding the broader contextual knowledge encapsulated within surrounding classes. This oversight culminates in suboptimal matching outcomes.