An Empirical Study on the Robustness of Android Third-Party Library Detection Tools Against Advanced Obfuscation

Third-party libraries (TPLs) play a crucial role in Android app development by providing reusable functionalities, improving development efficiency, and reducing time-to-market. However, detecting and analyzing TPLs is essential, as their vulnerabilities, outdated versions, or malicious modifications can introduce security risks and compromise the integrity of Android apps. Existing TPL detection approaches struggle against code obfuscation, a prevalent practice in Android apps. While prior research has explored obfuscation-resistant detection methods, they largely overlook advanced obfuscation techniques such as package hierarchy obfuscation.

To bridge this gap, we first investigate the prevalence of advanced obfuscation in contemporary Android apps using ObfDetector, a novel static analysis tool capable of detecting identifier renaming, package hierarchy obfuscation, and code optimization. Our large-scale study on 77,504 closed-source Google Play apps and 619 widely used apps reveals extensive obfuscation adoption. We further evaluate the resilience of state-of-the-art TPL detection tools under realistic obfuscation conditions using a newly constructed benchmark dataset, exposing significant performance deficiencies, with F1-scores dropping below 50% for library-level detection and under 10% for version-level identification. Finally, we conduct a systematic failure analysis to uncover key architectural limitations in existing TPL detection frameworks and propose design guidelines for next-generation detection tools. We release our obfuscation detection tool and benchmark dataset to support further research in Android security.

• Software and its engineering → Software libraries and repositories.