MDSDroid: A Multi-level Detection System for Android Repackaged Applications

The repackaged Android applications released in the app markets have posed huge threats to users' privacy and security. Prior detection algorithms based on code similarity can hardly detect obfuscated and encrypted applications. UI features are resistant to code reinforcement, but they may lack scalability if dynamically obtained when an application is executing, therefore they can be affected by noise through static methods. In this paper, MDSDroid (Multi-level Detection System for Android Apps) is proposed, which combines the fast scalability of static methods with the accuracy of dynamic methods into the extraction of layout features. A novel tree structure similarity comparison algorithm is presented to measure applications' similarity on the multi-dimensional sequence. Our method is evaluated on the AndroZoo dataset. Experiments show that it has better performance than the well-known repackaging detection tool FSquaDRA, in terms of accuracy, scalability, and resistance to code reinforcement.