FSquaDRA: Fast Detection of Repackaged Applications

  • Yury Zhauniarovich
  • Olga Gadyatskaya
  • Bruno Crispo
  • Francesco La Spina
  • Ermanno Moser
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8566)


The ease of Android applications repackaging and proliferation of application clones in Google Play and other markets call for new effective techniques to detect repackaged code and combat distribution of cloned applications. Today all existing techniques for repackaging detection are based on code similarity or feature (e.g., permission set) similarity evaluation. We propose a new approach to detect repackaging based on the resource files available in application packages. Our tool called FSquaDRA performs a quick pairwise application comparison (full pairwise comparison for 55,000 applications in just 80 hours on a laptop), as it measures how many identical resources are present inside both packages under analysis. The intuition behind our approach is that malicious repackaged applications still need to maintain the “look and feel” of the originals by including the same images and other resource files, even though they might have additional code included or some of the original code removed.

To evaluate the reliability of our approach we perform a comparison of the FSquaDRA similarity scores with the code-based similarity scores of AndroGuard for a dataset of randomly selected application pairs, and our results demonstrate strong positive correlation of the FSquaDRA resource-based score with the code-based similarity score.


Smartphones Repackaging Mobile applications 


  1. 1.
  2. 2.
    AndroGuard: Reverse engineering, Malware and goodware analysis of Android applications,
  3. 3.
    Android-apktool: A tool for reverse engineering Android apk files,
  4. 4.
    Smali: An assembler/disassembler for Android’s dex format,
  5. 5.
    Cilibrasi, R., Vitányi, P.M.B.: Clustering by compression. IEEE Transactions on Information Theory 51, 1523–1545 (2005)CrossRefGoogle Scholar
  6. 6.
    Crussell, J., Gibler, C., Chen, H.: Attack of the clones: Detecting cloned applications on android markets. In: Foresti, S., Yung, M., Martinelli, F. (eds.) ESORICS 2012. LNCS, vol. 7459, pp. 37–54. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  7. 7.
    Crussell, J., Gibler, C., Chen, H.: Scalable semantics-based detection of similar android applications. In: Proc. of Esorics 2013 (2013)Google Scholar
  8. 8.
    Desnos, A.: Android: Static analysis using similarity distance. In: Proc. of HICSS 2012, pp. 5394–5403 (2012)Google Scholar
  9. 9.
    Gibler, C., Stevens, R., Crussell, J., Chen, H., Zang, H., Choi, H.: Adrob: examining the landscape and impact of android application plagiarism. In: Proc. of MobiSys 2013, pp. 431–444 (2013)Google Scholar
  10. 10.
    Hanna, S., Huang, L., Wu, E., Li, S., Chen, C., Song, D.: Juxtapp: A scalable system for detecting code reuse among android applications. In: Flegel, U., Markatos, E., Robertson, W. (eds.) DIMVA 2012. LNCS, vol. 7591, pp. 62–81. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  11. 11.
    Huang, H., Zhu, S., Liu, P., Wu, D.: A framework for evaluating mobile app repackaging detection algorithms. In: Huth, M., Asokan, N., Čapkun, S., Flechais, I., Coles-Kemp, L. (eds.) TRUST 2013. LNCS, vol. 7904, pp. 169–186. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  12. 12.
    Potharaju, R., Newell, A., Nita-Rotaru, C., Zhang, X.: Plagiarizing smartphone applications: attack strategies and defense techniques. In: Barthe, G., Livshits, B., Scandariato, R. (eds.) ESSoS 2012. LNCS, vol. 7159, pp. 106–120. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  13. 13.
    Protalinski, E.: Warning: New Android malware tricks users with real Opera Mini (July 2012),
  14. 14.
    Vidas, T., Christin, N.: Sweetening android lemon markets: measuring and combating malware in application marketplaces. In: Proc. of CODASPY 2013, pp. 197–208 (2013)Google Scholar
  15. 15.
    Zhou, W., Zhou, Y., Grace, M., Jiang, X., Zou, S.: Fast, scalable detection of ”piggybacked” mobile applications. In: Proc. of CODASPY 2013, pp. 185–196 (2013)Google Scholar
  16. 16.
    Zhou, W., Zhou, Y., Jiang, X., Ning, P.: Detecting repackaged smartphone applications in third-party android marketplaces. In: Proc. of CODASPY 2012, pp. 317–326 (2012)Google Scholar

Copyright information

© IFIP International Federation for Information Processing 2014

Authors and Affiliations

  • Yury Zhauniarovich
    • 1
  • Olga Gadyatskaya
    • 1
    • 2
  • Bruno Crispo
    • 1
  • Francesco La Spina
    • 1
  • Ermanno Moser
    • 1
  1. 1.Department of Information Engineering and Computer ScienceUniversity of TrentoTrentoItaly
  2. 2.Interdisciplinary Center for Security, Reliability and TrustUniversity of LuxembourgLuxembourg CityLuxembourg

Personalised recommendations