The idea of this project is to extend an exsting dataset for Android apps and their third-party libraries. Our current research relies on a foundational dataset of Android hybrid applications to analyze Third-Party Library (TPL) usage and associated security risks. The dataset contains currently Flutter, .NET MAUI, React Native, and Apache Cordova apps and we want to extend this with additional frameworks, such as Ionic or Unity. While we already maintain an automated data acquisition pipeline, this seminar project focuses on extending its capabilities to systematically crawl, download, and build applications built with additional modern hybrid frameworks (such as Ionic, Unity, etc.) from public repositories (e.g., GitHub, Gitlab, etc.). Crucially, this project will also expand the pipeline and dataset to include purely native Android applications. This native inclusion will serve as a vital control group, enabling comparative benchmarks that highlight architectural, performance, and security differences between native and cross-platform paradigms.
Modern Android applications are increasingly built using hybrid frameworks such as React Native, Flutter, and Cordova, allowing developers to deploy apps across multiple platforms with a single codebase. Like native apps, hybrid applications heavily rely on Third-Party Libraries (TPLs) to accelerate development and integrate functionalities like analytics, advertising, and UI components. However, TPLs can introduce severe security vulnerabilities and privacy risks. While numerous techniques exist to detect TPLs in native Android applications (analyzing Dalvik bytecode), identifying TPLs in hybrid apps remains a significant challenge. This project aims to bridge this gap by investigating the structure of hybrid apps and developing a novel approach to accurately detect embedded TPLs within their non-native components (e.g., JavaScript bundles, Dart binaries).