Extending the X-TPL Dataset with additional Hybrid Android App Frameworks and Native Android Apps
Abstract
The idea of this project is to extend an exsting dataset for Android apps and their third-party libraries. Our current research relies on a foundational dataset of Android hybrid applications to analyze Third-Party Library (TPL) usage and associated security risks. The dataset contains currently Flutter, .NET MAUI, React Native, and Apache Cordova apps and we want to extend this with additional frameworks, such as Ionic or Unity. While we already maintain an automated data acquisition pipeline, this seminar project focuses on extending its capabilities to systematically crawl, download, and build applications built with additional modern hybrid frameworks (such as Ionic, Unity, etc.) from public repositories (e.g., GitHub, Gitlab, etc.). Crucially, this project will also expand the pipeline and dataset to include purely native Android applications. This native inclusion will serve as a vital control group, enabling comparative benchmarks that highlight architectural, performance, and security differences between native and cross-platform paradigms.
Empirical mobile security research depends heavily on the availability of large-scale, well-maintained datasets. While corpora for traditional native apps (Java/Kotlin) are accessible, the ecosystem for tracking and categorizing hybrid applications is still fragmented. Researchers need a balanced, unified dataset to train detection models and evaluate software composition accurately. Currently, acquiring specific hybrid apps requires manual effort or disjointed scripts. This fragmentation severely hinders the advancement of 1-day vulnerability detection tools, which are critical for identifying known, unpatched vulnerabilities that persist when developers reuse outdated or custom-modified third-party libraries. Because complex code dependencies and custom developer modifications make finding these lingering 1-day vulnerabilities incredibly difficult, a robust testing corpus is essential. The main idea behind extending this dataset is to build a unified, automated ground-truth benchmark that maps dependency structures across all major cross-platform and native architectures.
Motivation
A diverse and expansive dataset is the backbone of reproducible security research. Without a large sample size of both hybrid and native applications, findings regarding TPL vulnerabilities or framework-specific risks lack generalizability. By automating the data collection and classification process, we remove a major hurdle for future research initiatives. Furthermore, establishing a side-by-side benchmark of native and hybrid apps allows the research community to concretely analyze how modern cross-platform development impacts an application’s security posture and dependency graph compared to traditional native development.
Goal
The primary objective of this seminar work or bachelor thesis is to extend our existing application dataset by extending an existing automated crawling, classification, and processing pipeline. The specific deliverables include:
- Developing a scraper/crawler to automatically fetch source code and metadata from app repositories (e.g., GitHub).
- Expanding the current dataset to include modern hybrid (e.g., Ionic, Unity, etc.) and native Android applications (e.g., Java/Kotlin).
- Documenting the pipeline architecture and providing a structured, ready-to-use benchmark dataset for subsequent static analysis tasks.
Requirements
To successfully complete this project, the student should have:
- Solid programming skills in Python.
- Familiarity with data processing, docker containers, web crawling.
- A basic understanding of Android application packaging (APK structure, Manifest files) and app building (e.g., Gradle).
- An interest in data engineering and building resilient, automated workflows.
Pointers
Supervision
Supervisor: Thomas Sutter
Professor: Prof. Dr. Timo Kehrer
Contact
If you are interested in this project or have any questions, please reach out!