Abstract
Modern Android applications are increasingly built using hybrid frameworks such as React Native, Flutter, and Cordova, allowing developers to deploy apps across multiple platforms with a single codebase. Like native apps, hybrid applications heavily rely on Third-Party Libraries (TPLs) to accelerate development and integrate functionalities like analytics, advertising, and UI components. However, TPLs can introduce severe security vulnerabilities and privacy risks. While numerous techniques exist to detect TPLs in native Android applications (analyzing Dalvik bytecode), identifying TPLs in hybrid apps remains a significant challenge. This project aims to bridge this gap by investigating the structure of hybrid apps and developing a novel approach to accurately detect embedded TPLs within their non-native components (e.g., JavaScript bundles, Dart binaries).
Software Composition Analysis (SCA) is a critical domain in mobile security, focusing on understanding the building blocks of applications. When assessing an app’s security and privacy posture, knowing which third-party code it executes is paramount. Existing state-of-the-art tools (e.g., LibScout, LibRadar) excel at analyzing Java/Kotlin bytecode in standard APKs. However, hybrid apps compile their core business logic and library dependencies into alternative formats—such as minified JavaScript files in React Native or compiled ARM code in Flutter. This context shift renders traditional TPL detection tools largely ineffective on the hybrid parts of the application.
To facilitate this research, an extensive, pre-collected dataset of hybrid mobile applications is already available and ready for analysis with a ground truth of their third-party libraries. This curated collection comprises real-world Android apps developed across the primary cross-platform frameworks, including Flutter, React Native, Apache Cordova, and .NET MAUI. Having this corpus in place eliminates the time-consuming overhead of data collection, scraping, and framework identification, allowing the student to immediately focus on reverse engineering, dependency extraction, and developing the core third-party library detection methodology.
Motivation
With over 70% of top apps utilizing some form of cross-platform or hybrid framework, the blind spot in hybrid TPL detection poses a massive threat to mobile security ecosystems. If a widely used hybrid library contains a critical CVE (Common Vulnerabilities and Exposures) or violates GDPR by exfiltrating user data, security researchers and app stores currently struggle to detect which apps are affected. Solving this problem will significantly enhance our ability to audit mobile applications at scale and protect end-users from vulnerable or malicious third-party code.
Goal
The primary goal of this project is to design, implement, and evaluate a methodology for detecting Third-Party Libraries in Android hybrid apps. Depending on the project type (Bachelor, Master, or Seminar), the scope can be adapted:
- Bachelor / Seminar: Focus on a single framework (e.g., React Native). Analyze how JS bundles are structured in the APK and build a prototype using fuzzy hashing or any other method you might like to detect them.
- Master: Tackle multiple frameworks (e.g., Flutter and React Native), handle obfuscation/minification, and build a robust, scalable tool. The project should evaluate the tool against a dataset of real-world applications and compare its accuracy, precision, and recall against baseline approaches.
Requirements
To successfully complete this project, the student should have:
- A strong foundation in computer science and software engineering.
- Proficiency in at least one scripting language (Python preferred) for tool development.
- Basic understanding of static analysis concepts (Reverse engineering, ASTs, hashing).
- Optional but beneficial: Experience with cross-platform frameworks (React Native, Flutter, Cordova) or reverse engineering tools (JADX, Apktool).
Pointers
- LibScout / LibRadar: Existing literature on native Android TPL detection. See
- React Native / Flutter Architecture: Official documentation on how these frameworks compile and bundle assets.
- Apktool & JADX: Standard tools for unpacking and inspecting Android APKs.
Supervision
Supervisor: Thomas Sutter Professor: Prof. Dr. Timo Kehrer
Contact
If you are interested in this project or have any questions, please reach out!