Mobile Application SDK Version Detection and Security Alert Based on Multi-partition LSH

Android mobile applications integrate a large number of third-party libraries (SDKs) to improve the efficiency of development and enhance the functionality of mobile applications, some SDKs have security vulnerabilities and misuse of access rights, which can cause security and privacy hazards to mobile applications. SDK version detection and vulnerability detection are the basis of mobile application security analysis, this paper proposes an LSH-based SDK version identification method. The method does SDK detection based on class hierarchy, extracts SDK source code fine-grained features using multipartition box LSH, and achieves SDK version detection by multi-feature fusion. On the basis of version identification, it does vulnerability warning and recommendation for insecure SDK versions. Collected more than 70 types and 1100 different versions of popular SDK data to build SDK information database, vulnerability database and scoring database. Verified and analyzed for 453 APPs, and the detection tool is better than other tools in the same category.