Open Source Component Detection in Android APKs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need to detect and identify open source components within an Android Application Package (APK) without access to its source code, as well as to determine compliance requirements and security vulnerabilities posed by these components, which is particularly challenging due to the limited resources on mobile devices and the mixing of code to enhance security.
Innovation Solution
A method and system that involves creating an open source class and archive database, retrieving classes from the APK, matching them against the database, and reporting the corresponding archive collection, which includes clustering and removing redundant or revisionary archives to determine the minimal set of open source components, their licenses, bugs, and vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code mixing is applied to enhance security in APKs, then security is improved, but difficulty of detecting and measuring open source components increases
Solution Approach 1:
The patent uses class files as an intermediary to detect open source components. Instead of directly analyzing mixed source code (which is difficult), the system extracts and analyzes class files that contain metadata about open source components, their licenses, and vulnerabilities. This intermediary approach allows detection without needing to trace through the mixed source code.
Solution Approach 2:
The patent replaces manual source code analysis (mechanical process of reading and understanding code) with automated analysis of class file metadata. The system uses tools to extract information from class files about open source components, replacing the need for manual code review and making detection feasible despite code mixing.
2Measurement precision
If comprehensive open source database is created to identify all components, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent creates a comprehensive open source database in advance, populated with information about known open source components, their class names, licenses, and vulnerabilities. This preliminary preparation allows the detection system to simply query the database during APK analysis, rather than building the database during the detection process itself, reducing operational complexity.
Solution Approach 2:
The system uses class files as copies or representations of the actual source code. By analyzing these class file copies that contain metadata about open source components, the system achieves precise identification without needing to handle the complex original source code, thereby reducing device complexity while maintaining measurement precision.
Data Source
AI summary
A method, system and computer program product, the method comprising: obtaining an open source class and archive database; receiving an Android Application Package (APK); retrieving one or more class comprised in the APK; matching each of the classes against the open source class and archive database, to obtain a corresponding archive collection, such that each archive in the archive collection comprises at least one of the classes; and reporting the respective archive collection.