Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Comparative research on two applications that point out security errors with libscout assistance #40

Open
streeg opened this issue Jun 25, 2023 · 0 comments

Comments

@streeg
Copy link

streeg commented Jun 25, 2023

Good afternoon, I'm a bachelor's student in computer science at the Universidade de Brasilia and I'm doing research using libscout as a tool for detecting external libraries. My goal is to verify if the security errors pointed out by the cognicrypt (https://www.eclipse.org/cognicrypt/) and cryptoguard (https://www.cryptoguard.com/) tools are mostly native or external code. I decided to use libscout as a helper tool thanks to the article 'Automated Third-Party Library Detection for Android Applications: Are We There Yet?'. I already got some results, however, talking to my tutor and analyzing some of the tool's outputs, we observed that sometimes the analysis of a certain application registers external libraries only in the "Library Identifier" step and does not show in the "ProfileMatch" step. This is not something that prevents the completion of my undergraduate work, however, it would be interesting to understand why this happens. I've already tried changing the proximity value of the cluster, nevertheless, the library continues to appear only in its identification and not in the match step.
The following attachment illustrates this. Okio3 and HTTP show in the Library Identify step but not in the ProfileMatch.

It is worth adding that I am using the flags to dull a full profile match and that I am using the profile dataset available here on the wiki.

libscout_result.txt

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant