<div class="csl-bib-body">
<div class="csl-entry">Hageman, K., Feal, A., Gamba, J., Girish, A., Bleier, J., Lindorfer, M., Tapiador, J., & Vallina-Rodriguez, N. (2023). Mixed Signals: Analyzing Software Attribution Challenges in the Android Ecosystem. <i>IEEE Transactions on Software Engineering</i>, <i>49</i>(4), 2964–2979. https://doi.org/10.34726/5296</div>
</div>
-
dc.identifier.issn
0098-5589
-
dc.identifier.uri
http://hdl.handle.net/20.500.12708/190633
-
dc.identifier.uri
https://doi.org/10.34726/5296
-
dc.description.abstract
The ability to identify the author responsible for a given software object is critical for many research studies and for enhancing software transparency and accountability. However, as opposed to other application markets like Apple's iOS App Store, attribution in the Android ecosystem is known to be hard. Prior research has leveraged market metadata and signing certificates to identify software authors without questioning the validity and accuracy of these attribution signals. However, Android application (app) authors can, either intentionally or by mistake, hide their true identity due to: (1) the lack of policy enforcement by markets to ensure the accuracy and correctness of the information disclosed by developers in their market profiles during the app release process, and (2) the use of self-signed certificates for signing apps instead of certificates issued by trusted CAs. In this paper, we perform the first empirical analysis of the availability, volatility and overall aptness of publicly available market and app metadata for author attribution in Android markets. To that end, we analyze a dataset of over 2.5 million market entries and apps extracted from five Android markets for over two years. Our results show that widely used attribution signals are often missing from market profiles and that they change over time. We also invalidate the general belief about the validity of signing certificates for author attribution. For instance, we find that apps from different authors share signing certificates due to the proliferation of app building frameworks and software factories. Finally, we introduce the concept of an attribution graph and we apply it to evaluate the validity of existing attribution signals on the Google Play Store. Our results confirm that the lack of control over publicly available signals can confuse automatic attribution processes.
en
dc.description.sponsorship
WWTF Wiener Wissenschafts-, Forschu und Technologiefonds
-
dc.description.sponsorship
SBA Research gemeinnützige GmbH
-
dc.language.iso
en
-
dc.publisher
IEEE COMPUTER SOC
-
dc.relation.ispartof
IEEE Transactions on Software Engineering
-
dc.rights.uri
http://rightsstatements.org/vocab/InC/1.0/
-
dc.subject
Android
en
dc.subject
attribution
en
dc.subject
attribution graph
en
dc.subject
mobile apps
en
dc.title
Mixed Signals: Analyzing Software Attribution Challenges in the Android Ecosystem