2016 · Conference paper
Statistical Deobfuscation of Android Applications
DeGuard reverses layout obfuscation in Android APKs, predicting original names for the fields, methods, classes and packages that ProGuard renames. Built on Soot, it represents an app as a dependency graph over program elements and keeps Android API and other unobfuscated names fixed. It then runs MAP inference with Nice2Predict on a conditional random field learned from 1,684 F-Droid apps, under constraints that keep the renamed APK semantically equivalent. On 100 held-out F-Droid apps obfuscated with ProGuard, names identical to the originals rise from 13.3% to 79.1%, and third-party library prediction reaches 91.3% precision and 91.0% recall.
Scope and limitations
Only layout (identifier) obfuscation is addressed. Data, control-flow and cryptographic obfuscation, custom string encryption, reflection and goto-based code reordering are not reversed, and the paper notes that most malware samples it inspected also used such techniques. The benchmark is 100 benign, open-source F-Droid apps, obfuscated by enabling ProGuard without changing its rules and scored by exact match to the original names, so semantically close names count as errors; elements that ProGuard removed are not scored. Accuracy on other obfuscators or on malware may be lower. Libraries are identified by a package-name heuristic covering 133 libraries, and the training apps may import the same libraries. The 49-family malware study gives manual examples, such as Base64 decoders and location handling, without precision figures.
Why it fits this collection
Adds learned identifier recovery for obfuscated Android packages, complementing the interface-reconstruction papers in the app section and the binary symbol-recovery research elsewhere in the bibliography.
Publication and review details
- Venue
- ACM CCS 2016
- Status
- Conference paper
- Publication / posting date
- October 24, 2016
- Date source
- ACM-deposited Crossref metadata gives print and online publication on 2016-10-24. That is also the first day of the October 24–28 conference; the date comes from the publisher record, not from the conference schedule.
- DOI
- 10.1145/2976749.2978422
ACM's Crossref deposit and the ETH-hosted author PDF agree on the title, four-author order and CCS ’16 DOI; Crossref gives pages 343–355. The paper and the SRI project page name http://apk-deguard.com as the public DeGuard service; on 2026-10-18 it redirected to HTTPS and then did not respond, so it is not linked as a working service. No DeGuard source repository was found, and code_url is null. The project page says DeGuard is built on the open-source Nice2Predict framework; that separate inference engine is not recorded as this paper's code. Nothing was run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.