Unveiling the Ownership: An Empirical Study of Android App Associations via SDK IDs

Abstract

In the Android app ecosystem, apps are linked through various associations, such as the same ownership, corporate ecosystems, or app repackaging. Revealing these associations offers critical insights into app owners’ behaviors and potential violations. However, no work systematically measures these stakeholder relationships at an ecosystem scale. Moreover, previous works are fundamentally limited by their reliance on fragile, identity-unbound metadata or easily obfuscated code structures, leading to unreliable features and restricted application scenarios.In this work, we conduct a large-scale empirical measurement of potential violations and app owner behaviors in the wild. To bridge the capability gap, we introduce the third-party SDK ID, a novel, developer identity-bound feature obtained directly from app files, and design AndroLinker, a pipeline combining static and dynamic analysis to extract features to uncover explicit and implicit app associations. By deploying AndroLinker across our constructed datasets, we answer three research questions: (1) AndroLinker robustly extracts SDK IDs with 90.32% precision and achieves 98.9% accuracy in authorship attribution, significantly outperforming existing tools. (2) At the ecosystem scale, we detected 6,452 market apps linked to known potentially unwanted apps (PUAs), driving the permanent removal of 2,515 PUAs. (3) Through an in-depth analysis of app associations, we exposed cross-market PUA groups employing dual-profit and diverse evasion strategies, and uncovered the corporate ecosystems of technology companies. These results demonstrate the effectiveness of SDK IDs and AndroLinker in demystifying complex associations and securing the Android ecosystem.