  Third-party libraries (TPLs) have become a significant part of the Android
ecosystem. Developers can employ various TPLs to facilitate their app
development. Unfortunately, the popularity of TPLs also brings new security
issues. For example, TPLs may carry malicious or vulnerable code, which can
infect popular apps to pose threats to mobile users. Furthermore, TPL detection
is essential for downstream tasks, such as vulnerabilities and malware
detection. Thus, various tools have been developed to identify TPLs. However,
no existing work has studied these TPL detection tools in detail, and different
tools focus on different applications and techniques with performance
differences. A comprehensive understanding of these tools will help us make
better use of them. To this end, we conduct a comprehensive empirical study to
fill the gap by evaluating and comparing all publicly available TPL detection
tools based on six criteria: accuracy of TPL construction, effectiveness,
efficiency, accuracy of version identification, resiliency to code obfuscation,
and ease of use. Besides, we enhance these open-source tools by fixing their
limitations, to improve their detection ability. Finally, we build an
extensible framework that integrates all existing available TPL detection
tools, providing an online service for the research community. We release the
evaluation dataset and enhanced tools. According to our study, we also present
the essential findings and discuss promising implications to the community. We
believe our work provides a clear picture of existing TPL detection techniques
and also gives a roadmap for future research.
