We propose a system, named ATVHunter, which can pinpoint the precise vulnerable in-app TPL versions and provide detailed information about the vulnerabilities and TPLs. We propose a two-phase detection approach to identify specific TPL versions. Specifically, we extract the Control Flow Graphs as the coarse-grained feature to match potential TPLs in the pre-defined TPL database, and then extract opcode in each basic block of CFG as the fine-grained feature to identify the exact TPL versions. We build a comprehensive TPL database (189,545 unique TPLs with 3,006,676 versions) as the reference database. Meanwhile, to identify the vulnerable in-app TPL versions, we also construct a comprehensive and known vulnerable TPL database containing 1,180 CVEs and 224 security bugs. Experimental results show ATVHunter outperforms state-of-the-art TPL detection tools, achieving 90.55% precision and 88.79% recall with high efficiency, and is also resilient to widely-used obfuscation techniques and scalable for large-scale TPL detection. Furthermore, to investigate the ecosystem of the vulnerable TPLs used by apps, we exploit ATVHunter to conduct a large-scale analysis on 104,446 apps and find that 9,050 apps include vulnerable TPL versions with 53,337 vulnerabilities and 7,480 security bugs, most of which are with high risks and are not recognized by app developers.

翻译：我们提议了一个名为ATVHunter的系统,该系统可以确定精确的脆弱应用TPL版本,并提供关于脆弱性和TPL的详细信息。我们建议采用两个阶段的检测方法来识别具体的TPL版本。具体地说,我们提取控制流程图作为粗粗略的特性,以匹配预先定义的TPL数据库中的潜在TPL,然后在CFG的每个基本部分中提取操作代码,作为精细筛选功能,以识别准确的TPL版本。我们建立了一个全面的TPL数据库(189,545个独特的TPL,3,006,676版本)作为参考数据库。同时,我们建议用两个阶段的检测方法来识别具体的TPL版本中的脆弱。我们还建立了一个全面和已知的脆弱TPL数据库,其中包括1,180个CPL和224个安全错误。实验结果显示,ATV的功能优于最新技术检测工具,达到90.55%的精确度和88.79%的回顾率。我们还能够适应广泛使用的模糊技术和可测量的TPL版本。 另外,我们还认识到,在大规模开发TPL4时使用了一个大规模安全风险的系统。