Working notes behind mobile_and_app_measurement — every query with its population and denominator, the report script and its unedited output, the fold and its complete residue, the probe regexes and the case-sensitivity trap they walked into, the figures checked against the source PDFs, the external sources verified and the ones rejected, and what could not be established. Corpus-level caveats that apply to every page on this site are on corpus and are not restated here.

Contemporaneous. Written during the run that produced the content page, 2026-08-27, not reconstructed afterwards.

No. Checked 2026-08-27 by node scripts/sitemap.mjs (80 pages) plus core.searchPages for mobile and android:

node scripts/dw.mjs search mobile   # 40 hits, all provenance/content pages on other topics
node scripts/dw.mjs search android  # 32 hits, likewise

Every hit was an incidental mention inside a page about something else (privacy:consent, practices:legal_enforcement, literature:bibliography). No page owns mobile or app measurement. So this is a creation, not an extension, and not an overlap that needed a neighbour broadened.

Four pages own an adjacent piece, and each is linked out to rather than restated:

The item as specified said “propose the namespace placement before creating it”. The decision, and it was a decision rather than an obvious call:

• Chosen: design:mobile_and_app_measurement. design: already holds the site's cross-cutting “how do you set this measurement up” pages — website_selection, sampling, crawling_location, archives, longitudinal, website_classification, ip_classification. This page is exactly that shape for a different platform: sampling frame, vantage, instrumentation, what to report.
• Rejected: a new top-level mobile: namespace. It would strand one page in a namespace of its own and duplicate what design: is for. The site's existing platform-flavoured pages (design:platforms:facebook and friends) already live under design:, so a sibling namespace would also be inconsistent.
• Rejected: programming:mobile_instrumentation. programming: is where per-tool pages live (programming:crawler:openwpm, programming:crawler:webxray). A future Frida-, Appium- or mitmproxy-on-mobile how-to belongs there and should be created there. But this page is study design, not a tool manual, and putting sampling and reporting guidance under programming: would misfile it.
• Rejected: broadening design:automated_measurements. It is a red link. Creating a page in order to broaden it is not broadening it.

A reasonable person could have gone with mobile: as a namespace on the argument that mobile deserves the same treatment as the web and will eventually need several pages. If that happens, the page should move; nothing on it assumes the design: prefix except its own id.

Nothing linked here, so a bullet was added to start under Research design in the same sitting. Without it the page is invisible.

Every figure on the content page is a share of one of these. The rule was applied without exception: name the denominator before the numerator, and never write “of 5,859 papers”.

appAnalysis (529) is the page's population, and that was a choice. mobilePlat (1,075) is twice as large and would have produced friendlier percentages, but it contains cellular-network measurement, Bluetooth-tracker security, handset firmware work and smartphone user studies. A reader planning to take apps apart is not in that population. The content page states both and says which one every table is on.

The item's brief carried stale numbers. It said “409 mobile-app-analysis papers, population.sourceList Google Play 183 and AndroZoo 35, tools category mobile-instrumentation 271”. Those were computed on the 4,322-paper corpus. On the current run: 529, Google Play 134 under its largest single spelling (250 after merging spellings), AndroZoo 46, mobile-instrumentation 364. Every one was re-derived; none was carried over.

Sentinels are never answers. not-stated, none-mentioned, not-applicable, unclear and unknown are reported as themselves. The sharpest case on this page is vantage.locations: 430 appAnalysis papers have a vantage tuple, 117 state a location, and 313 produce only a sentinel. Counting the sentinel as an answer would have turned “72.8% of mobile app studies do not say where they measured from” into silence.

Papers, never tuples. paperCounts() in scripts/lib.mjs does the counting; a paper naming Frida in five tuples is one paper.

cd /workspace/artifacts/wiki
node scripts/report_mobile.mjs      > scripts/report_mobile-output.txt
node scripts/quotecheck_mobile.mjs  > scripts/quotecheck_mobile-output.txt
sh   scripts/mobile_probes.sh       > scripts/mobile_probes-output.txt
node scripts/mobile_number_guard.mjs > scripts/mobile_number_guard-output.txt

The guard is the last gate: it harvests every numeric token from the content page and requires each one to appear in one of the three committed outputs, or to be listed in an ALLOW map with a written reason. It currently traces 305 of 366 figures to an output and allows 61 with reasons (external version numbers, dates, ordinals, and figures from cited papers that the quote check covers instead).

What the guard does not do, and this matters: it proves a number appears in a source. It does not prove it is the right number for the sentence around it, and it cannot see figures inside quoted phrases. The two worst errors on this page (see §12) were both invisible to it and were caught by re-reading the prose against the script output by hand.

mobile_number_guard-output.txt

figures harvested from pages/design_mobile_and_app_measurement.txt: 366
allowed with a written reason: 61
traced to 3 committed outputs: 305

UNACCOUNTED: none

All three read /workspace/publications_dataset/data via dataRoot() in scripts/lib.mjs, which probes both the current and the older mount layout. The probe script regenerates its own path list from the extraction, so the probes and the report can never drift apart on the population.

tools[].name is free text and agrees run-to-run on roughly 20% of exact strings, so it is never aggregated by exact string. The generic skeleton() fold in scripts/lib.mjs normalises case and punctuation, which is not enough here: it leaves “Android Debug Bridge (adb)”, “adb” and “Android Debug Bridge” as three tools.

scripts/mobile_fold.mjs adds an ordered alias table. How much it changes the answer, from §2 of the report output:

adb is the worst case: reporting the largest single spelling would have undercounted it by 61%. Monkey and UI Automator are next, at 12 and 8 spellings each for a single tool.

Two fold decisions where a reasonable person could disagree:

1. objection is folded into pinning-bypass helper, not Frida. It is a Frida front-end, so Frida would be defensible. It went the other way because 8 of its 10 used tuples in this corpus give SSL-pinning bypass as the purpose (the other two are generic hooking and APK repackaging), so counting it as Frida would have inflated Frida and emptied the pinning-bypass family. The purposes are quoted in the fold file's comment.
2. frida-ios-dump is folded into iOS app acquisition, not Frida. It uses Frida but it is an IPA extractor, not an instrumentation use. The rule order was changed after a smoke test showed it landing in Frida.

The fold is deliberately targeted, not a complete taxonomy. It defines families for mobile-specific tooling and leaves everything else alone. So it maps only 921 of 3,306 “used” tool tuples (27.9%) in appAnalysis, and the residue is 2,385 tuples across 1,732 distinct names. That is not a failure: the residue is dominated by VirusTotal (58 tuples), Python (22), Selenium (21), Chrome (19), scikit-learn (15) and a long tail of one-off custom tools, none of which is a mobile tool and none of which belongs in a mobile tool family. The content page states the 27.9% figure so no reader mistakes the folded table for a complete tool census.

The residue is printed in full in §8 of the report output below, in two parts: every name with ≥2 tuples in a table, then all 1,466 names appearing exactly once, listed alphabetically. Nothing is truncated.

The fold source, since it is the load-bearing decision on this page:

mobile_fold.mjs

// Fold mobile tool names into families, for design:mobile_and_app_measurement.
//
// WHY: tool names in `tools[].name` are free text and ~20% stable run-to-run by
// exact string (data/extract/README.md). The generic skeleton() fold in lib.mjs
// canonicalises case and punctuation, which is not enough here: "Android Debug
// Bridge (adb)" (29 papers), "adb" (9) and "Android Debug Bridge" (5) are one
// tool under three spellings, and counting them separately undercounts adb by a
// factor of three. Same for Frida (Frida / frida-tools / frida-server / Frida
// Gadget), Xposed (Xposed / Xposed framework / LSPosed) and Monkey (Monkey /
// Android Monkey / Application Exerciser Monkey / three more).
//
// Rules are ordered; the first match wins. Anything that matches no rule keeps
// its skeleton-folded name and is reported as residue by report_mobile.mjs, so
// the part this file cannot classify stays visible.
 
// [canonical family, matcher]. Matchers are tested against the raw name.
export const FAMILIES = [
  // --- dynamic instrumentation / hooking
  // frida-ios-dump is an IPA extractor, not an instrumentation use of Frida, so it
  // is matched by the 'iOS app acquisition' rule below and excluded here.
  ['Frida', /^frida(?![- ]?ios)|frida[- ]?(tools|server|gadget|trace|inject)/i],
  ['Xposed', /xposed|^lsposed$|^edxposed$|^taichi$/i],
  ['Magisk', /^magisk/i],
  ['adb', /^adb$|android (debug|debugging) bridge|^adb shell$/i],
  ['TaintDroid', /^taintdroid$/i],
    // objection is a Frida front-end, but 8 of its 10 'used' tuples in this corpus
  // give SSL-pinning bypass as the purpose, so it is counted here and not as Frida.
  ['pinning-bypass helper', /just ?trust ?me|ssl ?(un)?kill ?switch|trust ?me ?already|^unpinning|nsc ?patch|^objection$/i],
 
  // --- UI automation / app exercisers
  ['Monkey', /monkey(?!runner)/i],
  ['monkeyrunner', /monkeyrunner/i],
  ['UI Automator', /ui ?automator|uiautomator/i],
  ['Appium', /^appium/i],
  ['DroidBot', /^droidbot|^humanoid$|^droidmate|^stoat$/i],
  ['AndroidViewClient', /androidviewclient|^culebra$/i],
  ['Accessibility Service', /accessibility service/i],
  ['RERAN', /^reran$/i],
 
  // --- static analysis / reverse engineering
  ['apktool', /^apk ?tool/i],
  ['jadx', /^jadx/i],
  ['Soot', /^soot$/i],
  ['FlowDroid', /^flowdroid$/i],
  ['Androguard', /^androguard$/i],
  ['smali/baksmali', /^(bak)?smali$|^apkid$|^dex2jar$|^dexdump$|^dexlib/i],
  ['WALA', /^wala$/i],
  ['IDA Pro', /^ida( pro)?$|^idapython$/i],
  ['Ghidra', /^ghidra$/i],
  ['MobSF', /^mobsf$|mobile[- ]security[- ]framework/i],
  ['LibRadar', /^libradar/i],
  ['LibScout', /^libscout/i],
  ['PScout', /^pscout$|^axplorer$/i],
 
  // --- traffic interception
  ['mitmproxy', /^mitm ?(proxy|dump|web)/i],
  ['Burp Suite', /^burp/i],
  ['tcpdump', /^tcpdump$/i],
  ['Wireshark', /^wireshark$|^tshark$/i],
  ['Fiddler', /^fiddler/i],
  ['Charles Proxy', /^charles/i],
 
  // --- app acquisition / store scraping
  ['Play store scraper', /google[- ]?play[- ]?scraper|^gplaycli$|^playstoredownloader$|google play (api|protobuf api|developer api|store api)|^apkeep$|^raccoon$/i],
  ['third-party APK mirror', /^apkpure$|^apkmirror$|^apkcombo$|^aptoide$|^androidrank$|^appbrain$|^apkfab$/i],
  ['AndroZoo', /^androzoo$|^androidzoo$/i],
  ['F-Droid', /^f[- ]?droid$/i],
  ['iOS app acquisition', /^ipatool|^ipa ?tool|^clutch$|frida[- ]?ios[- ]?dump|^flexdecrypt$|^bagbak$|^itunes/i],
 
  // --- iOS device access
  ['libimobiledevice', /libimobiledevice|^ideviceinstaller$|^idevice|^cfgutil$/i],
  ['jailbreak tool', /^checkra1n$|^palera1n$|^unc0ver$|^checkm8$|^taurine$/i],
 
  // --- devices and emulation
  ['Android emulator', /android emulator|^avd$|android virtual device|^genymotion$|^qemu$/i],
];
 
export function foldTool(raw) {
  const name = String(raw).trim();
  for (const [family, re] of FAMILIES) if (re.test(name)) return { family, mapped: true };
  return { family: name, mapped: false };
}
 
// Fold a paper's tool tuples to a Set of family names, counting each family once
// per paper. `filter` selects which tuples count (e.g. usedOrMentioned==='used').
export function paperFamilies(paper, filter = (t) => t.usedOrMentioned === 'used') {
  const fams = new Set();
  const unmapped = new Set();
  for (const t of paper.tools) {
    if (!filter(t)) continue;
    const { family, mapped } = foldTool(t.name);
    fams.add(family);
    if (!mapped) unmapped.add(family);
  }
  return { fams, unmapped };
}

The extraction schema has no field for “did you use a handset or an emulator”, “did the app pin”, “which storefront”. Those questions were answered with full-text probes over the same 529 papers, whitespace collapsed and soft hyphens rejoined first, reading paper.cols.txt and never paper.norm.txt.

A probe hit is a mention. It is an upper bound on doing the thing and a lower bound on nothing: a paper can state its handset model without writing the words “physical device”. Every probe figure on the content page is labelled as a mention.

The trap, and it is a big one. Tool names are proper nouns and must be matched case-sensitively. The first pass ran everything case-insensitively and produced:

A 6.4× over-count on Xposed would have been published as “Xposed is mentioned by half the field”, which is the opposite of the page's actual finding that Xposed is dead. The committed probe script prints both variants for the four terms where the difference is large, so the trap is visible in the audit trail rather than only in these notes. Every probe number on the content page is the case-sensitive one.

Probes whose regex was deliberately widened or narrowed after a first look:

The “store region” row is the honest one: the content page wanted a number for “how many papers state which storefront they sampled” and there is no probe that answers it, so the page uses the vantage.locations sentinel rate (313 of 430) and says what that does and does not cover.

Unedited probe output:

mobile_probes-output.txt

population: mobile-app-analysis papers with full text = 529

--- certificate pinning and TLS interception
    71  mentions certificate/SSL/TLS pinning
    33  describes bypassing pinning
    33  names a pinning-bypass tool
    13  mentions the Android Network Security Configuration
    13  mentions Certificate Transparency

--- instrumentation
    87  mentions Frida (case-sensitive)
   100    ... same probe case-insensitively, for comparison
    40  mentions Xposed (case-sensitive)
   256    ... case-insensitively: matches the word "exposed"
    18  mentions Magisk
    59  mentions mitmproxy
    35  mentions root detection / SafetyNet / Play Integrity
    15  mentions emulator detection

--- device or emulator
   109  says "physical/real device" (or phone/smartphone/handset)
    51  names an Android emulator product or phrase
    25  says plainly that it ran on an emulator

--- what defeats static analysis
   144  mentions native code / JNI / NDK
    85  mentions packing or unpacking
    29  names ProGuard / R8 / DexGuard
   256  mentions obfuscation (any sense -- wide, includes crypto/traffic obfuscation)

--- app acquisition and the store
    46  names a third-party APK/IPA mirror or downloader
    68  mentions AndroZoo
    11  mentions F-Droid
   142  mentions "App Store" (case-sensitive)
   243    ... case-insensitively: also matches generic "app store"
    80  names the Apple App Store specifically
    51  mentions jailbreaking or a jailbreak tool
     8  mentions store terms of service near scraping/downloading
    55  mentions privacy labels / Data Safety
    23  names Exodus Privacy / AppCensus / Lumen

--- driving the app
    72  mentions Monkey (case-sensitive)
    61  names a UI-exploration driver
    48  reports a coverage measure

--- LLMs
    42  mentions an LLM/GPT (case-sensitive)
   167    ... case-insensitively

--- historical
    84  mentions TaintDroid (only 7 of 529 papers actually USED it)

Every measured figure quoted on the content page was checked against data/fulltext/<year>/<venue>/<slug>/paper.cols.txt by scripts/quotecheck_mobile.mjs. The check is on the substring the wiki page actually prints, not on the extraction's evidence.quote, because those are sometimes different sentences.

40 figures across 13 papers: 38 verbatim, 2 present but fragmented by column reflow, 0 not located.

Two findings worth recording:

1. oltrogge2021_mallory, “5,511 (36.7%) vulnerable apps”. The extraction's evidence.quote for this tuple is a different sentence (“2,232 (14.8%) apps with vulnerable HostnameVerifier and 5,202 (34.7%) apps with vulnerable TrustManager”), whose numbers do not add to 5,511. The prevalence string was checked directly against the paper and the paper does say, verbatim, “Most of the affected apps implemented both vulnerabilities, resulting in 5,511 (36.7%) vulnerable apps total.” The figure is right; the extraction's quote is a poor witness for it. This is why the check is on the published substring and not on the quote.
2. Two FRAG verdicts — lin2021_longitudinal (“1,129,615 app removal records, which correspond to 1,033,488 different mobile apps”) and wang2019_evolution (“43.8% of apps in 2014 … over 68% of apps in 2017”). In both, decolumn.mjs spliced a straddling line from the neighbouring column into the middle of the sentence, so the sentence is not contiguous in our rendering. Both were read in context by hand and both figures are correct. The script reports FRAG rather than MISS for exactly this case, and it distinguishes FRAG from a real miss by requiring every distinctive token inside a window twice the needle's length.
3. rodriguez2025_settings, “3,245 apps (53.68%)”. Same reflow damage: the source renders as “245 face difficulties … apps (53.68%) integrate at least one of these SDKs.” The percentage and the clause are both present; the “3,” was separated. The content page quotes the percentage, not the absolute count, for this reason.

Unedited output:

quotecheck_mobile-output.txt

quote/figure check over 13 papers, 40 figures

OK   IMC 2022  static pinning indicators 27%/33%
OK   IMC 2022  runtime pinning popular 11.4%/6.7%
OK   IMC 2022  runtime pinning random 0.9%/2.5%
OK   IMC 2022  circumvention 51.51%/66.15%
OK   IMC 2022  circumvention iOS 66.15%
OK   IMC 2022  Popular set n=1,000
OK   IMC 2022  Random set n=1,000
OK   USENIX 2021  NSC adoption 99,212 / 1,335,322
OK   USENIX 2021  NSC downgrades 88,174 (88.87%)
OK   USENIX 2021  NSC pinning 663 apps
OK   USENIX 2021  user-CA re-enable 8,606 / 1,098,479 (8.67%)
OK   USENIX 2021  vulnerable validation 5,511 (36.7%)
OK   USENIX 2024  Chinese apps 1529/2765 (55.3%)
OK   USENIX 2024  Play apps 322/5061 (6.4%)
OK   CCS 2023  NSC pinning 385 apps (3.89%)
OK   CCS 2023  static vs dynamic 54/281 vs 40/160
OK   USENIX 2018  FlowDroid >48%, Argus >73%, DroidSafe >4%
OK   USENIX 2018  13 undocumented FlowDroid flaws
OK   USENIX 2018  2,026 of 7,584 executable
OK   USENIX 2023  attrition 3654 analysed
OK   USENIX 2023  pre-consent 3013 (82.5%)
OK   USENIX 2023  identifiers 1285 (35.2%)
OK   USENIX 2023  TCF 146 (4.0%)
OK   PETS 2022  tracking libraries 88.73%/79.35%
OK   PETS 2022  pre-consent contact 81.44%/68.46%
OK   PETS 2022  12k per platform
OK   PETS 2025  Facebook SDK 53.68%
OK   PETS 2025  AdvertiserIDCollection 6.79%
OK   USENIX 2024  DSS coverage 46.8%
OK   USENIX 2024  DSS updated 40%
OK   USENIX 2024  ad/analytics library 42%
FRAG WWW 2021  removals 1,129,615 / 1,033,488
      needle: 1,129,615 app removal records, which correspond to 1,033,488 different mobile apps
OK   WWW 2021  median 28.5 days
OK   WWW 2021  top-1500 5%
FRAG WWW 2019  ad libraries 43.8% -> 68%
      needle: 43.8% of apps in 2014 used at least one ad library, while over 68% of apps in 2017
OK   WWW 2019  no update ~61%
OK   NDSS 2026  chameleon 162 (9.85%), 92.59% precision
OK   NDSS 2026  ads 85.96% / pop-ups 95.56% / distraction 19.21%
OK   CCS 2025  723 families / 14,178 versions
OK   CCS 2025  14,178 versions

38 verbatim, 2 present but fragmented by column reflow, 0 NOT LOCATED, of 40

Training data is stale by construction for tool currency, so every external claim on the content page was fetched, not recalled, on 2026-08-27. Verification was by GitHub API or releases.atom/commits.atom feed for repositories, by registry API for packages, and by the vendor's or platform's own documentation for everything else.

An external-currency sweep was delegated to a sub-agent (model: sonnet). Its report was not taken at face value; every load-bearing item was re-fetched. Four of its claims were wrong or unverifiable, and all four would have reached the page:

The sub-agent also over-read the CT-enforcement situation (“Android 17 is set to enable CT enforcement by default”) in a way the primary page does not state. The page says only what the CT policy page says: enforcement is scoped to publicly-trusted certificates, so a locally-installed interception root is not covered.

Recorded so the next run does not re-add them.

• How many papers state their storefront. No probe with acceptable precision was found (see §6). The page uses the vantage.locations sentinel rate as the nearest available proxy and says so explicitly.
• Whether a mirror-served APK differs from the Play original. No study of this in the seven venues; the only material found was a vendor blog, rejected. Published as an open question.
• The Android/iOS balance, properly. The schema has no field finer than platforms = ['mobile']. The 369 / 39 / 66 / 55 split is a regex over metadata, published with that caveat and with the regex in the report script. It should not be quoted precisely.
• Whether the pinning-bypass success rate has changed since 2022. [1Pradeep, Amogh; Paracha, Muhammad Talha; Bhowmick, Protick; Davanian, Ali; Razaghpanah, Abbas; Chung, Taejoong; Lindorfer, Martina; Vallina-Rodriguez, Narseo; Levin, Dave; Choffnes, David (2022): "A Comparative Analysis of Certificate Pinning in Android & iOS", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] is the only measurement of it found anywhere in the corpus. Four Frida majors later, nobody has repeated it. Published as the first open question.
• Exodus Privacy's current tracker-signature count. Not on the front page, and the statistics pages were not reachable during this run. The page says the service is live and explicitly tells the reader to check before quoting a count.
• Whether the corpus's mobile share is really falling. appAnalysis peaked at 18.4% of papers in 2015 and is 6.7% in 2024. That could be a real shift, or it could be the corpus's absolute growth (119 papers in 2010, 690 in 2024) diluting a constant absolute volume — absolute mobile counts are roughly flat at 44–66 per year since 2019. The page reports the per-year table and does not claim a trend either way.
• Apple's privacy-manifest (PrivacyInfo.xcprivacy) requirement date. The fetch of Apple's required-reason-API page returned only a title. Privacy manifests are therefore not discussed on the page, even though they are an obviously scrapable artefact. A future run should get this and add it.

17 entries added to bibliography, appended before the closing </bibtex> of a fresh export of the live page (not a local copy — a stale local copy is a known trap here).

Duplicate check before appending, by four independent keys: exact key string, normalised title, DOI, and URL. One collision found and resolved:

• koch2023_enough already existed in the live bibliography, with identical title, URL and correct authors. The duplicate entry was deleted from the additions file rather than renamed; the page cites the existing key. Without the title/DOI/URL scan a key-string check alone would still have caught this one, but the same scan confirmed the other 17 are genuinely new.
• bibgen.mjs emitted author = {Koch, Simon and Altpeter, Benjamin and e.V., Datenanfragen.de and Johns, Martin} for that paper from the index — “Datenanfragen.de e.V.” is Altpeter's affiliation, not an author. The live entry already has the correct three authors, so no fix was needed, but the bug is recorded here because bibgen will reproduce it.

PETS and USENIX index records carry no authors (100% of both venues). Author lists were fetched from the venue landing pages with curl and a browser User-Agent — WebFetch gets 403 from usenix.org:

curl -s -A 'Mozilla/5.0 ...' https://www.usenix.org/conference/usenixsecurity21/presentation/oltrogge
curl -s -A 'Mozilla/5.0 ...' https://petsymposium.org/popets/2025/popets-2025-0056.php

Every DOI was resolved against the Crossref API (api.crossref.org/works/<doi>); all 11 DOI-bearing entries returned HTTP 200. The six USENIX/NDSS entries have no DOI and are cited by landing-page URL, which is what bibgen.mjs does for those venues.

Four entries are from outside the seven venues, added deliberately because the corpus cannot cover them:

Four reviewers, all told explicitly that the author's context may not be exhaustive, and all handed the page text, the report script, its unedited output, the probe and quote-check outputs, and these provenance notes. The three focused reviewers ran in parallel first; the generic reviewer ran afterwards on the corrected page.

REVIEWLOG_PLACEHOLDER

Unedited output of node scripts/report_mobile.mjs. §8 is the complete fold residue.

report_mobile-output.txt

==============================================================================
1. POPULATIONS
==============================================================================
corpus                                              5859
appAnalysis  studyTypes has 'mobile-app-analysis'    529   9.0% of corpus
mobilePlat   platforms has 'mobile'                  1075   18.3%
either                                              1079
both                                                525
tools category 'mobile-instrumentation' (any)        364
  of those, outside 'either'                        32
population unit 'mobile-apps'                       502
  of those, outside 'either'                        24

--- appAnalysis per venue
Venue    appAnalysis  all   share of venue
-------  -----------  ----  --------------
USENIX   143          1410  10.1%
CCS      106          990   10.7%
NDSS     82           701   11.7%
PETS     66           510   12.9%
IEEE-SP  63           767   8.2%
WWW      37           843   4.4%
IMC      32           638   5.0%

--- appAnalysis per year (2026 is provisional: CCS/IMC 2026 not held, IEEE S&P/WWW 2026 under-selected)
Year  papers  appAnalysis  share  mobilePlat  share
----  ------  -----------  -----  ----------  -----
2010  119     1            0.8%   6           5.0%
2011  116     3            2.6%   11          9.5%
2012  151     13           8.6%   25          16.6%
2013  125     13           10.4%  27          21.6%
2014  166     23           13.9%  40          24.1%
2015  190     35           18.4%  51          26.8%
2016  182     23           12.6%  45          24.7%
2017  231     32           13.9%  61          26.4%
2018  254     20           7.9%   53          20.9%
2019  402     38           9.5%   82          20.4%
2020  404     44           10.9%  86          21.3%
2021  379     44           11.6%  84          22.2%
2022  546     49           9.0%   106         19.4%
2023  719     55           7.6%   113         15.7%
2024  690     46           6.7%   110         15.9%
2025  770     66           8.6%   127         16.5%
2026  415     24           5.8%   48          11.6%

==============================================================================
2. TOOLING, folded (population: appAnalysis, N=529, tuples with usedOrMentioned="used")
==============================================================================

--- folded tool families (only families the fold defines; unmapped names are residue, printed in section 8)
Family                  papers  share of 529
----------------------  ------  ------------
Frida                   74      14.0%
adb                     71      13.4%
Soot                    65      12.3%
apktool                 57      10.8%
mitmproxy               52      9.8%
FlowDroid               49      9.3%
Androguard              37      7.0%
smali/baksmali          34      6.4%
Monkey                  34      6.4%
jadx                    32      6.0%
Xposed                  31      5.9%
Play store scraper      30      5.7%
tcpdump                 27      5.1%
Wireshark               25      4.7%
LibRadar                23      4.3%
Android emulator        21      4.0%
IDA Pro                 18      3.4%
Appium                  17      3.2%
UI Automator            15      2.8%
pinning-bypass helper   15      2.8%
DroidBot                14      2.6%
Magisk                  14      2.6%
PScout                  12      2.3%
iOS app acquisition     12      2.3%
Ghidra                  12      2.3%
Burp Suite              11      2.1%
third-party APK mirror  10      1.9%
LibScout                10      1.9%
libimobiledevice        9       1.7%
Fiddler                 8       1.5%
WALA                    7       1.3%
TaintDroid              7       1.3%
AndroZoo                7       1.3%
MobSF                   7       1.3%
AndroidViewClient       6       1.1%
jailbreak tool          5       0.9%
monkeyrunner            3       0.6%
Accessibility Service   3       0.6%
RERAN                   3       0.6%
Charles Proxy           2       0.4%

--- the same families per era — this is the currency evidence
era sizes: 2010-2015=88  2016-2020=157  2021-2024=194  2025-2026*=90
Family                  total  2010-2015   2016-2020   2021-2024   2025-2026*
----------------------  -----  ----------  ----------  ----------  ----------
Frida                   74     0 (0.0%)    6 (3.8%)    38 (19.6%)  30 (33.3%)
adb                     71     5 (5.7%)    13 (8.3%)   34 (17.5%)  19 (21.1%)
Soot                    65     8 (9.1%)    24 (15.3%)  24 (12.4%)  9 (10.0%)
apktool                 57     10 (11.4%)  21 (13.4%)  15 (7.7%)   11 (12.2%)
mitmproxy               52     1 (1.1%)    11 (7.0%)   27 (13.9%)  13 (14.4%)
FlowDroid               49     4 (4.5%)    16 (10.2%)  22 (11.3%)  7 (7.8%)
Androguard              37     7 (8.0%)    7 (4.5%)    18 (9.3%)   5 (5.6%)
smali/baksmali          34     15 (17.0%)  11 (7.0%)   5 (2.6%)    3 (3.3%)
Monkey                  34     2 (2.3%)    14 (8.9%)   12 (6.2%)   6 (6.7%)
jadx                    32     0 (0.0%)    2 (1.3%)    18 (9.3%)   12 (13.3%)
Xposed                  31     0 (0.0%)    16 (10.2%)  13 (6.7%)   2 (2.2%)
Play store scraper      30     0 (0.0%)    6 (3.8%)    14 (7.2%)   10 (11.1%)
tcpdump                 27     2 (2.3%)    5 (3.2%)    14 (7.2%)   6 (6.7%)
Wireshark               25     2 (2.3%)    6 (3.8%)    8 (4.1%)    9 (10.0%)
LibRadar                23     0 (0.0%)    10 (6.4%)   11 (5.7%)   2 (2.2%)
Android emulator        21     7 (8.0%)    7 (4.5%)    6 (3.1%)    1 (1.1%)
IDA Pro                 18     1 (1.1%)    6 (3.8%)    7 (3.6%)    4 (4.4%)
Appium                  17     0 (0.0%)    2 (1.3%)    7 (3.6%)    8 (8.9%)
UI Automator            15     0 (0.0%)    3 (1.9%)    7 (3.6%)    5 (5.6%)
pinning-bypass helper   15     0 (0.0%)    3 (1.9%)    8 (4.1%)    4 (4.4%)
DroidBot                14     0 (0.0%)    2 (1.3%)    8 (4.1%)    4 (4.4%)
Magisk                  14     0 (0.0%)    1 (0.6%)    5 (2.6%)    8 (8.9%)
PScout                  12     2 (2.3%)    7 (4.5%)    0 (0.0%)    3 (3.3%)
iOS app acquisition     12     2 (2.3%)    4 (2.5%)    3 (1.5%)    3 (3.3%)
Ghidra                  12     0 (0.0%)    2 (1.3%)    4 (2.1%)    6 (6.7%)
Burp Suite              11     1 (1.1%)    2 (1.3%)    4 (2.1%)    4 (4.4%)
third-party APK mirror  10     2 (2.3%)    5 (3.2%)    3 (1.5%)    0 (0.0%)
LibScout                10     0 (0.0%)    6 (3.8%)    3 (1.5%)    1 (1.1%)
libimobiledevice        9      0 (0.0%)    2 (1.3%)    5 (2.6%)    2 (2.2%)
Fiddler                 8      1 (1.1%)    2 (1.3%)    5 (2.6%)    0 (0.0%)

--- unfolded top names, for comparison with the folded table above
name (skeleton-folded only)  papers
---------------------------  ------
Frida                        72
Soot                         65
VirusTotal                   58
apktool                      56
mitmproxy                    52
FlowDroid                    49
Android Debug Bridge (adb)   41
Androguard                   37
JADX                         32
tcpdump                      28
LibRadar                     22
Python                       22
Xposed                       22
Selenium                     21
Wireshark                    20
adb                          19
Chrome                       19
scikit-learn                 19
IDA Pro                      18
Appium                       17
google-play-scraper          15
DroidBot                     14
Monkey                       14
random forest                13
Android emulator             12
distinct skeleton-folded names: 1755

--- how much the alias fold changes the answer
adb                  folded= 71  largest single spelling="Android Debug Bridge (ADB)"=28  spellings=11
Frida                folded= 74  largest single spelling="Frida"=69  spellings=10
Xposed               folded= 31  largest single spelling="Xposed"=22  spellings=5
Monkey               folded= 34  largest single spelling="Monkey"=13  spellings=12
UI Automator         folded= 15  largest single spelling="Android UI Automator"=4  spellings=8
Play store scraper   folded= 30  largest single spelling="google-play-scraper"=12  spellings=12

--- tool GROUPS — the four things a mobile study can instrument, and whether it combines them
tool group            papers  share of 529  2010-2015   2016-2020   2021-2024   2025-2026*
--------------------  ------  ------------  ----------  ----------  ----------  ----------
static analysis / RE  225     42.5%         37 (42.0%)  69 (43.9%)  82 (42.3%)  37 (41.1%)
runtime hooking       155     29.3%         10 (11.4%)  32 (20.4%)  73 (37.6%)  40 (44.4%)
traffic interception  110     20.8%         7 (8.0%)    24 (15.3%)  52 (26.8%)  27 (30.0%)
UI exploration        89      16.8%         4 (4.5%)    26 (16.6%)  36 (18.6%)  23 (25.6%)

static AND traffic: 55 (10.4% of 529)
  static only 170
  traffic only 55
  neither (no tool in either group named) 249
Era         N    static AND traffic
----------  ---  ------------------
2010-2015   88   4 (4.5%)
2016-2020   157  12 (7.6%)
2021-2024   194  25 (12.9%)
2025-2026*  90   14 (15.6%)

UI exploration AND traffic interception: 30 (5.7% of 529) — the "drive it and watch the wire" pipeline

==============================================================================
3. STATIC VS DYNAMIC (population: appAnalysis papers that classified something)
==============================================================================
appAnalysis papers with >=1 classification tuple: 472 / 529
classification.method  papers  share of 529  share of classifiers
---------------------  ------  ------------  --------------------
heuristic-rules        257     48.6%         54.4%
manual-labelling       192     36.3%         40.7%
static-analysis        149     28.2%         31.6%
supervised-ml          103     19.5%         21.8%
third-party-service    87      16.4%         18.4%
curated-database       75      14.2%         15.9%
dynamic-analysis       48      9.1%          10.2%
regex-or-signature     46      8.7%          9.7%
other                  32      6.0%          6.8%
unsupervised-ml        23      4.3%          4.9%
blocklist              20      3.8%          4.2%
graph-analysis         16      3.0%          3.4%
llm                    15      2.8%          3.2%

--- static-analysis and dynamic-analysis methods per era
Era         N    static-analysis  dynamic-analysis  both       llm
----------  ---  ---------------  ----------------  ---------  ----------
2010-2015   88   32 (36.4%)       11 (12.5%)        8 (9.1%)   0 (0.0%)
2016-2020   157  41 (26.1%)       9 (5.7%)          6 (3.8%)   0 (0.0%)
2021-2024   194  58 (29.9%)       20 (10.3%)        12 (6.2%)  1 (0.5%)
2025-2026*  90   18 (20.0%)       8 (8.9%)          5 (5.6%)   14 (15.6%)

--- classification.validation (population: appAnalysis papers that classified something)
validation                  papers  share of classifiers
--------------------------  ------  --------------------
manual-validation           321     68.0%
none-reported               218     46.2%
comparison-to-other-method  79      16.7%
held-out-test-set           60      12.7%
cross-validation            35      7.4%
papers reporting >=1 real validation: 393 (83.3% of 472 classifiers)
papers reporting NO validation on any classifier: 79 (16.7%)
(for comparison, papers with >=1 'none-reported' tuple: 218 — these overlap)
papers where EVERY classifier has a real validation value: 178 (37.7%)

--- Android vs iOS, by regex over title + tool names + population sources + detection phenomena
Android-matching only 369 (69.8%) | iOS-matching only 39 (7.4%) | both 66 (12.5%) | neither 55 (10.4%)

--- classification.target
target               papers  share of 529
-------------------  ------  ------------
other                234     44.2%
mobile-app           198     37.4%
vulnerability        113     21.4%
sdk-or-library       66      12.5%
domain               51      9.6%
network-traffic      44      8.3%
privacy-policy       39      7.4%
web-request          28      5.3%
malware              26      4.9%
website-category     26      4.9%
ip-address           18      3.4%
user-generated-text  17      3.2%

==============================================================================
4. THE APP SAMPLE (population: appAnalysis)
==============================================================================
sourceList: stated in 513/529, sentinel-only 13, no population tuple 3
sourceList (skeleton-folded)    papers  share of 529
------------------------------  ------  ------------
Google Play                     134     25.3%
Google Play store               75      14.2%
custom seed list                58      11.0%
AndroZoo                        46      8.7%
Apple App Store                 11      2.1%
VirusTotal                      11      2.1%
F-Droid                         7       1.3%
Tranco                          7       1.3%
Amazon Mechanical Turk          6       1.1%
AppBrain                        6       1.1%
custom device set               6       1.1%
DroidBench                      6       1.1%
AndroidRank                     5       0.9%
App Store                       5       0.9%
Android Malware Genome project  4       0.8%
Android Market                  4       0.8%
custom experimental setup       4       0.8%
GitHub                          4       0.8%
Google Play market              4       0.8%
Baidu Market                    3       0.6%

--- the same, after merging Google Play spellings by hand
Google Play family: 250 papers (47.3% of 529) across 62 spellings
  spellings: Android Market | Google Play | Google Play Market | Google Play Store | Google Play Store (US site) | Google Play Store (popular apps) | Google Play Store Top Free in Android Apps | Google Play Store and Apple App Store | Google Play Store and featured/recommended apps | Google Play Store and six online sources: Androidapps, Apkhere, Apkmirror, Apkpure, Uptodown, and Aptoide | Google Play Store and third-party websites | Google Play Store charts | Google Play Store dataset from related work [79] | Google Play Store developer contact information | Google Play Store historical most-installed list | Google Play Store in the US | Google Play Store privacy-policy links | Google Play Store reviews | Google Play Store top app charts | Google Play Store's Designed for Families program | Google Play Store's Top 500 list | Google Play Store, Apple App store, and App Annie | Google Play Store, Crawl 1 | Google Play Store, Crawl 2 | Google Play Store, Crawl 3 | Google Play Store, apps described as app-lockers | Google Play Store, “top free” category | Google Play Top Free charts | Google Play and 360 App Assistant top download lists | Google Play and Apkmonk | Google Play and Apple App Store | Google Play and Baidu market | Google Play and Tencent Myapp | Google Play and WanDouJia | Google Play and development documentation | Google Play and iTunes stores | Google Play and other 12 popular third-party app markets worldwide | Google Play and third-party Android markets | Google Play and third-party Android markets plus VirusTotal | Google Play apps using com.umlaut.crowd SDK | Google Play categories | Google Play dynamically analyzed apps | Google Play filtered app set | Google Play lists of popular apps in 49 app categories | Google Play market | Google Play marketplace dataset provided by Norton | Google Play search engine | Google Play store | Google Play store based on the rank of APKPure | Google Play store top app lists | Google Play store, Ubuntu Software Center and Chrome Extensions | Google Play store; AOL Query Log dataset | Google Play top paid app list | Google Play top-ranked apps | Google Play's “top 200 free apps” list | Google Play, Germany | Google Play, MyApp, and Apple App Store | Google Play, apkpure.com, and apktada.com | Google Play, third-party websites (APKPure and 360 Store) | Google Play; AppBrain and AndroidRank | Official Android Market | official Android Market

--- app-set sizes (population: mobile-apps population tuples inside appAnalysis)
papers with a mobile-apps population tuple: 400; of those, 397 state an n
n over 916 tuples: min 1  p10 17  median 1300  p90 329272  max 65000000
app-set size band  papers with >=1 such tuple  share of 397
-----------------  --------------------------  ------------
1-10               52                          13.1%
11-100             139                         35.0%
101-1,000          127                         32.0%
1,001-10,000       130                         32.7%
10,001-100,000     112                         28.2%
>100,000           92                          23.2%

--- sampling method for mobile-apps population tuples
samplingMethod        papers  share of 400
--------------------  ------  ------------
purposive             196     49.0%
top-n                 140     35.0%
random                91      22.8%
pre-existing-dataset  71      17.8%
exhaustive            51      12.8%
seed-and-crawl        38      9.5%
convenience           35      8.8%
stratified            28      7.0%
snowball              2       0.5%

--- listVersion: does the paper pin WHEN the apps were fetched?
mobile-apps population tuples: 930; with a listVersion: 393 (42.3%)
papers: 400; with >=1 listVersion: 222 (55.5%)

--- temporal.mode
temporal.mode       papers  share of 529
------------------  ------  ------------
active-probing      192     36.3%
live-crawl          188     35.5%
existing-dataset    166     31.4%
passive-collection  93      17.6%
web-archive         4       0.8%

==============================================================================
5. VANTAGE AND STOREFRONT (population: appAnalysis papers with >=1 vantage tuple)
==============================================================================
appAnalysis papers with >=1 vantage tuple: 430 / 529
locations: stated in 117/430 (27.2%); sentinel-only 313 (72.8%)
location (skeleton-folded, NOT geo-folded)  papers
------------------------------------------  ------
United States                               23
Germany                                     17
China                                       12
India                                       10
U.S.                                        9
Europe                                      8
Asia                                        6
Canada                                      6
North America                               6
USA                                         6
Austria                                     5
EU                                          5
infrastructure      papers  share of 430
------------------  ------  ------------
research-testbed    156     36.3%
volunteer-devices   44      10.2%
university-network  29      6.7%
cloud-provider      19      4.4%
commercial-vpn      11      2.6%
mobile-network      11      2.6%
proxy-service       3       0.7%
residential         2       0.5%
tor                 1       0.2%

==============================================================================
6. WHAT THE WEB-SHAPED SCHEMA FIELDS SAY (population: appAnalysis)
==============================================================================
appAnalysis papers with a crawlConfig object: 115 / 529 (21.7%)
  for comparison, corpus-wide 'crawled' population: 1120
  statefulness      stated  10/115  stateful=5 stateless=5
  headless          stated  12/115  headless=8 headful=4
  consentAction     stated  31/115  no-interaction=29 accept-all=2
  interactionDepth  stated  74/115  single-target-page=40 landing-page-only=17 deep-crawl=14 landing-plus-subpages=3
  authentication    stated  71/115  none=60 account-registration=5 manual-login=4 automated-login=1 sso=1

--- artifacts.availability
availability                papers  share of 529
--------------------------  ------  ------------
public                      267     50.5%
promised-not-yet-available  31      5.9%
restricted                  12      2.3%
on-request                  7       1.3%
explicitly-withheld         6       1.1%
sentinel-only (none-mentioned/not-stated): 188 (35.5%)

--- ethics.reviewOutcome
reviewOutcome                   papers  share of 529
------------------------------  ------  ------------
approved                        87      16.4%
explicitly-discussed-no-review  25      4.7%
not-required                    22      4.2%
exempt                          11      2.1%
sought-outcome-unstated         4       0.8%
sentinel-only: 330 (62.4%)

--- "states a value" side of each field, for the page table
ethics.reviewOutcome    stated 149 (28.2% of 529)  sentinel-only 330  no ethics object 50
artifacts.availability  stated 323 (61.1% of 529)  sentinel-only 188  no artifacts object 18  of which stated: public 267 (50.5%)
vantage.locations       stated 117 (27.2% of 430)  sentinel-only 313 (72.8%)
population.listVersion  stated 222 (55.5% of 400)

==============================================================================
7. EXEMPLAR FIGURES QUOTED ON THE PAGE (detection tuples, verbatim prevalence)
==============================================================================

IMC 2022 — A comparative analysis of certificate pinning in Android & iOS.
  population: AlternativeTo n=575 mobile-apps top-n | Google Play Store n=1000 mobile-apps random | iTunes Search API n=1000 mobile-apps top-n | Android app-ID list compiled by prior work n=1000 mobile-apps random | Apple App Store listings n=1000 mobile-apps random
  * static certificate-pinning indicators | share of apps with one instance | up to 27% of Android apps and 33% of iOS apps
      quote: "Static analysis reveals even more potential pinning (up to 27% on Android and 33% on iOS)." [introduction]
  * runtime certificate pinning | share of apps using pinning at runtime | 11.4% of popular iOS apps and 6.7% of popular Android apps
      quote: "We find a wide range of prevalence for potential and actual pinning, with 11.4% of popular iOS apps and 6.7% of popular Android apps using pinning in our dynamic tests." [introduction]
  * runtime certificate pinning | share of apps using pinning at runtime | 0.9% of random Android apps and 2.5% of random iOS apps
      quote: "Pinning is much less prevalent in randomly selected (i.e., less popular) apps (0.9% of Android and 2.5% of iOS apps)." [introduction]
  * pinning circumvention | share of unique pinned destinations circumvented | ≈51.51% on Android and ≈66.15% on iOS
      quote: "we were able to successfully circumvent pinning for ≈51.51% unique destinations on Android, and ≈66.15% unique destinations on iOS." [methodology]
  * weak TLS ciphers | percentage of apps with at least one bad-cipher connection | Common Android: 23.4% of pinning apps versus 8.35% overall
      quote: "For the Common Android dataset, we see that pinning apps reduce connection security as the percentage of bad ciphers in pinning apps is higher (23.4%) than that of the overall dataset (8.35%)." [results]
  * PII in pinned traffic | PII prevalence in pinned versus non-pinned traffic | iOS advertisement IDs: 25.85% pinned versus 18.06% non-pinned
      quote: "Ad. ID* 25.85 % 18.06 %" [results]

USENIX 2021 — Why Eve and Mallory Still Love Android: Revisiting TLS (In)Security in Android Applications
  population: Google Play n=1335322 mobile-apps seed-and-crawl | Google Play n=15000 mobile-apps random | Google Play n=40 mobile-apps purposive
  * NSC adoption | share of Google Play apps | 99,212 of 1,335,322 apps implemented custom NSC settings
      quote: "Of the 1,335,322 free Android apps we analyzed, 99,212 implemented custom NSC settings." [results]
  * NSC security downgrades | share of apps with custom NSC files | 88.87% downgraded security compared to default settings
      quote: "Out of the 99,212 apps with custom NSC files that we were able to identify in our body of Android applications, 88,174 (88.87%) apps included configurations that downgrade security compared to default settings." [results]
  * Certificate pinning | share of apps with custom NSC settings | 663 apps, or 0.67%, used NSC certificate pinning
      quote: "Overall, we found 663 apps that implement certificate pinning using NSC." [results]
  * Trust in user-installed CAs | share of apps targeting Android 7 or higher | 8,606 apps (8.67%) re-enabled trust for user-installed certificates
      quote: "Out of 1,098,479 apps targeting Android 7 or higher, we found 8,606 apps that re-enable trust for user-installed certificates (8.67%)." [results]
  * Vulnerable certificate-validation code | share of analyzed apps | 5,511 of 15,000 apps (36.7%) were vulnerable
      quote: "Overall, we found 2,232 (14.8%) apps with vulnerable HostnameVerifier and 5,202 (34.7%) apps with vulnerable TrustManager implementations." [results]
  * Google Play safeguard bypasses | acceptance or blocking of experiments | Most vulnerable TrustManager and HostnameVerifier implementations were accepted
      quote: "After submitting each experiment to Google Play, the app went through the Google Play app review procedure. Once the verification process concluded, we checked for security alerts in the Google Play Console." [methodology]
  * Sensitive data over HTTP | share of manually analyzed apps | More than half of both 20-app sets used HTTP for sensitive user data
      quote: "In conclusion we find that in both sets more than half of the apps we tested manually used HTTP to transfer sensitive user data including login credentials." [results]

USENIX 2024 — Racing for TLS Certificate Validation: A Hijacker's Guide to the Android TLS Galaxy
  population: 360 Mobile Assistant (Qihoo 360 Appstore) n=4121 mobile-apps top-n | Google Play store based on the rank of APKPure n=5452 mobile-apps top-n | 360 Mobile Assistant (Qihoo 360 Appstore) n=2765 mobile-apps top-n | Google Play store based on the rank of APKPure n=5061 mobile-apps top-n
  * TLS certificate validation failures | share of apps | 55.3% of Chinese apps and 6.4% of Google Play apps
      quote: "We found that 1529/2765 (55.3%) of Chinese apps were identified to have at least one of the four certificate validation issues; in contrast ... 322/5061 (6.4%)" [results]
  * Validation hijacking | share of insecure apps | 34.3% of insecure Chinese apps and 21.1% of insecure Google Play apps
      quote: "524/1529 (34.3%) of the Chinese apps, and 68/322 (21.1%) of the Google Play apps with TLS validation issues suffer from validation hijacking." [introduction]
  * Unverified certificate signatures | share of apps | 47.3% Chinese and 4.8% Google Play apps
      quote: "1307/2765 (47.3%) were identified with unverified certificate signatures ... For Google Play apps, 244/5061 (4.8%)" [results]
  * Self-signed certificate acceptance | share of apps | 49.7% Chinese and 4.8% Google Play apps
      quote: "1375/2765 (49.7%) trusted self-signed certificates ... For Google Play apps, 243/5061 (4.8%)" [results]
  * Expired certificate acceptance | share of apps | 47.4% Chinese and 4.6% Google Play apps
      quote: "1310/2765 (47.4%) accepted expired certificates ... For Google Play apps, 231/5061 (4.6%)" [results]
  * Domain mismatch acceptance | share of apps | 38.3% Chinese and 4.7% Google Play apps
      quote: "1059/2765 (38.3%) ignored mismatched domain ... For Google Play apps, 236/5061 (4.7%)" [results]
  * Sensitive information leakage | share of insecure apps | 88.8% of Chinese apps with validation issues; 86.3% of Google Play apps used plain insecure TLS
      quote: "In the Chinese app dataset, we found that 1358/1529 (88.8%) of the apps transmit sensitive information using insecure TLS connections." [results]
  * Static certificate override presence | share of collected apps | 47.0% Chinese and 21.3% Google Play apps used override functions
      quote: "Through a combination of dynamic and static analyses, we observed 1937/4121 (47.0%) Chinese apps and 1162/5452 (21.3%) Google Play apps utilizing these override functions." [results]

CCS 2023 — IoTFlow: Inferring IoT Device Behavior at Scale through Static Mobile Companion App Analysis.
  population: three prior datasets: Neupane et al., IoTSpotter, and IoTProfiler n=9889 mobile-apps pre-existing-dataset | Google Play Store n=947 mobile-apps top-n | custom device set n=13 iot-devices purposive
  * IoT endpoint and protocol reconstruction | number of apps with reconstructed endpoints or schemes | Schemes reconstructed in 7,113 remote-endpoint apps and 871 local-endpoint apps
      quote: "For IoT-VER, we reconstructed schemes in 7,113 unique apps for remote endpoints and in 871 apps for local communication." [results]
  * Direct device communication | share of apps | 6,355 apps (64.26%) declared Bluetooth permissions; 1,483 (14.99%) had local IP addresses
      quote: "6,355 (64.26%) apps declare at least one Bluetooth permission. We find a local IP address in 1,483 (14.99%) apps" [results]
  * MQTT endpoint reachability | reachable endpoints | 74 of 138 remote MQTT endpoints (53.62%) accepted a connection
      quote: "We connected successfully (return code 0) to 74 MQTT endpoints (53.62%)." [results]
  * Certificate pinning and expiry | share of apps or certificates | 385 apps (3.89%) used pinning; 9,129 certificates (29.18%) were expired in May 2023
      quote: "We use the approach by Pradeep et al. [76] to identify pinning and the corresponding certificates by analyzing the Network Security Configuration (NSC)" [results]
  * Abandoned domains | domains available for registration | 67 domains from 73 apps were verified available for registration
      quote: "we verified that 67 domains from 73 apps are indeed available for registration." [results]
  * Inter-component data flows | number of flows | 497 of 579 Bluetooth flows (85.84%) involved ICC
      quote: "Overall, we found 579 flows from Bluetooth sources in 90 apps. Remarkably, 497 (85.84%) of these flows involve ICC" [results]
  * Hard-coded encryption keys | share of apps using encryption | 2,321 IoT apps (57.04%) contained reconstructed hard-coded keys
      quote: "Overall, we reconstructed hard-coded keys in 2,321 (57.04%) IoT apps and 408 (50.24%) general-purpose apps." [results]
  * Static versus dynamic behavior coverage | matching domains and paths across 13 apps | IoTFlow extracted 54 domains and 281 paths versus 40 domains and 160 paths dynamically
      quote: "IoTFlow performs better than dynamic analysis and extracts more IoT-related behavior statically from companion apps than dynamic analysis (54 domains and 281 paths vs. 40 domains and 160 paths)" [evaluation]

USENIX 2018 — Discovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation
  population: F-droid n=7 mobile-apps convenience | Google Play n=8664 mobile-apps top-n
  * Undocumented flaws in Android leak detectors | number of unique flaws | 13 unique flaws in FlowDroid
      quote: "Our in-depth analysis of the output of µSE for FlowDroid discovers 13 unique flaws that are not documented in either the paper or the source code repository" [evaluation]
  * Undetected executable data leaks | share of executable mutants undetected | FlowDroid 48.7%; Argus 73.1%; DroidSafe 4.1%
      quote: "FlowDroid cannot detect over 48% of the leaks, while Argus cannot detect over 73%. Further, DroidSafe does not detect a non-negligible percentage of leaks (i.e., over 4%)" [results]
  * Android fragment use | share of apps containing fragments | 91% of 8,664 apps contained fragment code
      quote: "the fact that 7,860 out of 8,664 top apps, or 91% of popular apps contain fragment code" [appendix]
  * Executable injected mutants | number and percentage of executable mutants | 2,026 of 7,584 mutants were verified executable; over 73% filtered
      quote: "µSE injects 7, 584 leaks into the Android apps, of which, 5, 558 potentially non-executable leaks are filtered out using our EE, leaving only 2, 026 leaks confirmed as executable" [results]

USENIX 2023 — The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications
  population: Google Play Store charts n=3006 mobile-apps top-n | iOS App Store category rankings n=1773 mobile-apps top-n
  * privacy consent dialogs | share of successfully analyzed apps | 814 (22.3%) apps displayed a privacy consent dialog on start; 434 (11.9%) displayed a proper dialog.
      quote: "Overall, we detected 814 (22.3%) apps displaying a privacy consent dialog on start. 232 (6.3%) displayed a link, 165 (4.5%) displayed a notice, and 434 (11.9%) displayed a proper dialog." [results]
  * dark patterns | share of proper dialogs with at least one violation | 429 (98.8%) proper dialogs violated at least one design requirement.
      quote: "We detected at least one violation of our design requirements in 429 apps (98.8%). On Android ... 98.4% ... and on iOS ... 99.5%." [results]
  * pre-consent tracker traffic | apps contacting monitored tracking endpoints before interaction | 3013 (82.5%) analyzed apps contacted a covered tracking endpoint before interaction.
      quote: "Mapping the requests back to apps, leads to 3013 (82.5%) of apps contacted one of our covered tracking endpoints before any interaction took place." [results]
  * pseudonymous data transmission | apps sending a unique identifier before consent | 1285 (35.2%) apps sent at least one request containing a unique identifier.
      quote: "1285 (35.2%) apps sent at least one request containing a unique identifier rendering the contained information at least pseudonymous and thus covered by the GDPR." [results]
  * post-rejection data transmission | apps transmitting pseudonymous data after rejection | 5 apps transmitted pseudonymous data after interacting with an unambiguous reject button.
      quote: "We observed 5 transmitting pseudonymous data after interacting with an unambiguous reject button out of which all 5 were new." [results]
  * TCF usage | apps setting TCF-related strings | 146 (4.0%) apps set TCF-related settings during execution.
      quote: "We detected only TCF-related settings in 146 (4.0%) apps. This highly limits any analysis approach based on frameworks." [results]

PETS 2022 — Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps
  population: Google Play n=283065 mobile-apps seed-and-crawl | Apple App Store n=285680 mobile-apps seed-and-crawl | Google Play n=12000 mobile-apps random | Apple App Store n=12000 mobile-apps random
  * tracking-library presence | share of apps containing a library | 88.73% of Android apps and 79.35% of iOS apps contained at least one tracking library.
      quote: "88.73% contained at least one on Android, 79.35% on iOS." [results]
  * potential AdId access | share of apps with matching code | 86.1% of Android apps and 42.7% of iOS apps could access the AdId.
      quote: "We detected potential access to the AdId by checking for the presence of the AdSupport class and the system interface IAdvertisingIdService" [methodology]
  * tracking before consent | share of apps contacting tracking domains at startup | 81.44% of Android apps and 68.46% of iOS apps potentially shared data before consent.
      quote: "This suggests potentially widespread violations of applicable data protection law (in 81.44% of Android apps, and 68.46% of iOS apps)." [results]
  * PII exposure in network traffic | share of apps transmitting identifiers | 55.4% of Android apps and 31.0% of iOS apps shared the AdId over the Internet.
      quote: "We found that more Android apps shared the AdId over the Internet (55.4% on Android, and 31.0% on iOS)." [results]
  * permission requests | share of apps requesting permissions | Camera was requested by 56.3% of iOS apps and 21.2% of Android apps.
      quote: "Both were included by about 50% of iOS apps (Camera 56.3%, Location 49.2%), and less than a third of Android apps (Camera 21.2%, Location 28.0%)." [results]
  * cross-platform app identity | share classified as cross-platform | 13.7% of downloaded Android apps and 12.8% of iOS apps met the 95% similarity threshold.
      quote: "Among the 24k downloaded apps, we considered only those apps as cross-platform that had a cosine similarity of at least 95%. This amounted to 13.7% of downloaded Android apps, and 12.8% of iOS apps." [methodology]

USENIX 2024 — Unpacking Privacy Labels: A Measurement and Developer Perspective on Google's Data Safety Section
  population: AndroZoo n=2720000 mobile-apps pre-existing-dataset | Google Play Store n=1100000 mobile-apps exhaustive | Google Play Store n=15000 mobile-apps purposive | custom trend-based developer list n=30000 mobile-apps purposive
  * DSS adoption | share of apps | 46.8% of apps had privacy labels as of May 2023.
      quote: "Privacy labels are present only for 46.8% of the apps on the Google play store (as of May 31 2023)." [dataset]
  * DSS longitudinal changes | share of apps updating DSS | 40% updated their DSS at least once; 4% updated it at least twice.
      quote: "We find that 40% (n=283K) of the apps updated their DSS at least once, while 4% (n=27K) updated it at least twice." [results]
  * Third-party library underreporting | share of analyzed apps | 42% used at least one advertising or analytics library.
      quote: "Analyzing the apks, we find that 42% of the analyzed subset of apps used at least one third-party library for advertisement or analytics." [results]
  * DSS and permission inconsistency | share of apps | 11.5% reported precise location without location permissions; 23.7% reported files without corresponding permissions.
      quote: "11.5% of the apps report collecting or sharing precise location data without obtaining location permissions." [results]
  * Encryption inconsistency | share of apps | 40% claimed no collection or sharing but encryption; 59% lacked INTERNET permission while claiming encryption.
      quote: "59% of apps do not request network permissions, yet state that they encrypt data in transit." [results]
  * Developer-label disagreement | share of developers | 41% disagreed for collection and 42% disagreed for sharing.
      quote: "41% of developers who stated in their emails not to engage in data collection were nonetheless reported as collecting data in their DSS. A similar inconsistency (42%) was observed for data sharing." [results]
  * Developer response themes | coded responses | 225 responses were coded after filtering 889 voluntary responses.
      quote: "Using the refined codebook, the two authors continued to code independently until they stopped observing new codes by the 175th response... reaching 225 responses." [methodology]
  * Overreported purposes | number of apps | More than 3,500 apps listed six or more purposes for every collected data type.
      quote: "out of the 7 possible purposes for collecting data, more than 3.5K apps list 6 or more purposes for every data type they collect" [results]

WWW 2021 — A Longitudinal Study of Removed Apps in iOS App Store.
  population: iOS app store n=1033488 mobile-apps exhaustive | iOS app store n=854 mobile-apps purposive | iOS app store n=759 mobile-apps purposive
  * iOS app removals | number of removal records and distinct apps | 1,129,615 records corresponding to 1,033,488 different apps
      quote: "Overall, there are 1,129,615 app removal records, which correspond to 1,033,488 different mobile apps." [dataset]
  * Cyclical app removal | median interval between adjacent peaks | 28.5 days
      quote: "The median of time interval between the adjacent peaks is 28.5 days." [results]
  * Removed popular apps | share of removed apps ever ranked top-1500 | 51,704 removed apps (5%)
      quote: "Overall, 51,704 of the removed apps (5%) has been ranked in top-1500 across categories." [results]
  * Removal reasons | share of manually labeled apps by reason | Ranking Fraud 67.6%; Fake Description 56.1%; Content Issue 55.4%
      quote: "Most apps are removed mainly due to the reasons including Ranking Fraud (67.6%), Fake Description (56.1%), and Content Issue (55.4%)." [results]
  * App-removal prediction | F1 score | GBDT achieved F1=0.8326; six-days-ahead prediction achieved F1=79.3%
      quote: "The best performances for AUC score, precision, recall, F1 score, accuracy and false positive rate are 0.9116, 0.8909, 0.8214, 0.8326, 0.8397, and 0.0844, respectively." [results]

NDSS 2026 — CHAMELEOSCAN: Demystifying and Detecting iOS Chameleon Apps via LLM-Powered UI Exploration
  population: WeChat Accounts (4), Appraven Groups (2), Illicit Websites (17) n=500 mobile-apps seed-and-crawl | App Store n=300 mobile-apps random | App Store n=23416 mobile-apps pre-existing-dataset | App Store n=1644 mobile-apps purposive | KNOWN dataset n=467 mobile-apps pre-existing-dataset
  * iOS Chameleon apps | detection rate and precision | 162 of 1,644 apps (9.85%) identified; 92.59% precision
      quote: "C HAMELEO S CAN identified 162 (9.85%) as Chameleon apps, with manual verification confirming a precision of 92.59%." [results]
  * Transformation methods | share of Chameleon apps | 10 categories; specific-string submission 69.60% and designated-area tapping 9.80%
      quote: "the two most prevalent formats ... account for 69.60% (348 cases) and 9.80% (49 cases), respectively." [results]
  * Review-disclosed transformation methods | share of apps | 244 of 500 apps (48.8%) contained disclosed transformation methods
      quote: "48.8% (244) of analyzed apps contained review-disclosed transformation methods" [results]
  * Functional transformation discrepancies | qualitative prevalence | 234 accessible-IPAs transitioned to illicit operational states after transformation
      quote: "Following successful transformation, these apps invariably transition to illicit operational states" [results]
  * Chameleon detection on known apps | recall and precision | 71.76% recall and 100% precision
      quote: "C HAMELEO S CAN achieves a recall of 71.76% and a precision of 100%." [results]
  * Hybrid UI frameworks | share of analyzed apps | 104 of 223 analyzed apps (46.64%) used Flutter or WebView
      quote: "Collectively, 104 apps (46.64%) relied on hybrid frameworks (Flutter or WebView)" [results]
  * UI interference elements | precision, recall, and resolution rate | 19.21% of observed pages contained distracting elements; ads resolved in 85.96% and pop-ups in 95.56%
      quote: "manual analysis identifying distracting elements in 19.21% of cases (848 pages) ... resolved 85.96% of intrusive ads ... and 95.56% of pop-up instances" [results]

PETS 2025 — Privacy Settings of Third-Party Libraries in Android Apps: A Study of Facebook SDKs
  population: AndroZoo n=8848 mobile-apps top-n | AndroZoo n=6203 mobile-apps top-n
  * Facebook SDK integration | share of analyzed apps | 53.68% integrate at least one Facebook SDK
      quote: "3,245 apps (53.68%) integrate at least one of these SDKs." [results]
  * Privacy-setting modifications | privacy-enhanced configuration rate | AutoLogAppEvents: 17.90%; AutoInit: 11.46%; AdvertiserIDCollection: 6.79%
      quote: "The percentage of apps opting for privacy-enhanced configurations remains low across most settings, such as AdvertiserIDCollection, where only 6.79% of apps disabled the default data collection setting." [results]
  * Personal-data transmission | unique connections and transmitting apps | 80,449 unique connections from 4,959 apps; 3,589 apps transmitted user data
      quote: "we successfully intercepted 80,449 unique connections from 4,959 apps, with 3,589 of these apps transmitting a range of user data." [results]
  * Facebook SDK data transmission | connections containing personal data | 917 connections across 518 apps
      quote: "Facebook SDKs were identified as one of the top sources of off-device personal data transmission, with 917 connections containing personal data across 518 apps" [results]
  * AdID transmission | share of Facebook SDK data transfers | AdID was 54.03% of data types transferred by Facebook SDKs
      quote: "Among all data types transferred by Facebook's SDKs, AdID was the most prevalent (54.03%)" [results]
  * Privacy-label discrepancies | potential non-disclosure rate | 399 of 1,388 apps (28.75%) enabled AdID collection but failed to disclose it
      quote: "399 out of 1,388 apps (28.75%) have AdvertiserIDCollection enabled-whether explicitly set or left as the default-but fail to disclose this in their privacy labels." [results]
  * Privacy-policy discrepancies | non-disclosure rate | 58 of 1,037 analyzed policies (5.59%) failed to disclose AdID collection
      quote: "Across all 1,388 apps with AdID collection enabled-either by default or explicitly-we analyzed 1,037 privacy policies and identified 58 apps (5.59%) that did not disclose AdID collection." [results]
  * Child-directed app compliance issues | apps evaluated | 73 apps met all three restrictive criteria; 779 declared Play Families adherence
      quote: "Our evaluation of 73 apps that met these criteria did not uncover issues related to the integration of Facebook SDKs" [results]

==============================================================================
8. FOLD RESIDUE — every "used" tool name in appAnalysis that mobile_fold.mjs does NOT map
==============================================================================
"used" tool tuples in appAnalysis: 3306; mapped to a family: 921 (27.9%); residue: 2385 tuples in 1732 distinct names

The residue is dominated by general-purpose tooling (Python, PyTorch, Chrome) that the
fold deliberately does not name, plus one-off custom tools. Printed in full, >=2 tuples:
unmapped name                          tuples
-------------------------------------  ------
VirusTotal                             58
Python                                 22
Selenium                               21
Chrome                                 19
scikit-learn                           15
Amazon Mechanical Turk                 10
EasyList                               10
Random Forest                          10
OpenSSL                                9
Prolific                               9
Scrapy                                 8
Firefox                                8
spaCy                                  8
Android                                7
iptables                               7
Google Play                            7
Google Search                          7
Docker                                 7
Tranco                                 7
PyTorch                                7
NLTK                                   6
WordNet                                6
Google Translate                       6
Support Vector Machine                 6
TensorFlow                             6
Android Studio                         6
AVClass                                6
t-SNE                                  6
EasyPrivacy                            6
PolicyLint                             6
Qualtrics                              6
Amazon EC2                             5
Android SDK                            5
Android NDK                            5
netstat                                5
Keras                                  5
word2vec                               5
BERT                                   5
GPT-4o                                 5
Android Open Source Project (AOSP)     4
Amandroid                              4
MaxMind                                4
Safari                                 4
R                                      4
Google Chrome                          4
logistic regression                    4
IccTA                                  4
Chromium                               4
Tesseract                              4
MobileInsight                          4
aapt                                   4
SMOTE                                  4
USRP B210                              4
CogniCrypt                             4
BeautifulSoup                          4
Google Play Store                      4
Google Safe Browsing                   4
langdetect                             4
JEB                                    4
DBSCAN                                 4
IPinfo                                 4
CryptoGuard                            4
TF-IDF                                 4
Adam                                   4
Exodus                                 4
Wenjuanxing                            4
PoliCheck                              4
Polisis                                4
ChatGPT                                4
Heros                                  3
strace                                 3
class-dump                             3
SEAndroid                              3
Google Play Unofficial Python API      3
SQLite                                 3
Monsoon Power Monitor                  3
MalloDroid                             3
Dynamic Time Warping                   3
grep                                   3
curl                                   3
AWS EC2                                3
SuSi                                   3
OpenWPM                                3
k-means                                3
Tor Browser                            3
Flask                                  3
EdgeMiner                              3
Z3                                     3
ping                                   3
OCR                                    3
RabbitMQ                               3
Scikit-learn                           3
strings                                3
Binwalk                                3
Logistic Regression                    3
Python Requests                        3
RootBeer                               3
Crunchbase                             3
Puppeteer                              3
Lumen Privacy Monitor                  3
UIHarvester                            3
ProVerif                               3
CocoaPods                              3
MiniCrawler                            3
crt.sh                                 3
ipinfo.io                              3
nmap                                   3
WhatsApp                               3
AirGuard                               3
SpaCy                                  3
AFL++                                  3
APKEditor                              3
Android Asset Packaging Tool           2
Dedexer                                2
AOSP                                   2
jsoup                                  2
Web of Trust (WOT)                     2
k-nearest neighbors (k-NN)             2
AppBrain.com                           2
Carat                                  2
Norton Mobile Security                 2
Hopper                                 2
otool                                  2
GDB                                    2
Dalysis                                2
Robotium                               2
NetworkX                               2
Stanford parser                        2
support vector machine (SVM)           2
Dexpler                                2
noVNC                                  2
PhoneLab                               2
tc                                     2
GSM Arena                              2
MaxMind GeoIP                          2
PlanetLab                              2
Meddle                                 2
ReCon                                  2
Hindsight                              2
AdGuard                                2
Celery                                 2
Redis                                  2
enjarify                               2
Support Vector Machine (SVM)           2
logcat                                 2
Compatibility Test Suite (CTS)         2
SVM                                    2
Android Asset Packaging Tool (aapt)    2
Z3-Str                                 2
APK Downloader                         2
DroidSafe                              2
XGBoost                                2
Node.js                                2
Gradient Boosting                      2
Word2Vec                               2
Google Text-to-Speech                  2
Scapy                                  2
hostapd                                2
srsLTE                                 2
OpenStreetMap                          2
BLESSED                                2
Gensim                                 2
ssdeep                                 2
Shodan                                 2
Nessus                                 2
Capstone                               2
Latent Dirichlet Allocation            2
Random Forest Classifier               2
NIST SP 800-22                         2
Google Cloud Natural Language API      2
imagehash                              2
Euphony                                2
FirmXRay                               2
Baidu                                  2
Public Suffix List                     2
Apache Spark                           2
AWS                                    2
RIPE Atlas                             2
Luminati                               2
agglomerative hierarchical clustering  2
PhishTank                              2
Pandas                                 2
Farsight DNSDB                         2
Beautiful Soup                         2
AppCensus                              2
DeviceCheck                            2
Google App Engine                      2
GNU Parallel                           2
OpenVPN                                2
Google Vision API                      2
YOLOv3                                 2
Koodous                                2
URLCrazy                               2
K-means                                2
Festvox                                2
ACVTool                                2
TensorFlow Lite                        2
TDLib                                  2
DYNAMO                                 2
Cuttlefish                             2
SCAT                                   2
Apptopia                               2
SimilarWeb                             2
googleplay-api                         2
AllenNLP                               2
LightGBM                               2
Doccano                                2
Prodigy                                2
apksigner                              2
Firmware Scanner                       2
Androwarn                              2
Twitter Academic API                   2
BeautifulSoup4                         2
tc-netem                               2
WHOIS                                  2
Termux                                 2
Random forest                          2
Google Play query completion API       2
Google Translate API                   2
Android Studio Emulator                2
AntMonitor                             2
tldextract                             2
MNN                                    2
VirusTotal API                         2
Hidden Markov Model                    2
Viterbi algorithm                      2
k-nearest neighbors                    2
ImageNet                               2
Google Maps                            2
nDPI                                   2
Open5GS                                2
BrowserStack                           2
Edge                                   2
Brave                                  2
Sentence-BERT                          2
HtmlToPlaintext                        2
Apple Find My                          2
OpenHaystack                           2
RoBERTa                                2
Chrome DevTools                        2
Playwright                             2
Symantec Sitereview                    2
cosine similarity                      2
SciPy                                  2
ZXTouch                                2
Logcat                                 2
AVClass2                               2
eBPF                                   2
ThirdEye                               2
Google search engine                   2
Apache                                 2
TalkBack                               2
Raspberry Pi 4                         2
ss                                     2
GraphSAGE                              2
GPT-4                                  2
Theos                                  2
Unity                                  2
regular expressions                    2
google_play_scraper                    2
DuckDuckGo Tracker Radar               2
ESP32                                  2
PostgreSQL                             2
plistlib                               2
Google Play Protect                    2
requests                               2

names appearing exactly once: 1466 — listed alphabetically:
  114DNS passive DNS | 3-layer neural network | 360 Mobile Guard | 360 Passive DNS Project
  3u | 7-Zip | 89z Google Play crawler | A-priori algorithm
  AAPT | ABBYY FineReader | ABY | ACR122u
  ADAM | ADB Log-Cat | ADB Logcat | ADT Eclipse plug-ins
  AES | AKAZE | ANTLR | AOSP 4.4.2 r12
  APER | APISENSE | APKLab.io | APKParser
  ARM NEON | ARPABET | ATLAS.ti | AV-Class
  AVG | AVG AntiVirus Free | AVG Antivirus Free v2.9 | AWS Device Farm
  AWS IoT | AZ Screen Recorder | Abuse.ch's malware sources blacklist | Accelerometer Meter v1.32
  AccessibilityService | Acra 4.2.3 | ActivityInstrumentationTestCase | Acunetix
  AdAway | AdAway Hosts | AdBlockPlus | AdaBoost
  Adafruit Bluefruit LE Sniffer | Adafruit PN532 | Adaptive Boost | Adaptive Misinformation
  AdblockPlus Library for Android | AdvBox | Affinity Propagation | Affinity propagation
  Aho-Corasick automaton | Aircrack-ng | AlarmManager | Alexa
  Alexa ranking | AliPay-dev | Aliyun Cloud | Aliyun Cloud Servers
  Amarisoft Callbox | Amazon | Amazon AWS EC2 | Amazon Alexa
  Amazon Device Farm | Amazon Rekognition | Amazon Text-to-Speech | Amazon Web Service EC2
  Amazon Web Services (AWS) EC2 m4.4xlarge | AmiGo | AmiGo testbed | AnTuTu
  AndHook | AndroBomb | AndroChef Java Decompiler | AndroTotal
  AndroZoo app crawler | Android 10 | Android 2.2 | Android 2.3.3
  Android 4.1.1 (Jellybean) | Android 4.3 emulator | Android API | Android ART DoCall()
  Android Asset Packaging Tool (AAPT) | Android Auto Clicker | Android Bluetooth HCI snoop log | Android CPU governors
  Android DDMS | Android Developers documentation | Android InstrumentationTestRunner | Android Open Source Project
  Android Open Source Project (AOSP) 8.1 | Android OpenSSL | Android PackageManager APIs | Android Profiler
  Android Sensor Framework | Android SpeechRecognizer API | Android Studio IDE | Android Studio Profiler
  Android TextToSpeech API | Android ViewServer | Android WebView | Android adb
  Android dumpsys | Android proc filesystem | AndroidStudio | Anguli
  AntMonitor Library | Antiy AVL Mobile Security | Antutu Benchmark | AoAv2 protocol
  Apache Cordova | Apache Groovy | ApkSigner | Apkmonk
  App Annie | App Store Scraper | App instrumentation framework by Koch et al. | AppBrain API
  AppCensus custom Android instrumentation | Appetize.io | Apple App Store | Apple App Store API
  Apple Catalog API | Apple Geolocation API | Apple Maps | Apple iCloud API
  Apple-provided web API | AppleScript | AppsPlayground | Appscope
  Aquatone | Archive.org | Arduino | Arduino Micro
  Argus | Arjun | AssetStudio | Attack-VC
  Audacity | AudioFlinger | AutoCog | AutoGluon
  AutoHotkey | AutoVC | Autofill Framework | Avast
  Axolotl | Aya | BCM4387 network adapter | BERT Cased
  BERT-Base uncased | BERT-base-uncased | BIND 9 | BLE 4.2 adapter
  BLE GAP API | BTLEmap | Baidu OCR | Baidu PhoneGuard
  Bash | Basic Naive Bayes (BNB) | Battery Historian | BatteryLab
  Beautiful-Soup | Bee | Better tracker blocker | BiLSTM
  BinDiff | Binary Ninja | BinaryNinja | BladeRF
  BlueDroid | BlueSeal | BlueStacks | Bluetooth
  Bluetooth Explorer | Bluetooth HCI snoop | Bluetooth Packet Logger | BluetoothGatt
  BluetoothGattServer | Boot-Image-tools | Bosch GLR825 laser distance measurer | BouncyCastle
  Brave Software | Brave for Android | Bro | Broadcom BCM4360
  Bui et al. purpose-extraction tool | Bundler toolkit | BusyBox | Butterworth filter
  BypassRootCheck-Pro | C&W | C4.5 Decision Tree | C4.5 decision tree
  CADO-NFS | CAIDA's Archipelago (Ark) | CANDID | CBOW (Continuous Bag-of-Words)
  CETA resources | CETD algorithm | CFR | CHIP Tool
  CLD3 | CLIP | CLTK | CMU pronunciation dictionary
  CMUDict | CNN & RNN | CNN and RNN | CSRF Scanner
  CTIA Stolen Phone Checker | CVC4 | CVE | CVE Details
  CYREN | CaffeineMark | Camera Timestamp Free | Canny Edge Detection
  CardEmulator | Cardpliance | Carthage | Cartographer
  Cartopy | CellularPrivacy | Centroid | Centroid Prediction
  Centroids | Cephei | ChatGPT (OpenAI's TextCompletion API) | ChatGPT 3.5 and 4
  CheckHost | Checker Framework | Choco data constraint solver | Chrome DevTools Protocol
  Chrome DevTools Protocol (CDP) | Chrome Developer Tools | Chrome Extension Source Viewer | Chrome User Experience Report (CrUX)
  Chrome WebDriver | Chrome WebRTC Debugging Console | Chrome remote debugging protocol | ChromeCacheView
  Chromium Code Search | Chromium source code | Clang-based fuzzy parser | Cloud Datastore
  Cloud Research | Cloudflare website categorization | ClueFinder | CmrfScanner
  CodeQL | CogniCryptSAST | ComDroid | Common Library classification
  Compatibility Testing Suite (CTS) | ConceptNet | Console | Convolutional Neural Network
  Convolutional neural network (CNN) | Cookie-Editor | CoreML | CrashScope
  Criminal IP | Cruiser app crawler | Crunchbase API | CrySL
  Crylogger | CryptoREX | Customized Mitm Proxy | CyanogenMod
  Cyanogenmod 11 | Cycript | Cydia Substrate | D8
  DAGGER | DBIP | DED | DIAG
  DIALDroid-Bench | DOTHOME | DSFD | Daikon
  Dalvik VM | Dalvik virtual machine | Damerau-Levenshtein edit distance | Dare
  Decision Tree | Decision Tree (DT) | Decision Trees | DeepFool
  DeepSec | DeepSniffer | DeepSteal | DeltaWalker
  DenseNet 201 | Depot | Detect Language | Dialogflow
  DidFail | Difuzer | Digital Asset Links | DigitalOcean
  Disconnect | Disconnect Me | Dnsmasq | Doc2Vec
  Docker Swarm | DomainTools WHOIS | DontKillMyApp | Dopamine
  DoubleX | Dovecot | Draco | Dragnet
  DroidBench | DroidBench 2.0 | DroidChameleon | DroidPlugin
  DroidRA | DroidSIFT | Droidlysis | Drozer
  EAST | ELM327 command set | EMP-toolkit | EOEDroid
  ESP32 WROOM | Easy List | Easy Privacy | EasyList, EasyPrivacy, Disconnect, and AdGuard mobile list
  Eclipse | Eclipse ADT | Edgeminer | EfficientNet-B0
  Elasticsearch | Elbow method | ElevenLabs | Ella
  Empath | Epicc | Esprima | Etherscan
  Etherscan List Token Transfer Events API | Ettercap | Ettus USRP B210 | ExifRead
  ExoPlayer | Exodus Privacy tracker list | Exodus-Privacy | ExodusPrivacy
  Explicit Semantic Analysis | ExpressVPN | Extreme Gradient Boosting (XGB) | F-Secure
  FAISS | FFmpeg | FP-GROWTH | FPMON
  FSEvents | FSGANR | FSGANS | FSquaDRA
  FSquaDRA2 | FaceNet512 | FaceShifter | Facebook Graph API
  FairFace | Fakeium | Faker | Fanboy
  Fast Gradient Sign Method (FGSM) | FastAI | FastDTW | FastRPC
  Fastbot | Fastly | Fax | Fernflower
  Filebench | FindSecBugs | FingerprintJS | FingerprintJS2
  Fingerprintjs2 | FireBase Scanner | Firebase scanner | Firefox mobile browser
  FirmXray | First Order Method Model (FOMM) | Fisher Score | Fleiss's κ
  Flesch Kincaid Calculator | Flightradar24 | FlowPrint | Flutter
  Foolbox | ForceAtlas2 | ForcePoint | Fortify SCA
  Fossology | FoulWrapper | Function ID | G*Power
  GATOR | GCC | GCC/G++ | GDA
  GPT-4-Turbo | GPT-J 6B | GPT4o | GPy
  GSDMM | Gadgets360 | Gaussian Mixture Model | Gaussian Naive Bayes
  Gaussian Naive Bayes (GNB) | Gaussian mixture models (GMMs) | Gaussian model | Gemini
  Generative Adversarial Network (GAN) | Genymotion Emulator | GeoIP | Geocodio
  Gitleaks | Go | Go-based crawler | GoDaddy
  Google | Google AdWords | Google Ads | Google App Engine AutoML
  Google Best Guess | Google Chrome 63.0.3239.111 | Google Chrome's browser developer tools | Google Cloud Natural Language APIs
  Google Cloud Speech-to-Text | Google Cloud Vision API | Google Compute Engine | Google Custom Search API
  Google Custom Search JSON API | Google Dataset Search | Google Direction API | Google Firebase Test Lab
  Google Form | Google Forms | Google Image | Google Image Search
  Google Images | Google Keyword Planner | Google Map API | Google Maps API
  Google Maps Directions API | Google Maps Javascript API | Google Natural Language API | Google Pixel 3a
  Google Play Console | Google Play Downloader | Google Play SDK Index | Google Play Store developer console
  Google Play recommendation system | Google SSO | Google Safe Browsing Update API | Google SafeBrowsing
  Google Scholar | Google Search APIs | Google SentencePiece Tokenizer | Google Takeout
  Google Tesseract OCR | Google Translate API for Python | Google Translation | Google Translator
  Google Vision Text Documentation Detection API | Google libphonenumber | Google migration API | Google play unofficial Python API
  Google related query API | Google text-to-speech (TTS) engine | Google's Activity Recognition API | Google's Gemini LLM
  Google's Protobuf compiler | Google's Tesseract | Google's Vision API | Google's language detection
  Google-Protobuf | GooglePlay | Gradient Boosting Decision Tree | Gradle
  Grammarly | GraphQL Security Auditor | Greynoise | Grid Search
  Griffin-Lim | Grounded Theory | Guibat icon classification model | Gyrophone code
  H3 | HCI snoop log | HERE Map | HIVE-COTE
  HLR lookup | HLRLOOKUPS | HMAC-SHA256 | HTTP Archive
  HTTP Toolkit | HTTPS Everywhere | Hadoop File System | Hakrawler
  HanLP | Haversine formula | Heroku | Hertz
  Hierarchical Mixture of Naive Bayes (HMNB) | Hill Climbing | History Export | HornDroid
  HostingChecker | Hurricane Electric's Tunnel Broker | Hushed | Hybrid Analysis
  IBM WALA | IC3 | ICSI Certificate Notary | ICSI Netalyzr for Android
  ICface | IDA Freeware | IDA-Pro | IDA-pro
  IGNN | IMEI.info | INA219 High Side DC Current Sensor | IP2Location
  IPA-tool | IPInfo | IPaddressAPI.com | IPerf
  IRTT | Inception | Inception-ResNet-v1 | InceptionTime
  Intel PCM | IntelliDroid | Internet Archive | Internet Information Services (IIS)
  Internet Routing Registries (IRRs) | JA3 | JA3S | JAW
  JD-GUI | JEB Android decompiler | JEB Decompiler | JEB Pro
  JEB decompiler | JExifViewer | JSA String Analyzer (JSA) | JSketch
  JSoup | JSoup 1.11.1 | JTOOL | Jaccard index
  Jaccard similarity coefficient | Janus | Java API nanoTime | Java Cryptography Architecture (JCA)
  Java Cryptography Extension (JCE) | Java Reflection | Java reflection | Java-ML
  JavaBaker | JavaParser | JavaPathfinder | JavaSMT
  JavaScript | JetBrains dotPeek | Jieba | Jitsi
  Joker | Jupyter Notebooks | K Nearest Neighbors | K-Nearest Neighbor
  K-Nearest Neighbor (kNN) | K-Nearest Neighbors | K-Nearest Neighbors (KNN) | K-nearest neighbor algorithm (KNN)
  KVM | Kamailio | KiwiTalk | Knockoff Nets
  Kolmogorov-Smirnov test | Kplaysearch | Krakatau | Krippendorff's alpha
  Kruskal-Wallis test | Kryptowire's internal Android static analysis engine | LATCH | LDA
  LDPlayer | LIBLINEAR | LIBSVM | LIEF
  LIME | LLDB | LLVM | LLaMA 3.1 8B Instruct
  LME4 | LOWESS | LSPlant | LSTM encoder-decoder
  Lalaine | Langdetect | Language Technology Platform (LTP) | Lasso regularized linear regression
  Latent Semantic Analysis | LatinIME | Leader Algorithm | LeakScope
  LearnLib | Learning Vector Quantization (LVQ) | Legend | Lemur
  Levenberg-Marquardt algorithm | LexisNexis | LibAFL | LibFuzzer
  LibPecker | LibSVM | LightCNN | Lightbeam
  LineageOS | LineageOS 19 | Linux Virtual Machine | Linux namespaces
  LiteRadar | LiveLab | Llama 3 | Local Extreme Value Detection (LEVD)
  Local Outlier Factor | Logistic Regression (LR) | Long Short-Term Memory | Lookout Security & Antivirus
  Lookout Security & Antivirus v6.9 | Lookout Security and Antivirus | Louvain algorithm | Lumen
  Lumos | Lxml | M'layer Perceptron (Deep) | MANOVA
  MATLAB | MATLAB 5G Toolbox | MATLAB Curve Fitting Toolbox | MAXQDA
  MD5 | MD5 and SHA-1 cryptanalytic toolbox (hashclash) | MDROID+ | MIRToolbox
  MIRtollbox | MITM SSL proxy | MKNetworkKit | ML-Doctor
  MLP | MPlayer | Mace | Mallodroid
  Mallory | MalwareBytes | ManyCam | Marvel App
  Marvel app | Matlab | Matlab LTE Toolbox | Matplotlib
  Matter.js | Maven Repository | MaxMind GeoIP2 Precision Web Service | MaxMind GeoLite2
  MaxMind Geolocation | MaxMind commercial database | Maximum Likelihood Estimation | Maxmind
  McAfee | McNemar's test | Mechanical Turk | Media Projection
  MediaExtract | MeshLab | Metasploit | Microsoft Azure
  Microsoft Azure Speaker Recognition | Microworkers | Mini-Crawler | Mixture of Naive Bayes (MNB)
  Mixture of Naive Bayes with Categories (MNBC) | MoaAB | Mobibench | Mobile Verification Toolkit (MVT)
  MobileNetV2 | MobileNetV3 | Mobileinsight | ModelXray
  ModelXtractor | ModemManager | Modularity | MongoDB
  Monsoon High Voltage Power Monitor | Monsoon Meter | Monsoon high-resolution Power Monitor | Monsoon power monitor
  Monte Carlo simulations | Mother of All Adblocking | Mozilla Rhino | Mozilla's funfuzz
  Mullvad | Multi-Hop | Multinomial Naïve Bayes | Munkres algorithm
  NIST statistical test suites | NLTK CoreNLP Parser | NLTK English stopwords list | NLTK Sentence Tokenizer
  NLTK stop words | NMAP | NPA/NXX database | NTP
  Naive Bayes | Naive Bayes classifier | Naive Bayes with Informative Priors (PNB) | National Vulnerability Database
  Navizon app | Nearest Neighbor | Needleman-Wunsch algorithm | Netify
  Netlab | Netron | Netstat | Network Analyzer
  Network Signal Guru | NetworkManager | NetworkProfiler | Neural Networks
  NextDNS | Nmap | NoFrak | NoTracking
  NomadLAB | Nordic nrf52840 board | Norton | Norton Mobile Security Lite v2.5.0.379
  NortonLifeLock mobile security product | NoxPlayer | NuSMV | NumPy
  O-LLVM obfuscator | OBFUSCAN | OCR SPACE | OOPSpam
  OPAL framework | OPTis-S4 | OS Monitor | OVR Metrics Tool
  OWASP Zed Attack Proxy (ZAP) | Oat2dex | OkHttp3 | Oltrogge et al.'s Android app crawler
  OmniParser | Omnipeek | OneTrust | Online Protobuf Decoder
  Ookla Speedtest | Open | Open GPX Tracker | OpenAI Vision API
  OpenAirInterface (OAI) | OpenCV | OpenCV cv2.absdiff | OpenCellID
  OpenMP | OpenPhish | OpenWrt | OpenYOLO
  Opera | Optunity | Orbot | Osquery
  PACER | PJSIP | PLY (Python Lex-Yacc) | POWDER
  PRAW | Packet Capture | PacketDotNet.Ieee80211 | PacketLogger
  PaddleOCR | PageRank | Paho | Paho MQTT client
  Palo Alto Firewall | Palo Alto Networks proprietary detection system | Papers With Code | Paragraph Vectors Model
  Parani-UD100 | Partial Program Analysis (PPA) | Pastebin | Patch Antenna RP-SMA-R/A
  Patch-based Multiview Stereo (PMVS) | Perceptual Hashing (pHash) | Permission Checker (PerChecker) | Perspective
  Perspective API | PhoneGap | PhotoDNA | Phraser
  Pi-hole's Default List | Pillow | Ping Traceroute | PingTools
  Piper | PlayDrone | Plino | Polar Proxy
  PoliGraph | Policy Highlights | PolicyLint preprocessing script | Porter Stemmer
  Postfix | Postman | Power Profiler | PowerTool
  PowerTutor | Prediction-Poison | Principal Component Analysis | Principal Component Analysis (PCA)
  Priv-Accept | PrivBERT | Privacify | PrivacyGrade
  ProbLog | ProcHarvester | Procyon | Projected Gradient Descent (PGD)
  Prolific Academic | Protocol Informatics (PI) | Proton VPN | Proxmark RDV4
  ProxyDroid | Proxyman | PubNub | PublicWWW
  PurPliance NER model | PyBLE | PyBluez | PyCrypto
  PyDictionary | PyOD | PyPy | PyQt5
  PySMT | PyTorchMobile | PyVirtualDisplay | Pytesseract
  Python 3.8 | Python Cryptography Toolkit (pycrypto) | Python Flask | Python NLTK
  Python SSL library | Python crawler | Python cryptography module | Python enchant
  Python pdfminer | Python script | Python socket library | Python string similarity matching
  Python timeit | Python validators library | Python-based implementation | Qianxin sandbox
  Qihoo 360 | Qihoo 360 passive DNS | Qualcomm Hexagon SDK | Qualys SSL Labs
  Qualys SSL Server Test | Qwen2.5-14B | Qwen2.5-7B | Qwen2.5-Coder-32B-Instruct
  Qwen2.5-VL | R-Droid | R8 | R8 retrace
  RAM disks | RAW SOCKET | ROP | RSPAN
  Raccoon APK Downloader | Raccoon app downloader | Radare | RainbowCrack
  Random Forest (RF) | Random Forests | Random Lists | Randoop
  Rapid7's passive DNS | Raspberry Pi | Raspberry Pi 4 Model B | Raspberry-PI
  ReadabiliPy | Readability | Realistic Vision V4.0 noVAE | Reaper
  Reddit API | Redexer | Regex Generator++ | RenderTexture
  ReproDroid | ResNet101 | ResNet152 | Resemblyzer
  Resnet | RetinaFace | Rev | Ridler-Calvard method
  Robokiller | Robolectric | Root Zone Database | Rust
  SAAF | SAPIC+ | SBERT all-MiniLM-L6-v2 | SHA-256
  SHA-512 | SHAP | SIFT | SIM7000A
  SIMtrace2 | SLOCCount | SMT solver | SNPE
  SQLCipher | SQLMap | SSIM | SSL Labs
  SSL proxy | SSLsniff | STAC | SURF
  SV2TTS | SVC | SVM classifier (custom) | SVM with RBF kernel
  SWI-Prolog | Safari Privacy Report | Safari Web Inspector | SafetyNet
  Samsung Internet Browser | Savitzky-Golay smoothing filter | SceneDroid | Scikit-Learn
  Screaming Frog | Sdat2img | Seaborn | SearchBug
  Selendroid | Selenium WebDriver | Selenium web driver | Self-Organizing Map (SOM)
  Semgrep | SensorDisabler | SensorLog | SensorTower
  SentencePiece | Seq2Seq | SerpAPI | ServiceOS browser runtime
  ShadowNet | Shamiko | Shark | Shark for Root
  Shodan Search Engine | ShowAPI | Showcaller | Siamese neural network
  Signal | Signal for android backup decryption tool | Sikuli | SimCSE
  Simg2img | SimiDroid | Simple Transformers | SimpleNLG
  Skyfield | Slither | Smali/BakSmali | Smart Contract Sanctuary
  SmartDroid | SmartThings Simulator IDE | SnoopDog | Snorkel
  SourceDNA | Spamhaus | Spamhaus Policy Block List | Spamhaus passive DNS API
  Spamhaus' SBL and DBL | Spark | Speedtest CLI | Sphinx
  Sphinx-4 | Spicy | Splituapp | Spongy Castle
  SpongyCastle | SpoofTooph | Spoon | SpyOnWeb
  Squid | Stanford NER | Stanford Named Entity Recognizer | Stanford POSTagger
  Stanford Parser | Stanford Parser Wrapper | Stanford Topic Modeling Toolbox | Stanford typed dependency parser
  Stanza | Statcounter | Stats-Models OLS | Statsmodels
  Steven Black host list | Storm | Strava | Support Vector Machine (SVM) Linear kernel
  Support Vector Machine (SVM) with RBF Kernel | Support Vector Machines (SVM) | Swift | System WebView Shell App
  T5-11B | TC Slim | TC voice synthesis API | TCP-Dump
  TF-IDF cosine similarity | TFLite | TI CC2540 | TLS-Attacker
  TWRP | Tacyt | Tailscale | Tamarin
  Tamarin prover | Team Cymru IP-to-ASN | Team Cymru's Botnet Analysis and Reporting Service | Temperature calibration
  Tencent Map Geocoding API | TensorFlowLite | TerminalEmulator | Tesseract OCR
  Tesseract OCR Engine | Tesseract-OCR | Texas Instruments (TI) CC2640 | Texas Instruments INA219
  TextExerciser | Threema | Tile hidden API | Time Machine
  TinyCheck | Tinyproxy | Titanium Framework | TollFreeNumbers.com
  Tor | Toybox | Trace.js | Trace32
  Tracker Detect | Tracker Radar Collector (TRC) | TrafficStats.getUidRxBytes() | TransE
  Transformer-Based Universal Sentence Encoder | Transformer-based model | Trend Micro Mobile Security | TrendMicro Mobile Security Personal Edition v2.0.0.1294
  Trepn Profiler | TriggerScope | TrollStore | TruffleHog
  Tsung | TurkPrime | Twilio Lookup API | Twitter Search API
  U-Net | UBC | UIPicker | UPX
  URLExtract | URLScan | UTSFuzzer | Uber API
  Uber Client app | UberTooth One | Ubertooth One | Ubertooth-One
  UiRef | UpSet | User Agent Switcher | User Interviews
  VF2 | VFDecrypt | VGG | VGGNet
  VMMap | VMware ESXi | VMware Workstation | Valgrind
  Variational AutoEncoders | VeriFast | Very sparse random projection | ViT
  VirusTotal public API | VisibleV8 | Void | WHOIS database
  WICG webpackage | WProf | Wandoujia management app | Watir
  Wayback Machine | WeChat | WeChat Windows client | WeChat metadata API
  Web Audio API | Web of Trust (WoT) | WebAgentDriver | WebAssembly
  WebProxyTool | WebUI | WebUSB API | Webshrinker
  Weka | WhatsApp Crypt14-Crypt15 Decrypter | WhatsApp Google Drive extractor | WhoTracks.Me
  Whois IP Address Database | WhoisXMLAPI WHOIS API | WiFi Direct | Widevine Integration Platform
  Wine | WireShark/tshark | Word Mover's Distance | Word2vec
  WordNet::similarity | Wowza Stream Engine | WuKong | Wukong
  X-Ray 2020 | X-Ray Tracker List | X2Face | XCUITest
  XCode | XLM-Roberta | XPMChecker | XPOChecker
  XPrivacy | XSEDE TACC Jetstream | XSStrike | Xception
  Xcode UI tests | Xray | YAHFA | YCSB
  YOLO_Label | Yellow Pages | Yet Another Mail Merge (YAMM) | YouTube Player APIs
  Z3-str | Z3StrSolver | ZRTP4PJ | Zeek
  ZeroMQ | ZoKrates | Zoom | aapt2
  adb dumpsys | adblockparser | airbase-ng | allmpnet-base-v2
  android-async-http 1.4.9 | android.os.FileObserver | angr | anisotropy-based quality method
  annotation tool [5] | api.trongrid.io | apk-mitm | app-downloader
  autocorrect | axmlparserpy | bert-base-uncased | bidirectional LSTM
  bidirectional LSTM sentence embedding model | binwalk | bluetooth Python module | bpftool
  chrome-remoteinterface | clang | cloud_enum | commercial URL filtering service
  commercial VPN subscriptions | commercial pDNS tool | conditional random field | conditional random field (CRF)
  continuous speedtest | create ap | curve25519-dalek | custom Android app
  custom EME JavaScript script | custom app-market crawler | custom automated crawler | custom browser extension
  custom crawler | custom retrieval tool | custom scraper | custom static analysis
  custom web scraper | customized Needleman-Wunsch algorithm | cve-search | danglingcname
  data collection tools developed by Garimella and Tyson | database | decision tree classifier | decision trees
  devmodectl | dex-method-list | dexter | diff
  dmg2img | dnsmasq | doc2vec PV-DM | domain Whois
  dpkt | dumpdecrypted | dumpsys | dynamic execution monitor
  dynamic time warping (DTW) | e2tools | eadb | emoji
  emoji Python package | emulator | en_core_web_lg | ens-normalize
  esalib | eth-ens-namehash | ethers.js | exclusive sparse coding
  exit survey software | fast.com | fastText | fastboot
  fastcluster | filemon | firebase-messaging | foundation LLMs
  friTap | gSpan | genetic programming | gensim
  getapk custom shell script | getrusage | google-play-scrape | googler
  googletrans | gplaycrawler | gplaydl | gpsoauth
  gpt-4o | gradient decision boosted trees (GDBT) | graph-based label propagation | graph-tool
  handleopenurl.com | hashcat | hcidump | headless Chrome Browser
  headless browser | hex editor | hierarchical clustering | hpHosts
  hping3 | iOS SDK | iOracle | iPerf
  iPerf3 | iVerify | ibtool | idna-uts46-hx
  instrumented Android 9.0 (Pie) | ip xfrm state | ipcat | ipcc-downloader
  iperf3 | ipinfo | iptoasn.com | ipvigilante.com
  jarsigner | javalang | javap | javascript-hooker
  javax.crypto | jeb | jieba | jitsi-srtp
  jtool | k-Means | k-means clustering | kernel module
  keytool | knee-point method | ksvm | lattice-based key recovery algorithm
  libav | libclang | libqmi | libselinux
  libtins | linux-router | lldb | log
  logic analyzer | lxml | mDNSResponder | macOS Console
  macOS Console app | macOS system logging facility | machine learning classifier from Chatterjee et al. | massdns
  maximum-relevancy minimum-redundancy (mRMR) | miniTracing | minidom | mitm-proxy
  mobile security product's analysis infrastructure | mock location provider | modAL | mtr
  mtranslate | multi-class k-nearest neighbors classifier | multi-layer perception (MLP) | multi-layer perceptron (MLP)
  multimeter tester | multipass | nRF52832 Dongle | ncnn
  nearest neighbor algorithm | netsniff-ng | network sniffer | network tap
  networkx | nosmoke | nsenter | oat2dex
  objdump | one-class Support Vector Machine | openssl | our crawler
  ovrgpuprofiler | p0f | paraphrase-multilingual-MiniLM-L12-v2 | parse-play
  pcap-parser | pcap4j | petlib | pfctl
  pix2pix | pkuseg | playsound | plutil
  pm3 client | power-meter | procstats | professional transcription service
  proprietary instrumented AOSP build | protobufs library | protoscope | proxy
  proxy server | proxychains4 | publicly available GitHub script | publicsuffixlist
  publicwww.com | pyOpenSSL | pySim | pyasn1
  pyautogui | pyelftools | pygtrans | pymobiledevice3
  pysoot | pytesseract | python-magic | python-whois
  pytorch.nn | pywinauto | r0capture | r4nd0m
  radiff2 | random forest | random forest (custom) | random sampling
  recurrent neural network with LSTM units | redroid | regex package | regular expressions (regex)
  reservoir sampling | ripgrep | roberta-large-nli-stsb-mean-tokens | rootAVD
  rvictl | scikit-learn DecisionTreeRegressor | scrcpy | screening application
  script written by the aforementioned hobbyist | semantic similarity | sentence-transformers/all-MiniLM-L6-v2 | sesearch
  simg2img | simulated annealing | smali/dexpler | smp_call_function_single
  spaCy en_core_web_lg | sparse SVM | speedtest.net | sqldiff
  sqlmap | srec_cat | srsENB | srsRAN
  srsRAN v21.10 | srsUE | sslscan | startSSL
  stochastic gradient descent (SGD) | stress-ng | strongSwan | supervised linear classifier (custom adaptation)
  sysctl | sysfs | syslog -w | sysmoEUICC1
  tPacketCapture | tf-idf vectorizer | tld | tool developed by Garimella et al.
  traceroute | transformer-based encoder | transparent proxy | tree edit distance
  tvbus.exe | two-coin model | uBlock Origin | unbound
  urllib | vDexExtractor | vmihailenco/msgpack | web crawler
  web3.js | web3.py | whitelist-chrome | www.iplocation.net
  wxappUnpacker | wxml-transformer | xcodebuild | z3
  zImageTool | zxcvbn

← back to the content page · corpus-level provenance