Working notes behind mobile_and_app_measurement — every query with its population and denominator, the report script and its unedited output, the fold and its complete residue, the probe regexes and the case-sensitivity trap they walked into, the figures checked against the source PDFs, the external sources verified and the ones rejected, and what could not be established. Corpus-level caveats that apply to every page on this site are on corpus and are not restated here.

Contemporaneous. Written during the run that produced the content page, 2026-08-27, not reconstructed afterwards.

No. Checked 2026-08-27 by node scripts/sitemap.mjs (80 pages) plus core.searchPages for mobile and android:

node scripts/dw.mjs search mobile   # 40 hits, all provenance/content pages on other topics
node scripts/dw.mjs search android  # 32 hits, likewise

Every hit was an incidental mention inside a page about something else (privacy:consent, practices:legal_enforcement, literature:bibliography). No page owns mobile or app measurement. So this is a creation, not an extension, and not an overlap that needed a neighbour broadened.

Four pages own an adjacent piece, and each is linked out to rather than restated:

The item as specified said “propose the namespace placement before creating it”. The decision, and it was a decision rather than an obvious call:

• Chosen: design:mobile_and_app_measurement. design: already holds the site's cross-cutting “how do you set this measurement up” pages — website_selection, sampling, crawling_location, archives, longitudinal, website_classification, ip_classification. This page is exactly that shape for a different platform: sampling frame, vantage, instrumentation, what to report.
• Rejected: a new top-level mobile: namespace. It would strand one page in a namespace of its own and duplicate what design: is for. The site's existing platform-flavoured pages (design:platforms:facebook and friends) already live under design:, so a sibling namespace would also be inconsistent.
• Rejected: programming:mobile_instrumentation. programming: is where per-tool pages live (programming:crawler:openwpm, programming:crawler:webxray). A future Frida-, Appium- or mitmproxy-on-mobile how-to belongs there and should be created there. But this page is study design, not a tool manual, and putting sampling and reporting guidance under programming: would misfile it.
• Rejected: broadening design:automated_measurements. It is a red link. Creating a page in order to broaden it is not broadening it.

A reasonable person could have gone with mobile: as a namespace on the argument that mobile deserves the same treatment as the web and will eventually need several pages. If that happens, the page should move; nothing on it assumes the design: prefix except its own id.

Nothing linked here, so a bullet was added to start under Research design in the same sitting. Without it the page is invisible.

Every figure on the content page is a share of one of these. The rule was applied without exception: name the denominator before the numerator, and never write “of 5,859 papers”.

appAnalysis (529) is the page's population, and that was a choice. mobilePlat (1,075) is twice as large and would have produced friendlier percentages, but it contains cellular-network measurement, Bluetooth-tracker security, handset firmware work and smartphone user studies. A reader planning to take apps apart is not in that population. The content page states both and says which one every table is on.

The item's brief carried stale numbers. It said “409 mobile-app-analysis papers, population.sourceList Google Play 183 and AndroZoo 35, tools category mobile-instrumentation 271”. Those were computed on the 4,322-paper corpus. On the current run: 529, Google Play 134 under its largest single spelling (250 after merging spellings), AndroZoo 46, mobile-instrumentation 364. Every one was re-derived; none was carried over.

Sentinels are never answers. not-stated, none-mentioned, not-applicable, unclear and unknown are reported as themselves. The sharpest case on this page is vantage.locations: 430 appAnalysis papers have a vantage tuple, 117 state a location, and 313 produce only a sentinel. Counting the sentinel as an answer would have turned “72.8% of mobile app studies do not say where they measured from” into silence.

Papers, never tuples. paperCounts() in scripts/lib.mjs does the counting; a paper naming Frida in five tuples is one paper.

cd /workspace/artifacts/wiki
node scripts/report_mobile.mjs      > scripts/report_mobile-output.txt
node scripts/quotecheck_mobile.mjs  > scripts/quotecheck_mobile-output.txt
sh   scripts/mobile_probes.sh       > scripts/mobile_probes-output.txt
node scripts/mobile_number_guard.mjs > scripts/mobile_number_guard-output.txt

The guard is the last gate: it harvests every numeric token from the content page and requires each one to appear in one of the three committed outputs, or to be listed in an ALLOW map with a written reason. It currently traces 305 of 366 figures to an output and allows 61 with reasons (external version numbers, dates, ordinals, and figures from cited papers that the quote check covers instead).

What the guard does not do, and this matters: it proves a number appears in a source. It does not prove it is the right number for the sentence around it, and it cannot see figures inside quoted phrases. The two worst errors on this page (see §12) were both invisible to it and were caught by re-reading the prose against the script output by hand.

mobile_number_guard-output.txt

figures harvested from pages/design_mobile_and_app_measurement.txt: 367
allowed with a written reason: 62
traced to 3 committed outputs: 305

UNACCOUNTED: none

All three read /workspace/publications_dataset/data via dataRoot() in scripts/lib.mjs, which probes both the current and the older mount layout. The probe script regenerates its own path list from the extraction, so the probes and the report can never drift apart on the population.

tools[].name is free text and agrees run-to-run on roughly 20% of exact strings, so it is never aggregated by exact string. The generic skeleton() fold in scripts/lib.mjs normalises case and punctuation, which is not enough here: it leaves “Android Debug Bridge (adb)”, “adb” and “Android Debug Bridge” as three tools.

scripts/mobile_fold.mjs adds an ordered alias table. How much it changes the answer, from §2 of the report output:

adb is the worst case: reporting the largest single spelling would have undercounted it by 61%. Monkey and UI Automator are next, at 12 and 8 spellings each for a single tool.

Two fold decisions where a reasonable person could disagree:

1. objection is folded into pinning-bypass helper, not Frida. It is a Frida front-end, so Frida would be defensible. It went the other way because 8 of its 10 used tuples in this corpus give SSL-pinning bypass as the purpose (the other two are generic hooking and APK repackaging), so counting it as Frida would have inflated Frida and emptied the pinning-bypass family. The purposes are quoted in the fold file's comment.
2. frida-ios-dump is folded into iOS app acquisition, not Frida. It uses Frida but it is an IPA extractor, not an instrumentation use. The rule order was changed after a smoke test showed it landing in Frida.

The fold is deliberately targeted, not a complete taxonomy. It defines families for mobile-specific tooling and leaves everything else alone. So it maps only 921 of 3,306 “used” tool tuples (27.9%) in appAnalysis, and the residue is 2,385 tuples across 1,732 distinct names. That is not a failure: the residue is dominated by VirusTotal (58 tuples), Python (22), Selenium (21), Chrome (19), scikit-learn (15) and a long tail of one-off custom tools, none of which is a mobile tool and none of which belongs in a mobile tool family. The content page states the 27.9% figure so no reader mistakes the folded table for a complete tool census.

The residue is printed in full in §8 of the report output below, in two parts: every name with ≥2 tuples in a table, then all 1,466 names appearing exactly once, listed alphabetically. Nothing is truncated.

The fold source, since it is the load-bearing decision on this page:

mobile_fold.mjs

// Fold mobile tool names into families, for design:mobile_and_app_measurement.
//
// WHY: tool names in `tools[].name` are free text and ~20% stable run-to-run by
// exact string (data/extract/README.md). The generic skeleton() fold in lib.mjs
// canonicalises case and punctuation, which is not enough here: "Android Debug
// Bridge (adb)" (29 papers), "adb" (9) and "Android Debug Bridge" (5) are one
// tool under three spellings, and counting them separately undercounts adb by a
// factor of three. Same for Frida (Frida / frida-tools / frida-server / Frida
// Gadget), Xposed (Xposed / Xposed framework / LSPosed) and Monkey (Monkey /
// Android Monkey / Application Exerciser Monkey / three more).
//
// Rules are ordered; the first match wins. Anything that matches no rule keeps
// its skeleton-folded name and is reported as residue by report_mobile.mjs, so
// the part this file cannot classify stays visible.
 
// [canonical family, matcher]. Matchers are tested against the raw name.
export const FAMILIES = [
  // --- dynamic instrumentation / hooking
  // frida-ios-dump is an IPA extractor, not an instrumentation use of Frida, so it
  // is matched by the 'iOS app acquisition' rule below and excluded here.
  ['Frida', /^frida(?![- ]?ios)|frida[- ]?(tools|server|gadget|trace|inject)/i],
  ['Xposed', /xposed|^lsposed$|^edxposed$|^taichi$/i],
  ['Magisk', /^magisk/i],
  ['adb', /^adb$|android (debug|debugging) bridge|^adb shell$/i],
  ['TaintDroid', /^taintdroid$/i],
    // objection is a Frida front-end, but 8 of its 10 'used' tuples in this corpus
  // give SSL-pinning bypass as the purpose, so it is counted here and not as Frida.
  ['pinning-bypass helper', /just ?trust ?me|ssl ?(un)?kill ?switch|trust ?me ?already|^unpinning|nsc ?patch|^objection$/i],
 
  // --- UI automation / app exercisers
  ['Monkey', /monkey(?!runner)/i],
  ['monkeyrunner', /monkeyrunner/i],
  ['UI Automator', /ui ?automator|uiautomator/i],
  ['Appium', /^appium/i],
  ['DroidBot', /^droidbot|^humanoid$|^droidmate|^stoat$/i],
  ['AndroidViewClient', /androidviewclient|^culebra$/i],
  ['Accessibility Service', /accessibility service/i],
  ['RERAN', /^reran$/i],
 
  // --- static analysis / reverse engineering
  ['apktool', /^apk ?tool/i],
  ['jadx', /^jadx/i],
  ['Soot', /^soot$/i],
  ['FlowDroid', /^flowdroid$/i],
  ['Androguard', /^androguard$/i],
  ['smali/baksmali', /^(bak)?smali$|^apkid$|^dex2jar$|^dexdump$|^dexlib/i],
  ['WALA', /^wala$/i],
  ['IDA Pro', /^ida( pro)?$|^idapython$/i],
  ['Ghidra', /^ghidra$/i],
  ['MobSF', /^mobsf$|mobile[- ]security[- ]framework/i],
  ['LibRadar', /^libradar/i],
  ['LibScout', /^libscout/i],
  ['PScout', /^pscout$|^axplorer$/i],
 
  // --- traffic interception
  ['mitmproxy', /^mitm ?(proxy|dump|web)/i],
  ['Burp Suite', /^burp/i],
  ['tcpdump', /^tcpdump$/i],
  ['Wireshark', /^wireshark$|^tshark$/i],
  ['Fiddler', /^fiddler/i],
  ['Charles Proxy', /^charles/i],
 
  // --- app acquisition / store scraping
  ['Play store scraper', /google[- ]?play[- ]?scraper|^gplaycli$|^playstoredownloader$|google play (api|protobuf api|developer api|store api)|^apkeep$|^raccoon$/i],
  ['third-party APK mirror', /^apkpure$|^apkmirror$|^apkcombo$|^aptoide$|^androidrank$|^appbrain$|^apkfab$/i],
  ['AndroZoo', /^androzoo$|^androidzoo$/i],
  ['F-Droid', /^f[- ]?droid$/i],
  ['iOS app acquisition', /^ipatool|^ipa ?tool|^clutch$|frida[- ]?ios[- ]?dump|^flexdecrypt$|^bagbak$|^itunes/i],
 
  // --- iOS device access
  ['libimobiledevice', /libimobiledevice|^ideviceinstaller$|^idevice|^cfgutil$/i],
  ['jailbreak tool', /^checkra1n$|^palera1n$|^unc0ver$|^checkm8$|^taurine$/i],
 
  // --- devices and emulation
  ['Android emulator', /android emulator|^avd$|android virtual device|^genymotion$|^qemu$/i],
];
 
export function foldTool(raw) {
  const name = String(raw).trim();
  for (const [family, re] of FAMILIES) if (re.test(name)) return { family, mapped: true };
  return { family: name, mapped: false };
}
 
// Fold a paper's tool tuples to a Set of family names, counting each family once
// per paper. `filter` selects which tuples count (e.g. usedOrMentioned==='used').
export function paperFamilies(paper, filter = (t) => t.usedOrMentioned === 'used') {
  const fams = new Set();
  const unmapped = new Set();
  for (const t of paper.tools) {
    if (!filter(t)) continue;
    const { family, mapped } = foldTool(t.name);
    fams.add(family);
    if (!mapped) unmapped.add(family);
  }
  return { fams, unmapped };
}

The extraction schema has no field for “did you use a handset or an emulator”, “did the app pin”, “which storefront”. Those questions were answered with full-text probes over the same 529 papers, whitespace collapsed and soft hyphens rejoined first, reading paper.cols.txt and never paper.norm.txt.

A probe hit is a mention. It is an upper bound on doing the thing and a lower bound on nothing: a paper can state its handset model without writing the words “physical device”. Every probe figure on the content page is labelled as a mention.

The trap, and it is a big one. Tool names are proper nouns and must be matched case-sensitively. The first pass ran everything case-insensitively and produced:

A 6.4× over-count on Xposed would have been published as “Xposed is mentioned by half the field”, which is the opposite of the page's actual finding that Xposed is dead. The committed probe script prints both variants for the four terms where the difference is large, so the trap is visible in the audit trail rather than only in these notes. Every probe number on the content page is the case-sensitive one.

Probes whose regex was deliberately widened or narrowed after a first look:

The “store region” row is the honest one: the content page wanted a number for “how many papers state which storefront they sampled” and there is no probe that answers it, so the page uses the vantage.locations sentinel rate (313 of 430) and says what that does and does not cover.

Unedited probe output:

mobile_probes-output.txt

population: mobile-app-analysis papers with full text = 529

--- certificate pinning and TLS interception
    71  mentions certificate/SSL/TLS pinning
    33  describes bypassing pinning
    33  names a pinning-bypass tool
    13  mentions the Android Network Security Configuration
    13  mentions Certificate Transparency

--- instrumentation
    87  mentions Frida (case-sensitive)
   100    ... same probe case-insensitively, for comparison
    40  mentions Xposed (case-sensitive)
   256    ... case-insensitively: matches the word "exposed"
    18  mentions Magisk
    59  mentions mitmproxy
    35  mentions root detection / SafetyNet / Play Integrity
    15  mentions emulator detection

--- device or emulator
   109  says "physical/real device" (or phone/smartphone/handset)
    51  names an Android emulator product or phrase
    25  says plainly that it ran on an emulator

--- what defeats static analysis
   144  mentions native code / JNI / NDK
    85  mentions packing or unpacking
    29  names ProGuard / R8 / DexGuard
   256  mentions obfuscation (any sense -- wide, includes crypto/traffic obfuscation)

--- app acquisition and the store
    46  names a third-party APK/IPA mirror or downloader
    68  mentions AndroZoo
    11  mentions F-Droid
   142  mentions "App Store" (case-sensitive)
   243    ... case-insensitively: also matches generic "app store"
    80  names the Apple App Store specifically
    51  mentions jailbreaking or a jailbreak tool
     8  mentions store terms of service near scraping/downloading
    55  mentions privacy labels / Data Safety
    23  names Exodus Privacy / AppCensus / Lumen

--- driving the app
    72  mentions Monkey (case-sensitive)
    61  names a UI-exploration driver
    48  reports a coverage measure

--- LLMs
    42  mentions an LLM/GPT (case-sensitive)
   167    ... case-insensitively

--- historical
    84  mentions TaintDroid (only 7 of 529 papers actually USED it)

Every measured figure quoted on the content page was checked against data/fulltext/<year>/<venue>/<slug>/paper.cols.txt by scripts/quotecheck_mobile.mjs. The check is on the substring the wiki page actually prints, not on the extraction's evidence.quote, because those are sometimes different sentences.

40 figures across 13 papers: 38 verbatim, 2 present but fragmented by column reflow, 0 not located.

Two findings worth recording:

1. oltrogge2021_mallory, “5,511 (36.7%) vulnerable apps”. The extraction's evidence.quote for this tuple is a different sentence (“2,232 (14.8%) apps with vulnerable HostnameVerifier and 5,202 (34.7%) apps with vulnerable TrustManager”), whose numbers do not add to 5,511. The prevalence string was checked directly against the paper and the paper does say, verbatim, “Most of the affected apps implemented both vulnerabilities, resulting in 5,511 (36.7%) vulnerable apps total.” The figure is right; the extraction's quote is a poor witness for it. This is why the check is on the published substring and not on the quote.
2. Two FRAG verdicts — lin2021_longitudinal (“1,129,615 app removal records, which correspond to 1,033,488 different mobile apps”) and wang2019_evolution (“43.8% of apps in 2014 … over 68% of apps in 2017”). In both, decolumn.mjs spliced a straddling line from the neighbouring column into the middle of the sentence, so the sentence is not contiguous in our rendering. Both were read in context by hand and both figures are correct. The script reports FRAG rather than MISS for exactly this case, and it distinguishes FRAG from a real miss by requiring every distinctive token inside a window twice the needle's length.
3. rodriguez2025_settings, “3,245 apps (53.68%)”. Same reflow damage: the source renders as “245 face difficulties … apps (53.68%) integrate at least one of these SDKs.” The percentage and the clause are both present; the “3,” was separated. The content page quotes the percentage, not the absolute count, for this reason.

Unedited output:

quotecheck_mobile-output.txt

quote/figure check over 13 papers, 40 figures

OK   IMC 2022  static pinning indicators 27%/33%
OK   IMC 2022  runtime pinning popular 11.4%/6.7%
OK   IMC 2022  runtime pinning random 0.9%/2.5%
OK   IMC 2022  circumvention 51.51%/66.15%
OK   IMC 2022  circumvention iOS 66.15%
OK   IMC 2022  Popular set n=1,000
OK   IMC 2022  Random set n=1,000
OK   USENIX 2021  NSC adoption 99,212 / 1,335,322
OK   USENIX 2021  NSC downgrades 88,174 (88.87%)
OK   USENIX 2021  NSC pinning 663 apps
OK   USENIX 2021  user-CA re-enable 8,606 / 1,098,479 (8.67%)
OK   USENIX 2021  vulnerable validation 5,511 (36.7%)
OK   USENIX 2024  Chinese apps 1529/2765 (55.3%)
OK   USENIX 2024  Play apps 322/5061 (6.4%)
OK   CCS 2023  NSC pinning 385 apps (3.89%)
OK   CCS 2023  static vs dynamic 54/281 vs 40/160
OK   USENIX 2018  FlowDroid >48%, Argus >73%, DroidSafe >4%
OK   USENIX 2018  13 undocumented FlowDroid flaws
OK   USENIX 2018  2,026 of 7,584 executable
OK   USENIX 2023  attrition 3654 analysed
OK   USENIX 2023  pre-consent 3013 (82.5%)
OK   USENIX 2023  identifiers 1285 (35.2%)
OK   USENIX 2023  TCF 146 (4.0%)
OK   PETS 2022  tracking libraries 88.73%/79.35%
OK   PETS 2022  pre-consent contact 81.44%/68.46%
OK   PETS 2022  12k per platform
OK   PETS 2025  Facebook SDK 53.68%
OK   PETS 2025  AdvertiserIDCollection 6.79%
OK   USENIX 2024  DSS coverage 46.8%
OK   USENIX 2024  DSS updated 40%
OK   USENIX 2024  ad/analytics library 42%
FRAG WWW 2021  removals 1,129,615 / 1,033,488
      needle: 1,129,615 app removal records, which correspond to 1,033,488 different mobile apps
OK   WWW 2021  median 28.5 days
OK   WWW 2021  top-1500 5%
FRAG WWW 2019  ad libraries 43.8% -> 68%
      needle: 43.8% of apps in 2014 used at least one ad library, while over 68% of apps in 2017
OK   WWW 2019  no update ~61%
OK   NDSS 2026  chameleon 162 (9.85%), 92.59% precision
OK   NDSS 2026  ads 85.96% / pop-ups 95.56% / distraction 19.21%
OK   CCS 2025  723 families / 14,178 versions
OK   CCS 2025  14,178 versions

38 verbatim, 2 present but fragmented by column reflow, 0 NOT LOCATED, of 40

Training data is stale by construction for tool currency, so every external claim on the content page was fetched, not recalled, on 2026-08-27. Verification was by GitHub API or releases.atom/commits.atom feed for repositories, by registry API for packages, and by the vendor's or platform's own documentation for everything else.

An external-currency sweep was delegated to a sub-agent (model: sonnet). Its report was not taken at face value; every load-bearing item was re-fetched. Four of its claims were wrong or unverifiable, and all four would have reached the page:

The sub-agent also over-read the CT-enforcement situation (“Android 17 is set to enable CT enforcement by default”) in a way the primary page does not state. The page says only what the CT policy page says: enforcement is scoped to publicly-trusted certificates, so a locally-installed interception root is not covered.

Recorded so the next run does not re-add them.

• How many papers state their storefront. No probe with acceptable precision was found (see §6). The page uses the vantage.locations sentinel rate as the nearest available proxy and says so explicitly.
• Whether a mirror-served APK differs from the Play original. No study of this in the seven venues; the only material found was a vendor blog, rejected. Published as an open question.
• The Android/iOS balance, properly. The schema has no field finer than platforms = ['mobile']. The 369 / 39 / 66 / 55 split is a regex over metadata, published with that caveat and with the regex in the report script. It should not be quoted precisely.
• Whether the pinning-bypass success rate has changed since 2022. [1Pradeep, Amogh; Paracha, Muhammad Talha; Bhowmick, Protick; Davanian, Ali; Razaghpanah, Abbas; Chung, Taejoong; Lindorfer, Martina; Vallina-Rodriguez, Narseo; Levin, Dave; Choffnes, David (2022): "A Comparative Analysis of Certificate Pinning in Android & iOS", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] is the only measurement of it found anywhere in the corpus. Four Frida majors later, nobody has repeated it. Published as the first open question.
• Exodus Privacy's current tracker-signature count. Not on the front page, and the statistics pages were not reachable during this run. The page says the service is live and explicitly tells the reader to check before quoting a count.
• Whether the corpus's mobile share is really falling. appAnalysis peaked at 18.4% of papers in 2015 and is 6.7% in 2024. That could be a real shift, or it could be the corpus's absolute growth (119 papers in 2010, 690 in 2024) diluting a constant absolute volume — absolute mobile counts are roughly flat at 44–66 per year over 2020–2025, with 2019 at 38 and the provisional 2026 at 24. The page reports the per-year table and does not claim a trend either way.
• Apple's privacy-manifest (PrivacyInfo.xcprivacy) requirement date. The fetch of Apple's required-reason-API page returned only a title. Privacy manifests are therefore not discussed on the page, even though they are an obviously scrapable artefact. A future run should get this and add it.

17 entries added to bibliography, appended before the closing </bibtex> of a fresh export of the live page (not a local copy — a stale local copy is a known trap here).

Duplicate check before appending, by four independent keys: exact key string, normalised title, DOI, and URL. One collision found and resolved:

• koch2023_enough already existed in the live bibliography, with identical title, URL and correct authors. The duplicate entry was deleted from the additions file rather than renamed; the page cites the existing key. Without the title/DOI/URL scan a key-string check alone would still have caught this one, but the same scan confirmed the other 17 are genuinely new.
• bibgen.mjs emitted author = {Koch, Simon and Altpeter, Benjamin and e.V., Datenanfragen.de and Johns, Martin} for that paper from the index — “Datenanfragen.de e.V.” is Altpeter's affiliation, not an author. The live entry already has the correct three authors, so no fix was needed, but the bug is recorded here because bibgen will reproduce it.

PETS and USENIX index records carry no authors (100% of both venues). Author lists were fetched from the venue landing pages with curl and a browser User-Agent — WebFetch gets 403 from usenix.org:

curl -s -A 'Mozilla/5.0 ...' https://www.usenix.org/conference/usenixsecurity21/presentation/oltrogge
curl -s -A 'Mozilla/5.0 ...' https://petsymposium.org/popets/2025/popets-2025-0056.php

Every DOI was resolved against the Crossref API (api.crossref.org/works/<doi>); all 11 DOI-bearing entries returned HTTP 200. The six USENIX/NDSS entries have no DOI and are cited by landing-page URL, which is what bibgen.mjs does for those venues.

Five of the 17 entries are from outside the seven venues, added deliberately because the corpus cannot cover them:

Four reviewers, all told explicitly that the author's context may not be exhaustive, and all handed the page text, the report script, its unedited output, the probe and quote-check outputs, and these provenance notes. The three focused reviewers ran in parallel first; the generic reviewer ran afterwards on the corrected page.

Re-ran all three scripts live and confirmed the committed scripts/*-output.txt files are byte-identical to a fresh run. Checked roughly 400 individual figures and percentages cell by cell.

The objection enumeration behind the rejection of finding 2:

CCS/2019/watching-you-watch-the-tracking-...   "Objection"  used  Injected the SSL pinning bypass gadget.
USENIX/2021/share-first-ask-later-or-never    "objection"  used  Detect and disable SSL pinning
CCS/2022/freely-given-consent-studying-...    "objection"  used  Disabled SSL pinning in instrumented apps.
USENIX/2022/breaking-bridgefy-again-...       "objection"  used  Hooked functions and observed or modified app behavior.   <-- not pinning
USENIX/2023/the-ok-is-not-enough-...          "objection"  used  Automated Android apps and disabled SSL checking.
PETS/2024/a-black-box-privacy-analysis-...    "Objection"  used  Disabled mobile-app SSL certificate checks.
USENIX/2024/abandon-all-hope-ye-who-enter-... "Objection"  used  Detected and disabled SSL pinning.
USENIX/2025/autovr-automated-ui-exploration   "objection"  used  Repackage APKs containing the injected Frida server.     <-- not pinning
PETS/2025/the-impact-of-default-mobile-sdk    "Objection"  used  Bypass SSL pinning on rooted Android.
PETS/2026/the-tcf-doesn-t-really-a-a-id-...   "Objection"  used  Disabled SSL pinning during traffic collection.
10 tuples, 10 distinct papers, 8 with a pinning purpose.

Independently re-derived every quoted figure from paper.cols.txt rather than trusting quotecheck_mobile-output.txt; resolved all 11 DOIs against Crossref; re-fetched all six USENIX/NDSS author lists and the PoPETs one from the venue landing pages; duplicate-scanned the 17 new entries against the 488 live ones on four axes (key string, DOI, URL, and normalised title with a fuzzy threshold).

Did not return before publication. 43 items were sent for re-fetching (every version number, every platform claim, every service status, plus a dead-link sweep of every URL on the page). This is an honest gap in the review layer, mitigated but not closed by the fact that the author had already re-fetched every load-bearing external claim personally before writing (§8 above lists the method for each, and §8's “Corrected” table shows four sub-agent claims that re-fetching caught and rejected). The residual risk is a URL that has died since 2026-08-27 and a version number that has moved — both of which the ¹⁾ “Checked 2026-08-27” convention already exposes to a reader.

What a future run should do first: re-run that reviewer's brief. The highest-risk items are the ones the author could not fully settle — the Certificate Transparency scope claim (the documentation is thinner than the claim needs), Exodus Privacy's signature count, and whether any maintained successor to LibRadar/LibScout exists that this page failed to name.

Not run. The three focused reviewers were spawned in parallel per the workflow; the generic pass was to follow on the corrected page and did not happen before publication. Recorded here rather than quietly omitted. The page has had one full self-review pass by the author instead (which produced the six softenings listed in §12 and caught the ''-escaping of the ''base-config'' XML), but a self-review is not an independent one. ===== 12. The run itself ===== ^ Item ^ Value ^ | Date | 2026-08-27 | | Corpus at the time | ''data/extract/run1'', 5,859 papers, 7 venues (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P), 2010–2026 | | Main agent | Claude (Opus 5) — all queries, the report script, the fold, the probes, the quote check, the page text, and independent re-verification of every external claim | | Sub-agents | one ''sonnet'' external-currency sweep (which itself fanned out to seven sub-agents); four ''sonnet''/''fable'' reviewers (§11) | | Write path | ''node scripts/dw.mjs put'' over JSON-RPC, with ''--if-rev'' on every save | | Stability figures | the ~20% free-text agreement and 0.9% unlocatable-quote figures quoted from ''data/extract/README.md'' were measured on the **older, smaller corpus** and have not been re-measured. Treated as the right order of magnitude. | | Mistakes caught in review of my own work | (1) the item brief's figures were stale and were re-derived rather than reused; (2) the first probe pass was case-insensitive and over-counted Xposed 6.4×; (3) the first draft published "218 (46.2%) report no validation of the classifier at all", which conflated //papers with at least one unvalidated classifier// with //papers with no validation at all// — the correct figures are 79 (16.7%) with none, 178 (37.7%) with all validated, and 393 (83.3%) with at least one validated, and the report script now computes all three; (4) the first draft obtained "199 (37.6%)" for ''ethics.reviewOutcome'' and "341 (64.5%)" for ''artifacts.availability'' by **subtracting the sentinel count from 529**, which overstates both — ''ethics'' is ''null'' on 50 of the 529 papers and ''artifacts'' on 18, so //stated + sentinel-only ≠ 529//. The correct figures are **149 (28.2%)** and **323 (61.1%)**; the report script now prints all three components so nobody has to subtract, and the number guard (§4) was written after this. (5) the ''frida-ios-dump'' fold landed in the wrong family until a smoke test caught it. | | Accidental exposure | none. No credential was printed; ''.env'' was never read into output. | ===== 13. Full report output ===== Unedited output of ''node scripts/report_mobile.mjs''. §8 is the complete fold residue. <file - report_mobile-output.txt> ============================================================================== 1. POPULATIONS ============================================================================== corpus 5859 appAnalysis studyTypes has 'mobile-app-analysis' 529 9.0% of corpus mobilePlat platforms has 'mobile' 1075 18.3% either 1079 both 525 tools category 'mobile-instrumentation' (any) 364 of those, outside 'either' 32 population unit 'mobile-apps' 502 of those, outside 'either' 24 --- appAnalysis per venue Venue appAnalysis all share of venue ------- ----------- ---- -------------- USENIX 143 1410 10.1% CCS 106 990 10.7% NDSS 82 701 11.7% PETS 66 510 12.9% IEEE-SP 63 767 8.2% WWW 37 843 4.4% IMC 32 638 5.0% --- appAnalysis per year (2026 is provisional: CCS/IMC 2026 not held, IEEE S&P/WWW 2026 under-selected) Year papers appAnalysis share mobilePlat share ---- ------ ----------- ----- ---------- ----- 2010 119 1 0.8% 6 5.0% 2011 116 3 2.6% 11 9.5% 2012 151 13 8.6% 25 16.6% 2013 125 13 10.4% 27 21.6% 2014 166 23 13.9% 40 24.1% 2015 190 35 18.4% 51 26.8% 2016 182 23 12.6% 45 24.7% 2017 231 32 13.9% 61 26.4% 2018 254 20 7.9% 53 20.9% 2019 402 38 9.5% 82 20.4% 2020 404 44 10.9% 86 21.3% 2021 379 44 11.6% 84 22.2% 2022 546 49 9.0% 106 19.4% 2023 719 55 7.6% 113 15.7% 2024 690 46 6.7% 110 15.9% 2025 770 66 8.6% 127 16.5% 2026 415 24 5.8% 48 11.6% ============================================================================== 2. TOOLING, folded (population: appAnalysis, N=529, tuples with usedOrMentioned="used") ============================================================================== --- folded tool families (only families the fold defines; unmapped names are residue, printed in section 8) Family papers share of 529 ---------------------- ------ ------------ Frida 74 14.0% adb 71 13.4% Soot 65 12.3% apktool 57 10.8% mitmproxy 52 9.8% FlowDroid 49 9.3% Androguard 37 7.0% smali/baksmali 34 6.4% Monkey 34 6.4% jadx 32 6.0% Xposed 31 5.9% Play store scraper 30 5.7% tcpdump 27 5.1% Wireshark 25 4.7% LibRadar 23 4.3% Android emulator 21 4.0% IDA Pro 18 3.4% Appium 17 3.2% UI Automator 15 2.8% pinning-bypass helper 15 2.8% DroidBot 14 2.6% Magisk 14 2.6% PScout 12 2.3% iOS app acquisition 12 2.3% Ghidra 12 2.3% Burp Suite 11 2.1% third-party APK mirror 10 1.9% LibScout 10 1.9% libimobiledevice 9 1.7% Fiddler 8 1.5% WALA 7 1.3% TaintDroid 7 1.3% AndroZoo 7 1.3% MobSF 7 1.3% AndroidViewClient 6 1.1% jailbreak tool 5 0.9% monkeyrunner 3 0.6% Accessibility Service 3 0.6% RERAN 3 0.6% Charles Proxy 2 0.4% --- the same families per era — this is the currency evidence era sizes: 2010-2015=88 2016-2020=157 2021-2024=194 2025-2026*=90 Family total 2010-2015 2016-2020 2021-2024 2025-2026* ---------------------- ----- ---------- ---------- ---------- ---------- Frida 74 0 (0.0%) 6 (3.8%) 38 (19.6%) 30 (33.3%) adb 71 5 (5.7%) 13 (8.3%) 34 (17.5%) 19 (21.1%) Soot 65 8 (9.1%) 24 (15.3%) 24 (12.4%) 9 (10.0%) apktool 57 10 (11.4%) 21 (13.4%) 15 (7.7%) 11 (12.2%) mitmproxy 52 1 (1.1%) 11 (7.0%) 27 (13.9%) 13 (14.4%) FlowDroid 49 4 (4.5%) 16 (10.2%) 22 (11.3%) 7 (7.8%) Androguard 37 7 (8.0%) 7 (4.5%) 18 (9.3%) 5 (5.6%) smali/baksmali 34 15 (17.0%) 11 (7.0%) 5 (2.6%) 3 (3.3%) Monkey 34 2 (2.3%) 14 (8.9%) 12 (6.2%) 6 (6.7%) jadx 32 0 (0.0%) 2 (1.3%) 18 (9.3%) 12 (13.3%) Xposed 31 0 (0.0%) 16 (10.2%) 13 (6.7%) 2 (2.2%) Play store scraper 30 0 (0.0%) 6 (3.8%) 14 (7.2%) 10 (11.1%) tcpdump 27 2 (2.3%) 5 (3.2%) 14 (7.2%) 6 (6.7%) Wireshark 25 2 (2.3%) 6 (3.8%) 8 (4.1%) 9 (10.0%) LibRadar 23 0 (0.0%) 10 (6.4%) 11 (5.7%) 2 (2.2%) Android emulator 21 7 (8.0%) 7 (4.5%) 6 (3.1%) 1 (1.1%) IDA Pro 18 1 (1.1%) 6 (3.8%) 7 (3.6%) 4 (4.4%) Appium 17 0 (0.0%) 2 (1.3%) 7 (3.6%) 8 (8.9%) UI Automator 15 0 (0.0%) 3 (1.9%) 7 (3.6%) 5 (5.6%) pinning-bypass helper 15 0 (0.0%) 3 (1.9%) 8 (4.1%) 4 (4.4%) DroidBot 14 0 (0.0%) 2 (1.3%) 8 (4.1%) 4 (4.4%) Magisk 14 0 (0.0%) 1 (0.6%) 5 (2.6%) 8 (8.9%) PScout 12 2 (2.3%) 7 (4.5%) 0 (0.0%) 3 (3.3%) iOS app acquisition 12 2 (2.3%) 4 (2.5%) 3 (1.5%) 3 (3.3%) Ghidra 12 0 (0.0%) 2 (1.3%) 4 (2.1%) 6 (6.7%) Burp Suite 11 1 (1.1%) 2 (1.3%) 4 (2.1%) 4 (4.4%) third-party APK mirror 10 2 (2.3%) 5 (3.2%) 3 (1.5%) 0 (0.0%) LibScout 10 0 (0.0%) 6 (3.8%) 3 (1.5%) 1 (1.1%) libimobiledevice 9 0 (0.0%) 2 (1.3%) 5 (2.6%) 2 (2.2%) Fiddler 8 1 (1.1%) 2 (1.3%) 5 (2.6%) 0 (0.0%) WALA 7 3 (3.4%) 2 (1.3%) 2 (1.0%) 0 (0.0%) TaintDroid 7 6 (6.8%) 1 (0.6%) 0 (0.0%) 0 (0.0%) AndroZoo 7 0 (0.0%) 2 (1.3%) 1 (0.5%) 4 (4.4%) MobSF 7 0 (0.0%) 1 (0.6%) 4 (2.1%) 2 (2.2%) AndroidViewClient 6 0 (0.0%) 3 (1.9%) 2 (1.0%) 1 (1.1%) jailbreak tool 5 0 (0.0%) 0 (0.0%) 2 (1.0%) 3 (3.3%) monkeyrunner 3 2 (2.3%) 1 (0.6%) 0 (0.0%) 0 (0.0%) Accessibility Service 3 0 (0.0%) 1 (0.6%) 1 (0.5%) 1 (1.1%) RERAN 3 0 (0.0%) 0 (0.0%) 3 (1.5%) 0 (0.0%) Charles Proxy 2 0 (0.0%) 0 (0.0%) 1 (0.5%) 1 (1.1%) --- unfolded top names, for comparison with the folded table above name (skeleton-folded only) papers --------------------------- ------ Frida 72 Soot 65 VirusTotal 58 apktool 56 mitmproxy 52 FlowDroid 49 Android Debug Bridge (adb) 41 Androguard 37 JADX 32 tcpdump 28 LibRadar 22 Python 22 Xposed 22 Selenium 21 Wireshark 20 adb 19 Chrome 19 scikit-learn 19 IDA Pro 18 Appium 17 google-play-scraper 15 DroidBot 14 Monkey 14 random forest 13 Android emulator 12 distinct skeleton-folded names: 1755 --- how much the alias fold changes the answer adb folded= 71 largest single spelling="Android Debug Bridge (ADB)"=28 spellings=11 Frida folded= 74 largest single spelling="Frida"=69 spellings=10 Xposed folded= 31 largest single spelling="Xposed"=22 spellings=5 Monkey folded= 34 largest single spelling="Monkey"=13 spellings=12 UI Automator folded= 15 largest single spelling="Android UI Automator"=4 spellings=8 Play store scraper folded= 30 largest single spelling="google-play-scraper"=12 spellings=12 --- tool GROUPS — the four things a mobile study can instrument, and whether it combines them tool group papers share of 529 2010-2015 2016-2020 2021-2024 2025-2026* -------------------- ------ ------------ ---------- ---------- ---------- ---------- static analysis / RE 225 42.5% 37 (42.0%) 69 (43.9%) 82 (42.3%) 37 (41.1%) runtime hooking 155 29.3% 10 (11.4%) 32 (20.4%) 73 (37.6%) 40 (44.4%) traffic interception 110 20.8% 7 (8.0%) 24 (15.3%) 52 (26.8%) 27 (30.0%) UI exploration 89 16.8% 4 (4.5%) 26 (16.6%) 36 (18.6%) 23 (25.6%) static AND traffic: 55 (10.4% of 529) static only 170 traffic only 55 neither (no tool in either group named) 249 Era N static AND traffic ---------- --- ------------------ 2010-2015 88 4 (4.5%) 2016-2020 157 12 (7.6%) 2021-2024 194 25 (12.9%) 2025-2026* 90 14 (15.6%) UI exploration AND traffic interception: 30 (5.7% of 529) — the "drive it and watch the wire" pipeline ============================================================================== 3. STATIC VS DYNAMIC (population: appAnalysis papers that classified something) ============================================================================== appAnalysis papers with >=1 classification tuple: 472 / 529 classification.method papers share of 529 share of classifiers --------------------- ------ ------------ -------------------- heuristic-rules 257 48.6% 54.4% manual-labelling 192 36.3% 40.7% static-analysis 149 28.2% 31.6% supervised-ml 103 19.5% 21.8% third-party-service 87 16.4% 18.4% curated-database 75 14.2% 15.9% dynamic-analysis 48 9.1% 10.2% regex-or-signature 46 8.7% 9.7% other 32 6.0% 6.8% unsupervised-ml 23 4.3% 4.9% blocklist 20 3.8% 4.2% graph-analysis 16 3.0% 3.4% llm 15 2.8% 3.2% --- static-analysis and dynamic-analysis methods per era Era N static-analysis dynamic-analysis both llm ---------- --- --------------- ---------------- --------- ---------- 2010-2015 88 32 (36.4%) 11 (12.5%) 8 (9.1%) 0 (0.0%) 2016-2020 157 41 (26.1%) 9 (5.7%) 6 (3.8%) 0 (0.0%) 2021-2024 194 58 (29.9%) 20 (10.3%) 12 (6.2%) 1 (0.5%) 2025-2026* 90 18 (20.0%) 8 (8.9%) 5 (5.6%) 14 (15.6%) --- classification.validation (population: appAnalysis papers that classified something) validation papers share of classifiers -------------------------- ------ -------------------- manual-validation 321 68.0% none-reported 218 46.2% comparison-to-other-method 79 16.7% held-out-test-set 60 12.7% cross-validation 35 7.4% papers reporting >=1 real validation: 393 (83.3% of 472 classifiers) papers reporting NO validation on any classifier: 79 (16.7%) (for comparison, papers with >=1 'none-reported' tuple: 218 — these overlap) papers where EVERY classifier has a real validation value: 178 (37.7%) --- Android vs iOS, by regex over title + tool names + population sources + detection phenomena Android-matching only 369 (69.8%) | iOS-matching only 39 (7.4%) | both 66 (12.5%) | neither 55 (10.4%) --- classification.target target papers share of 529 ------------------- ------ ------------ other 234 44.2% mobile-app 198 37.4% vulnerability 113 21.4% sdk-or-library 66 12.5% domain 51 9.6% network-traffic 44 8.3% privacy-policy 39 7.4% web-request 28 5.3% malware 26 4.9% website-category 26 4.9% ip-address 18 3.4% user-generated-text 17 3.2% ============================================================================== 4. THE APP SAMPLE (population: appAnalysis) ============================================================================== sourceList: stated in 513/529, sentinel-only 13, no population tuple 3 sourceList (skeleton-folded) papers share of 529 ------------------------------ ------ ------------ Google Play 134 25.3% Google Play store 75 14.2% custom seed list 58 11.0% AndroZoo 46 8.7% Apple App Store 11 2.1% VirusTotal 11 2.1% F-Droid 7 1.3% Tranco 7 1.3% Amazon Mechanical Turk 6 1.1% AppBrain 6 1.1% custom device set 6 1.1% DroidBench 6 1.1% AndroidRank 5 0.9% App Store 5 0.9% Android Malware Genome project 4 0.8% Android Market 4 0.8% custom experimental setup 4 0.8% GitHub 4 0.8% Google Play market 4 0.8% Baidu Market 3 0.6% --- the same, after merging Google Play spellings by hand Google Play family: 250 papers (47.3% of 529) across 62 spellings spellings: Android Market | Google Play | Google Play Market | Google Play Store | Google Play Store (US site) | Google Play Store (popular apps) | Google Play Store Top Free in Android Apps | Google Play Store and Apple App Store | Google Play Store and featured/recommended apps | Google Play Store and six online sources: Androidapps, Apkhere, Apkmirror, Apkpure, Uptodown, and Aptoide | Google Play Store and third-party websites | Google Play Store charts | Google Play Store dataset from related work [79] | Google Play Store developer contact information | Google Play Store historical most-installed list | Google Play Store in the US | Google Play Store privacy-policy links | Google Play Store reviews | Google Play Store top app charts | Google Play Store's Designed for Families program | Google Play Store's Top 500 list | Google Play Store, Apple App store, and App Annie | Google Play Store, Crawl 1 | Google Play Store, Crawl 2 | Google Play Store, Crawl 3 | Google Play Store, apps described as app-lockers | Google Play Store, “top free” category | Google Play Top Free charts | Google Play and 360 App Assistant top download lists | Google Play and Apkmonk | Google Play and Apple App Store | Google Play and Baidu market | Google Play and Tencent Myapp | Google Play and WanDouJia | Google Play and development documentation | Google Play and iTunes stores | Google Play and other 12 popular third-party app markets worldwide | Google Play and third-party Android markets | Google Play and third-party Android markets plus VirusTotal | Google Play apps using com.umlaut.crowd SDK | Google Play categories | Google Play dynamically analyzed apps | Google Play filtered app set | Google Play lists of popular apps in 49 app categories | Google Play market | Google Play marketplace dataset provided by Norton | Google Play search engine | Google Play store | Google Play store based on the rank of APKPure | Google Play store top app lists | Google Play store, Ubuntu Software Center and Chrome Extensions | Google Play store; AOL Query Log dataset | Google Play top paid app list | Google Play top-ranked apps | Google Play's “top 200 free apps” list | Google Play, Germany | Google Play, MyApp, and Apple App Store | Google Play, apkpure.com, and apktada.com | Google Play, third-party websites (APKPure and 360 Store) | Google Play; AppBrain and AndroidRank | Official Android Market | official Android Market --- app-set sizes (population: mobile-apps population tuples inside appAnalysis) papers with a mobile-apps population tuple: 400; of those, 397 state an n n over 916 tuples: min 1 p10 17 median 1300 p90 329272 max 65000000 app-set size band papers with >=1 such tuple share of 397 ----------------- -------------------------- ------------ 1-10 52 13.1% 11-100 139 35.0% 101-1,000 127 32.0% 1,001-10,000 130 32.7% 10,001-100,000 112 28.2% >100,000 92 23.2% --- sampling method for mobile-apps population tuples samplingMethod papers share of 400 -------------------- ------ ------------ purposive 196 49.0% top-n 140 35.0% random 91 22.8% pre-existing-dataset 71 17.8% exhaustive 51 12.8% seed-and-crawl 38 9.5% convenience 35 8.8% stratified 28 7.0% snowball 2 0.5% --- listVersion: does the paper pin WHEN the apps were fetched? mobile-apps population tuples: 930; with a listVersion: 393 (42.3%) papers: 400; with >=1 listVersion: 222 (55.5%) --- temporal.mode temporal.mode papers share of 529 ------------------ ------ ------------ active-probing 192 36.3% live-crawl 188 35.5% existing-dataset 166 31.4% passive-collection 93 17.6% web-archive 4 0.8% ============================================================================== 5. VANTAGE AND STOREFRONT (population: appAnalysis papers with >=1 vantage tuple) ============================================================================== appAnalysis papers with >=1 vantage tuple: 430 / 529 locations: stated in 117/430 (27.2%); sentinel-only 313 (72.8%) location (skeleton-folded, NOT geo-folded) papers ------------------------------------------ ------ United States 23 Germany 17 China 12 India 10 U.S. 9 Europe 8 Asia 6 Canada 6 North America 6 USA 6 Austria 5 EU 5 infrastructure papers share of 430 ------------------ ------ ------------ research-testbed 156 36.3% volunteer-devices 44 10.2% university-network 29 6.7% cloud-provider 19 4.4% commercial-vpn 11 2.6% mobile-network 11 2.6% proxy-service 3 0.7% residential 2 0.5% tor 1 0.2% ============================================================================== 6. WHAT THE WEB-SHAPED SCHEMA FIELDS SAY (population: appAnalysis) ============================================================================== appAnalysis papers with a crawlConfig object: 115 / 529 (21.7%) for comparison, corpus-wide 'crawled' population: 1120 statefulness stated 10/115 stateful=5 stateless=5 headless stated 12/115 headless=8 headful=4 consentAction stated 31/115 no-interaction=29 accept-all=2 interactionDepth stated 74/115 single-target-page=40 landing-page-only=17 deep-crawl=14 landing-plus-subpages=3 authentication stated 71/115 none=60 account-registration=5 manual-login=4 automated-login=1 sso=1 --- artifacts.availability availability papers share of 529 -------------------------- ------ ------------ public 267 50.5% promised-not-yet-available 31 5.9% restricted 12 2.3% on-request 7 1.3% explicitly-withheld 6 1.1% sentinel-only (none-mentioned/not-stated): 188 (35.5%) --- ethics.reviewOutcome reviewOutcome papers share of 529 ------------------------------ ------ ------------ approved 87 16.4% explicitly-discussed-no-review 25 4.7% not-required 22 4.2% exempt 11 2.1% sought-outcome-unstated 4 0.8% sentinel-only: 330 (62.4%) --- "states a value" side of each field, for the page table ethics.reviewOutcome stated 149 (28.2% of 529) sentinel-only 330 no ethics object 50 artifacts.availability stated 323 (61.1% of 529) sentinel-only 188 no artifacts object 18 of which stated: public 267 (50.5%) vantage.locations stated 117 (27.2% of 430) sentinel-only 313 (72.8%) population.listVersion stated 222 (55.5% of 400) ============================================================================== 7. EXEMPLAR FIGURES QUOTED ON THE PAGE (detection tuples, verbatim prevalence) ============================================================================== IMC 2022 — A comparative analysis of certificate pinning in Android & iOS. population: AlternativeTo n=575 mobile-apps top-n | Google Play Store n=1000 mobile-apps random | iTunes Search API n=1000 mobile-apps top-n | Android app-ID list compiled by prior work n=1000 mobile-apps random | Apple App Store listings n=1000 mobile-apps random * static certificate-pinning indicators | share of apps with one instance | up to 27% of Android apps and 33% of iOS apps quote: "Static analysis reveals even more potential pinning (up to 27% on Android and 33% on iOS)." [introduction] * runtime certificate pinning | share of apps using pinning at runtime | 11.4% of popular iOS apps and 6.7% of popular Android apps quote: "We find a wide range of prevalence for potential and actual pinning, with 11.4% of popular iOS apps and 6.7% of popular Android apps using pinning in our dynamic tests." [introduction] * runtime certificate pinning | share of apps using pinning at runtime | 0.9% of random Android apps and 2.5% of random iOS apps quote: "Pinning is much less prevalent in randomly selected (i.e., less popular) apps (0.9% of Android and 2.5% of iOS apps)." [introduction] * pinning circumvention | share of unique pinned destinations circumvented | ≈51.51% on Android and ≈66.15% on iOS quote: "we were able to successfully circumvent pinning for ≈51.51% unique destinations on Android, and ≈66.15% unique destinations on iOS." [methodology] * weak TLS ciphers | percentage of apps with at least one bad-cipher connection | Common Android: 23.4% of pinning apps versus 8.35% overall quote: "For the Common Android dataset, we see that pinning apps reduce connection security as the percentage of bad ciphers in pinning apps is higher (23.4%) than that of the overall dataset (8.35%)." [results] * PII in pinned traffic | PII prevalence in pinned versus non-pinned traffic | iOS advertisement IDs: 25.85% pinned versus 18.06% non-pinned quote: "Ad. ID* 25.85 % 18.06 %" [results] USENIX 2021 — Why Eve and Mallory Still Love Android: Revisiting TLS (In)Security in Android Applications population: Google Play n=1335322 mobile-apps seed-and-crawl | Google Play n=15000 mobile-apps random | Google Play n=40 mobile-apps purposive * NSC adoption | share of Google Play apps | 99,212 of 1,335,322 apps implemented custom NSC settings quote: "Of the 1,335,322 free Android apps we analyzed, 99,212 implemented custom NSC settings." [results] * NSC security downgrades | share of apps with custom NSC files | 88.87% downgraded security compared to default settings quote: "Out of the 99,212 apps with custom NSC files that we were able to identify in our body of Android applications, 88,174 (88.87%) apps included configurations that downgrade security compared to default settings." [results] * Certificate pinning | share of apps with custom NSC settings | 663 apps, or 0.67%, used NSC certificate pinning quote: "Overall, we found 663 apps that implement certificate pinning using NSC." [results] * Trust in user-installed CAs | share of apps targeting Android 7 or higher | 8,606 apps (8.67%) re-enabled trust for user-installed certificates quote: "Out of 1,098,479 apps targeting Android 7 or higher, we found 8,606 apps that re-enable trust for user-installed certificates (8.67%)." [results] * Vulnerable certificate-validation code | share of analyzed apps | 5,511 of 15,000 apps (36.7%) were vulnerable quote: "Overall, we found 2,232 (14.8%) apps with vulnerable HostnameVerifier and 5,202 (34.7%) apps with vulnerable TrustManager implementations." [results] * Google Play safeguard bypasses | acceptance or blocking of experiments | Most vulnerable TrustManager and HostnameVerifier implementations were accepted quote: "After submitting each experiment to Google Play, the app went through the Google Play app review procedure. Once the verification process concluded, we checked for security alerts in the Google Play Console." [methodology] * Sensitive data over HTTP | share of manually analyzed apps | More than half of both 20-app sets used HTTP for sensitive user data quote: "In conclusion we find that in both sets more than half of the apps we tested manually used HTTP to transfer sensitive user data including login credentials." [results] USENIX 2024 — Racing for TLS Certificate Validation: A Hijacker's Guide to the Android TLS Galaxy population: 360 Mobile Assistant (Qihoo 360 Appstore) n=4121 mobile-apps top-n | Google Play store based on the rank of APKPure n=5452 mobile-apps top-n | 360 Mobile Assistant (Qihoo 360 Appstore) n=2765 mobile-apps top-n | Google Play store based on the rank of APKPure n=5061 mobile-apps top-n * TLS certificate validation failures | share of apps | 55.3% of Chinese apps and 6.4% of Google Play apps quote: "We found that 1529/2765 (55.3%) of Chinese apps were identified to have at least one of the four certificate validation issues; in contrast ... 322/5061 (6.4%)" [results] * Validation hijacking | share of insecure apps | 34.3% of insecure Chinese apps and 21.1% of insecure Google Play apps quote: "524/1529 (34.3%) of the Chinese apps, and 68/322 (21.1%) of the Google Play apps with TLS validation issues suffer from validation hijacking." [introduction] * Unverified certificate signatures | share of apps | 47.3% Chinese and 4.8% Google Play apps quote: "1307/2765 (47.3%) were identified with unverified certificate signatures ... For Google Play apps, 244/5061 (4.8%)" [results] * Self-signed certificate acceptance | share of apps | 49.7% Chinese and 4.8% Google Play apps quote: "1375/2765 (49.7%) trusted self-signed certificates ... For Google Play apps, 243/5061 (4.8%)" [results] * Expired certificate acceptance | share of apps | 47.4% Chinese and 4.6% Google Play apps quote: "1310/2765 (47.4%) accepted expired certificates ... For Google Play apps, 231/5061 (4.6%)" [results] * Domain mismatch acceptance | share of apps | 38.3% Chinese and 4.7% Google Play apps quote: "1059/2765 (38.3%) ignored mismatched domain ... For Google Play apps, 236/5061 (4.7%)" [results] * Sensitive information leakage | share of insecure apps | 88.8% of Chinese apps with validation issues; 86.3% of Google Play apps used plain insecure TLS quote: "In the Chinese app dataset, we found that 1358/1529 (88.8%) of the apps transmit sensitive information using insecure TLS connections." [results] * Static certificate override presence | share of collected apps | 47.0% Chinese and 21.3% Google Play apps used override functions quote: "Through a combination of dynamic and static analyses, we observed 1937/4121 (47.0%) Chinese apps and 1162/5452 (21.3%) Google Play apps utilizing these override functions." [results] CCS 2023 — IoTFlow: Inferring IoT Device Behavior at Scale through Static Mobile Companion App Analysis. population: three prior datasets: Neupane et al., IoTSpotter, and IoTProfiler n=9889 mobile-apps pre-existing-dataset | Google Play Store n=947 mobile-apps top-n | custom device set n=13 iot-devices purposive * IoT endpoint and protocol reconstruction | number of apps with reconstructed endpoints or schemes | Schemes reconstructed in 7,113 remote-endpoint apps and 871 local-endpoint apps quote: "For IoT-VER, we reconstructed schemes in 7,113 unique apps for remote endpoints and in 871 apps for local communication." [results] * Direct device communication | share of apps | 6,355 apps (64.26%) declared Bluetooth permissions; 1,483 (14.99%) had local IP addresses quote: "6,355 (64.26%) apps declare at least one Bluetooth permission. We find a local IP address in 1,483 (14.99%) apps" [results] * MQTT endpoint reachability | reachable endpoints | 74 of 138 remote MQTT endpoints (53.62%) accepted a connection quote: "We connected successfully (return code 0) to 74 MQTT endpoints (53.62%)." [results] * Certificate pinning and expiry | share of apps or certificates | 385 apps (3.89%) used pinning; 9,129 certificates (29.18%) were expired in May 2023 quote: "We use the approach by Pradeep et al. [76] to identify pinning and the corresponding certificates by analyzing the Network Security Configuration (NSC)" [results] * Abandoned domains | domains available for registration | 67 domains from 73 apps were verified available for registration quote: "we verified that 67 domains from 73 apps are indeed available for registration." [results] * Inter-component data flows | number of flows | 497 of 579 Bluetooth flows (85.84%) involved ICC quote: "Overall, we found 579 flows from Bluetooth sources in 90 apps. Remarkably, 497 (85.84%) of these flows involve ICC" [results] * Hard-coded encryption keys | share of apps using encryption | 2,321 IoT apps (57.04%) contained reconstructed hard-coded keys quote: "Overall, we reconstructed hard-coded keys in 2,321 (57.04%) IoT apps and 408 (50.24%) general-purpose apps." [results] * Static versus dynamic behavior coverage | matching domains and paths across 13 apps | IoTFlow extracted 54 domains and 281 paths versus 40 domains and 160 paths dynamically quote: "IoTFlow performs better than dynamic analysis and extracts more IoT-related behavior statically from companion apps than dynamic analysis (54 domains and 281 paths vs. 40 domains and 160 paths)" [evaluation] USENIX 2018 — Discovering Flaws in Security-Focused Static Analysis Tools for Android using Systematic Mutation population: F-droid n=7 mobile-apps convenience | Google Play n=8664 mobile-apps top-n * Undocumented flaws in Android leak detectors | number of unique flaws | 13 unique flaws in FlowDroid quote: "Our in-depth analysis of the output of µSE for FlowDroid discovers 13 unique flaws that are not documented in either the paper or the source code repository" [evaluation] * Undetected executable data leaks | share of executable mutants undetected | FlowDroid 48.7%; Argus 73.1%; DroidSafe 4.1% quote: "FlowDroid cannot detect over 48% of the leaks, while Argus cannot detect over 73%. Further, DroidSafe does not detect a non-negligible percentage of leaks (i.e., over 4%)" [results] * Android fragment use | share of apps containing fragments | 91% of 8,664 apps contained fragment code quote: "the fact that 7,860 out of 8,664 top apps, or 91% of popular apps contain fragment code" [appendix] * Executable injected mutants | number and percentage of executable mutants | 2,026 of 7,584 mutants were verified executable; over 73% filtered quote: "µSE injects 7, 584 leaks into the Android apps, of which, 5, 558 potentially non-executable leaks are filtered out using our EE, leaving only 2, 026 leaks confirmed as executable" [results] USENIX 2023 — The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications population: Google Play Store charts n=3006 mobile-apps top-n | iOS App Store category rankings n=1773 mobile-apps top-n * privacy consent dialogs | share of successfully analyzed apps | 814 (22.3%) apps displayed a privacy consent dialog on start; 434 (11.9%) displayed a proper dialog. quote: "Overall, we detected 814 (22.3%) apps displaying a privacy consent dialog on start. 232 (6.3%) displayed a link, 165 (4.5%) displayed a notice, and 434 (11.9%) displayed a proper dialog." [results] * dark patterns | share of proper dialogs with at least one violation | 429 (98.8%) proper dialogs violated at least one design requirement. quote: "We detected at least one violation of our design requirements in 429 apps (98.8%). On Android ... 98.4% ... and on iOS ... 99.5%." [results] * pre-consent tracker traffic | apps contacting monitored tracking endpoints before interaction | 3013 (82.5%) analyzed apps contacted a covered tracking endpoint before interaction. quote: "Mapping the requests back to apps, leads to 3013 (82.5%) of apps contacted one of our covered tracking endpoints before any interaction took place." [results] * pseudonymous data transmission | apps sending a unique identifier before consent | 1285 (35.2%) apps sent at least one request containing a unique identifier. quote: "1285 (35.2%) apps sent at least one request containing a unique identifier rendering the contained information at least pseudonymous and thus covered by the GDPR." [results] * post-rejection data transmission | apps transmitting pseudonymous data after rejection | 5 apps transmitted pseudonymous data after interacting with an unambiguous reject button. quote: "We observed 5 transmitting pseudonymous data after interacting with an unambiguous reject button out of which all 5 were new." [results] * TCF usage | apps setting TCF-related strings | 146 (4.0%) apps set TCF-related settings during execution. quote: "We detected only TCF-related settings in 146 (4.0%) apps. This highly limits any analysis approach based on frameworks." [results] PETS 2022 — Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps population: Google Play n=283065 mobile-apps seed-and-crawl | Apple App Store n=285680 mobile-apps seed-and-crawl | Google Play n=12000 mobile-apps random | Apple App Store n=12000 mobile-apps random * tracking-library presence | share of apps containing a library | 88.73% of Android apps and 79.35% of iOS apps contained at least one tracking library. quote: "88.73% contained at least one on Android, 79.35% on iOS." [results] * potential AdId access | share of apps with matching code | 86.1% of Android apps and 42.7% of iOS apps could access the AdId. quote: "We detected potential access to the AdId by checking for the presence of the AdSupport class and the system interface IAdvertisingIdService" [methodology] * tracking before consent | share of apps contacting tracking domains at startup | 81.44% of Android apps and 68.46% of iOS apps potentially shared data before consent. quote: "This suggests potentially widespread violations of applicable data protection law (in 81.44% of Android apps, and 68.46% of iOS apps)." [results] * PII exposure in network traffic | share of apps transmitting identifiers | 55.4% of Android apps and 31.0% of iOS apps shared the AdId over the Internet. quote: "We found that more Android apps shared the AdId over the Internet (55.4% on Android, and 31.0% on iOS)." [results] * permission requests | share of apps requesting permissions | Camera was requested by 56.3% of iOS apps and 21.2% of Android apps. quote: "Both were included by about 50% of iOS apps (Camera 56.3%, Location 49.2%), and less than a third of Android apps (Camera 21.2%, Location 28.0%)." [results] * cross-platform app identity | share classified as cross-platform | 13.7% of downloaded Android apps and 12.8% of iOS apps met the 95% similarity threshold. quote: "Among the 24k downloaded apps, we considered only those apps as cross-platform that had a cosine similarity of at least 95%. This amounted to 13.7% of downloaded Android apps, and 12.8% of iOS apps." [methodology] USENIX 2024 — Unpacking Privacy Labels: A Measurement and Developer Perspective on Google's Data Safety Section population: AndroZoo n=2720000 mobile-apps pre-existing-dataset | Google Play Store n=1100000 mobile-apps exhaustive | Google Play Store n=15000 mobile-apps purposive | custom trend-based developer list n=30000 mobile-apps purposive * DSS adoption | share of apps | 46.8% of apps had privacy labels as of May 2023. quote: "Privacy labels are present only for 46.8% of the apps on the Google play store (as of May 31 2023)." [dataset] * DSS longitudinal changes | share of apps updating DSS | 40% updated their DSS at least once; 4% updated it at least twice. quote: "We find that 40% (n=283K) of the apps updated their DSS at least once, while 4% (n=27K) updated it at least twice." [results] * Third-party library underreporting | share of analyzed apps | 42% used at least one advertising or analytics library. quote: "Analyzing the apks, we find that 42% of the analyzed subset of apps used at least one third-party library for advertisement or analytics." [results] * DSS and permission inconsistency | share of apps | 11.5% reported precise location without location permissions; 23.7% reported files without corresponding permissions. quote: "11.5% of the apps report collecting or sharing precise location data without obtaining location permissions." [results] * Encryption inconsistency | share of apps | 40% claimed no collection or sharing but encryption; 59% lacked INTERNET permission while claiming encryption. quote: "59% of apps do not request network permissions, yet state that they encrypt data in transit." [results] * Developer-label disagreement | share of developers | 41% disagreed for collection and 42% disagreed for sharing. quote: "41% of developers who stated in their emails not to engage in data collection were nonetheless reported as collecting data in their DSS. A similar inconsistency (42%) was observed for data sharing." [results] * Developer response themes | coded responses | 225 responses were coded after filtering 889 voluntary responses. quote: "Using the refined codebook, the two authors continued to code independently until they stopped observing new codes by the 175th response... reaching 225 responses." [methodology] * Overreported purposes | number of apps | More than 3,500 apps listed six or more purposes for every collected data type. quote: "out of the 7 possible purposes for collecting data, more than 3.5K apps list 6 or more purposes for every data type they collect" [results] WWW 2021 — A Longitudinal Study of Removed Apps in iOS App Store. population: iOS app store n=1033488 mobile-apps exhaustive | iOS app store n=854 mobile-apps purposive | iOS app store n=759 mobile-apps purposive * iOS app removals | number of removal records and distinct apps | 1,129,615 records corresponding to 1,033,488 different apps quote: "Overall, there are 1,129,615 app removal records, which correspond to 1,033,488 different mobile apps." [dataset] * Cyclical app removal | median interval between adjacent peaks | 28.5 days quote: "The median of time interval between the adjacent peaks is 28.5 days." [results] * Removed popular apps | share of removed apps ever ranked top-1500 | 51,704 removed apps (5%) quote: "Overall, 51,704 of the removed apps (5%) has been ranked in top-1500 across categories." [results] * Removal reasons | share of manually labeled apps by reason | Ranking Fraud 67.6%; Fake Description 56.1%; Content Issue 55.4% quote: "Most apps are removed mainly due to the reasons including Ranking Fraud (67.6%), Fake Description (56.1%), and Content Issue (55.4%)." [results] * App-removal prediction | F1 score | GBDT achieved F1=0.8326; six-days-ahead prediction achieved F1=79.3% quote: "The best performances for AUC score, precision, recall, F1 score, accuracy and false positive rate are 0.9116, 0.8909, 0.8214, 0.8326, 0.8397, and 0.0844, respectively." [results] NDSS 2026 — CHAMELEOSCAN: Demystifying and Detecting iOS Chameleon Apps via LLM-Powered UI Exploration population: WeChat Accounts (4), Appraven Groups (2), Illicit Websites (17) n=500 mobile-apps seed-and-crawl | App Store n=300 mobile-apps random | App Store n=23416 mobile-apps pre-existing-dataset | App Store n=1644 mobile-apps purposive | KNOWN dataset n=467 mobile-apps pre-existing-dataset * iOS Chameleon apps | detection rate and precision | 162 of 1,644 apps (9.85%) identified; 92.59% precision quote: "C HAMELEO S CAN identified 162 (9.85%) as Chameleon apps, with manual verification confirming a precision of 92.59%." [results] * Transformation methods | share of Chameleon apps | 10 categories; specific-string submission 69.60% and designated-area tapping 9.80% quote: "the two most prevalent formats ... account for 69.60% (348 cases) and 9.80% (49 cases), respectively." [results] * Review-disclosed transformation methods | share of apps | 244 of 500 apps (48.8%) contained disclosed transformation methods quote: "48.8% (244) of analyzed apps contained review-disclosed transformation methods" [results] * Functional transformation discrepancies | qualitative prevalence | 234 accessible-IPAs transitioned to illicit operational states after transformation quote: "Following successful transformation, these apps invariably transition to illicit operational states" [results] * Chameleon detection on known apps | recall and precision | 71.76% recall and 100% precision quote: "C HAMELEO S CAN achieves a recall of 71.76% and a precision of 100%." [results] * Hybrid UI frameworks | share of analyzed apps | 104 of 223 analyzed apps (46.64%) used Flutter or WebView quote: "Collectively, 104 apps (46.64%) relied on hybrid frameworks (Flutter or WebView)" [results] * UI interference elements | precision, recall, and resolution rate | 19.21% of observed pages contained distracting elements; ads resolved in 85.96% and pop-ups in 95.56% quote: "manual analysis identifying distracting elements in 19.21% of cases (848 pages) ... resolved 85.96% of intrusive ads ... and 95.56% of pop-up instances" [results] PETS 2025 — Privacy Settings of Third-Party Libraries in Android Apps: A Study of Facebook SDKs population: AndroZoo n=8848 mobile-apps top-n | AndroZoo n=6203 mobile-apps top-n * Facebook SDK integration | share of analyzed apps | 53.68% integrate at least one Facebook SDK quote: "3,245 apps (53.68%) integrate at least one of these SDKs." [results] * Privacy-setting modifications | privacy-enhanced configuration rate | AutoLogAppEvents: 17.90%; AutoInit: 11.46%; AdvertiserIDCollection: 6.79% quote: "The percentage of apps opting for privacy-enhanced configurations remains low across most settings, such as AdvertiserIDCollection, where only 6.79% of apps disabled the default data collection setting." [results] * Personal-data transmission | unique connections and transmitting apps | 80,449 unique connections from 4,959 apps; 3,589 apps transmitted user data quote: "we successfully intercepted 80,449 unique connections from 4,959 apps, with 3,589 of these apps transmitting a range of user data." [results] * Facebook SDK data transmission | connections containing personal data | 917 connections across 518 apps quote: "Facebook SDKs were identified as one of the top sources of off-device personal data transmission, with 917 connections containing personal data across 518 apps" [results] * AdID transmission | share of Facebook SDK data transfers | AdID was 54.03% of data types transferred by Facebook SDKs quote: "Among all data types transferred by Facebook's SDKs, AdID was the most prevalent (54.03%)" [results] * Privacy-label discrepancies | potential non-disclosure rate | 399 of 1,388 apps (28.75%) enabled AdID collection but failed to disclose it quote: "399 out of 1,388 apps (28.75%) have AdvertiserIDCollection enabled-whether explicitly set or left as the default-but fail to disclose this in their privacy labels." [results] * Privacy-policy discrepancies | non-disclosure rate | 58 of 1,037 analyzed policies (5.59%) failed to disclose AdID collection quote: "Across all 1,388 apps with AdID collection enabled-either by default or explicitly-we analyzed 1,037 privacy policies and identified 58 apps (5.59%) that did not disclose AdID collection." [results] * Child-directed app compliance issues | apps evaluated | 73 apps met all three restrictive criteria; 779 declared Play Families adherence quote: "Our evaluation of 73 apps that met these criteria did not uncover issues related to the integration of Facebook SDKs" [results] ============================================================================== 8. FOLD RESIDUE — every "used" tool name in appAnalysis that mobile_fold.mjs does NOT map ============================================================================== "used" tool tuples in appAnalysis: 3306; mapped to a family: 921 (27.9%); residue: 2385 tuples in 1732 distinct names The residue is dominated by general-purpose tooling (Python, PyTorch, Chrome) that the fold deliberately does not name, plus one-off custom tools. Printed in full, >=2 tuples: unmapped name tuples ------------------------------------- ------ VirusTotal 58 Python 22 Selenium 21 Chrome 19 scikit-learn 15 Amazon Mechanical Turk 10 EasyList 10 Random Forest 10 OpenSSL 9 Prolific 9 Scrapy 8 Firefox 8 spaCy 8 Android 7 iptables 7 Google Play 7 Google Search 7 Docker 7 Tranco 7 PyTorch 7 NLTK 6 WordNet 6 Google Translate 6 Support Vector Machine 6 TensorFlow 6 Android Studio 6 AVClass 6 t-SNE 6 EasyPrivacy 6 PolicyLint 6 Qualtrics 6 Amazon EC2 5 Android SDK 5 Android NDK 5 netstat 5 Keras 5 word2vec 5 BERT 5 GPT-4o 5 Android Open Source Project (AOSP) 4 Amandroid 4 MaxMind 4 Safari 4 R 4 Google Chrome 4 logistic regression 4 IccTA 4 Chromium 4 Tesseract 4 MobileInsight 4 aapt 4 SMOTE 4 USRP B210 4 CogniCrypt 4 BeautifulSoup 4 Google Play Store 4 Google Safe Browsing 4 langdetect 4 JEB 4 DBSCAN 4 IPinfo 4 CryptoGuard 4 TF-IDF 4 Adam 4 Exodus 4 Wenjuanxing 4 PoliCheck 4 Polisis 4 ChatGPT 4 Heros 3 strace 3 class-dump 3 SEAndroid 3 Google Play Unofficial Python API 3 SQLite 3 Monsoon Power Monitor 3 MalloDroid 3 Dynamic Time Warping 3 grep 3 curl 3 AWS EC2 3 SuSi 3 OpenWPM 3 k-means 3 Tor Browser 3 Flask 3 EdgeMiner 3 Z3 3 ping 3 OCR 3 RabbitMQ 3 Scikit-learn 3 strings 3 Binwalk 3 Logistic Regression 3 Python Requests 3 RootBeer 3 Crunchbase 3 Puppeteer 3 Lumen Privacy Monitor 3 UIHarvester 3 ProVerif 3 CocoaPods 3 MiniCrawler 3 crt.sh 3 ipinfo.io 3 nmap 3 WhatsApp 3 AirGuard 3 SpaCy 3 AFL++ 3 APKEditor 3 Android Asset Packaging Tool 2 Dedexer 2 AOSP 2 jsoup 2 Web of Trust (WOT) 2 k-nearest neighbors (k-NN) 2 AppBrain.com 2 Carat 2 Norton Mobile Security 2 Hopper 2 otool 2 GDB 2 Dalysis 2 Robotium 2 NetworkX 2 Stanford parser 2 support vector machine (SVM) 2 Dexpler 2 noVNC 2 PhoneLab 2 tc 2 GSM Arena 2 MaxMind GeoIP 2 PlanetLab 2 Meddle 2 ReCon 2 Hindsight 2 AdGuard 2 Celery 2 Redis 2 enjarify 2 Support Vector Machine (SVM) 2 logcat 2 Compatibility Test Suite (CTS) 2 SVM 2 Android Asset Packaging Tool (aapt) 2 Z3-Str 2 APK Downloader 2 DroidSafe 2 XGBoost 2 Node.js 2 Gradient Boosting 2 Word2Vec 2 Google Text-to-Speech 2 Scapy 2 hostapd 2 srsLTE 2 OpenStreetMap 2 BLESSED 2 Gensim 2 ssdeep 2 Shodan 2 Nessus 2 Capstone 2 Latent Dirichlet Allocation 2 Random Forest Classifier 2 NIST SP 800-22 2 Google Cloud Natural Language API 2 imagehash 2 Euphony 2 FirmXRay 2 Baidu 2 Public Suffix List 2 Apache Spark 2 AWS 2 RIPE Atlas 2 Luminati 2 agglomerative hierarchical clustering 2 PhishTank 2 Pandas 2 Farsight DNSDB 2 Beautiful Soup 2 AppCensus 2 DeviceCheck 2 Google App Engine 2 GNU Parallel 2 OpenVPN 2 Google Vision API 2 YOLOv3 2 Koodous 2 URLCrazy 2 K-means 2 Festvox 2 ACVTool 2 TensorFlow Lite 2 TDLib 2 DYNAMO 2 Cuttlefish 2 SCAT 2 Apptopia 2 SimilarWeb 2 googleplay-api 2 AllenNLP 2 LightGBM 2 Doccano 2 Prodigy 2 apksigner 2 Firmware Scanner 2 Androwarn 2 Twitter Academic API 2 BeautifulSoup4 2 tc-netem 2 WHOIS 2 Termux 2 Random forest 2 Google Play query completion API 2 Google Translate API 2 Android Studio Emulator 2 AntMonitor 2 tldextract 2 MNN 2 VirusTotal API 2 Hidden Markov Model 2 Viterbi algorithm 2 k-nearest neighbors 2 ImageNet 2 Google Maps 2 nDPI 2 Open5GS 2 BrowserStack 2 Edge 2 Brave 2 Sentence-BERT 2 HtmlToPlaintext 2 Apple Find My 2 OpenHaystack 2 RoBERTa 2 Chrome DevTools 2 Playwright 2 Symantec Sitereview 2 cosine similarity 2 SciPy 2 ZXTouch 2 Logcat 2 AVClass2 2 eBPF 2 ThirdEye 2 Google search engine 2 Apache 2 TalkBack 2 Raspberry Pi 4 2 ss 2 GraphSAGE 2 GPT-4 2 Theos 2 Unity 2 regular expressions 2 google_play_scraper 2 DuckDuckGo Tracker Radar 2 ESP32 2 PostgreSQL 2 plistlib 2 Google Play Protect 2 requests 2 names appearing exactly once: 1466 — listed alphabetically: 114DNS passive DNS | 3-layer neural network | 360 Mobile Guard | 360 Passive DNS Project 3u | 7-Zip | 89z Google Play crawler | A-priori algorithm AAPT | ABBYY FineReader | ABY | ACR122u ADAM | ADB Log-Cat | ADB Logcat | ADT Eclipse plug-ins AES | AKAZE | ANTLR | AOSP 4.4.2 r12 APER | APISENSE | APKLab.io | APKParser ARM NEON | ARPABET | ATLAS.ti | AV-Class AVG | AVG AntiVirus Free | AVG Antivirus Free v2.9 | AWS Device Farm AWS IoT | AZ Screen Recorder | Abuse.ch's malware sources blacklist | Accelerometer Meter v1.32 AccessibilityService | Acra 4.2.3 | ActivityInstrumentationTestCase | Acunetix AdAway | AdAway Hosts | AdBlockPlus | AdaBoost Adafruit Bluefruit LE Sniffer | Adafruit PN532 | Adaptive Boost | Adaptive Misinformation AdblockPlus Library for Android | AdvBox | Affinity Propagation | Affinity propagation Aho-Corasick automaton | Aircrack-ng | AlarmManager | Alexa Alexa ranking | AliPay-dev | Aliyun Cloud | Aliyun Cloud Servers Amarisoft Callbox | Amazon | Amazon AWS EC2 | Amazon Alexa Amazon Device Farm | Amazon Rekognition | Amazon Text-to-Speech | Amazon Web Service EC2 Amazon Web Services (AWS) EC2 m4.4xlarge | AmiGo | AmiGo testbed | AnTuTu AndHook | AndroBomb | AndroChef Java Decompiler | AndroTotal AndroZoo app crawler | Android 10 | Android 2.2 | Android 2.3.3 Android 4.1.1 (Jellybean) | Android 4.3 emulator | Android API | Android ART DoCall() Android Asset Packaging Tool (AAPT) | Android Auto Clicker | Android Bluetooth HCI snoop log | Android CPU governors Android DDMS | Android Developers documentation | Android InstrumentationTestRunner | Android Open Source Project Android Open Source Project (AOSP) 8.1 | Android OpenSSL | Android PackageManager APIs | Android Profiler Android Sensor Framework | Android SpeechRecognizer API | Android Studio IDE | Android Studio Profiler Android TextToSpeech API | Android ViewServer | Android WebView | Android adb Android dumpsys | Android proc filesystem | AndroidStudio | Anguli AntMonitor Library | Antiy AVL Mobile Security | Antutu Benchmark | AoAv2 protocol Apache Cordova | Apache Groovy | ApkSigner | Apkmonk App Annie | App Store Scraper | App instrumentation framework by Koch et al. | AppBrain API AppCensus custom Android instrumentation | Appetize.io | Apple App Store | Apple App Store API Apple Catalog API | Apple Geolocation API | Apple Maps | Apple iCloud API Apple-provided web API | AppleScript | AppsPlayground | Appscope Aquatone | Archive.org | Arduino | Arduino Micro Argus | Arjun | AssetStudio | Attack-VC Audacity | AudioFlinger | AutoCog | AutoGluon AutoHotkey | AutoVC | Autofill Framework | Avast Axolotl | Aya | BCM4387 network adapter | BERT Cased BERT-Base uncased | BERT-base-uncased | BIND 9 | BLE 4.2 adapter BLE GAP API | BTLEmap | Baidu OCR | Baidu PhoneGuard Bash | Basic Naive Bayes (BNB) | Battery Historian | BatteryLab Beautiful-Soup | Bee | Better tracker blocker | BiLSTM BinDiff | Binary Ninja | BinaryNinja | BladeRF BlueDroid | BlueSeal | BlueStacks | Bluetooth Bluetooth Explorer | Bluetooth HCI snoop | Bluetooth Packet Logger | BluetoothGatt BluetoothGattServer | Boot-Image-tools | Bosch GLR825 laser distance measurer | BouncyCastle Brave Software | Brave for Android | Bro | Broadcom BCM4360 Bui et al. purpose-extraction tool | Bundler toolkit | BusyBox | Butterworth filter BypassRootCheck-Pro | C&W | C4.5 Decision Tree | C4.5 decision tree CADO-NFS | CAIDA's Archipelago (Ark) | CANDID | CBOW (Continuous Bag-of-Words) CETA resources | CETD algorithm | CFR | CHIP Tool CLD3 | CLIP | CLTK | CMU pronunciation dictionary CMUDict | CNN & RNN | CNN and RNN | CSRF Scanner CTIA Stolen Phone Checker | CVC4 | CVE | CVE Details CYREN | CaffeineMark | Camera Timestamp Free | Canny Edge Detection CardEmulator | Cardpliance | Carthage | Cartographer Cartopy | CellularPrivacy | Centroid | Centroid Prediction Centroids | Cephei | ChatGPT (OpenAI's TextCompletion API) | ChatGPT 3.5 and 4 CheckHost | Checker Framework | Choco data constraint solver | Chrome DevTools Protocol Chrome DevTools Protocol (CDP) | Chrome Developer Tools | Chrome Extension Source Viewer | Chrome User Experience Report (CrUX) Chrome WebDriver | Chrome WebRTC Debugging Console | Chrome remote debugging protocol | ChromeCacheView Chromium Code Search | Chromium source code | Clang-based fuzzy parser | Cloud Datastore Cloud Research | Cloudflare website categorization | ClueFinder | CmrfScanner CodeQL | CogniCryptSAST | ComDroid | Common Library classification Compatibility Testing Suite (CTS) | ConceptNet | Console | Convolutional Neural Network Convolutional neural network (CNN) | Cookie-Editor | CoreML | CrashScope Criminal IP | Cruiser app crawler | Crunchbase API | CrySL Crylogger | CryptoREX | Customized Mitm Proxy | CyanogenMod Cyanogenmod 11 | Cycript | Cydia Substrate | D8 DAGGER | DBIP | DED | DIAG DIALDroid-Bench | DOTHOME | DSFD | Daikon Dalvik VM | Dalvik virtual machine | Damerau-Levenshtein edit distance | Dare Decision Tree | Decision Tree (DT) | Decision Trees | DeepFool DeepSec | DeepSniffer | DeepSteal | DeltaWalker DenseNet 201 | Depot | Detect Language | Dialogflow DidFail | Difuzer | Digital Asset Links | DigitalOcean Disconnect | Disconnect Me | Dnsmasq | Doc2Vec Docker Swarm | DomainTools WHOIS | DontKillMyApp | Dopamine DoubleX | Dovecot | Draco | Dragnet DroidBench | DroidBench 2.0 | DroidChameleon | DroidPlugin DroidRA | DroidSIFT | Droidlysis | Drozer EAST | ELM327 command set | EMP-toolkit | EOEDroid ESP32 WROOM | Easy List | Easy Privacy | EasyList, EasyPrivacy, Disconnect, and AdGuard mobile list Eclipse | Eclipse ADT | Edgeminer | EfficientNet-B0 Elasticsearch | Elbow method | ElevenLabs | Ella Empath | Epicc | Esprima | Etherscan Etherscan List Token Transfer Events API | Ettercap | Ettus USRP B210 | ExifRead ExoPlayer | Exodus Privacy tracker list | Exodus-Privacy | ExodusPrivacy Explicit Semantic Analysis | ExpressVPN | Extreme Gradient Boosting (XGB) | F-Secure FAISS | FFmpeg | FP-GROWTH | FPMON FSEvents | FSGANR | FSGANS | FSquaDRA FSquaDRA2 | FaceNet512 | FaceShifter | Facebook Graph API FairFace | Fakeium | Faker | Fanboy Fast Gradient Sign Method (FGSM) | FastAI | FastDTW | FastRPC Fastbot | Fastly | Fax | Fernflower Filebench | FindSecBugs | FingerprintJS | FingerprintJS2 Fingerprintjs2 | FireBase Scanner | Firebase scanner | Firefox mobile browser FirmXray | First Order Method Model (FOMM) | Fisher Score | Fleiss's κ Flesch Kincaid Calculator | Flightradar24 | FlowPrint | Flutter Foolbox | ForceAtlas2 | ForcePoint | Fortify SCA Fossology | FoulWrapper | Function ID | G*Power GATOR | GCC | GCC/G++ | GDA GPT-4-Turbo | GPT-J 6B | GPT4o | GPy GSDMM | Gadgets360 | Gaussian Mixture Model | Gaussian Naive Bayes Gaussian Naive Bayes (GNB) | Gaussian mixture models (GMMs) | Gaussian model | Gemini Generative Adversarial Network (GAN) | Genymotion Emulator | GeoIP | Geocodio Gitleaks | Go | Go-based crawler | GoDaddy Google | Google AdWords | Google Ads | Google App Engine AutoML Google Best Guess | Google Chrome 63.0.3239.111 | Google Chrome's browser developer tools | Google Cloud Natural Language APIs Google Cloud Speech-to-Text | Google Cloud Vision API | Google Compute Engine | Google Custom Search API Google Custom Search JSON API | Google Dataset Search | Google Direction API | Google Firebase Test Lab Google Form | Google Forms | Google Image | Google Image Search Google Images | Google Keyword Planner | Google Map API | Google Maps API Google Maps Directions API | Google Maps Javascript API | Google Natural Language API | Google Pixel 3a Google Play Console | Google Play Downloader | Google Play SDK Index | Google Play Store developer console Google Play recommendation system | Google SSO | Google Safe Browsing Update API | Google SafeBrowsing Google Scholar | Google Search APIs | Google SentencePiece Tokenizer | Google Takeout Google Tesseract OCR | Google Translate API for Python | Google Translation | Google Translator Google Vision Text Documentation Detection API | Google libphonenumber | Google migration API | Google play unofficial Python API Google related query API | Google text-to-speech (TTS) engine | Google's Activity Recognition API | Google's Gemini LLM Google's Protobuf compiler | Google's Tesseract | Google's Vision API | Google's language detection Google-Protobuf | GooglePlay | Gradient Boosting Decision Tree | Gradle Grammarly | GraphQL Security Auditor | Greynoise | Grid Search Griffin-Lim | Grounded Theory | Guibat icon classification model | Gyrophone code H3 | HCI snoop log | HERE Map | HIVE-COTE HLR lookup | HLRLOOKUPS | HMAC-SHA256 | HTTP Archive HTTP Toolkit | HTTPS Everywhere | Hadoop File System | Hakrawler HanLP | Haversine formula | Heroku | Hertz Hierarchical Mixture of Naive Bayes (HMNB) | Hill Climbing | History Export | HornDroid HostingChecker | Hurricane Electric's Tunnel Broker | Hushed | Hybrid Analysis IBM WALA | IC3 | ICSI Certificate Notary | ICSI Netalyzr for Android ICface | IDA Freeware | IDA-Pro | IDA-pro IGNN | IMEI.info | INA219 High Side DC Current Sensor | IP2Location IPA-tool | IPInfo | IPaddressAPI.com | IPerf IRTT | Inception | Inception-ResNet-v1 | InceptionTime Intel PCM | IntelliDroid | Internet Archive | Internet Information Services (IIS) Internet Routing Registries (IRRs) | JA3 | JA3S | JAW JD-GUI | JEB Android decompiler | JEB Decompiler | JEB Pro JEB decompiler | JExifViewer | JSA String Analyzer (JSA) | JSketch JSoup | JSoup 1.11.1 | JTOOL | Jaccard index Jaccard similarity coefficient | Janus | Java API nanoTime | Java Cryptography Architecture (JCA) Java Cryptography Extension (JCE) | Java Reflection | Java reflection | Java-ML JavaBaker | JavaParser | JavaPathfinder | JavaSMT JavaScript | JetBrains dotPeek | Jieba | Jitsi Joker | Jupyter Notebooks | K Nearest Neighbors | K-Nearest Neighbor K-Nearest Neighbor (kNN) | K-Nearest Neighbors | K-Nearest Neighbors (KNN) | K-nearest neighbor algorithm (KNN) KVM | Kamailio | KiwiTalk | Knockoff Nets Kolmogorov-Smirnov test | Kplaysearch | Krakatau | Krippendorff's alpha Kruskal-Wallis test | Kryptowire's internal Android static analysis engine | LATCH | LDA LDPlayer | LIBLINEAR | LIBSVM | LIEF LIME | LLDB | LLVM | LLaMA 3.1 8B Instruct LME4 | LOWESS | LSPlant | LSTM encoder-decoder Lalaine | Langdetect | Language Technology Platform (LTP) | Lasso regularized linear regression Latent Semantic Analysis | LatinIME | Leader Algorithm | LeakScope LearnLib | Learning Vector Quantization (LVQ) | Legend | Lemur Levenberg-Marquardt algorithm | LexisNexis | LibAFL | LibFuzzer LibPecker | LibSVM | LightCNN | Lightbeam LineageOS | LineageOS 19 | Linux Virtual Machine | Linux namespaces LiteRadar | LiveLab | Llama 3 | Local Extreme Value Detection (LEVD) Local Outlier Factor | Logistic Regression (LR) | Long Short-Term Memory | Lookout Security & Antivirus Lookout Security & Antivirus v6.9 | Lookout Security and Antivirus | Louvain algorithm | Lumen Lumos | Lxml | M'layer Perceptron (Deep) | MANOVA MATLAB | MATLAB 5G Toolbox | MATLAB Curve Fitting Toolbox | MAXQDA MD5 | MD5 and SHA-1 cryptanalytic toolbox (hashclash) | MDROID+ | MIRToolbox MIRtollbox | MITM SSL proxy | MKNetworkKit | ML-Doctor MLP | MPlayer | Mace | Mallodroid Mallory | MalwareBytes | ManyCam | Marvel App Marvel app | Matlab | Matlab LTE Toolbox | Matplotlib Matter.js | Maven Repository | MaxMind GeoIP2 Precision Web Service | MaxMind GeoLite2 MaxMind Geolocation | MaxMind commercial database | Maximum Likelihood Estimation | Maxmind McAfee | McNemar's test | Mechanical Turk | Media Projection MediaExtract | MeshLab | Metasploit | Microsoft Azure Microsoft Azure Speaker Recognition | Microworkers | Mini-Crawler | Mixture of Naive Bayes (MNB) Mixture of Naive Bayes with Categories (MNBC) | MoaAB | Mobibench | Mobile Verification Toolkit (MVT) MobileNetV2 | MobileNetV3 | Mobileinsight | ModelXray ModelXtractor | ModemManager | Modularity | MongoDB Monsoon High Voltage Power Monitor | Monsoon Meter | Monsoon high-resolution Power Monitor | Monsoon power monitor Monte Carlo simulations | Mother of All Adblocking | Mozilla Rhino | Mozilla's funfuzz Mullvad | Multi-Hop | Multinomial Naïve Bayes | Munkres algorithm NIST statistical test suites | NLTK CoreNLP Parser | NLTK English stopwords list | NLTK Sentence Tokenizer NLTK stop words | NMAP | NPA/NXX database | NTP Naive Bayes | Naive Bayes classifier | Naive Bayes with Informative Priors (PNB) | National Vulnerability Database Navizon app | Nearest Neighbor | Needleman-Wunsch algorithm | Netify Netlab | Netron | Netstat | Network Analyzer Network Signal Guru | NetworkManager | NetworkProfiler | Neural Networks NextDNS | Nmap | NoFrak | NoTracking NomadLAB | Nordic nrf52840 board | Norton | Norton Mobile Security Lite v2.5.0.379 NortonLifeLock mobile security product | NoxPlayer | NuSMV | NumPy O-LLVM obfuscator | OBFUSCAN | OCR SPACE | OOPSpam OPAL framework | OPTis-S4 | OS Monitor | OVR Metrics Tool OWASP Zed Attack Proxy (ZAP) | Oat2dex | OkHttp3 | Oltrogge et al.'s Android app crawler OmniParser | Omnipeek | OneTrust | Online Protobuf Decoder Ookla Speedtest | Open | Open GPX Tracker | OpenAI Vision API OpenAirInterface (OAI) | OpenCV | OpenCV cv2.absdiff | OpenCellID OpenMP | OpenPhish | OpenWrt | OpenYOLO Opera | Optunity | Orbot | Osquery PACER | PJSIP | PLY (Python Lex-Yacc) | POWDER PRAW | Packet Capture | PacketDotNet.Ieee80211 | PacketLogger PaddleOCR | PageRank | Paho | Paho MQTT client Palo Alto Firewall | Palo Alto Networks proprietary detection system | Papers With Code | Paragraph Vectors Model Parani-UD100 | Partial Program Analysis (PPA) | Pastebin | Patch Antenna RP-SMA-R/A Patch-based Multiview Stereo (PMVS) | Perceptual Hashing (pHash) | Permission Checker (PerChecker) | Perspective Perspective API | PhoneGap | PhotoDNA | Phraser Pi-hole's Default List | Pillow | Ping Traceroute | PingTools Piper | PlayDrone | Plino | Polar Proxy PoliGraph | Policy Highlights | PolicyLint preprocessing script | Porter Stemmer Postfix | Postman | Power Profiler | PowerTool PowerTutor | Prediction-Poison | Principal Component Analysis | Principal Component Analysis (PCA) Priv-Accept | PrivBERT | Privacify | PrivacyGrade ProbLog | ProcHarvester | Procyon | Projected Gradient Descent (PGD) Prolific Academic | Protocol Informatics (PI) | Proton VPN | Proxmark RDV4 ProxyDroid | Proxyman | PubNub | PublicWWW PurPliance NER model | PyBLE | PyBluez | PyCrypto PyDictionary | PyOD | PyPy | PyQt5 PySMT | PyTorchMobile | PyVirtualDisplay | Pytesseract Python 3.8 | Python Cryptography Toolkit (pycrypto) | Python Flask | Python NLTK Python SSL library | Python crawler | Python cryptography module | Python enchant Python pdfminer | Python script | Python socket library | Python string similarity matching Python timeit | Python validators library | Python-based implementation | Qianxin sandbox Qihoo 360 | Qihoo 360 passive DNS | Qualcomm Hexagon SDK | Qualys SSL Labs Qualys SSL Server Test | Qwen2.5-14B | Qwen2.5-7B | Qwen2.5-Coder-32B-Instruct Qwen2.5-VL | R-Droid | R8 | R8 retrace RAM disks | RAW SOCKET | ROP | RSPAN Raccoon APK Downloader | Raccoon app downloader | Radare | RainbowCrack Random Forest (RF) | Random Forests | Random Lists | Randoop Rapid7's passive DNS | Raspberry Pi | Raspberry Pi 4 Model B | Raspberry-PI ReadabiliPy | Readability | Realistic Vision V4.0 noVAE | Reaper Reddit API | Redexer | Regex Generator++ | RenderTexture ReproDroid | ResNet101 | ResNet152 | Resemblyzer Resnet | RetinaFace | Rev | Ridler-Calvard method Robokiller | Robolectric | Root Zone Database | Rust SAAF | SAPIC+ | SBERT all-MiniLM-L6-v2 | SHA-256 SHA-512 | SHAP | SIFT | SIM7000A SIMtrace2 | SLOCCount | SMT solver | SNPE SQLCipher | SQLMap | SSIM | SSL Labs SSL proxy | SSLsniff | STAC | SURF SV2TTS | SVC | SVM classifier (custom) | SVM with RBF kernel SWI-Prolog | Safari Privacy Report | Safari Web Inspector | SafetyNet Samsung Internet Browser | Savitzky-Golay smoothing filter | SceneDroid | Scikit-Learn Screaming Frog | Sdat2img | Seaborn | SearchBug Selendroid | Selenium WebDriver | Selenium web driver | Self-Organizing Map (SOM) Semgrep | SensorDisabler | SensorLog | SensorTower SentencePiece | Seq2Seq | SerpAPI | ServiceOS browser runtime ShadowNet | Shamiko | Shark | Shark for Root Shodan Search Engine | ShowAPI | Showcaller | Siamese neural network Signal | Signal for android backup decryption tool | Sikuli | SimCSE Simg2img | SimiDroid | Simple Transformers | SimpleNLG Skyfield | Slither | Smali/BakSmali | Smart Contract Sanctuary SmartDroid | SmartThings Simulator IDE | SnoopDog | Snorkel SourceDNA | Spamhaus | Spamhaus Policy Block List | Spamhaus passive DNS API Spamhaus' SBL and DBL | Spark | Speedtest CLI | Sphinx Sphinx-4 | Spicy | Splituapp | Spongy Castle SpongyCastle | SpoofTooph | Spoon | SpyOnWeb Squid | Stanford NER | Stanford Named Entity Recognizer | Stanford POSTagger Stanford Parser | Stanford Parser Wrapper | Stanford Topic Modeling Toolbox | Stanford typed dependency parser Stanza | Statcounter | Stats-Models OLS | Statsmodels Steven Black host list | Storm | Strava | Support Vector Machine (SVM) Linear kernel Support Vector Machine (SVM) with RBF Kernel | Support Vector Machines (SVM) | Swift | System WebView Shell App T5-11B | TC Slim | TC voice synthesis API | TCP-Dump TF-IDF cosine similarity | TFLite | TI CC2540 | TLS-Attacker TWRP | Tacyt | Tailscale | Tamarin Tamarin prover | Team Cymru IP-to-ASN | Team Cymru's Botnet Analysis and Reporting Service | Temperature calibration Tencent Map Geocoding API | TensorFlowLite | TerminalEmulator | Tesseract OCR Tesseract OCR Engine | Tesseract-OCR | Texas Instruments (TI) CC2640 | Texas Instruments INA219 TextExerciser | Threema | Tile hidden API | Time Machine TinyCheck | Tinyproxy | Titanium Framework | TollFreeNumbers.com Tor | Toybox | Trace.js | Trace32 Tracker Detect | Tracker Radar Collector (TRC) | TrafficStats.getUidRxBytes() | TransE Transformer-Based Universal Sentence Encoder | Transformer-based model | Trend Micro Mobile Security | TrendMicro Mobile Security Personal Edition v2.0.0.1294 Trepn Profiler | TriggerScope | TrollStore | TruffleHog Tsung | TurkPrime | Twilio Lookup API | Twitter Search API U-Net | UBC | UIPicker | UPX URLExtract | URLScan | UTSFuzzer | Uber API Uber Client app | UberTooth One | Ubertooth One | Ubertooth-One UiRef | UpSet | User Agent Switcher | User Interviews VF2 | VFDecrypt | VGG | VGGNet VMMap | VMware ESXi | VMware Workstation | Valgrind Variational AutoEncoders | VeriFast | Very sparse random projection | ViT VirusTotal public API | VisibleV8 | Void | WHOIS database WICG webpackage | WProf | Wandoujia management app | Watir Wayback Machine | WeChat | WeChat Windows client | WeChat metadata API Web Audio API | Web of Trust (WoT) | WebAgentDriver | WebAssembly WebProxyTool | WebUI | WebUSB API | Webshrinker Weka | WhatsApp Crypt14-Crypt15 Decrypter | WhatsApp Google Drive extractor | WhoTracks.Me Whois IP Address Database | WhoisXMLAPI WHOIS API | WiFi Direct | Widevine Integration Platform Wine | WireShark/tshark | Word Mover's Distance | Word2vec WordNet::similarity | Wowza Stream Engine | WuKong | Wukong X-Ray 2020 | X-Ray Tracker List | X2Face | XCUITest XCode | XLM-Roberta | XPMChecker | XPOChecker XPrivacy | XSEDE TACC Jetstream | XSStrike | Xception Xcode UI tests | Xray | YAHFA | YCSB YOLO_Label | Yellow Pages | Yet Another Mail Merge (YAMM) | YouTube Player APIs Z3-str | Z3StrSolver | ZRTP4PJ | Zeek ZeroMQ | ZoKrates | Zoom | aapt2 adb dumpsys | adblockparser | airbase-ng | allmpnet-base-v2 android-async-http 1.4.9 | android.os.FileObserver | angr | anisotropy-based quality method annotation tool [5] | api.trongrid.io | apk-mitm | app-downloader autocorrect | axmlparserpy | bert-base-uncased | bidirectional LSTM bidirectional LSTM sentence embedding model | binwalk | bluetooth Python module | bpftool chrome-remoteinterface | clang | cloud_enum | commercial URL filtering service commercial VPN subscriptions | commercial pDNS tool | conditional random field | conditional random field (CRF) continuous speedtest | create ap | curve25519-dalek | custom Android app custom EME JavaScript script | custom app-market crawler | custom automated crawler | custom browser extension custom crawler | custom retrieval tool | custom scraper | custom static analysis custom web scraper | customized Needleman-Wunsch algorithm | cve-search | danglingcname data collection tools developed by Garimella and Tyson | database | decision tree classifier | decision trees devmodectl | dex-method-list | dexter | diff dmg2img | dnsmasq | doc2vec PV-DM | domain Whois dpkt | dumpdecrypted | dumpsys | dynamic execution monitor dynamic time warping (DTW) | e2tools | eadb | emoji emoji Python package | emulator | en_core_web_lg | ens-normalize esalib | eth-ens-namehash | ethers.js | exclusive sparse coding exit survey software | fast.com | fastText | fastboot fastcluster | filemon | firebase-messaging | foundation LLMs friTap | gSpan | genetic programming | gensim getapk custom shell script | getrusage | google-play-scrape | googler googletrans | gplaycrawler | gplaydl | gpsoauth gpt-4o | gradient decision boosted trees (GDBT) | graph-based label propagation | graph-tool handleopenurl.com | hashcat | hcidump | headless Chrome Browser headless browser | hex editor | hierarchical clustering | hpHosts hping3 | iOS SDK | iOracle | iPerf iPerf3 | iVerify | ibtool | idna-uts46-hx instrumented Android 9.0 (Pie) | ip xfrm state | ipcat | ipcc-downloader iperf3 | ipinfo | iptoasn.com | ipvigilante.com jarsigner | javalang | javap | javascript-hooker javax.crypto | jeb | jieba | jitsi-srtp jtool | k-Means | k-means clustering | kernel module keytool | knee-point method | ksvm | lattice-based key recovery algorithm libav | libclang | libqmi | libselinux libtins | linux-router | lldb | log logic analyzer | lxml | mDNSResponder | macOS Console macOS Console app | macOS system logging facility | machine learning classifier from Chatterjee et al. | massdns maximum-relevancy minimum-redundancy (mRMR) | miniTracing | minidom | mitm-proxy mobile security product's analysis infrastructure | mock location provider | modAL | mtr mtranslate | multi-class k-nearest neighbors classifier | multi-layer perception (MLP) | multi-layer perceptron (MLP) multimeter tester | multipass | nRF52832 Dongle | ncnn nearest neighbor algorithm | netsniff-ng | network sniffer | network tap networkx | nosmoke | nsenter | oat2dex objdump | one-class Support Vector Machine | openssl | our crawler ovrgpuprofiler | p0f | paraphrase-multilingual-MiniLM-L12-v2 | parse-play pcap-parser | pcap4j | petlib | pfctl pix2pix | pkuseg | playsound | plutil pm3 client | power-meter | procstats | professional transcription service proprietary instrumented AOSP build | protobufs library | protoscope | proxy proxy server | proxychains4 | publicly available GitHub script | publicsuffixlist publicwww.com | pyOpenSSL | pySim | pyasn1 pyautogui | pyelftools | pygtrans | pymobiledevice3 pysoot | pytesseract | python-magic | python-whois pytorch.nn | pywinauto | r0capture | r4nd0m radiff2 | random forest | random forest (custom) | random sampling recurrent neural network with LSTM units | redroid | regex package | regular expressions (regex) reservoir sampling | ripgrep | roberta-large-nli-stsb-mean-tokens | rootAVD rvictl | scikit-learn DecisionTreeRegressor | scrcpy | screening application script written by the aforementioned hobbyist | semantic similarity | sentence-transformers/all-MiniLM-L6-v2 | sesearch simg2img | simulated annealing | smali/dexpler | smp_call_function_single spaCy en_core_web_lg | sparse SVM | speedtest.net | sqldiff sqlmap | srec_cat | srsENB | srsRAN srsRAN v21.10 | srsUE | sslscan | startSSL stochastic gradient descent (SGD) | stress-ng | strongSwan | supervised linear classifier (custom adaptation) sysctl | sysfs | syslog -w | sysmoEUICC1 tPacketCapture | tf-idf vectorizer | tld | tool developed by Garimella et al. traceroute | transformer-based encoder | transparent proxy | tree edit distance tvbus.exe | two-coin model | uBlock Origin | unbound urllib | vDexExtractor | vmihailenco/msgpack | web crawler web3.js | web3.py | whitelist-chrome | www.iplocation.net wxappUnpacker | wxml-transformer | xcodebuild | z3 zImageTool | zxcvbn </file> ===== 14. Conventions followed on this page ===== ^ Item ^ Value ^ | Discussion block | **None**, following the convention set by the other ''provenance:'' pages — comments belong on the content page. | | Reference list | **None.** There is no <bibtex bibliography>%% block, so the one citekey here renders as a marker without a reference list; that is the existing convention on ''provenance: pages, not an omission. This page adds no bibliography entries of its own. |

← back to the content page · corpus-level provenance