TPL-Benchmark: A Comprehensive Benchmark for Third-Party Library Detection in Android Applications

Abstract

Accurate detection of third-party libraries (TPLs) is essential for securing millions of Android applications, enabling vulnerability tracking, malware detection, and supply chain security auditing. However, existing TPL detection benchmarks have limited scale and outdated coverage, which hinders a rigorous and fair evaluation of the tool’s effectiveness in real-world scenarios. To bridge this gap, we present TPL-Benchmark, a comprehensive benchmark comprising over 6,000 real-world applications with precise, version-level annotations for both remote and local dependencies. More specifically, we develop TPL-Extractor, an efficient and accurate automated framework for version-level dependency annotation, aiming to address the high labor cost and limited precision of prior ground-truth construction methods. Equipped with this benchmark, we reproduce and evaluate twelve state-of-the-art TPL detection tools, revealing optimization directions in adaptability to R8-era transitions, version resolution accuracy, candidate–library correspondence granularity, similarity threshold robustness, and efficiency/scalability on large app or library sets. Beyond benchmarking, we further analyze how TPL characteristics influence downstream security tasks, including vulnerability detection, malware analysis, secret leakage assessment, and LLM-based evaluation. Collectively, our study advances the understanding of TPL detection and establishes a foundation for more robust, adaptive, and scalable security analyses in the Android ecosystem.