NLRadar

Run Command

To use NLRadar for static analysis, run the following command:

java -jar NLRadar.jar [apk_path] [android.jar_path]

Where:

• [apk_path] is the path to the APK file to be analyzed
• [android.jar_path] is the path to the android.jar file from the Android SDK

Project Files

• This repository contains the following files:
  • NLRadar: Source code of NLRadar
  • NLRadar.jar: Executable JAR file of NLRadar
  • android.jar: Dependency required for the analysis
  • Static Analysis Assessment.xlsx: Detailed result of Static Analysis Assessment
  • LLM Assessment.xlsx: Detailed results of NLS abuse identification using LLM analysis
  • ApkInfo: The Package Name and SHA256 information of the test dataset
  • NLRadar/LLM_Evaluation: Example Prompt of LLM-based Security Evaluation

Effectiveness Assess

Store

Label Item Package Name

NLRadar

Manually Label

Filtering

Leakage

Operation Triggering

Filtering

Leakage

Operation Triggering

Originating App

Content

Attributes

Network

Local Storage

Database

Sharepreference

Dismissal

Interaction

Auto Reply

Originating App

Content

Attributes

Network

Local Storage

Database

Sharepreference

Dismissal

Interaction

Auto Reply

A n d r o z o o

eu.toneiv.ubktouch

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.dongbao.ygzj

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.qihoo.appstore

●

★

★

◎

★

◎

★

◎

●

★

★

◎

◎

◎

★

◎

com.android.app.notificationbar

●

◎

◎

◎

◎

◎

◎

◎

●

◎

◎

◎

◎

★

◎

◎

com.alibaba.icbu.app.seller

●

◎

◎

◎

◎

◎

◎

◎

●

◎

◎

◎

◎

◎

◎

◎

com.loc.tracker

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.viapalm.kidcares

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.qihoo.cloudisk

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

dominapp.number

com.whatsapp com.google.android.gm

" @ " "whatsapp" "telegram" "gmail" startsWith("+") "http" "www."

★

★

◎

◎

◎

com.whatsapp com.google.android.gm

" @ " "whatsapp" "telegram" "gmail" startsWith("+") "http" "www."

★

★

◎

◎

◎

com.mdnsoft.ussddualwidget

●

◎

★

◎

◎

★

◎

◎

●

◎

★

◎

◎

★

◎

◎

rss.serv.rete.accept

null,code,codice key...

★

★

◎

★

★

◎

◎

null,code,codice key...

★

★

◎

◎

★

◎

◎

step.tracker.stepcounter.walking

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.bjhl.xiaozao

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.eztech.portal.crm.lpd

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.tencent.qqpimsecure

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

★

◎

◎

com.yc.pedometer

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.chenfankeji.cleanmaster

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.zhapp.infowear

●

●

id

◎

◎

◎

◎

◎

◎

◎

com.tencent.qqmusic com.netease.cloudmusic com.kugou.android com.android.bbkmusic cn.kuwo.player

●

id

◎

◎

◎

◎

◎

◎

◎

com.junruy.callfake

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

ebr.com.bancobmg.bancodigital

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.app.cy.fireboltt

●

●

◎

◎

◎

◎

◎

◎

◎

●

●

◎

◎

◎

◎

◎

◎

◎

com.cyk.amcallerflicker

com.android.mms com.cyk.amcallerflicker android

"Running" "Download" "Complete" ……

◎

◎

◎

◎

◎

◎

◎

com.android.mms com.cyk.amcallerflicker android

"Running" "Download" "Complete" ……

◎

◎

◎

◎

◎

◎

◎

com.calleridannounce.callerid.caller name.caller.nameannouncer.names peaker

com.google.android.dialer messaging, mms

●

◎

◎

◎

◎

◎

◎

◎

com.google.android.dialer messaging, mms

●

◎

◎

◎

◎

◎

◎

◎

pl.tronik.progress_gps

●

id

◎

◎

◎

◎

◎

◎

◎

●

id, group

◎

◎

◎

◎

◎

◎

◎

com.psafe.msuite

●

key, id, posttime, isOngoing

★

★

★

★

★

●

key, id, posttime, isOngoing

★

★

★

★

★

M a l r a d a r

com.comeback.myside.sms

●

●

◎

◎

◎

◎

★

◎

◎

Telephony.Sms.getDef aultSmsPackage(this)

●

◎

◎

◎

◎

★

◎

◎

com.antivirus.booster.smart.security

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.mobile.kavass

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.patronum.android

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.note.android.gnotes

com.whatsapp com.facebook.katana org.telegram.messenger

●

★

◎

◎

◎

◎

◎

◎

com.whatsapp com.facebook.katana org.telegram.messenger

●

★

◎

◎

◎

◎

◎

◎

com.billowyapps.multiaccount

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.mobile.kavass

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.demo.testing

com.skype.raider org.telegram.messenger...

●

★

◎

◎

◎

◎

◎

◎

com.skype.raider org.telegram.messenger...

●

★

◎

◎

◎

◎

◎

◎

com.update.bbm

securitylogagent samsung.android android

◎

◎

◎

◎

★

◎

◎

securitylogagent samsung.android android

◎

◎

◎

◎

★

◎

◎

com.powerful.phone.android.cleaner

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

com.hawkshawspy

com.skype.raider org.telegram.messenger...

●

★

◎

◎

◎

◎

◎

◎

com.skype.raider org.telegram.messenger...

●

★

◎

◎

◎

◎

◎

◎

com.quranmp3ramadan.readquran

◎

◎

◎

◎

★

◎

◎

◎

◎

◎

◎

★

◎

◎

com.antivirus.guardian.security

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.booster.antivirus.cleaner.security

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.supo.security

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.building.castle.bster

●

◎

◎

◎

◎

★

◎

◎

Telephony.Sms.getDef aultSmsPackage(this)

◎

◎

◎

◎

★

◎

◎

com.clean.antivirus.security

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.supo.security

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.supo.security

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.windowspl.launcherwith

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

◎

mobi.boostnow

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.supo.security

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

●

●

isClearable, isOngoing, id, key, tag

◎

◎

★

◎

★

◎

◎

com.freecard.danhbaionline2017

id

◎

◎

◎

◎

◎

◎

◎

id

◎

◎

◎

◎

◎

◎

◎

com.tvn.app.smartnote

●

◎

◎

◎

◎

◎

◎

◎

●

◎

◎

◎

◎

◎

◎

◎

com.Ignite.amino.clean

●

◎

◎

◎

◎

◎

◎

◎

●

◎

◎

◎

◎

◎

◎

◎

Note: Detailed Result for Effectiveness Assess:  For Filtering Dimension,  ● Indicates the existence of a comparison, but without a specific comparison object (please check if it is empty or from self-notification). For Leakage and Operation Triggering Dimension, ★ stands for presence, and ◎ stands for absense. For a clearer display of the relevant information, please refer to the "Effectiveness.xml" file.