these-ammii/thesis
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

start modifying contrib section
All checks were successful
/ test_checkout (push) Successful in 1m0s
Details

Browse source
This commit is contained in:
Jean-Marie Mineau 2025-07-19 23:01:15 +02:00
parent ad66b1293d
commit fd4d6fa239
Signed by: histausse
GPG key ID: B66AEEDA9B645AD2
49 changed files with 22629 additions and 88 deletions
Download patch file Download diff file Expand all files Collapse all files

38
3_rasta/3_experiments.typ
View file

@ -1,4 +1,4 @@
#import "../lib.typ": todo, highlight, num, paragraph
#import "../lib.typ": todo, highlight, num, paragraph, SDK
#import "X_var.typ": *
#import "X_lib.typ": *
@ -55,8 +55,7 @@ For the tools that we could run, #resultratio of analysis are finishing successf
//(those with less than 50% of successful execution and including the two tools that we were unable to build).
]
/*
== RQ2: temporal evolution
=== RQ2: Size, #SDK and Date Influence
#todo[alt text for fig rasta-exit-evolution-java and rasta-exit-evolution-not-java]
@ -120,17 +119,7 @@ sqlite> SELECT apk1.first_seen_year, (COUNT(*) * 100) / (SELECT 20 * COUNT(*)
```
*/
#highlight()[
*RQ2 answer:* For the #nbtoolsselected tools that can be used partially, a global decrease of the success rate of tools' analysis is observed over time.
Starting at 78% of success rate, after five years, tools have 61% of success; after ten years, 45% of success.
]
*/
=== RQ2: Size, SDK and Date Influence
To measure the influence of the date, SDK version and size of applications, we fixed one parameter while varying an other.
For the sake of clarity, we separated Java based / non Java based tools.
To compare the influence of the date, #SDK version and size of applications, we fixed one parameter while varying an other.
#todo[Alt text for fig rasta-decorelation-size]
#figure(stack(dir: ltr,
@ -209,21 +198,25 @@ We observe that 9 tools over 12 have a finishing rate dropping below 20% for Jav
caption: [Non Java based tools],
supplement: [Subfigure],
) <fig:rasta-rate-evolution-non-java-decile-min-sdk>]
), caption: [Finishing rate by min SDK with a bytecode size $in$ [4.08, 5.2] MB]
), caption: [Finishing rate by min #SDK with a bytecode size $in$ [4.08, 5.2] MB]
) <fig:rasta-decorelation-size>
We performed similar experiments by variating the min SDK and target SDK versions, still with a fixed bytecode size between 4.08 and 5.2 MB, as shown in @fig:rasta-rate-evolution-java-decile-min-sdk and @fig:rasta-rate-evolution-non-java-decile-min-sdk.
We found that contrary to the target SDK, the min SDK version has an impact on the finishing rate of Java based tools: 8 tools over 12 are below 50% after SDK 16.
It is not surprising, as the min SDK is highly correlated to the year.
We performed similar experiments by variating the min #SDK and target #SDK versions, still with a fixed bytecode size between 4.08 and 5.2 MB, as shown in @fig:rasta-rate-evolution-java-decile-min-sdk and @fig:rasta-rate-evolution-non-java-decile-min-sdk.
We found that contrary to the target #SDK, the min #SDK version has an impact on the finishing rate of Java based tools: 8 tools over 12 are below 50% after #SDK 16.
It is not surprising, as the min #SDK is highly correlated to the year.
#highlight()[
*RQ2 answer:*
The success rate varies based on the size of bytecode and SDK version.
For the #nbtoolsselected tools that can be used partially, a global decrease of the success rate of tools' analysis is observed over time.
Starting at 78% of success rate, after five years, tools have 61% of success; after ten years, 45% of success.
The success rate varies based on the size of bytecode and #SDK version.
The date is also correlated with the success rate for Java based tools only.
]
=== RQ3: Malware vs Goodware
=== RQ3: Malware vs Goodware <sec:rasta-mal-vs-good>
#todo[complete @sec:rasta-mal-vs-good by commenting the new figures]
/*
```
@ -256,7 +249,6 @@ sqlite> SELECT vt_detection == 0, COUNT(DISTINCT sha256) FROM apk WHERE dex_size
*/
/*
#todo[Alt text for rasta-exit-goodmal]
#figure(
image(
@ -266,8 +258,6 @@ sqlite> SELECT vt_detection == 0, COUNT(DISTINCT sha256) FROM apk WHERE dex_size
),
caption: [Exit status comparing goodware and malware for the Rasta dataset],
) <fig:rasta-exit-goodmal>
*/
/*
[15:25] Jean-Marie Mineau
@ -295,7 +285,6 @@ sqlite> SELECT AVG(apk_size) FROM apk WHERE vt_detection != 0;
*/
/*
#figure({
show table: set text(size: 0.80em)
table(
@ -329,7 +318,6 @@ sqlite> SELECT AVG(apk_size) FROM apk WHERE vt_detection != 0;
)},
caption: [Average size and date of goodware/malware parts of the Rasta dataset],
) <tab:rasta-sizes>
*/
#figure({