  We propose a system, named ATVHunter, which can pinpoint the precise
vulnerable in-app TPL versions and provide detailed information about the
vulnerabilities and TPLs. We propose a two-phase detection approach to identify
specific TPL versions. Specifically, we extract the Control Flow Graphs as the
coarse-grained feature to match potential TPLs in the pre-defined TPL database,
and then extract opcode in each basic block of CFG as the fine-grained feature
to identify the exact TPL versions. We build a comprehensive TPL database
(189,545 unique TPLs with 3,006,676 versions) as the reference database.
Meanwhile, to identify the vulnerable in-app TPL versions, we also construct a
comprehensive and known vulnerable TPL database containing 1,180 CVEs and 224
security bugs. Experimental results show ATVHunter outperforms state-of-the-art
TPL detection tools, achieving 90.55% precision and 88.79% recall with high
efficiency, and is also resilient to widely-used obfuscation techniques and
scalable for large-scale TPL detection. Furthermore, to investigate the
ecosystem of the vulnerable TPLs used by apps, we exploit ATVHunter to conduct
a large-scale analysis on 104,446 apps and find that 9,050 apps include
vulnerable TPL versions with 53,337 vulnerabilities and 7,480 security bugs,
most of which are with high risks and are not recognized by app developers.
