Artifacts for OCTOPUS: Observing Communication Traffic Of Pre-installed User Software on Re-Hosted Android Mobile Devices

This repository contains the dataset and analysis artifacts supporting the paper "OCTOPUS: Observing Communication Traffic Of Pre-installed User Software on Re-Hosted Android Mobile Devices". This dataset provides the foundation for our large-scale dynamic analysis of Android pre-installed applications (PIAs) extracted from read-only system partitions. By utilizing an automated, highly parallelized re-hosting pipeline, we migrated vendor-specific PIAs into virtualized Android environments. This repository includes the structural metadata of the firmware and applications, alongside the comprehensive results of both our static and dynamic security audits. The data highlights the hidden outbound telemetry streams and third-party tracking frameworks embedded within highly privileged, factory-state operating system packages across the modern mobile supply chain. Dataset Files The repository provides the following files, covering firmware metadata, application metadata, static-analysis results, runtime coverage, and network-traffic observations: File Description Size android_firmware.jsonl Contains the structural metadata of the analyzed Android firmware samples. Each record describes a firmware image and its associated properties, providing the basis for linking extracted applications and analysis results to their originating firmware. 7.11 GB android_app.jsonl Contains metadata for the Android applications extracted from the analyzed firmware images. The records capture application-level information and their relationship to the corresponding firmware samples, enabling the characterization and aggregation of pre-installed applications across vendors and devices. 4.73 GB static_analysis.parquet Contains the results of the static security analysis performed on the analyzed applications. The data captures statically identified security- and privacy-relevant characteristics and serves as the basis for comparison with observed runtime behavior. 111.96 MB apk_scanner_report.jsonl Contains the raw reports generated by the APK scanning pipeline. These reports provide detailed application-level findings produced by the employed static scanning tools and preserve the underlying scanner output used during subsequent analysis. 1.28 GB ApkScannerReport_ExodusReport.jsonl Contains the Exodus Privacy scanner reports associated with the analyzed APKs. The reports provide information on statically identified third-party trackers and related tracking components, supporting the analysis of potential tracking functionality in pre-installed applications. 517.63 MB coverage_summary.csv Contains summary statistics describing the execution and analysis coverage achieved during the dynamic testing campaign. It provides an overview of the applications subjected to runtime analysis and the corresponding execution and coverage outcomes. 632.54 KB app_traffic.parquet Contains the application-level network-traffic observations collected during dynamic execution. The data captures network activity generated by analyzed applications and provides the basis for characterizing outbound communication and telemetry behavior. 85.00 MB Together, these files provide the metadata, static-analysis results, dynamic execution summaries, and network-traffic observations required to reproduce and extend the analyses presented in the paper. The dataset is organized to preserve the relationships between firmware samples, extracted applications, static-analysis findings, runtime execution results, and observed network communications.