# Statistical Deobfuscation of Android Applications > DeGuard reverses layout obfuscation in Android APKs, predicting original names for the fields, methods, classes and packages that ProGuard renames. Built on Soot, it represents an app as a dependency graph over program elements and keeps Android API and other unobfuscated names fixed. It then runs MAP inference with Nice2Predict on a conditional random field learned from 1,684 F-Droid apps, under constraints that keep the renamed APK semantically equivalent. On 100 held-out F-Droid apps obfuscated with ProGuard, names identical to the originals rise from 13.3% to 79.1%, and third-party library prediction reaches 91.3% precision and 91.0% recall. - Authors: Benjamin Bichsel; Veselin Raychev; Petar Tsankov; Martin Vechev - Venue: ACM CCS 2016 - Status: Conference paper - Publication / posting date: October 24, 2016 - Date source: ACM-deposited Crossref metadata gives print and online publication on 2016-10-24. That is also the first day of the October 24–28 conference; the date comes from the publisher record, not from the conference schedule. - DOI: 10.1145/2976749.2978422 - Sources reviewed: 2026-10-18 - Added to the catalog: 2026-10-19 - Original paper: - PDF: - Project: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-deguard/index.md) ## Scope and limitations Only layout (identifier) obfuscation is addressed. Data, control-flow and cryptographic obfuscation, custom string encryption, reflection and goto-based code reordering are not reversed, and the paper notes that most malware samples it inspected also used such techniques. The benchmark is 100 benign, open-source F-Droid apps, obfuscated by enabling ProGuard without changing its rules and scored by exact match to the original names, so semantically close names count as errors; elements that ProGuard removed are not scored. Accuracy on other obfuscators or on malware may be lower. Libraries are identified by a package-name heuristic covering 133 libraries, and the training apps may import the same libraries. The 49-family malware study gives manual examples, such as Base64 decoders and location handling, without precision figures. ## Why it fits this collection Adds learned identifier recovery for obfuscated Android packages, complementing the interface-reconstruction papers in the app section and the binary symbol-recovery research elsewhere in the bibliography. ## Publication and review notes ACM's Crossref deposit and the ETH-hosted author PDF agree on the title, four-author order and CCS ’16 DOI; Crossref gives pages 343–355. The paper and the SRI project page name http://apk-deguard.com as the public DeGuard service; on 2026-10-18 it redirected to HTTPS and then did not respond. No DeGuard source repository was found. The project page says DeGuard is built on the open-source Nice2Predict framework. ## Primary sources 1. 2. 3. 4. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.