VR-Themis: A Scalable Framework for Virtual Reality Application Clone Detection

VR-Themis: A Scalable Framework for Virtual Reality Application Clone Detection

Abstract. Repackaging of mobile applications (aka app cloning) not only threatens the security and privacy of mobile users but also infringes upon the copyright of the original app developers. However, existing detection methods that primarily focus on mobile platforms (such as Android) fail to capture the essential features of virtual reality (VR). Consequently, they are inadequate for effectively detecting cloned VR apps, which have often been targeted by illegal users in the VR market. Considering the unique features of VR apps, this paper proposes a two-stage app clone detection framework, namely VR-Themis, based on Hierarchy-Object-Behaviour (HOB). Firstly, VR-Themis exploits the coarse-grained stage to cluster apps based on their retrievable statistical features, making this tool scalable to large-scale VR app datasets. Then, in the fine-grained stage, VR-Themis performs in-depth analysis of the suspicious apps (identified in the first stage) by calculating similarity using our defined HOB metrics. Our extensive experiments indicate that VR-Themis successfully detects 307 suspected clone apps from the collected 4,277 VR apps without false positives, demonstrating its effectiveness and scalability.

Introduction. Repackaged VR apps pose a significant threat to VR ecosystems. They undermine the interests of original developers, increase the maintenance burden on app markets, and threaten user privacy. For instance, Commuter Games reported that their VR racing game, Downtown Club, has about five times more players than the copies sold. Similarly, Realcast’s Just Hoops has nearly six times as many users as copies sold. This phenomenon is largely due to the presence of pirated versions repackaged. Furthermore, repackaged VR apps significantly increase users’ vulnerability to security and privacy attacks (e.g., inception attacks). Although some VR headset companies have released solutions (e.g., Meta Quest Attestation API), their reliance on online connectivity makes them vulnerable to crafty circumvention. As of this writing, active VR piracy communities continue to thrive, disseminating sources for repackaged pirated app downloads and methods for installing unauthorized apps on VR headsets, posing a lasting challenge to the industry.

In fact, the VR ecosystem is not the first mobile ecosystem to face the threat of app cloning. The ease of repackaging on mobile platforms has made them hotspots for illegal users. For example, Android apps are easily repackaged using reverse engineering tools, such as Apktool, dex2jar, and JADX. These tools enable users to decompile apps, modify intrinsic contents, and then repackage them for distribution. Existing state-of-the-art clone detectors for mobile apps rely on various features for similarity comparison, including code-centric similarity, layout similarity of User Interface (UI), resource metadata comparison, and combinations of them.

Despite the numerous existing clone detection approaches for mobile apps, VR platforms introduce novel development features that render conventional methods entirely ineffective for detecting clones in VR applications. Traditional mobile app development primarily relies on tools like Android Studio, focusing on 2D interface design and application logic. As a result, existing mobile app clone detectors typically use code, UI layouts, and resource metadata as the main features in their similarity metrics. In contrast, the development of VR apps emphasizes immersive 3D scene design. According to a breakdown of VR development costs, primary budget allocations include 30% for digital assets (e.g., 3D modeling and animation), 25% for code development, and 15% for 3D user interaction design. This allocation reflects the increased importance of non-code asset creation and 3D scene design in VR, highlighting the limitations of mobile-oriented clone detection methods. In summary, existing state-of-the-art mobile app clone detection approaches are inherently infeasible for VR apps due to three key reasons: (1) The 3D scene structures of VR apps cannot be represented by the 2D UI layouts used in mobile applications; (2) VR apps heavily rely on non-code assets (e.g., 3D models and animations) that are not considered in mobile-oriented detection methods; and (3) 3D development engines (e.g., Unity) typically provide protection mechanisms (e.g., IL2CPP in Unity), which invalidate code-centric similarity metrics. These disparities necessitate a novel detection approach tailored specifically for VR ecosystems, rather than incremental improvements over existing mobile-oriented methods.

To bridge this research gap, this paper proposes a novel clone detection approach specifically designed for VR apps, named VR-Themis. This detection approach adopts a two-stage framework and is specifically designed to address three critical challenges in VR app clone detection:

(1) Complexity of Pairwise Comparison. Directly comparing all possible pairs of VR apps becomes computationally prohibitive with large datasets. VR-Themis addresses this challenge through a coarse-grained stage that groups VR apps based on retrievable statistical features, thereby significantly reducing the complexity of comparisons.

(2) Limitations of Conventional Clone Detection Characteristics and Metrics. Existing mobile app clone detection methods rely on features such as code, UI layouts, and resource metadata, which are ineffective for the unique complexities of VR apps. Unlike mobile apps, VR apps involve intricate 3D scene hierarchies with interconnected GameObjects, immersive visual elements, dynamic interaction components, and customized script Behaviours. To characterize these unique features of VR apps, we propose the Hierarchy-Object-Behaviour (HOB) model, a structured representation tailored for VR. Additionally, conventional similarity metrics fall short in capturing the multi-dimensional complexities of VR apps. To overcome this challenge, VR-Themis introduces HOB metrics, a three-tiered similarity metric suite based on the HOB model by integrating Hierarchy Edit Distance for structural differences, GameObject Node Distance for visual and functional variations, and Script Behaviour Similarity for Behavioural consistency. This synergy allows VR-Themis to perform fine-grained and multi-dimensional comparisons of suspicious cloned apps.

(3) Scarcity of Benchmark Datasets for VR Clone Detection: Unlike the mobile app ecosystem, the VR domain lacks publicly available datasets specifically designed for proprietary VR app clone detection. To the best of our knowledge, there is currently no benchmark tailored for proprietary VR app clones with the provision of reliable ground truths. Additionally, existing VR-related datasets from other research do not meet the scale requirement for our study. Consequently, we constructed our own dataset consisting of 4,277 VR apps from multiple sources. For our experiments, we also utilize a smaller, carefully curated subset of this dataset, with manually verified clone truths, to determine thresholds and report accuracy.

In summary, the main contributions of this work are highlighted as follows:

– We construct a VR app dataset collected from diverse sources, including side-loading channels that have not been considered in previous research.

– We propose an automatic app clone detection approach. As far as we know, this is the first study on proprietary VR app clone detection. Our two-stage method incorporates a coarse-grained clustering to reduce comparison space, followed by fine-grained in-depth comparisons.

– We introduce HOB metrics, a VR similarity metric suite based on our HOB model. This metric suite is specifically designed to compare the unique characteristics of VR apps, including intricate 3D scene hierarchies, object-level visual and functional components, and script-driven Behaviours.

– We conduct extensive experiments on 4,277 Unity-based VR apps. Results show that VR-Themis effectively and efficiently detects cloned VR apps with high accuracy.

Background and Threat Model. App cloning has become a significant concern in the mobile app industry, as it often facilitates various cybercrimes. Common motivations include: inserting malicious code into popular apps, hijacking advertising revenue, distributing cracked versions that bypass paid features, creating unauthorized localizations, and plagiarizing proprietary 3D assets with minimal effort. The last motivation is particularly disruptive in VR, where high-quality 3D models and animations require substantial development resources.

VR operating systems (OSs) (e.g., Meta Horizon OS and PICO OS) are custom-developed on top of Android OS. However, VR application development differs significantly from conventional mobile app development (e.g., Android SDK) due to the unique requirements of VR platforms. VR development emphasizes immersion that enables users to engage naturally with their surroundings. Unlike traditional mobile app development, where coding plays a predominant role, VR development places significant importance on creating high-quality 3D assets and designing immersive 3D scenes.

A VR app typically consists of several scenes, where a scene is defined as an asset that contains all or part of an app. The VR scene representation serves as the structural foundation for organizing the visual, functional, and interactive elements within 3D virtual environments. In most VR development engines, this representation adopts a tree structure, commonly referred to as the hierarchy. The hierarchy represents the grouping and parent-child relationships among GameObjects. Each node in the scene’s hierarchy tree corresponds to a GameObject, where the parent GameObject may contain other child GameObjects inheriting the parent’s properties. GameObjects are the fundamental elements in the VR engine to represent real objects like balls, lights, cameras, and so on. Nevertheless, GameObjects cannot perform any functions themselves; they only serve as containers. To enable a GameObject to possess a specific object’s necessary properties, one or more components must be attached to it. In Unity, various built-in components are provided, though developers can also create their own components using the Unity Scripting API.

The threat model is defined from the following perspectives. Goal: The goal of VR-Themis is to accurately identify cloned VR apps, which are defined as two (or more) apps exhibiting substantial similarity in architecture and fundamental assets but are distributed under distinct ownership without explicit authorization. This focus distinguishes VR app clone detection from code reuse detection, as the latter does not emphasize scene hierarchies and digital assets. Adversary capabilities: An adversary possesses the following capabilities: Decompilation: The adversary can use tools like AssetStudio to decompile VR APKs and extract scene hierarchies, assets (e.g., meshes, textures, and animations), and C# scripts. Modification: The adversary can obfuscate or minify scripts (e.g., renaming methods and variables in C#), modify 3D models (e.g., squashing, stretching, and vertex perturbation), and alter scene hierarchies. Distribution: The adversary can distribute cloned apps through unofficial channels (e.g., sideloading platforms) or masquerade as developers. Assumptions: First, we assume that most VR apps store their scene hierarchies and assets statically within the VR APK. This assumption is supported by the fact that the majority of VR apps are designed to function in an offline way. Apps that dynamically load resources at runtime or retrieve assets from remote servers are outside the scope of this work. Second, we assume that the adversary is capable of performing minor modifications to cloned VR apps to circumvent detection. These modifications may include code obfuscation, asset perturbation, and alterations to the scene hierarchy. However, the adversary is unlikely to fully redesign the app or make significant architectural changes due to resource and time constraints.

Hierarchy-Object-Behaviour Similarity Metric for VR App Clone Detection. This section introduces a modeling framework for VR app clone detection by combining a representation with its similarity metrics. We first present the Hierarchy-Object-Behaviour (HOB) model, which encodes a VR app as scene hierarchies of GameObjects, comprising objects with components and script-driven Behaviours. Building on this representation, we define HOB metrics, a multidimensional suite of similarity measures. Together, the HOB model and HOB metrics capture VR-specific characteristics that extend beyond mobile-oriented features.

To overcome the limitations of conventional mobile-oriented app clone detectors in capturing VR-specific characteristics, we propose a HOB model. This model provides a structured representation of VR apps by analyzing their scene hierarchy (Hierarchy), 3D objects (Object), and script-driven components (Behaviour). By comprehensively capturing the characteristics of VR apps from high-level structural representations to detailed functional Behaviours, it effectively overcomes the shortcomings of mobile app clone detection methods in handling 3D scenes and non-code assets.

Hierarchy. VR apps typically consist of multiple scenes (levels), each represented as a hierarchy tree. This structure describes the parent-child relationships and organization of all objects (i.e., GameObject) within a scene. The HOB model parses and extracts this hierarchical information from VR APK, organizing the VR app as a tree structure, in which each scene is represented as a sub-tree. Each node of a tree corresponds to a GameObject containing the following information: Components are multiple attachments defining the properties and Behaviours of the GameObject; and Transform includes 3D coordinates, rotation, and scale. In this way, the HOB model comprehensively reflects the architecture of a VR app.

Object. In the HOB model, the definition of an object is based on the GameObject concept. GameObject’s functionality is enabled through the attachment of components. However, game engines lack an effective mechanism to classify GameObjects based on their functionality. This limitation introduces significant challenges when comparing GameObjects across different VR apps, as it requires examining all their components individually. Such an approach is both computationally expensive and inefficient, especially given the diversity and complexity of components. To address this issue, we introduce a classification mechanism that assigns a type to each GameObject based on its major components. This mechanism groups GameObjects with similar functionalities under the same type. For instance, when an AudioSource component is attached to a GameObject, we classify this GameObject as an Audio type. Our proposed GameObject type classification mechanism adheres to three criteria: 1) Comprehensiveness requires defining as many GameObject types as possible to ensure broad coverage; 2) Accuracy ensures that the assigned type accurately represents the GameObject’s functionality; and 3) No overlapping of type definitions guarantees that a GameObject cannot belong to multiple types simultaneously. To ensure accurate classification, we implement a priority mechanism that assigns each GameObject a unique type based on its highest-priority component, avoiding overlaps.

Behaviour. In VR apps, Behaviours are the core components that determine the interactivity and functionality, and their definition is based on the concept of Component. Behaviours are typically implemented through C# scripts, which extend the MonoBehaviour base class to define the functionality of GameObject. For example, Behaviours can trigger events, modify component properties, or respond to user inputs. Unlike built-in components provided by game engines, Behaviours consist of custom code written by developers, often using tools like the Unity Scripting API. Illegal cloners frequently make minor modifications to Behaviour scripts, such as renaming variables, to evade detection. However, since Behaviour scripts directly control the functi…

Based on the paper, here are the specific improvements you can make to AI systems and what the improved systems can do:

---

1. VR-Specific Clone Detection System

• Improvement: Build an AI system that uses the HOB model (Hierarchy-Object-Behaviour) to represent VR apps as structured trees of GameObjects, components, and script behaviours, rather than relying on 2D UI or code-centric features.

• Capability: The system can automatically detect repackaged or cloned VR apps (e.g., on Meta Quest, Pico) by comparing 3D scene hierarchies, object-level components (meshes, animations, textures), and script behaviour fingerprints, even when code is obfuscated or IL2CPP-compiled.

2. Scalable Two-Stage Detection Pipeline

• Improvement: Implement a coarse-to-fine detection approach: first cluster apps using statistical features (e.g., number of scenes, GameObjects, meshes, MonoBehaviours) with DBSCAN, then perform fine-grained pairwise similarity using HED, GND, and SBS metrics.

• Capability: The system can efficiently handle large VR app datasets (e.g., 4,277 apps) by reducing pairwise comparisons from millions to 4.5% of the original space, enabling real-time or near-real-time screening of app stores or sideloading platforms.

3. Robust Similarity Metrics for 3D Assets

• Improvement: Use the paper’s metrics: Hierarchy Edit Distance (HED) for structural differences, GameObject Node Distance (GND) with Jaccard distance for component sets and mesh decimation for 3D model comparison, and Script Behaviour Similarity (SBS) using cosine similarity on script metadata (method signatures, data types) after stripping names.

• Capability: The system can detect clones even when attackers modify 3D models (e.g., squashing, vertex perturbation), rename variables, or change scene hierarchies, while avoiding false positives from shared assets or templates.

4. Cross-Platform and Cross-Engine Adaptation

• Improvement: Adapt the framework to other Android-based VR platforms (Pico, Vive) and engines (Unreal, libGDX) by modifying asset extraction tools (e.g., UE Viewer for Unreal) and adjusting the HOB model to engine-specific component types.

• Capability: The system can be deployed across diverse VR ecosystems, providing a unified clone detection solution for multiple headset brands and development engines.

5. Automated Asset Extraction and Preprocessing

• Improvement: Integrate the custom tools (AssetStudio.Fine for Unity) and mesh decimation (via Blender) to automatically extract scene hierarchies, assets, and script metadata from APKs, and to reduce mesh complexity for faster comparison without losing accuracy.

• Capability: The system can process large volumes of VR APKs automatically, extracting structured data and computing similarity scores in a fully automated pipeline, reducing manual effort and enabling continuous monitoring.

6. Threshold Tuning and False-Positive Reduction

• Improvement: Use the paper’s empirical findings (e.g., 80% similarity threshold, DBSCAN with ϵ=0.1, minPts=2) to calibrate detection sensitivity, and incorporate APK signature verification to exclude legitimate multi-version apps.

• Capability: The system achieves zero false positives on real-world datasets (as demonstrated) and can be fine-tuned for different app markets or threat models, balancing recall and precision.

7. Clone Motivation Analysis and Traceability

• Improvement: Extend the system to classify detected clones by motivation (e.g., pirated paid games, localized language versions, freemium unlocks) using metadata and behavioural patterns, and to heuristically infer the original app via submission timestamps or download counts.

• Capability: The system can provide actionable intelligence to app store moderators and developers, identifying not only clones but also the likely original and the type of infringement, aiding in takedown decisions.

8. Benchmark Dataset Creation for Future Research

• Improvement: Use the paper’s dataset (4,277 VR apps, 307 confirmed clones) and methodology to create a public benchmark for VR clone detection, including ground-truth labels and feature extraction pipelines.

• Capability: The system can serve as a reference for training and evaluating new AI models, enabling reproducible research and fostering the development of more advanced detection techniques.

Summary of Improved AI System Capabilities:

The improved AI system can automatically detect cloned VR apps across multiple platforms and engines, scale to large app stores, resist common evasion techniques (code obfuscation, asset modification, hierarchy changes), and provide high accuracy with zero false positives, while also enabling continuous monitoring and forensic analysis of VR piracy.