VR-Themis: A Scalable Framework for Virtual Reality Application Clone Detection

1 Introduction

• Repackaged VR apps harm original developers, burden app markets, and expose users to security and privacy attacks, while piracy communities continue to circulate unauthorized apps and installation methods.The passage cites inception attacks [53] as an example and notes that online-dependent attestation solutions can be circumvented.Source: §1 · pp. 1–2
• Mobile-oriented clone detectors are inadequate for VR because 2D layouts miss 3D scenes, non-code assets matter, and engine protections undermine code-based metrics.The passage reports that VR development budgets allocate 30% to digital assets, 25% to code, and 15% to 3D interaction design.Source: §1 · p. 2
• The coarse-grained stage clusters apps using retrievable statistical features to reduce the prohibitive pairwise-comparison burden on large datasets.The framework then performs in-depth comparisons on suspicious apps.Source: §1 · p. 3
• The HOB model represents VR scene hierarchies, GameObjects, and script Behaviours, while its metrics combine hierarchy edit distance, object node distance, and script-behaviour similarity.Together, these metrics support fine-grained, multidimensional comparisons of suspicious apps.Source: §1 · p. 3
• The authors assembled 4,277 VR apps from multiple sources, including side-loading channels, and manually verified clone truths in a curated subset for threshold selection and accuracy reporting.They identify the lack of a publicly available benchmark with reliable ground truths for proprietary VR app clones.Source: §1 · p. 3
• VR-Themis combines coarse-grained clustering with fine-grained HOB comparisons and is reported to detect cloned VR apps effectively and efficiently.The authors describe the work as the first study of proprietary VR app clone detection.Source: §1 · p. 3

2.1 Mobile Application Clone

• App cloning can enable malware insertion, ad hijacking, cracked versions, unauthorized localization, and 3D-asset plagiarism, especially disruptive in VR because quality assets require substantial resources.Source: §2.1 · p. 4

2.2 VR Application Development

• VR apps organize visual and interactive elements in tree-structured scenes: hierarchy nodes are GameObjects, which require attached components to gain object properties.A scene contains all or part of an app; components may be built-in or developer-created.Source: §2.2 · p. 4

2.3 Threat Model

• Cloned VR apps are defined as unauthorized apps under distinct ownership that substantially resemble one another in architecture and fundamental assets, unlike code-reuse detection focused on neither scene hierarchies nor digital assets.The definition distinguishes clone detection from code reuse detection.Source: §2.3 · pp. 4–5
• The adversary can decompile VR APKs to extract hierarchies, assets, and scripts; obfuscate scripts, perturb models, alter hierarchies, and distribute clones through unofficial channels or by masquerading as developers.Examples include renaming C# methods and variables, squashing or stretching 3D models, and perturbing vertices.Source: §2.3 · p. 5
• The analysis assumes most apps store scene hierarchies and assets statically in the APK, excludes runtime- or remotely loaded resources, and targets minor modifications rather than full redesigns.The assumed constraint against major architectural changes reflects adversaries’ resource and time constraints.Source: §2.3 · p. 5

3.1 Hierarchy-Object-Behaviour Model

• The HOB model represents each scene as a hierarchy of GameObjects with components and transforms, assigning each object a unique type by its highest-priority component.This representation captures app architecture and groups GameObjects with similar functionalities under the same type.Source: §3.1 · p. 6
• VR Behaviours are custom C# MonoBehaviour scripts that control GameObject functionality; extracting their key features can expose similarities despite minor edits such as variable renaming.The passage notes that core script logic is difficult for cloners to alter.Source: §3.1 · p. 7

3.2 HOB Metrics: Multi-Dimensional VR App Similarity Measures

• HED measures scene-tree differences through insertions, deletions, and substitutions costing 1 each, while a GameObject modification costs its GND distance.HED is the minimum cost of transforming one scene hierarchy tree into another.Source: §3.2 · p. 7
• GND uses Jaccard distance between component sets for most GameObject types, but assigns distance 1 when two 3DObject nodes have different meshes.Different meshes are treated as incomparable because they represent different visual information, even if their other components match.Source: §3.2 · pp. 7–8
• SBS compares feature vectors extracted from custom scripts by cosine similarity, deeming components identical at similarity ≥ 0.8, a threshold tied to the 80% code-sharing indicator.Built-in component comparisons can generally rely on component types, while custom script components require script comparison.Source: §3.2 · p. 9

4.1 Scope

• The scope centers on Unity-developed Meta Quest apps, while the framework can adapt to other Android-based VR platforms.The focus reflects Meta Quest’s market dominance and Unity’s use in over 70% of top-selling Quest games; the study also uses Unity-specific asset extraction tools.Source: §4.1 · pp. 9–10

4.2 Coarse-grained Processing

• Ten VR-specific statistical features cluster apps to reduce pairwise comparison complexity, spanning hierarchy, objects, and behaviour.They include scene count; counts of GameObject nodes, AnimationClips, Animators, Materials, Sprites, Texture2Ds, AudioClips, and meshes; and MonoBehaviours. Three experienced VR developers validated the feature selection. Object-level features capture visual and functional characteristics, while hierarchy and script distinctions require fine-grained analysis.Source: §4.2 · pp. 10–11

4.3 Fine-grained Processing

• In the fine-grained stage, HOB combines HED, GND, and SBS to assess structural, object-level, and behavioural similarity between apps.AssetStudio.Fine extracts scene hierarchies and assets; GameObjects are categorized by type so component-level comparisons are limited to matching types. HED compares hierarchies, GND compares GameObject components, and SBS compares script feature vectors.Source: §4.3 · pp. 11, 12, 14
• Mesh decimation reduces mesh vertices and faces while minimizing shape changes, enabling VR-Themis to address 3DScan’s processing-time limitations on complex objects.The mesh-processing method is implemented using Blender; the paper says §5.3 reports its effectiveness and improvements over 3DScan.Source: §4.3 · p. 12, Figure 4 · p. 12
• SBS uses cosine similarity between script-metadata feature vectors to compare behaviour across Mono and IL2CPP backends and tolerate lightweight modifications.For Mono apps, metadata comes from Assembly-CSharp.dll decompiled with dnSpy; for IL2CPP apps, Il2CppDumper restores a DLL from libil2cpp.so and global-metadata.dat. The fingerprint counts ordered modifiers, parameters, and data types without names, helping resist method-name obfuscation.Source: §4.3 · p. 13, Figure 5 · p. 13

5.1 Dataset

• The dataset contains 4,277 Unity-based Meta Quest APKs collected from five sources, and is described as the largest VR APK dataset constructed for clone detection to date.APK sizes range from 18.26 MB to 2305.95 MB, with most below 400 MB.Source: §5.1 · pp. 14–15

5.2 Coarse-grained Detection

• The coarse stage reduced 9,144,226 possible app pairs to 416,385 suspected pairs, about 4.55%, after feature extraction and clustering.For 100 apps with known clone truths, ϵ = 0.1 achieved 100% recall and 80.65% precision; feature extraction took 5,810.44 seconds and clustering 0.1024 seconds.Source: §5.2 · p. 16

5.3 Fine-grained Detection

• Mesh decimation reduced average processing time by 53.54% on 8,000 mesh files extracted from 500 randomly selected VR APKs.Decimation ratios were 0.4 for medium meshes and 0.2 for large meshes; tests on 3,000 mesh files found no false positives, and identical meshes remained identical after decimation.Source: §5.3 · pp. 16–17
• 977 suspicious clone pairs involving 307 apps were identified, and manual review of detections across 4,277 apps found zero false positives.The pairs represent 7.18% of the dataset; fine-grained processing took 30,957.52 seconds.Source: §5.3 · p. 17, Table 1 · p. 17, §5.4 · p. 18

5.4 Cloning Verification and Accuracy Analysis

• VR-Themis identified all cloned pairs in a labeled 200-app evaluation with no false positives or false negatives.The set combined 100 apps with manually identified clone truths and 100 artificially generated clones; the manually identified apps were not used to set thresholds or parameters.Source: §5.4 · p. 18

5.5 Case Studies

• Case studies show suspected clones distributed across SideQuest and itch.io, including modified versions of a popular Meta-store app and a repackaged game translated into another language.In the first case, many clones exceeded 80% similarity and some exceeded 95%; the second showed decompilation and hierarchy-tree adjustments.Source: §5.5 · p. 19

Motivations Behind Apps Susceptible to Cloning

• 307 detected cloned apps revealed three motivations: targeting popular games, localizing language-limited apps, and unlocking paid features in freemium apps.Examples include Gorilla Tag clones with modified models and scenes, English apps repackaged in Chinese for unofficial channels, and pirated versions with paid features unlocked.Source: §6 · p. 19

Handling Shared Assets and Templates

• Structural HED and behavioural SBS complement visual similarity to avoid flagging apps that share common 3D assets or interaction templates as clones.Ambiguous cases may arise in lightweight apps relying heavily on public assets or templates; future work could compare assets with libraries such as the Unity Asset Store. No such cases appeared in the experiments.Source: §6 · p. 19

Limitations

• Clone traceability is challenging, while runtime-loaded assets, Unity Asset Bundles, and anti-cheating code obfuscation can limit scene capture or decompilation.Unity Asset Bundles have minimal impact because most VR apps operate offline; only two evaluated apps used obfuscation. The study also could not collect paid-download apps or apps with broken download links.Source: §6 · p. 19
• Future work will extend clone detection to VR apps built with other engines and deployed on additional devices.Potential engines include Unreal and libGDX; devices include HTC VIVE Pro 2, Sony PlayStation VR 2, and Pico 4.Source: §6 · p. 20

Mobile App Clone Detection

• Android clone detectors compare code graphs, fuzzy hashes, resources, UI layouts, resource/layouts, or feature vectors [57]; VR-Themis targets closed-source VR APKs with HOB.Prior VR code-clone approaches focus on open-source software and are inapplicable when source code is unavailable.Source: §7 · p. 20

Studies on VR/AR Apps

• VR/AR studies examine open-source projects, bug taxonomies, security and privacy, GUI detection [23], testing, LLM repair, and 3D asset editing [52].The asset-editing work targets collision meshes, a non-code asset category common in VR development.Source: §7 · p. 20

Unity-based Application

• Unity research addresses malicious-app detection, in-app-purchase vulnerabilities, and 3D model clone detection.Source: §7 · p. 21

• 307 suspected clone apps were detected among 4,277 VR apps with no false positives.Source: §8 · p. 21
• VR-Themis first clusters apps using coarse-grained statistical features, then compares suspicious apps using fine-grained HOB metrics.Source: §8 · p. 21
• The framework targets VR app cloning, which threatens developer interests and user security and is not adequately captured by existing mobile clone detectors.Source: §8 · p. 21