Java file directory structure-based Android application repackaging detection method

Abstract

The invention discloses a Java file directory structure-based Android application repackaging detection method. The method comprises the following steps of: for each known APK application program, carrying out decompression to obtain Java class file with a specific directory structure, wherein the directory structure can be considered as a tree structure; carrying out improved hash operation on each Java package name and each Java class name; taking obtained hash values as node signatures; connecting the node signatures by using a depth-first traversal algorithm so as to obtain a final application signature; calculating signatures of all the known applications and forming a signature library; and for a to-be-detected APK application program, obtaining a signature thereof according to a similar method, and calculating edition distances and similarities between the signature name and signatures in the signature library so as to obtain a detection result. According to the method, the influences caused by a code obfuscation technology and the insertion of malicious codes can be effectively avoided, so as to bring relatively good robustness and correctness.

Description

technical field [0001] The invention belongs to the technical field of Android application repackaging detection, and in particular relates to an Android application repackaging detection method based on a Java file directory structure. Background technique [0002] Currently, Android application repackaging detection methods mainly include code-based or behavior-based detection methods. Code or behavior-based detection methods use decompilation tools or dynamic behavior analysis tools to obtain code files or application behavior sequences, and then perform preprocessing to obtain sequence features, and obtain quantitative data of application similarity by calculating the distance of sequence features. This method can detect changes in application code and solve problems including code reuse, plagiarism, and repackaging. However, the extraction of sequence features is easily affected by code obfuscation techniques, so it has certain limitations when analyzing practical probl...

AI Technical Summary

Problems solved by technology

This method can detect changes in application code and solve problems including code reuse, plagiarism, and repackaging. However, the extraction of sequence features is easily affected by code obfuscation techniques, so it has certain limitations when analyzing practical problems.

Images