App detection and analysis methods for large-scale fast mobile applications

Abstract

The invention discloses a detection and analysis method of large-scale rapid mobile APPs. The method includes: acquiring the mobile APPs from a mobile phone application market; acquiring natural language features of the APPs by using a natural language processing technique facing a backward parsing code; acquiring DEX image features of the APPs by using a feature image processing technique facingDEX; judging whether the APPs are repackaged applications or not by using a fuzzy Hash based repackage validation technique; if the APPs are judged to be malicious APPs, printing MALWARE labels on thenatural language features and the DEX image features of the APPs and placing natural language features and the DEX image features into a verification model of a machine learning module; if the APPs are judged to be normal APPs, printing NORMAL labels on the natural language features and the DEX image features of the APPs, and placing the natural language features and the DEX image features into the verification module of the machine learning module.

Description

technical field [0001] The technology of the present invention relates to mobile application monitoring and type judgment in the mobile phone application market, and involves security detection and analysis of large-scale mobile Android applications in a short period of time, including code sample extraction and analysis, malicious code analysis, matching and early warning, and code detection Comprehensive analysis and evaluation. Background technique [0002] At present, the number of Android mobile applications in the mobile application market is large. The number of mobile applications that are launched and updated every day in various mobile application markets is increasing day by day. The speed of ordinary manual inspection or checking one by one through specific software to go online or update applications cannot adapt to the current speed of software updates, resulting in many problematic software remaining in mobile applications. In the market, some irreparable los...

AI Technical Summary

Problems solved by technology

[0005] Some methods use dynamic detection to detect the behavior of mobile applications, which can perfectly detect all possible malicious behaviors in an app, but it takes too long, the detection method is manual, and there is no automatic detection. For mobile applications Not very practical in the market

[0006] There are also detections based on signatures in practical apps to achieve a certain scale of detection. However, since signature detection is based on signatures, it is impossible to monitor new malicious apps that have no signatures.

Moreover, the detection method is too simple, and in the face of applications with complex malicious behaviors, missed detection and false detection may occur.

It is useful for the mobile application market that updates a large number of applications every day, but it cannot achieve comprehensive detection results

Images