Android Repackaged Application Detection Method and Storage Medium

Abstract

The present invention discloses an Android repackaged application detection method and a storage medium. The method includes: obtaining a legitimate application and its corresponding repackaged application; calculating the structural feature point arrays and eigenvalues of each application; calculating the average value of the eigenvalue ratio difference and the average value of the feature point ratio difference between the legitimate application and its corresponding repackaged application to obtain an eigenvalue difference threshold and a feature point difference threshold; obtaining a to-be-detected application and calculating the structural feature point array and eigenvalue of the to-be-detected application; if the absolute value of the difference between the eigenvalue of the to-be-detected application and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of identical structural feature points in the structural feature point arrays of the to-be-detected application and the one application to the total number of structural feature points is greater than the feature point difference threshold, then it is determined that the to-be-detected application is a repackaged application. The present invention can effectively improve the detection efficiency of repackaged applications.

Description

Technical Field

[0001] The present invention relates to the field of application detection technologies, and particularly to an Android repackaged application detection method and a storage medium. Background Art

[0002] In the situation of the rapid development of the mobile Internet and smart phones, the data volume of mobile applications has increased sharply. Mobile applications can not only bring richer functional experiences to users, but also bring a lot of convenience to people's lives. However, since the Android system is an open operating system, the more open the operating system is, the higher the possibility of being threatened by security. In the application market, there are a large number of malicious applications, which pose a great threat to the security and privacy of users. According to statistics, more than 80% of Android malicious applications are repackaged applications. A repackaged application refers to an application generated by a malicious developer after decompiling a legal application, modifying the code therein, embedding malicious code segments, and then repackaging and compiling it, aiming to seek benefits or spread malware.

[0003] Regarding Android repackaging detection, there are many current technologies, including: judging whether each file contained in the installation package has consistency inside, parsing the contents of AndroidManifest.xml, classes.dex, and resource.arsc files in the installation package, and using the signature of the entire installation package obtained by comparing the signatures of each file in the installation package as the basis for judgment, etc. These methods use different feature judgments as the basis for detecting whether it is a repackaged application. During the detection process, the entire installation package needs to be parsed, and even some methods need to deeply parse some of the files therein. Therefore, the detection efficiency of repackaging is not high. Summary of the Invention

[0004] The technical problem to be solved by the present invention is: to provide an Android repackaged application detection method and a storage medium, which can effectively improve the detection efficiency of repackaged applications.

[0005] To solve the above technical problem, the technical solution adopted by the present invention is: an Android repackaged application detection method, including:

[0006] Obtaining a legal application and its corresponding repackaged application;

[0007] Calculating the structural feature point arrays and feature values of each application;

[0008] According to the feature values and structural feature point arrays of the legal application and its corresponding repackaged application, calculating the average value of the feature value ratio difference and the average value of the feature point ratio difference between the legal application and its corresponding repackaged application, and obtaining the feature value difference threshold and the feature point difference threshold;

[0009] Obtain the application to be tested, and calculate the structural feature point array and eigenvalue of the application to be tested;

[0010] If the absolute value of the difference between the eigenvalue of the application to be tested and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of identical structural feature points in the structural feature point arrays of the application to be tested and the said one application to the total number of structural feature points is greater than the feature point difference threshold, then determine that the application to be tested is a repackaged application.

[0011] The present invention also relates to a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the following steps are implemented:

[0012] Obtain a legitimate application and its corresponding repackaged application;

[0013] Calculate the structural feature point array and eigenvalue of each application;

[0014] According to the eigenvalues and structural feature point arrays of the legitimate application and its corresponding repackaged application, calculate the average eigenvalue ratio difference and average feature point ratio difference of the legitimate application and its corresponding repackaged application, and obtain the eigenvalue difference threshold and feature point difference threshold;

[0015] Obtain the application to be tested, and calculate the structural feature point array and eigenvalue of the application to be tested;

[0016] If the absolute value of the difference between the eigenvalue of the application to be tested and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of identical structural feature points in the structural feature point arrays of the application to be tested and the said one application to the total number of structural feature points is greater than the feature point difference threshold, then determine that the application to be tested is a repackaged application.

[0017] The beneficial effects of the present invention are as follows: By obtaining a large number of legitimate applications and their corresponding repackaged applications, and calculating their eigenvalues as the basis for detecting repackaged applications, using the comparison of the eigenvalues of applications to replace the commonly used file parsing comparison, that is, replacing the complex file parsing comparison with a simple digital operation comparison, it can quickly distinguish whether the application to be tested is a repackaged application, effectively improving the detection efficiency, and having the characteristics that the more samples are calculated, the more accurate the detection is. Description of the Drawings

[0018] Figure 1 It is a flowchart of a method for detecting Android repackaged applications of the present invention;

[0019] Figure 2 It is a flowchart of the method in the first embodiment of the present invention. Detailed Embodiments

[0020] To describe the technical content, achieved objectives and effects of the present invention in detail, the following will be described in detail in conjunction with the embodiments and with reference to the accompanying drawings.

[0021] The most crucial concept of the present invention lies in: using the applied eigenvalue and the array of structural feature points as the basis for detecting repackaged applications.

[0022] Please refer to Figure 1 , an Android repackaged application detection method, including:

[0023] Obtain legitimate applications and their corresponding repackaged applications;

[0024] Calculate the array of structural feature points and the eigenvalue for each application;

[0025] According to the eigenvalue and the array of structural feature points of the legitimate application and its corresponding repackaged application, calculate the average value of the eigenvalue ratio difference and the average value of the feature point ratio difference between the legitimate application and its corresponding repackaged application, and obtain the eigenvalue difference threshold and the feature point difference threshold;

[0026] Obtain the application to be tested, and calculate the array of structural feature points and the eigenvalue of the application to be tested;

[0027] If the absolute value of the difference between the eigenvalue of the application to be tested and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of the same structural feature points in the array of structural feature points of the application to be tested and the array of structural feature points of the said application in the total number of structural feature points is greater than the feature point difference threshold, then determine that the application to be tested is a repackaged application.

[0028] From the above description, it can be seen that the beneficial effect of the present invention is that it can effectively improve the detection efficiency of repackaged applications.

[0029] Further, the specific calculation of the array of structural feature points and the eigenvalue for each application is as follows:

[0030] Obtain the files of an application, and group them according to the file structure hierarchy;

[0031] Calculate the structural feature points of each layer respectively according to the number of files and the average file size of each layer;

[0032] Arrange the structural feature points of each layer in a preset order to obtain the array of structural feature points of the said application;

[0033] Project each structural feature point in the array of structural feature points into a preset rectangular coordinate system, and sequentially connect the adjacent structural feature points to obtain a feature line segment;

[0034] Calculate the distance values between the center points of each characteristic line segment and the origin of the rectangular coordinate system respectively;

[0035] Add up each distance value to obtain the characteristic value of the application.

[0036] As can be seen from the above description, according to the file structure characteristics of the application, calculate the structure characteristic points of each layer of files in the application, so as to obtain an array of structure characteristic points that can depict the overall structure of the application files, and the characteristic value of the application can be calculated based on the array of structure characteristic points.

[0037] Further, after calculating the array of structure characteristic points and the characteristic values of each application, it further includes:

[0038] Store the array of structure characteristic points, the characteristic values and the application signatures of each application into the feature library.

[0039] As can be seen from the above description, by constructing a feature library, subsequent repackaging detection of applications can be effectively carried out.

[0040] Further, the specific calculation of the average value of the characteristic value ratio difference and the average value of the characteristic point ratio difference between the legitimate application and its corresponding repackaged application according to the characteristic values and the array of structure characteristic points of the legitimate application and its corresponding repackaged application to obtain the characteristic value difference threshold and the characteristic point difference threshold is as follows:

[0041] Calculate the characteristic value ratio difference value according to the characteristic values of the legitimate application and its corresponding repackaged application;

[0042] Calculate the average value of the characteristic value ratio difference values of multiple groups of legitimate applications and their corresponding repackaged applications to obtain the average value of the characteristic value ratio difference, and use the average value of the characteristic value ratio difference as the characteristic value difference threshold;

[0043] Compare each structure characteristic point in the array of structure characteristic points of the legitimate application and its corresponding repackaged application in sequence to obtain the number of identical structure characteristic points;

[0044] Calculate the characteristic point ratio difference value according to the number of identical structure characteristic points and the total number of structure characteristic points in the array of structure characteristic points;

[0045] Calculate the average value of the characteristic point ratio difference values of multiple groups of legitimate applications and their corresponding repackaged applications to obtain the average value of the characteristic point ratio difference, and use the average value of the characteristic point ratio difference as the characteristic point difference threshold.

[0046] As can be seen from the above description, according to the characteristic values and the array of structure characteristic points of multiple groups of legitimate applications and their corresponding repackaged applications, calculate the difference threshold as the detection basis for repackaged applications.

[0047] Further, if the absolute value of the difference between the eigenvalue of the application to be tested and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of identical structural feature points in the structural feature point arrays of the application to be tested and the said application to the total number of structural feature points is greater than the feature point difference threshold, then determining that the application to be tested is a repackaged application specifically includes:

[0048] Determine whether there is an application whose absolute value of the difference between its eigenvalue and the eigenvalue of the application to be tested is less than the eigenvalue difference threshold;

[0049] If not, determine that the application to be tested is not a repackaged application;

[0050] If so, determine whether the application signature of the application to be tested is the same as the application signature of the said application;

[0051] If the same, determine that the application to be tested is not a repackaged application;

[0052] If different, obtain the number of identical structural feature points in the structural feature point arrays of the application to be tested and the said application;

[0053] Determine whether the proportion of the number of the identical structural feature points to the total number of structural feature points in the structural feature point array of the said application is greater than the feature point difference threshold;

[0054] If yes, determine that the application to be tested is a repackaged application;

[0055] If not, determine that the application to be tested is not a repackaged application.

[0056] As can be seen from the above description, using the eigenvalue reflecting the application file structure, the feature structure point array, and the unique signature as the features to describe the application can not only effectively identify repackaged applications, but also convert the similarity comparison into a numerical comparison, improving the detection speed.

[0057] The present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the following steps are implemented:

[0058] Obtain legal applications and their corresponding repackaged applications;

[0059] Calculate the structural feature point arrays and eigenvalues of each application;

[0060] According to the eigenvalues and structural feature point arrays of legal applications and their corresponding repackaged applications, calculate the average eigenvalue ratio difference and the average feature point ratio difference of legal applications and their corresponding repackaged applications to obtain the eigenvalue difference threshold and the feature point difference threshold;

[0061] Obtain the application to be tested, and calculate the structural feature point array and eigenvalue of the application to be tested;

[0062] If the absolute value of the difference between the eigenvalue of the application to be tested and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of identical structural feature points in the structural feature point arrays of the application to be tested and the said application in the total number of structural feature points is greater than the feature point difference threshold, then determine that the application to be tested is a repackaged application.

[0063] Furthermore, the specific calculation of the structural feature point array and eigenvalue of each application is as follows:

[0064] Obtain the files of an application and group them according to the file structure hierarchy;

[0065] Calculate the structural feature points of each layer respectively according to the number of files and the average file size of each layer;

[0066] Arrange the structural feature points of each layer in a preset order to obtain the structural feature point array of the said application;

[0067] Project each structural feature point in the structural feature point array onto a preset rectangular coordinate system, and connect adjacent structural feature points in sequence to obtain feature line segments;

[0068] Calculate the distance value between the center point of each feature line segment and the origin of the rectangular coordinate system respectively;

[0069] Add up the distance values to obtain the eigenvalue of the said application.

[0070] Furthermore, after calculating the structural feature point array and eigenvalue of each application, it further includes:

[0071] Store the structural feature point arrays, eigenvalues, and application signatures of each application in the feature library.

[0072] Furthermore, the specific calculation of the eigenvalue ratio difference average value and the feature point ratio difference average value of the legitimate application and its corresponding repackaged application according to the eigenvalues and structural feature point arrays of the legitimate application and its corresponding repackaged application to obtain the eigenvalue difference threshold and the feature point difference threshold is as follows:

[0073] Calculate the eigenvalue ratio difference value according to the eigenvalues of the legitimate application and its corresponding repackaged application;

[0074] Calculate the average value of the eigenvalue ratio difference values of multiple groups of legitimate applications and their corresponding repackaged applications to obtain the eigenvalue ratio difference average value, and use the eigenvalue ratio difference average value as the eigenvalue difference threshold;

[0075] Sequentially compare each structural feature point in the array of structural feature points of a legitimate application and its corresponding repackaged application, and obtain the number of identical structural feature points;

[0076] Calculate the eigenvalue ratio difference value based on the number of identical structural feature points and the total number of structural feature points in the array of structural feature points;

[0077] Calculate the average value of the eigenvalue ratio difference values of multiple groups of legitimate applications and their corresponding repackaged applications to obtain the average eigenvalue ratio difference, and use the average eigenvalue ratio difference as the eigenvalue difference threshold.

[0078] Further, the specific method for determining that the application under test is a repackaged application if the absolute value of the difference between the eigenvalue of the application under test and the eigenvalue of an application is less than the eigenvalue difference threshold, and the ratio of the number of identical structural feature points in the array of structural feature points of the application under test and the application to the total number of structural feature points is greater than the eigenvalue difference threshold is as follows:

[0079] Determine whether there is an application such that the absolute value of the difference between the eigenvalue of the application and the eigenvalue of the application under test is less than the eigenvalue difference threshold;

[0080] If not, determine that the application under test is not a repackaged application;

[0081] If so, determine whether the application signature of the application under test is the same as the application signature of the application;

[0082] If the same, determine that the application under test is not a repackaged application;

[0083] If different, obtain the number of identical structural feature points in the array of structural feature points of the application under test and the application;

[0084] Determine whether the ratio of the number of identical structural feature points to the total number of structural feature points in the array of structural feature points of the application is greater than the eigenvalue difference threshold;

[0085] If so, determine that the application under test is a repackaged application;

[0086] If not, determine that the application under test is not a repackaged application.

[0087] Embodiment 1

[0088] Please refer to Figure 2 , Embodiment 1 of the present invention is: An Android repackaged application detection method, the method is based on eigenvalues, and includes the following steps:

[0089] S1: Obtain legitimate applications and their corresponding repackaged applications. Further, a large number of legitimate applications and their corresponding repackaged applications can be collected from major app markets.

[0090] S2: Calculate the structural feature point arrays and eigenvalues of each application. Specifically, the following explains how to calculate the structural feature point arrays and eigenvalues of a single application.

[0091] First, obtain the files of an application and group them according to the file structure hierarchy; that is, obtain all the files in the application (excluding folder files), and then divide the files at the same level in the directory tree into the same group.

[0092] Next, calculate the structural feature points of each layer respectively according to the number of files and the average file size of each layer, and then arrange the structural feature points of each layer in a preset order to obtain the structural feature point array of the application. For example, assume that the total number of layers of the application is N, that is, its directory tree has N layers, the number of files in the i-th layer is n i and the average file size is m i , then the structural feature point of the i-th layer is There are N structural feature points in N layers, which can be sorted in the order from the first layer to the N-th layer to obtain the structural feature point array of the application.

[0093] Then, project each structural feature point in the structural feature point array onto a preset rectangular coordinate system, and connect the adjacent structural feature points in sequence to obtain feature line segments. Since the structural feature points are represented in the form of (x, y), each structural feature point can be mapped to the rectangular coordinate system, and the structural feature point of the i-th layer is connected to the structural feature point of the i + 1-th layer (i = 1, 2,..., N - 1) to obtain N - 1 feature line segments.

[0094] Finally, calculate the distance values between the center points of each feature line segment and the origin of the rectangular coordinate system respectively, and add up the distance values to obtain the eigenvalue of the application. That is, calculate the center points of the line segments of the structural feature points and respectively Then calculate the distance values between the center points of each line segment and the origin (0, 0) and add them up. The added value is the eigenvalue of the application.

[0095] Further, save the eigenvalue, the structural feature point array of the application, and the application signature of the application to the feature library. The application signature is the identifier of the application developer and is unique.

[0096] S3: Calculate the average eigenvalue ratio difference and the average feature point ratio difference between the legitimate application and its corresponding repackaged application based on the eigenvalue and the array of structural feature points of the legitimate application and its corresponding repackaged application, so as to obtain the eigenvalue difference threshold and the feature point difference threshold.

[0097] Specifically, calculate the eigenvalue ratio difference value according to the eigenvalues of the legitimate application and its corresponding repackaged application, that is, the absolute value of the eigenvalue difference divided by the eigenvalue of the legitimate application. For example, assume that the eigenvalue of the legitimate application is a and the eigenvalue of the corresponding repackaged application is b, then the eigenvalue ratio difference value is |a - b| / a. At this time, a set of eigenvalue ratio difference values of the legitimate application and its corresponding repackaged application is obtained. By calculating the average value of the eigenvalue ratio difference values of multiple sets of legitimate applications and their corresponding repackaged applications, the average eigenvalue ratio difference can be obtained, and the average eigenvalue ratio difference is used as the eigenvalue difference threshold.

[0098] Compare each structural feature point in the array of structural feature points of the legitimate application and its corresponding repackaged application in sequence to obtain the number of identical structural feature points; then calculate the feature point ratio difference value according to the number of identical structural feature points and the total number of structural feature points in the array of structural feature points of the legitimate application. For example, assume that the array of structural feature points of the legitimate application is a[N] and the array of structural feature points of the corresponding repackaged application is b[N], then judge whether a[i] is equal to b[i] in sequence, i = 1, 2,..., N. If they are equal, the number of identical structural feature points is incremented by one until the array of structural feature points is traversed. Assume that the number of identical structural feature points is k, then the feature point ratio difference value of this set of legitimate application and its corresponding repackaged application is k / N.

[0099] Then calculate the average value of the feature point ratio difference values of multiple sets of legitimate applications and their corresponding repackaged applications to obtain the average feature point ratio difference, and use the average feature point ratio difference as the feature point difference threshold.

[0100] S4: Obtain the application to be tested, and calculate the array of structural feature points and the eigenvalue of the application to be tested; the calculation method is the same as that in step S2.

[0101] S5: Judge whether there is an application in the feature library, and the absolute value of the difference between the eigenvalue of the application and the eigenvalue of the application to be tested is less than the eigenvalue difference threshold. If so, execute step S6; if not, execute step S10.

[0102] S6: Judge whether the application signature of the application to be tested is the same as the application signature of the application. If so, execute step S10; if not, execute step S7.

[0103] S7: Obtain the number of identical structural feature points in the structural feature point arrays of the application under test and the one application; that is, sequentially compare each structural feature point in the structural feature point arrays of the application under test and the one application to obtain the number of identical structural feature points.

[0104] S8: Determine whether the proportion of the number of the identical structural feature points to the total number of structural feature points in the structural feature point array of the one application is greater than the feature point difference threshold. If so, execute step S9; if not, execute step S10.

[0105] S9: Determine that the application under test is a repackaged application.

[0106] S10: Determine that the application under test is not a repackaged application.

[0107] Since repackaged applications have the characteristic of high similarity with corresponding legitimate applications, eigenvalue analysis is first performed. If the difference is too large and exceeds the eigenvalue difference threshold, it indicates that the similarity is not high, so it is not a repackaged application. If the difference is small and the similarity is high, but the application signatures are the same, it proves that they are developed by the same developer and is also not a repackaged application. If the similarity is high and they are not developed by the same developer, it is possible that the eigenvalues happen to be close under certain conditions (such as using similar templates). Therefore, the method of comparing the structural feature point arrays needs to be adopted to determine whether the close eigenvalues are caused by most eigenvalues being the same or by chance. Therefore, to determine whether it is a repackaged application, it must simultaneously meet the following three conditions: 1. The eigenvalues are close; 2. The application signatures are different; 3. The structural feature point arrays are similar.

[0108] In this embodiment, a large number of legitimate applications and repackaged applications are collected, and the file structure features of these applications are extracted to construct the structural feature points of each layer of files in the application, so as to obtain a structural feature point array that can depict the overall structure of the application file. Then, the complex feature point array is converted into the eigenvalue of the application through calculation to construct a feature library. Subsequently, based on the eigenvalues, application signatures, and structural feature point arrays stored in the feature library of these applications, the difference threshold is calculated. Then, by comparing the application under test with the eigenvalues, application signatures, and structural feature point arrays stored in the feature library, it is determined whether it is a repackaged application.

[0109] This embodiment mainly relies on the high similarity between Android repackaged applications and the original applications, and uses the eigenvalue reflecting the application file structure, the feature structure point array, and the unique signature as the features describing the application. Through comparison, not only can repackaged applications be effectively identified, but also the similarity comparison is converted into a numerical comparison, which improves the detection speed. At the same time, the more samples in the feature library, the higher the detection accuracy.

[0110] Embodiment 2

[0111] This embodiment is a computer-readable storage medium corresponding to the above embodiment, on which a computer program is stored. When the program is executed by a processor, the following steps are implemented:

[0112] Obtain legal applications and their corresponding repackaged applications;

[0113] Calculate the structural feature point arrays and eigenvalues of each application;

[0114] According to the eigenvalues and structural feature point arrays of legal applications and their corresponding repackaged applications, calculate the average eigenvalue ratio difference and the average feature point ratio difference between legal applications and their corresponding repackaged applications, and obtain the eigenvalue difference threshold and the feature point difference threshold;

[0115] Obtain the application to be tested, and calculate the structural feature point array and eigenvalue of the application to be tested;

[0116] If the absolute value of the difference between the eigenvalue of the application to be tested and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of the same structural feature points in the structural feature point array of the application to be tested and the application is greater than the feature point difference threshold, then determine that the application to be tested is a repackaged application.

[0117] Further, the specific calculation of the structural feature point arrays and eigenvalues of each application is as follows:

[0118] Obtain the file of an application, and group it according to the file structure level;

[0119] Calculate the structural feature points of each layer respectively according to the number of files and the average file size of each layer;

[0120] Arrange the structural feature points of each layer in a preset order to obtain the structural feature point array of the application;

[0121] Project each structural feature point in the structural feature point array onto a preset rectangular coordinate system, and connect adjacent structural feature points in sequence to obtain feature line segments;

[0122] Calculate the distance values between the center points of each feature line segment and the origin of the rectangular coordinate system respectively;

[0123] Add up the distance values to obtain the eigenvalue of the application.

[0124] Further, after calculating the structural feature point arrays and eigenvalues of each application, it further includes:

[0125] Store the structural feature point arrays, eigenvalues, and application signatures of each application in a feature library.

[0126] Further, calculating the average value of the eigenvalue ratio difference and the average value of the feature point ratio difference between the legitimate application and its corresponding repackaged application based on the eigenvalue and the array of structural feature points of the legitimate application and its corresponding repackaged application, and obtaining the eigenvalue difference threshold and the feature point difference threshold specifically as follows:

[0127] Calculating the eigenvalue ratio difference value based on the eigenvalues of the legitimate application and its corresponding repackaged application;

[0128] Calculating the average value of the eigenvalue ratio difference values of multiple groups of legitimate applications and their corresponding repackaged applications to obtain the average value of the eigenvalue ratio difference, and using the average value of the eigenvalue ratio difference as the eigenvalue difference threshold;

[0129] Sequentially comparing each structural feature point in the array of structural feature points of the legitimate application and its corresponding repackaged application to obtain the number of identical structural feature points;

[0130] Calculating the feature point ratio difference value based on the number of identical structural feature points and the total number of structural feature points in the array of structural feature points;

[0131] Calculating the average value of the feature point ratio difference values of multiple groups of legitimate applications and their corresponding repackaged applications to obtain the average value of the feature point ratio difference, and using the average value of the feature point ratio difference as the feature point difference threshold.

[0132] Further, if the absolute value of the difference between the eigenvalue of the application to be tested and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of identical structural feature points in the array of structural feature points of the application to be tested and the an application to the total number of structural feature points is greater than the feature point difference threshold, then determining that the application to be tested is a repackaged application specifically as follows:

[0133] Judging whether there is an application whose absolute value of the difference between the eigenvalue of the application and the eigenvalue of the application to be tested is less than the eigenvalue difference threshold;

[0134] If not, determining that the application to be tested is a non-repackaged application;

[0135] If so, judging whether the application signature of the application to be tested is the same as the application signature of the an application;

[0136] If the same, determining that the application to be tested is a non-repackaged application;

[0137] If different, obtaining the number of identical structural feature points in the array of structural feature points of the application to be tested and the an application;

[0138] Determine whether the proportion of the number of the same structural feature points in the total number of structural feature points in the structural feature point array of the application is greater than the feature point difference threshold;

[0139] If so, determine that the application to be tested is a repackaged application;

[0140] If not, determine that the application to be tested is not a repackaged application.

[0141] In summary, a method for detecting Android repackaged applications and a storage medium provided by the present invention collect a large number of legitimate applications and repackaged applications, extract the file structure features of these applications, construct the structural feature points of each layer of files in the application, so as to obtain a structural feature point array that can depict the overall structure of the application file, and convert the complex feature point array into the feature value of the application through calculation, construct a feature library, and then calculate the difference threshold according to the feature values and structural feature point arrays of these applications. Subsequently, by comparing the application to be tested with the feature values, application signatures, and structural feature point arrays stored in the feature library, it is determined whether it is a repackaged application. The present invention mainly uses the high similarity between Android repackaged applications and the original applications, and uses the feature values reflecting the application file structure, the feature structure point array, and the unique signature as the features describing the application. Through comparison, not only can repackaged applications be effectively identified, but also the similarity comparison is converted into a numerical comparison, improving the detection speed. At the same time, the more samples in the feature library, the higher the detection accuracy.

[0142] The above are only embodiments of the present invention, and do not limit the patent scope of the present invention. Any equivalent transformation made using the specification and drawings of the present invention, or directly or indirectly applied in related technical fields, shall be equally included in the patent protection scope of the present invention.

Claims

1. An Android repackaged application detection method, characterized in that, it includes: Obtain legitimate applications and their corresponding repackaged applications; Calculate the structural feature point arrays and eigenvalues of each application; According to the eigenvalues and structural feature point arrays of legitimate applications and their corresponding repackaged applications, calculate the average eigenvalue ratio difference and the average feature point ratio difference of legitimate applications and their corresponding repackaged applications to obtain the eigenvalue difference threshold and the feature point difference threshold; Obtain the application to be tested, and calculate the structural feature point array and eigenvalue of the application to be tested; If the absolute value of the difference between the eigenvalue of the application to be tested and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of the same structural feature points in the structural feature point array of the application to be tested and the application to the total number of structural feature points is greater than the feature point difference threshold, then it is determined that the application to be tested is a repackaged application; The specific method for calculating the structural feature point arrays and eigenvalues of each application is as follows: Obtain the files of an application and group them according to the file structure hierarchy; Calculate the structural feature points of each layer respectively according to the number of files and the average file size of each layer; Arrange the structural feature points of each layer in a preset order to obtain the structural feature point array of the application; Project each structural feature point in the structural feature point array onto a preset rectangular coordinate system, and sequentially connect adjacent structural feature points to obtain feature line segments; Calculate the distance values between the center points of each feature line segment and the origin of the rectangular coordinate system respectively; Add up each distance value to obtain the eigenvalue of the application.

2. The Android repackaged application detection method according to claim 1, characterized in that, after calculating the structural feature point arrays and eigenvalues of each application, it further includes: Store the structural feature point arrays, eigenvalues, and application signatures of each application in a feature library.

3. The Android repackaged application detection method according to claim 1, characterized in that, the specific method for calculating the average eigenvalue ratio difference and the average feature point ratio difference of legitimate applications and their corresponding repackaged applications according to the eigenvalues and structural feature point arrays of legitimate applications and their corresponding repackaged applications to obtain the eigenvalue difference threshold and the feature point difference threshold is as follows: Calculate the eigenvalue ratio difference value according to the eigenvalues of legitimate applications and their corresponding repackaged applications; Calculate the average value of the eigenvalue ratio difference values of multiple groups of legitimate applications and their corresponding repackaged applications to obtain the average eigenvalue ratio difference, and use the average eigenvalue ratio difference as the eigenvalue difference threshold; Sequentially compare each structural feature point in the structural feature point arrays of legitimate applications and their corresponding repackaged applications to obtain the number of the same structural feature points; Calculate the feature point ratio difference value according to the number of the same structural feature points and the total number of structural feature points in the structural feature point array; Calculate the average value of the feature point ratio difference values of multiple groups of legitimate applications and their corresponding repackaged applications to obtain the average feature point ratio difference, and use the average feature point ratio difference as the feature point difference threshold.

4. The Android repackaged application detection method according to claim 1, characterized in that, the specific process of determining that the application under test is a repackaged application if the absolute value of the difference between the eigenvalue of the application under test and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of identical structural feature points in the structural feature point arrays of the application under test and the application is greater than the feature point difference threshold is as follows: judge whether there is an application whose absolute value of the difference between the eigenvalue of the application and the eigenvalue of the application under test is less than the eigenvalue difference threshold; if not, determine that the application under test is not a repackaged application; if so, judge whether the application signature of the application under test is the same as the application signature of the application; if the same, determine that the application under test is not a repackaged application; if different, obtain the number of identical structural feature points in the structural feature point arrays of the application under test and the application; judge whether the proportion of the number of the identical structural feature points to the total number of structural feature points in the structural feature point array of the application is greater than the feature point difference threshold; if so, determine that the application under test is a repackaged application; if not, determine that the application under test is not a repackaged application.

5. A computer-readable storage medium, on which a computer program is stored, characterized in that, when the program is executed by a processor, the following steps are implemented: obtain legal applications and their corresponding repackaged applications; calculate the structural feature point arrays and eigenvalues of each application; calculate the average eigenvalue ratio difference and the average feature point ratio difference of the legal applications and their corresponding repackaged applications according to the eigenvalues and structural feature point arrays of the legal applications and their corresponding repackaged applications, and obtain the eigenvalue difference threshold and the feature point difference threshold; obtain the application under test, and calculate the structural feature point array and eigenvalue of the application under test; if the absolute value of the difference between the eigenvalue of the application under test and the eigenvalue of an application is less than the eigenvalue difference threshold, and the proportion of the number of identical structural feature points in the structural feature point arrays of the application under test and the application is greater than the feature point difference threshold, then determine that the application under test is a repackaged application; the specific process of calculating the structural feature point arrays and eigenvalues of each application is as follows: obtain the file of an application and group it according to the file structure hierarchy; calculate the structural feature points of each layer respectively according to the number of files and the average file size of each layer; arrange the structural feature points of each layer in a preset order to obtain the structural feature point array of the application; project each structural feature point in the structural feature point array into a preset rectangular coordinate system, and connect the adjacent structural feature points in sequence to obtain a feature line segment; calculate the distance value between the center point of each feature line segment and the origin of the rectangular coordinate system respectively; add up each distance value to obtain the eigenvalue of the application.

6. The computer-readable storage medium according to claim 5, characterized in that, after calculating the structural feature point arrays and eigenvalues of each application, it further includes: The structural feature point array, feature value and application signature of each application are stored in the feature library.

7. The computer-readable storage medium according to claim 5, It is characterized in that According to the feature values ​​and structural feature point arrays of the legitimate application and its corresponding repackaged application, the feature value ratio difference average value and feature point ratio difference average value of the legitimate application and its corresponding repackaged application are calculated to obtain the feature value difference threshold and feature point difference threshold, which are specifically: According to the characteristic values ​​of the legitimate application and the corresponding repackaged application, a characteristic value ratio difference value is calculated; Calculate the average of the characteristic value ratio difference values ​​of the multiple groups of legal applications and their corresponding repackaged applications to obtain the characteristic value ratio difference average value, and use the characteristic value ratio difference average value as the characteristic value difference threshold; Sequentially compare each structural feature point in the structural feature point array of the legitimate application and its corresponding repackaged application to obtain the number of identical structural feature points; Calculating a characteristic point ratio difference value according to the number of the same structural characteristic points and the total number of structural characteristic points in the structural characteristic point array; The average value of the feature point ratio difference values ​​of the multiple groups of legal applications and their corresponding repackaged applications is calculated to obtain the feature point ratio difference average value, and the feature point ratio difference average value is used as the feature point difference threshold.

8. The computer-readable storage medium according to claim 5, It is characterized in that If the absolute value of the difference between the characteristic value of the application to be tested and the characteristic value of an application is less than the characteristic value difference threshold, and the ratio of the number of identical structural feature points in the structural feature point arrays of the application to be tested and the application to the total number of structural feature points is greater than the characteristic point difference threshold, then determining that the application to be tested is a repackaged application is specifically: Determine whether there is an application, the absolute value of the difference between the characteristic value of the application and the characteristic value of the application to be tested is less than the characteristic value difference threshold; If not, determining that the application to be tested is a non-repackaged application; If so, determining whether the application signature of the application to be tested is the same as the application signature of the one application; If they are the same, it is determined that the application to be tested is a non-repackaged application; If they are different, obtaining the number of identical structural feature points in the structural feature point arrays of the application to be tested and the first application; Determine whether the ratio of the number of the same structural feature points to the total number of structural feature points in the structural feature point array of the application is greater than the feature point difference threshold; If yes, determining that the application to be tested is a repackaged application; If not, it is determined that the application to be tested is a non-repackaged application.

Images