A detection method and device for Android simulator

Abstract

The present invention discloses a detection method and device for an Android simulator. First, it is determined whether the current device is an Android simulator based on whether the device information of the current device contains a simulated value or whether a value is modified; then, it is determined whether the current device is an Android simulator based on whether the hardware information of the current device contains a simulated value or whether it has normal functions; finally, the device information, hardware information, special file information and user trace information of the current device are integrated to generate a feature vector input into a detection model to determine whether the current device is an Android simulator. The present invention first adopts a light and fast judgment method to ensure the efficiency of detecting ordinary simulators, then combines special file information and user trace information that are difficult to simulate to construct a feature vector, and uses a machine learning method to improve the detection accuracy.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a detection method and device for an Android simulator. Technical Background

[0002] An Android emulator is an emulator that can run on a computer and simulate an Android phone system. An Android emulator can install, use, and uninstall Android phone applications. An Android emulator can simulate an Android phone's operating environment on a computer. Even if a user does not have a mobile phone hardware device, they can still use Android phone applications on a computer using an Android emulator.

[0003] The development of Android simulators has also brought some adverse effects. For example, Android simulators are used for data monitoring, account theft, hacker attacks, malicious registration, false authentication, order fraud, cash withdrawal, loan application, and merchant fraud. Most of the current Android simulator detection solutions are based on the hardware information of the Android phone to determine whether the operating environment of the Android phone application software is an Android simulator. However, some Android simulators can modify the underlying configuration files of the Android system, thereby forging the hardware information of the Android phone, such as the manufacturer, brand, model, CPU, memory, flash memory, sensor, screen resolution, Bluetooth, IMEI, mac address, mobile phone number, and network operator, and thus successfully deceive the existing Android simulator detection solutions. Summary of the invention

[0004] The technical problem to be solved by the present invention is to overcome the defects of the prior art and provide a detection method and device for an Android emulator. First, the device information or hardware information of the current device is used for detection, and then the current device features are constructed in combination with special file information and user trace information. A detection model is used to determine whether the current device is an Android emulator, thereby greatly improving the recognition efficiency and accuracy.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] A method for detecting an Android simulator, the steps of which include:

[0007] 1) Collect the device simulation values ​​of each device information in each simulator, obtain the device information of the current device, and determine whether the current device is an Android simulator based on the device simulation value and the device information; if it is not an Android simulator, proceed to step 2); if it is an Android simulator, obtain the detection result and proceed to step 4);

[0008] 2) Collect the hardware simulation values ​​of various hardware information in various simulators, obtain the hardware information of the current device, and determine whether the current device is an Android simulator based on the hardware simulation values ​​and the hardware information; if it is not an Android simulator, proceed to step 3); if it is an Android simulator, obtain the detection result and proceed to step 4);

[0009] 3) Obtain the special file information and user trace information of the current device, extract the device features by combining the device information and hardware information, and input the device features into the simulator detection model to obtain the detection results;

[0010] 4) Output the test results;

[0011] The simulator detection model is obtained through the following steps:

[0012] a) Obtain device information, hardware information, special file information and user trace information of several sample devices;

[0013] b) extracting device features of each sample device;

[0014] c) Perform machine learning training based on the device characteristics of each sample device to obtain a simulator detection model.

[0015] Furthermore, the equipment information includes: equipment attributes and production information.

[0016] Furthermore, the device attributes include: an International Mobile Subscriber Identity, an International Mobile Equipment Identity and / or a mobile phone number.

[0017] Furthermore, the production information includes: mobile phone brand, manufacturer, full product name, motherboard information, CPU_ABI, industrial model, device fingerprint, hardware information, product version number, production serial number and / or public model.

[0018] Further, in step 1), whether the current device is an Android emulator is determined by the following steps:

[0019] (1) Generate a first blacklist based on the device simulation value;

[0020] (2) Obtain the corresponding value of the device attribute through android.telephony.TelephonyManager; if the corresponding value of any device attribute is in the first blacklist, it is determined that the current device is an Android emulator; otherwise, go to step (3);

[0021] (3) Obtain the corresponding value of each first production information through the constants in android.os.Build; if the corresponding value of any first production information is in the first blacklist, it is determined that the current device is an Android emulator; otherwise, go to step (4);

[0022] (4) Read the / system / build.prop file to obtain the corresponding value of each second production information; if the corresponding value of any first production information is inconsistent with the corresponding value of the corresponding second production information, it is determined that the current device is an Android emulator.

[0023] Furthermore, the hardware information includes: sensor information, CPU information, battery information, speaker information, camera information, WiFi information and / or Bluetooth adapter information.

[0024] Further, in step 2), whether the current device is an Android emulator is determined by the following steps:

[0025] (1) Generate a second blacklist based on the hardware simulation value;

[0026] (2) Acquire each sensor in the current device and read the sensor parameters at a set interval; if the sensor cannot be acquired, the sensor parameters cannot be read normally, the corresponding value of the sensor parameter is in the second blacklist, or the sensor parameters read each time are consistent, then the current device is determined to be an Android emulator; otherwise, proceed to step (3);

[0027] (3) Obtaining the CPU information of the current device; if the CPU information cannot be obtained normally or the corresponding value of the CPU information is in the second blacklist, it is determined that the current device is an Android emulator; otherwise, proceeding to step (4);

[0028] (4) Obtain the battery information of the current device and read the battery parameters at a set interval; if the battery information cannot be obtained normally, the corresponding value of the read battery parameter is in the second blacklist, or the battery parameters read each time are consistent, then the current device is determined to be an Android emulator; otherwise, proceed to step (5);

[0029] (5) Obtain the speaker information of the current device and play any audio; if the audio cannot be played normally, determine that the current environment is an Android emulator, otherwise, go to step (6);

[0030] (6) Obtain the camera information of the current device and use the shooting function to take several photos; if the camera information cannot be obtained normally, the corresponding values ​​of each camera information are in the second blacklist, the photos cannot be taken or the photos are the same, then it is determined that the current device is an Android emulator; otherwise, go to step (7);

[0031] (7) Obtaining WiFi information; if the WiFi information cannot be obtained normally or the corresponding value of each WiFi information is in the second blacklist, it is determined that the current device is an Android emulator; otherwise, proceed to step (8);

[0032] (8) Obtain a Bluetooth adapter instance, turn on the Bluetooth function, and read the connectable device; if the Bluetooth adapter instance cannot be obtained normally, the Bluetooth function cannot be turned on, the connectable device cannot be read, or the corresponding value of the Bluetooth adapter instance is in the second blacklist, it is determined that the current device is an Android emulator.

[0033] Further, the sensor includes: an acceleration sensor, a pressure sensor, a magnetic field sensor, a direction sensor, a distance sensor and / or a temperature sensor.

[0034] Further, the sensor parameters include: acceleration, pressure, magnetic field strength, direction, distance and / or temperature. Further, the CPU information includes: CPU model, CPU temperature and / or CPU architecture.

[0035] Furthermore, the battery information includes: battery voltage, battery power, battery model and / or battery temperature.

[0036] Furthermore, the battery parameters include: battery power and / or battery temperature.

[0037] Furthermore, the directories from which special file information is extracted include: / sys, / sys / bus, / sys / class, / sys / module, / dev, / dev / socket, / system, / system / bin, and / system / lib.

[0038] Furthermore, the user trace information includes: contact list, call logs, text messages, browsing history, installed programs, chat records of social applications, purchase records of online shopping applications, whether the Xposed framework is installed and / or whether root permissions are obtained.

[0039] Furthermore, the method of machine learning training includes: decision tree.

[0040] A storage medium stores a computer program, wherein the computer program is configured to execute the method described above when running.

[0041] An electronic device comprises a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer to execute the method described above.

[0042] Compared with the prior art, the present invention has the following advantages:

[0043] 1) First, a light and fast judgment method is used to detect whether the attribute value has a simulated value. If so, it is determined to be an Android simulator to ensure the efficiency of detecting ordinary simulators.

[0044] 2) Innovatively use machine learning models to judge the current environment, extract user traces and special file information that cannot be simulated by the simulator, combine the acquired device information and hardware information to train the decision tree classifier, and use the decision tree model to make judgments on the current environment. This is better than using manually formulated judgment rules and is more accurate.

[0045] 3) Special file information and user trace information are difficult to simulate, and there will be large differences between artificial simulation and the actual environment. Therefore, extracting these two types of information as features can greatly improve the accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the process of the present invention.

[0047] Figure 2 It is a schematic diagram of device information detected by the device information module of the present invention.

[0048] Figure 3 It is a schematic diagram of hardware information detected by the hardware information module of the present invention.

[0049] Figure 4 It is a schematic diagram of a directory for collecting special file information by the comprehensive evaluation module of the present invention.

[0050] Figure 5 It is a schematic diagram of user trace information collected by the comprehensive evaluation module of the present invention. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention and to make the objects, features and advantages of the present invention more obvious and easy to understand, the technical core of the present invention is further described in detail below with reference to the accompanying drawings and examples.

[0052] The Android simulator detection method of the present invention has a flow chart as shown in Figure 1 As shown, it includes a device information detection module, a hardware information detection module and a comprehensive evaluation module. The steps are as follows:

[0053] 1. First, start the device information detection module, which uses device information to determine whether the current environment is in the Android emulator environment. Figure 2The device information detected by this module includes device attributes and production information. Device attributes refer to the three attributes of the current device: IMSI (International Mobile Subscriber Identity), IMEI (International Mobile Equipment Identity) and mobile phone number. Production information includes mobile phone brand, manufacturer, product full name, motherboard information, CPU_ABI, industrial model, device fingerprint, hardware information, product version number, production serial number, public model, etc. To detect these information, it is necessary to set the simulated value generated by each information in the Android simulator. If the obtained value matches the simulated value, it is judged that the current environment is under the simulator.

[0054] For device properties, call the relevant interface to directly obtain the value of the corresponding information, and match it with the simulation value to complete the judgment. For production information, it can also be judged by comparing the value obtained using the system interface and the simulator value. In addition, this information can not only be obtained using the system interface, but also by reading the configuration file / system / build.prop. In order to prevent the information from being tampered with by modifying the return value of the system interface, the information value is compared with the corresponding configuration item in the / system / build.prop file. If there are information items that do not match the two, it is judged that the current environment is under the simulator.

[0055] Specifically, the device information detection module process:

[0056] The first step is to collect the simulation values ​​of each device information in various simulators and generate a simulation value matching blacklist. If the value matches the value in the blacklist, the current environment is judged to be an Android simulator environment.

[0057] The second step is to obtain the device attribute information of the current environment through android.telephony.TelephonyManager, including IMSI, IMEI and mobile phone number.

[0058] The third step is to check whether the IMSI, IMEI and mobile phone number of the current environment are in the blacklist. If they are, the current environment is determined to be an Android emulator; otherwise, proceed to the next step.

[0059] The fourth step is to obtain the value of the production information of the current environment through the constants in android.os.Build, including brand, manufacturer, full product name, motherboard, CPU_ABI, industrial model, device fingerprint, hardware information, version number, production serial number, public model and other information.

[0060] Step 5: Check whether there is a simulation value in the production information of the current environment. If so, the current environment is determined to be an Android simulator; otherwise, proceed to the next step.

[0061] Step 6: Read the / system / build.prop file to check whether the obtained production information is consistent with the information in the file. If not, the current environment is determined to be an Android simulator; otherwise, enter the hardware information detection module.

[0062] 2. If the device information detection module does not determine that the current environment is in the Android emulator, enter the hardware information detection module. Figure 3 ,Hardware information includes sensor information, CPU information, battery information, speaker information, camera information, WiFi information, and Bluetooth adapter information. Whether the current environment is Android can be determined by judging whether these hardware devices can work normally.

[0063] Sensor information includes various sensors in the device: acceleration sensor, pressure sensor, magnetic field sensor, direction sensor, distance sensor, temperature sensor, etc. Use each type of sensor to obtain corresponding types of information. If it cannot be obtained normally, it is judged that it is in the simulator environment.

[0064] CPU information includes CPU model, CPU temperature, CPU architecture and other information. If it cannot be obtained normally, or the obtained value is a simulated value, it is judged to be in a simulator environment.

[0065] Battery information includes voltage, power, model, temperature, etc. If the model is a simulated value, or the voltage, power, and temperature remain unchanged for a period of time, it is judged to be in a simulator environment.

[0066] For the speaker information, camera information, WiFi information, and Bluetooth adapter information, if they cannot be used, it is determined that the current environment is a simulator.

[0067] Specifically, the hardware information detection module process:

[0068] The first step is to collect the simulation values ​​of various hardware information in various simulators and generate a simulation value matching blacklist. If the value matches the value in the blacklist, the current environment is judged to be an Android simulator environment.

[0069] The second step is to obtain the instances of various sensors in the current environment, including acceleration sensors, pressure sensors, magnetic field sensors, direction sensors, distance sensors, and temperature sensors. Use the sensor instances to read acceleration, pressure, magnetic field strength, direction, distance, and temperature, respectively, once every 60 seconds, for a total of 10 times. If the instance cannot be obtained normally, the information cannot be read normally, the information read is a simulated value, or the information read 10 times is exactly the same, then the current environment is determined to be an Android emulator, otherwise proceed to the next step.

[0070] The third step is to obtain the CPU information in the current environment, including model, temperature, and architecture. If the information cannot be obtained normally or the obtained value is a simulation value, the current environment is judged to be an Android simulator, otherwise proceed to the next step.

[0071] Step 4: Get the battery information in the current environment, including model, power, voltage, and temperature, and read the power and temperature every 60 seconds, for a total of 10 times. If the information cannot be obtained normally, the obtained value is a simulated value, or the power and temperature are the same after 10 readings, the current environment is determined to be an Android simulator, otherwise proceed to the next step.

[0072] Step 5: Get the current speaker instance and play any audio. If it cannot be played normally, the current environment is determined to be an Android emulator, otherwise proceed to the next step.

[0073] Step 6: Get the current camera information, including the number and pixels of the camera, and use the shooting function to take 10 photos. If the information cannot be obtained normally, the number and pixels of the camera have simulated values, the photo cannot be taken, or the 10 photos taken are the same, then the current environment is determined to be an Android emulator, otherwise proceed to the next step.

[0074] Step 7: Get WiFi information. If it cannot be obtained normally or the obtained value is a simulated value, the current environment is determined to be an Android simulator, otherwise proceed to the next step.

[0075] Step 8: Get the Bluetooth adapter instance, turn on the Bluetooth function, and read the connectable device. If the instance cannot be obtained normally, the Bluetooth function cannot be turned on, the connectable device cannot be read, and there is a simulation value in the obtained instance, then the current environment is judged to be an Android simulator, otherwise enter the comprehensive assessment module.

[0076] 3. If the hardware information detection module still does not determine that the current environment is a simulator environment, the comprehensive judgment module is started. This module no longer judges the current environment by matching or not matching a certain information item, but uses a decision tree model to make a comprehensive judgment on the current environment. The current environment information includes the device information obtained by the device information module, the hardware information obtained by the hardware information module, special file information, and user trace information.

[0077] Since the existing technology can modify the information of the simulator, it is easy to be disturbed if the device information and hardware information are detected and judged separately. Therefore, the present invention innovatively proposes a comprehensive judgment module to combine all information for judgment. If the device information and hardware information are modified in the simulator and changed to real values, the simulated values ​​will not appear in each information item. However, such a modification will destroy the association between the original information items. Therefore, by combining this information for judgment, it is possible to find the mismatched information items, thereby judging that the current environment is under the simulator.

[0078] The comprehensive judgment module also innovatively adds the extraction and judgment of user trace information. For the real environment, there will be traces of user use, including photo albums, text messages, calls, browsing records, installed software packages, etc. In the real environment, photo albums, text messages, calls and browsing records will have traces of user use and will install some commonly used applications. Therefore, by obtaining this information, it can be determined whether the current environment is in the Android emulator environment. The Xposed framework can modify the return value of the system interface, and the installation of the Xposed framework requires root permissions. Therefore, the installation of the Xposed framework and the acquisition of root permissions are also regarded as user trace information.

[0079] The device information, hardware information, special file information and user trace information are combined to extract features and classify using a decision tree model. If the final output result is 1, it means that the current environment is in an Android emulator; if it is 0, it means that the current environment is in a real device.

[0080] Comprehensive assessment module process:

[0081] The first step is to collect special file information, such as Figure 4 As shown, it mainly includes the file names under the / sys, / sys / bus, / sys / class, / sys / module, / dev, / dev / socket, / system, / system / bin, and / system / lib directories.

[0082] The second step is to collect user trace information, such as Figure 5 As shown, it includes contact list, call logs, text messages, browsing history, installed programs, chat records of social applications, purchase records of online shopping applications, whether the Xposed framework is installed, whether root permissions are obtained, etc.

[0083] In the third step, device information, hardware information, special file information, and user characteristic information are used as features to generate a vector describing the current environment.

[0084] The fourth step is to collect data. The device information, hardware information, special file information, and user characteristic information are collected in various versions of Android system environments of various Android simulators; the device information, hardware information, special file information, and user characteristic information are collected on various models of mobile phones with different years of use.

[0085] Step 5: Use the data collected in the previous step to train the decision tree model.

[0086] Step 6: Input the current environment vector and use the decision tree model to make predictions. If the output is 1, it means the current environment is an Android simulator environment; if the output is 0, it means the current environment is a real device.

[0087] The above embodiments are provided only for the purpose of describing the present invention, and are not intended to limit the scope of the present invention. The scope of the present invention is defined by the appended claims. Various equivalent substitutions and modifications made without departing from the spirit and principles of the present invention should all be included within the scope of the present invention.

Claims

1. A method for detecting an Android simulator, comprising the steps of: 1) Collect the device simulation values ​​of each device information in each simulator, obtain the device information of the current device, and determine whether the current device is an Android simulator based on the device simulation value and the device information; if it is not an Android simulator, proceed to step 2); If it is an Android simulator, obtain the test results and proceed to step 4); wherein the device information includes: device attributes and production information; the device attributes include: international mobile subscriber identity code, international mobile equipment identity code and / or mobile phone number; the production information includes: mobile phone brand, manufacturer, product full name, motherboard information, CPU_ABI, industrial model, device fingerprint, hardware information, product version number, production serial number and / or public model, and judging whether the current device is an Android simulator based on the device simulation value and device information includes: Generate a first blacklist based on the device simulation value; Obtain the corresponding value of the device attribute through android.telephony.TelephonyManager; if the corresponding value of any device attribute is in the first blacklist, determine that the current device is an Android emulator; otherwise, jump to obtaining the corresponding value of each first production information through the constant in android.os.Build; Obtain the corresponding value of each first production information through the constants in android.os.Build; if the corresponding value of any first production information is in the first blacklist, determine that the current device is an Android emulator; otherwise, jump to read the / system / build.prop file to obtain the corresponding value of each second production information; Read the / system / build.prop file to obtain the corresponding value of each second production information; if the corresponding value of any first production information is inconsistent with the corresponding value of the corresponding second production information, it is determined that the current device is an Android emulator; 2) Collect the hardware simulation values ​​of various hardware information in various simulators, obtain the hardware information of the current device, and judge whether the current device is an Android simulator based on the hardware simulation value and the hardware information; if it is not an Android simulator, proceed to step 3); if it is an Android simulator, obtain the detection result and proceed to step 4); wherein the hardware information includes: sensor information, CPU information, battery information, speaker information, camera information, WiFi information and / or Bluetooth adapter information, and judging whether the current device is an Android simulator based on the hardware simulation value and the hardware information includes: generating a second blacklist according to the hardware simulation value; Get each sensor in the current device and read the sensor parameters at a set interval; if the sensor cannot be obtained, the sensor parameters cannot be read normally, the corresponding value of the sensor parameter is in the second blacklist, or the sensor parameters read each time are consistent, then the current device is determined to be an Android emulator; otherwise, jump to the step to obtain the CPU information of the current device; Get the CPU information of the current device; if the CPU information cannot be obtained normally or the corresponding value of the CPU information is in the second blacklist, the current device is determined to be an Android emulator; otherwise, jump to get the battery information of the current device; Get the battery information of the current device and read the battery parameters at a set interval; if the battery information cannot be obtained normally, the corresponding value of the battery parameter is in the second blacklist, or the battery parameters read each time are consistent, then the current device is determined to be an Android emulator; otherwise, jump to obtaining the speaker information of the current device; Get the speaker information of the current device and play any audio; if the audio cannot be played normally, the current environment is determined to be an Android emulator, otherwise, jump to get the camera information of the current device; Get the camera information of the current device and use the shooting function to take several photos; if the camera information cannot be obtained normally, the corresponding values ​​of each camera information are in the second blacklist, the photos cannot be taken or the photos are the same, then the current device is judged to be an Android emulator; otherwise, jump to obtain WiFi information; Get WiFi information; if WiFi information cannot be obtained normally or the corresponding value of each WiFi information is in the second blacklist, it is determined that the current device is an Android emulator; otherwise, jump to get the Bluetooth adapter instance; Get a Bluetooth adapter instance, turn on the Bluetooth function, and read the connectable device; if the Bluetooth adapter instance cannot be obtained normally, the Bluetooth function cannot be turned on, the connectable device cannot be read, or the corresponding value of the Bluetooth adapter instance is in the second blacklist, then the current device is determined to be an Android simulator; 3) Get the special file information and user trace information of the current device, extract the device features in combination with the device information and hardware information, and input the device features into the simulator detection model to obtain the detection results; wherein the directories for extracting special file information include: / sys, / sys / bus, / sys / class, / sys / module, / dev, / dev / socket, / system, / system / bin and / system / lib; the user trace information includes: contact list, call logs, text messages, browsing history, installed programs, chat records of social applications, purchase records of online shopping applications, whether the Xposed framework is installed and / or whether root permissions are obtained; 4) Output the test results; The simulator detection model is obtained through the following steps: a) Obtain device information, hardware information, special file information and user trace information of several sample devices; b) extracting device features of each sample device; c) Perform machine learning training based on the device characteristics of each sample device to obtain a simulator detection model.

2. The method according to claim 1, characterized in that Sensors include: Acceleration sensor, pressure sensor, magnetic field sensor, direction sensor, distance sensor and / or temperature sensor; Sensor parameters include: acceleration, pressure, magnetic field strength, direction, distance and / or temperature; CPU information includes: CPU model, CPU temperature and / or CPU architecture; battery information includes: battery voltage, battery power, battery model and / or battery temperature; battery parameters include: battery power and / or battery temperature.

3. The method according to claim 1, characterized in that Methods for machine learning training include: Decision trees.

4. A storage medium storing a computer program, wherein: The computer program is configured to execute the method according to any one of claims 1 to 3 when executed.

5. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 3.

Images