A method for identifying and classifying malicious Android applications

Abstract

The present invention discloses a method for identifying and classifying Android shelled malicious applications, comprising the following steps: (1) constructing a fingerprint feature library of Android shelled malicious application shells; (2) constructing a fingerprint classification mapping library of Android shelled malicious application shells; (3) collecting different categories of unpacking tools for Android shelled malicious applications; (4) collecting an Android malicious application data set, unpacking it using an unpacking tool, and then extracting features and matching them using rules to identify the shelled Android malicious applications; (5) using the fingerprint classification mapping library constructed in (2) and processing the results in (4) to classify the shelled Android malicious applications; and (6) using the unpacking tools collected in (3) and processing the results in (5) to provide a suitable unpacking solution for the Android shelled malicious applications. The present invention can be used to effectively realize the identification and classification of Android shelled malicious applications.

Description

Technical Field

[0001] The present invention relates to the technical field of packed malicious application identification, and is a method for identifying and classifying Android packed malicious applications, specifically a method for identifying and classifying Android packed malicious applications by performing rule matching based on a fingerprint feature library and a classification mapping library. Background Art

[0002] Android-packed malicious apps: Android malicious app packing technology involves packing the APK to increase the difficulty for reverse engineers to analyze the APK, further protecting critical source code and file information within the APK. In recent years, threats to Android apps have steadily increased, primarily including decompilation, repackaging, dynamic debugging, hooking, data theft, and transaction hijacking. Simultaneously, Android security protection technology has also rapidly evolved, primarily categorized into static and dynamic protection technologies. The most representative static protection technology is Android app packing, which is further divided into dex and so packing technologies. Currently, malicious Android apps primarily utilize dex packing, which effectively thwarts antivirus detection engines and poses serious risks to users and mobile devices.

[0003] Identifying and classifying malicious Android applications: Android malicious applications primarily utilize Dex (DEX) packing technology to circumvent the platform's virus detection engine. Packer identification and classification involves fingerprinting the packer technology and classifying it based on its characteristics. This process primarily involves collecting vendors' packer fingerprint feature libraries and fingerprint classification mapping libraries. The primary objective is to identify and classify malicious Android applications that are packed with malicious applications through rule matching.

[0004] In recent years, the technology for identifying malicious Android applications packed with shells has continued to develop. Currently, it is mainly divided into entropy-based shell identification, machine learning or deep learning-based shell identification, and fingerprint feature library-based shell identification technology. Entropy-based shell identification technology cannot effectively address the impact of obfuscation technology on entropy. While machine learning-based shell identification technology can effectively address the problem of identifying unknown shells, existing machine learning-based shell identification technology focuses on how to select appropriate features. The choice of feature set determines the efficiency of shell identification, and it cannot effectively address the problem of identifying hybrid shells. While fingerprint feature library-based identification technology can solve the problem of hybrid shell identification, many currently invalidated shell application fingerprints are not available, and it does not provide a corresponding solution for shell removal. Therefore, it is necessary to effectively handle Android malicious shell applications by building a fingerprint feature library and a fingerprint classification mapping library, and then identify and classify the shelled malicious applications of Android malicious applications. This can address the identification and classification of hybrid shells and provide a corresponding shell removal solution. Summary of the Invention

[0005] The technical problem to be solved by this invention is to provide a method for identifying and classifying malicious Android applications that are packed with malware. Based on a constructed fingerprint feature library and fingerprint classification mapping library, this method can achieve the function of identifying and classifying malicious Android applications that are packed with malware while ensuring a high degree of accuracy. The technical solution is as follows:

[0006] A method for identifying and classifying malicious Android applications that are packed with malware, comprising the following steps:

[0007] Step 1: Collect the fingerprint features of Android packers and existing packer identification tools, perform manual reverse analysis, obtain the packer fingerprint feature labels of the packers, and then build a fingerprint feature library;

[0008] Step 2: Classify malicious Android packed applications according to the characteristics of the packing technology. Establish a mapping relationship between packed fingerprints and packed categories based on the characteristics of packing services provided by different vendors, obtain fingerprint classification mapping labels, and then build a packed fingerprint classification mapping library.

[0009] Step 3: Collect mainstream depacketizing tools from academia and industry. For the classified Android-packed malicious applications with different packing methods, derive the depacketizing tool labels corresponding to the malicious applications of the packer vendors to provide depacketizing solutions.

[0010] Step 4: Use an unpacking tool to unpack the Android packed malicious application, extract the corresponding features, and match them with the fingerprint feature library in step 1 to obtain the corresponding packed fingerprint feature label, thereby identifying the packer manufacturer category and hybrid packer category of the Android packed malicious application;

[0011] Step 5: Match the packer manufacturer category obtained in step 4 with the packer fingerprint classification mapping library built in step 2 to obtain the packer category to which the Android packer malicious application belongs, thereby achieving rapid classification of the Android packer malicious application;

[0012] Step 6: Based on the classification results in step 5, use the depacketizing tools collected in step 3 to provide a corresponding depacketizing solution for each type of Android packed malicious application.

[0013] Furthermore, the construction of the fingerprint classification mapping library in step 2 specifically includes:

[0014] Step 2.1: Classify the characteristics of Android packer applications into three categories: first-generation packer technology - Dex overall packer technology, second-generation packer technology - Dex function extraction, and third-generation packer technology - Dex2C / VMP;

[0015] Step 2.2: Research the packing methods on different vendors’ homepages;

[0016] Step 2.3: For those that do not have a clear mapping relationship on the manufacturer's homepage, analyze the Android packed malicious application samples within a specific time period and manually reverse analyze the characteristics of the packers to obtain the mapping relationship of the manufacturer's packing technology and the differences in packing technology between the enterprise version and free version of different manufacturers.

[0017] Step 2.4: Further calculate the mapping relationship between different manufacturers' packing methods and packing categories, and build a packing fingerprint classification mapping library.

[0018] Compared with the prior art, the beneficial effects of the present invention are: based on the constructed fingerprint feature library, fingerprint classification mapping library and depacketing tool set, the present invention can effectively realize the identification and classification of packed malicious applications in Android malicious applications, can identify hybrid packed applications, and can also provide an effective depacketing solution for Android packed malicious applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flowchart for identifying and classifying malicious Android applications in the present invention.

[0020] Figure 2 This is a category classification diagram of the Android shell technology in step 2 of the present invention. DETAILED DESCRIPTION

[0021] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] First, the packing features of Android packed malicious applications are collected and a packing fingerprint feature library is constructed. Then, the corresponding relationships between packing categories of different packing manufacturers are counted to construct a fingerprint classification mapping library. Finally, the application is unpacked by the Android malicious application unpacking program, and the rules are matched through the fingerprint feature library and the classification mapping library. A method for identifying and classifying Android packed malicious applications is proposed. The flow chart is as follows: Figure 1 As shown, the following steps are included:

[0023] Step 1: Collect the fingerprint features of Android packer manufacturers and existing packer identification tools, and perform manual reverse analysis to obtain the packer fingerprint feature labels of the packer manufacturers, thereby building a fingerprint feature library.

[0024] We used various Android shell identification tools and shell manufacturer fingerprints, and manually analyzed the Android shell application fingerprints. Finally, we were able to build a fingerprint feature library of 51 categories of 41 manufacturers based on the dex file features, so file features, and ELF file features.

[0025] Step 2: Classify the Android packed malicious applications according to the characteristics of the packing technology, such as Figure 2 As shown, according to the characteristics of the packing services of different manufacturers, a mapping relationship between packing fingerprints and packing categories is established to obtain fingerprint classification mapping labels, thereby constructing a packing fingerprint classification mapping library.

[0026] The classification method of the present invention is to build a fingerprint classification mapping library for Android malicious applications, which requires building a mapping relationship between the characteristics of the packing manufacturer and the type of packing technology. The specific steps are:

[0027] First, we categorize Android packer apps based on their characteristics into three categories: first-generation packer technology (Dex full packer), second-generation packer technology (Dex function extraction), and third-generation packer technology (Dex2C / VMP). Next, we research packer methods from different manufacturers. Many manufacturers clearly list their packer types on their homepages. For example, Dingxiang's packer methods are divided into Basic and Enterprise Editions. The Basic Edition only includes the first-generation packer technology, while the Enterprise Edition includes the first, second, and third generations of packer technology.

[0028] Secondly, for those that do not have a clear mapping relationship on the manufacturer's homepage, we analyzed the Android packed malicious application samples in the past four years and manually reverse analyzed the characteristics of the shell. We selected 200 Android malicious samples from VirusShare 2019-2022, and obtained the mapping relationship of the manufacturer's packing technology through manual reverse analysis, as well as the differences in packing technology between the enterprise version and free version of different manufacturers.

[0029] Finally, we further analyzed the mapping between different vendors' packing methods and packing categories, and constructed a packing fingerprint classification mapping library. Through extensive research, we found that vendors rarely use separate packing methods for the second and third categories. Furthermore, since the second and third packing methods were not found among vendors, the fingerprint classification mapping library was ultimately divided into four categories: first-generation packing, a combination of the first and second generation packing methods, a combination of the first and third generation packing methods, and a combination of the first, second, and third generation packing methods.

[0030] Step 3: Use the unpacking tool to unpack the Android packed malicious application, extract the corresponding features and match them with the fingerprint feature library in step 1 to obtain the corresponding shell fingerprint label, thereby identifying the packer manufacturer category and hybrid packer category of the Android packed malicious application.

[0031] After obtaining the fingerprint classification mapping library, the present invention collects mainstream depacketizing tools from academia and industry, and can provide appropriate depacketizing solutions for classified Android malicious applications with different packing methods.

[0032] Step 4: Use the unpacking tool to unpack the Android packed malicious application, extract the corresponding features and match them with the fingerprint feature library in step 1 to obtain the corresponding shell fingerprint label, thereby identifying the packer manufacturer category and hybrid packer category of the Android packed malicious application.

[0033] The present invention adopts a fingerprint feature matching method. In order to improve the efficiency of identifying malicious shell applications in Android, this embodiment collects and constructs a fingerprint feature library of 51 categories from 41 manufacturers, which can more accurately identify the manufacturer type of the shell.

[0034] In order to further verify the accuracy of the shell identification method for Android malicious applications, this embodiment collected a data set of 286,097 Android malicious applications from 2016 to 2022 on VirusShare, and used this method and other tools to process the data set accordingly, and finally continuously optimized the recognition accuracy.

[0035] Step 5: Match the packer manufacturer category obtained in step 4 with the packer fingerprint classification mapping library built in step 2 to obtain the packer category to which the Android packer malicious application belongs, thereby achieving rapid classification of the Android packer malicious application.

[0036] This embodiment rapidly classifies Android-packed malicious applications by processing the vendor classification results of the Android-packed malicious applications obtained in step 4 using the fingerprint classification feature library in step 2. Fifty samples of each category of packed malicious applications are then randomly selected and manually analyzed to further verify the classification accuracy.

[0037] Step 6: Finally, based on the classification results in step 5, using the depacketizing tools collected in step 3, we can quickly provide a suitable depacketizing solution for each type of Android packed malicious application.

[0038] Specifically, assuming that the input sequence of the present invention is S=[s1,...,s n ], where s n is the input vector of the nth Android malicious application. The input sequence S can be obtained through step 4.

[0039] L=[l1,...,l n ] is the fingerprint tag of the packer manufacturer, where l n is the fingerprint feature label of the n-th manufacturer’s packed file. The fingerprint feature label sequence L can be obtained through step 1.

[0040] W=[w1,...,w n ] is the fingerprint classification mapping label of the packer manufacturer, where w n is the fingerprint classification mapping label of the nth manufacturer. Through step 2, the fingerprint classification mapping label sequence W can be obtained.

[0041] V=[v1,...,v n ] is the depacketizing tool tag corresponding to the malicious application of the packer manufacturer, among which V n This is the depacketizing tool tag corresponding to the malicious application of the nth packer manufacturer, which can be obtained through step 3.

[0042] In step 4, we first use the unpacking tool to process the input sequence S, and then use the fingerprint feature label L to match the extracted fingerprints to obtain S. i The corresponding fingerprint tag l i This allows for quick and accurate identification of the packer manufacturer category of Android packer malicious applications. i and l iThey represent the input and output labels in step 4 respectively.

[0043] In step 5, the fingerprint classification mapping label W is used to process the input sequence L to obtain l i The corresponding fingerprint classification mapping label w i This will allow you to quickly categorize malicious Android applications. i and w i They represent the input and output labels in step 5 respectively.

[0044] In step 6, use the unpacking tool tag to process the V input sequence W to get w i Corresponding unpacking tool tag v i This can provide a suitable unpacking solution for Android malicious applications. i and v i They represent the input and output labels in step 5 respectively.

[0045] Finally, the above steps can be used to identify and classify malicious Android application shells.

[0046] The method for identifying and classifying Android packed malicious applications described in the method of the present invention can realize rapid identification and classification of Android packed malicious applications by constructing a fingerprint feature library, a fingerprint classification mapping library, and a shelling tool set, can solve the problem of hybrid packed identification, and can also provide an effective shelling solution for Android packed malicious applications.

Claims

1. A method for identifying and classifying malicious Android applications, characterized in that: The following steps are involved: Step 1: Collect the fingerprint features of Android packers and existing packer identification tools, perform manual reverse analysis, obtain the packer fingerprint feature labels of the packers, and then build a fingerprint feature library; Step 2: Classify malicious Android packed applications according to the characteristics of the packing technology. Establish a mapping relationship between packed fingerprints and packed categories based on the characteristics of packing services provided by different vendors, obtain fingerprint classification mapping labels, and then build a packed fingerprint classification mapping library. The construction of the fingerprint classification mapping library in step 2 specifically includes: Step 2.1: Classify the characteristics of Android packer applications into three categories: first-generation packer technology - Dex overall packer technology, second-generation packer technology - Dex function extraction, and third-generation packer technology - Dex2C / VMP; Step 2.2: Research the packing methods on different vendors’ homepages; Step 2.3: For those cases where there is no clear mapping relationship on the manufacturer's homepage, analyze the samples of Android packed malicious applications within a specific time period and manually reverse-engineer the packer features to obtain the mapping relationship between the manufacturer's packing technology and the differences in packing technology between the enterprise and free versions of different manufacturers; Step 2.4: Further calculate the mapping relationship between different manufacturers' packing methods and packing categories, and build a packing fingerprint classification mapping library; Step 3: Collect mainstream depacketizing tools from academia and industry. For the classified Android-packed malicious applications with different packing methods, derive the depacketizing tool labels corresponding to the malicious applications of the packer vendors to provide depacketizing solutions. Step 4: Use an unpacking tool to unpack the Android packed malicious application, extract the corresponding features, and match them with the fingerprint feature library in step 1 to obtain the corresponding packed fingerprint feature label, thereby identifying the packer manufacturer category and hybrid packer category of the Android packed malicious application; Step 5: Match the packer manufacturer category obtained in step 4 with the packer fingerprint classification mapping library built in step 2 to obtain the packer category to which the Android packer malicious application belongs, thereby achieving rapid classification of the Android packer malicious application; Step 6: Based on the classification results in step 5, use the depacketizing tools collected in step 3 to provide a corresponding depacketizing solution for each type of Android packed malicious application.

Images