A method and apparatus for detecting similar applications

CN117807453BActive Publication Date: 2026-10-23UNIV OF JINAN
View PDF 2 Cites 0 Cited by

Patent Information

Application Number
CN202410091610.0
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2024-01-22
Publication Date
2026-10-23
Estimated Expiration
2044-01-22

AI Technical Summary

Technical Problem

这种不足凸显了寻找相似应用程序的局限性

Benefits of technology

[0030]1、本发明从多个维度进行相似性检测,提高了应用程序相似性的准确率。传统方法通常只依赖于应用名称、图标等静态特征,而本发明综合考虑了多个方面,针对静态特征(包括图标、元数据、文本和依赖库等)、页面结构和CSS框架进行全面多维度的应用程序相似度检测,更全面地评估应用程序的相似性,降低误报率和漏报率。

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN117807453B_ABST
    Figure CN117807453B_ABST
Patent Text Reader

Abstract

The application relates to the technical field of computers, and provides a similar application program detection method and device. The application performs similarity detection from multiple dimensions, and improves the accuracy of application program similarity. The application comprehensively considers multiple aspects, performs comprehensive multidimensional application program similarity detection on static characteristics (including icons, metadata, texts and dependent libraries), page structures and CSS frameworks, more comprehensively evaluates the similarity of the application programs, and reduces the false positive rate and the false negative rate.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and apparatus for detecting similar applications. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] As the number of applications increases, so too will the number of similar applications. These similar applications may involve different developers and companies, but they may be highly similar in function, interface, or purpose. This can lead to user confusion and potentially increase intellectual property disputes. Therefore, users need smarter similar application detection tools to help them quickly find applications that match their needs and interests, thereby improving user experience and avoiding the download of malicious or insecure applications. Furthermore, developers and app stores urgently need a more accurate method to detect similar applications in order to better manage and recommend applications while avoiding intellectual property disputes.

[0004] Current methods for finding similar applications typically rely on static features such as application name and icon, but these methods neglect a comprehensive consideration of how the application actually behaves in the real world. This shortcoming highlights the limitations of finding similar applications. Summary of the Invention

[0005] To address the technical problems existing in the background art, the present invention provides a method and apparatus for detecting similar applications. The present invention can efficiently and accurately detect similar applications, not only considering static features such as application names and icons, but also comprehensively analyzing the functional and interface similarity of applications in actual use by simulating user operations, thereby meeting the ever-growing demand of users for application search and matching.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] The first aspect of the present invention provides a method for detecting similar applications.

[0008] A method for detecting similar applications includes:

[0009] Based on the target application input, crawl the system's built-in recommended applications as a control dataset;

[0010] The comparison dataset is decompiled to obtain the corresponding source code application.

[0011] Based on the static features of the source code application, calculate the first similarity between the target application and the source code application. Determine if the first similarity exceeds a first threshold. If so, output the corresponding recommended application; otherwise...

[0012] The system dynamically debugs and compares recommended applications in the dataset, parsing pages in real time to obtain page structure and CSS framework information. Based on this information, it calculates the similarity between the target application and the recommended application in terms of both page structure and CSS framework information. A second similarity score is obtained by weighting the similarity scores of these two scores. Finally, it checks if the second similarity score exceeds a second threshold. If so, it outputs the corresponding recommended application; otherwise, the process ends.

[0013] Furthermore, the process of crawling the system's built-in recommended applications as a reference dataset based on the input target application includes: automatically configuring program dependency packages and downloading Apktool to add to system variables; downloading Appium and NoxPlayer emulator and configuring the usage environment; and using the target application to crawl recommended applications from several application service providers within the system, processed by their own recommendation systems.

[0014] Furthermore, the process of calculating the first similarity between the target application and the source code application based on the static features of the source code application includes: obtaining the icon of the source code application, preprocessing the icon and converting it into a grayscale image, and calculating the similarity between the icon of the target application and the icon of the source code application.

[0015] Furthermore, the process of calculating the first similarity between the target application and the source code application based on the static features of the source code application also includes: obtaining the metadata of the source code application, comparing the metadata of the target application with the metadata of the source code application, and calculating the similarity between the metadata of the target application and the metadata of the source code application.

[0016] Furthermore, the process of calculating the first similarity between the target application and the source code application based on the static features of the source code application also includes: obtaining the introductory text of the source code application, performing vectorization processing, and calculating the similarity between the text vector of the target application and the text vector of the source code application.

[0017] Furthermore, the process of calculating the first similarity between the target application and the source code application based on the static features of the source code application also includes: using the Apktool tool to parse the apk file, extracting the files with the .so extension and storing them in a set, and using the Jaccard coefficient to iterate and calculate the similarity between the target application and the source code application.

[0018] Furthermore, the process of dynamically debugging the recommended applications in the comparison dataset and parsing the pages in real time includes: simulating user click operations on the application, dynamically debugging the application, using the API provided by Appium to parse the application pages in real time, obtaining the source code of the application pages, and saving it as an XML file, which includes the application's page structure information and CSS frame information.

[0019] A second aspect of the present invention provides a detection device for similar applications.

[0020] A detection device for similar applications includes:

[0021] The data acquisition module is configured to crawl the system's built-in recommended applications as a comparison dataset based on the input target application.

[0022] The decompilation module is configured to decompile a comparison dataset to obtain the corresponding source code application.

[0023] The first similarity module is configured to: calculate a first similarity between the target application and the source code application based on the static features of the source code application; determine whether the first similarity exceeds a first threshold; if so, output the corresponding recommended application; otherwise...

[0024] The second similarity module is configured to: dynamically debug the recommended applications in the comparison dataset, parse the pages in real time, and obtain the page structure information and CSS framework information of the recommended applications; based on the page structure information and CSS framework information of the recommended applications, calculate the similarity of the page structure information and the CSS framework information between the target application and the recommended application, respectively; obtain the second similarity based on the weighted value of the similarity of the page structure information and the CSS framework information; determine whether the second similarity exceeds the second threshold, and if so, output the corresponding recommended application; otherwise, end.

[0025] A third aspect of the present invention provides a computer-readable storage medium.

[0026] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the method for detecting similar applications as described in the first aspect above.

[0027] A fourth aspect of the present invention provides a computer device.

[0028] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps in the method for detecting similar applications as described in the first aspect above.

[0029] Compared with the prior art, the beneficial effects of the present invention are:

[0030] 1. This invention performs similarity detection from multiple dimensions, improving the accuracy of application similarity assessment. Traditional methods typically rely only on static features such as application name and icon, while this invention comprehensively considers multiple aspects, performing comprehensive and multi-dimensional application similarity detection on static features (including icons, metadata, text, and dependency libraries), page structure, and CSS framework. This provides a more comprehensive assessment of application similarity and reduces false positive and false negative rates.

[0031] 2. This invention takes into account the real-world behavior of applications. By simulating user operations, performing dynamic debugging, and parsing application pages in real time, it more accurately reflects the behavior and performance of applications in actual use. This invention achieves automated testing of applications and can calculate their similarity in real time.

[0032] 3. This invention features a highly scalable and modular design, allowing it to be easily expanded with other modules or embedded into other detection systems to adapt to evolving applications and malicious activities. This modularity makes the system easier to maintain and upgrade.

[0033] 4. This invention can effectively identify the input application and output other similar applications. This technology helps mobile application developers and research institutions analyze these similar applications more deeply, thus providing valuable research tools for professionals in the mobile application field. It also helps improve the user's application discovery experience while reducing the risk of intellectual property disputes. Considering the explosive growth in the number of applications and the importance of user experience, this invention is expected to meet the demand for high accuracy in similar application detection in the future. Attached Figure Description

[0034] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0035] Figure 1 This is a framework diagram of the detection method for similar applications shown in this invention;

[0036] Figure 2 This is a schematic diagram of the static features shown in this invention;

[0037] Figure 3 This is a flowchart illustrating a method for detecting similar applications as shown in this invention. Detailed Implementation

[0038] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0039] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0040] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0041] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and systems according to various embodiments of this disclosure. It should be noted that each block in a flowchart or block diagram may represent a module, segment, or portion of code, which may include one or more executable instructions for implementing the logical functions specified in the various embodiments. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutively represented blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, may be implemented using a dedicated hardware-based system that performs the specified functions or operations, or using a combination of dedicated hardware and computer instructions.

[0042] Example 1

[0043] This embodiment provides a method for detecting similar applications. This embodiment uses the application of this method to a server as an example for illustration. It is understood that this method can also be applied to terminals, and can also be applied to systems including terminals, servers, and other components, and can be implemented through interaction between the terminal and the server. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network servers, cloud communication, middleware services, domain name services, CDN security services, and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not limited herein. In this embodiment, the method includes:

[0044] Based on the target application input, crawl the system's built-in recommended applications as a control dataset;

[0045] The comparison dataset is decompiled to obtain the corresponding source code application.

[0046] Based on the static features of the source code application, calculate the first similarity between the target application and the source code application. Determine if the first similarity exceeds a first threshold. If so, output the corresponding recommended application; otherwise...

[0047] The system dynamically debugs and compares recommended applications in the dataset, parsing pages in real time to obtain page structure and CSS framework information. Based on this information, it calculates the similarity between the target application and the recommended application in terms of both page structure and CSS framework information. A second similarity score is obtained by weighting the similarity scores of these two scores. Finally, it checks if the second similarity score exceeds a second threshold. If so, it outputs the corresponding recommended application; otherwise, the process ends.

[0048] The technical solution of this embodiment will be described in detail below, such as... Figure 1 , Figure 3 As shown, the method described in this embodiment includes the following steps:

[0049] Step (1): Configure the usage environment and enter the target application;

[0050] Step (2): Obtain the comparison dataset through the application service provider built into the system;

[0051] Step (3): Decompile the application;

[0052] Step (4): Calculate the first similarity based on the static features of the application, determine and output similar applications;

[0053] Step (5): Dynamically debug the application and parse the page in real time;

[0054] Step (6): Calculate the second similarity using the application's page structure and CSS framework, and determine and output similar applications.

[0055] Specifically, step (1) consists of the following steps:

[0056] Step (1-1): Use the command "bash. / script.sh" to automatically configure program dependencies and download Apktool to add to system variables, and download Appium and NoxPlayer emulator and configure the usage environment.

[0057] Step (1-2): The user enters the target application.

[0058] In some embodiments, step (2) involves: using the target application information as keywords, crawling recommended applications from several application service providers built into the system after processing by their own recommendation systems as a comparison dataset.

[0059] In this invention, step (3) is as follows: use the Apktool tool to decompile the application in the comparison dataset to obtain the corresponding source code file (such as Smali code file).

[0060] like Figure 2 As shown, more specifically, step (4) consists of the following steps:

[0061] Step (4-1): For the static feature of the application: the icon, crawl the icons from the comparison dataset of several application service providers built into the system and save them. After reading the icon image, use cv2.resize to adjust the image to the same size, use cv2.cvtColor to convert the image to grayscale, and use the SSIM algorithm to calculate the similarity between the application icon and all application icons in the comparison dataset. The algorithm formula is as follows:

[0062] SSIM(x,y)=[l(x,y)] α [c(x,y)] β [s(x,y)] γ

[0063] In this model, l(x,y) compares the brightness of x and y, c(x,y) compares the contrast of x and y, s(x,y) compares the structure of x and y, and α, β, and γ are parameters that adjust the relative importance of l(x,y), c(x,y), and s(x,y). The value of SSIM ranges from -1 to 1. The closer the value is to 1, the more similar the two images are; the closer it is to -1, the greater the difference between the two images.

[0064] Step (4-2): For the static characteristics of the application: metadata, use the Apktool tool to parse the application's APK package, parse the manifest.xml file, and obtain the application's metadata, including the application name, package name, signature, version number, and developer information.

[0065] Step (4-3): Compare the metadata of the current application with that of the reference dataset, and use a fuzzy matching algorithm such as Levenshtein distance to calculate the similarity. The distance formula is as follows:

[0066]

[0067] Where |a| and |b| represent the lengths of strings a and b, respectively, tail(a) represents all characters except the first character of a, head(a) represents the first character of a, lev(a,b) represents the Levenshtein distance between the two strings a and b, and min represents the minimum value function. The Levenshtein distance represents the minimum number of editing operations required to transform one string into another, including insertion, deletion, and replacement of characters.

[0068] Step (4-4): For the static feature of the application: text, crawl and save the application description text from the comparison datasets of several application service providers built into the system. Use TfidfVectorizer to vectorize the description text using TF-IDF, and then use the TF-IDF algorithm to calculate the similarity between the two texts. The algorithm formula is as follows:

[0069] tfidf(t,d,D)=tf(t,d)·idf(t,D)

[0070] Where t represents a word, d represents a document, D represents the set containing all documents, TF-IDF is the term frequency, indicating how often a word appears in a document, and idF is the inverse document frequency, calculated as the inverse logarithm of the number of documents containing the word. If a word appears frequently in a specific document but is common in the entire corpus, its TF-IDF score will be relatively low. Conversely, if a word appears frequently in a specific document but is relatively scarce in the entire corpus, its TF-IDF score will be relatively high, indicating its high importance in that document.

[0071] Steps (4-5): For the static features of the application: dependency libraries, use the Apktool tool to parse the APK file, extract the files with the .so extension and store them in a collection. Use the Jaccard coefficient to calculate the similarity between the selected application and the control dataset. The formula for the Jaccard coefficient is as follows:

[0072]

[0073] Here, A and B are two given sets, A∩B is defined as the intersection of A and B, and A∪B is defined as the union of A and B. The Jaccard coefficient ranges from 0 to 1, and a larger Jaccard coefficient indicates a higher similarity.

[0074] Steps (4-6): The similarity results of the static features of the application are weighted according to the proportion of the static features to calculate the first similarity. Check whether it exceeds the first similarity threshold. If it exceeds, output that it is a similar application and end. Otherwise, continue to step 5.

[0075] In some embodiments, step (5) is as follows:

[0076] Step (5-1): Use the command line "adb install appPackage.apk" to install the application in the dataset onto NoxPlayer, where "adb install" is the installation command and "appPackage.apk" represents the name of the APK file to be installed.

[0077] Step (5-2): Run the command "adb shell monkey -p appPackage -v str(click_count)" to simulate user clicks on the application and dynamically debug the application. The "adb shell monkey" command is used to simulate various user operations on the device, "-p appPackage" specifies the package name of the application to be run, "-v" is used to specify detailed log information to be output, and "str(click_count)" is a parameter that represents the number of events to be executed.

[0078] Step (5-3): Use the API provided by Appium to parse the application page in real time, use driver1.page_source to get the source code of the application page, and save it as an XML file, which includes the application's page structure information and CSS frame information.

[0079] Specifically, step (6) is as follows:

[0080] Step (6-1): Based on the application's page structure information, use the xml.etree.ElementTree library to parse the application's page structure information, traverse the tree nodes and add the node labels to a list, and use difflib.SequenceMatcher to compare the similarity of the two label sequences.

[0081] Step (6-2): For the application's CSS framework information, parse the XML string into an ElementTree object, then recursively traverse the XML tree, check if each element has a class attribute, split the CSS class name in the attribute value and add it to a collection.

[0082] Step (6-3): Calculate the CSS frame similarity between the target application and the control dataset based on the Jaccard coefficient.

[0083] Step (6-4): The similarity results of the application's page structure and CSS framework are weighted according to their respective proportions to calculate the second similarity. The second similarity threshold is checked. If it is exceeded, the application is output as a similar application and the process ends; otherwise, the process ends directly.

[0084] Example 2

[0085] This embodiment provides a detection device for similar applications.

[0086] A detection device for similar applications includes:

[0087] The data acquisition module is configured to crawl the system's built-in recommended applications as a comparison dataset based on the input target application.

[0088] The decompilation module is configured to decompile a comparison dataset to obtain the corresponding source code application.

[0089] The first similarity module is configured to: calculate a first similarity between the target application and the source code application based on the static features of the source code application; determine whether the first similarity exceeds a first threshold; if so, output the corresponding recommended application; otherwise...

[0090] The second similarity module is configured to: dynamically debug the recommended applications in the comparison dataset, parse the pages in real time, and obtain the page structure information and CSS framework information of the recommended applications; based on the page structure information and CSS framework information of the recommended applications, calculate the similarity of the page structure information and the CSS framework information between the target application and the recommended applications, respectively; obtain the second similarity based on the weighted value of the similarity of the page structure information and the CSS framework information; determine whether the second similarity exceeds the second threshold, and if so, output the corresponding recommended application; otherwise, end.

[0091] It should be noted that the data acquisition module, decompilation module, first similarity module, and second similarity module described above are the same examples and application scenarios implemented in Embodiment 1, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the above modules, as part of a system, can be executed in a computer system such as a set of computer-executable instructions.

[0092] Example 3

[0093] This embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the similar application detection method described in Embodiment 1 above.

[0094] Example 4

[0095] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the similar application detection method described in Embodiment 1 above.

[0096] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0097] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0098] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0099] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0100] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0101] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting similar applications, characterized in that, include: Based on the target application input, crawl the system's built-in recommended applications as a control dataset; The comparison dataset is decompiled to obtain the corresponding source code application. Based on the static features of the source code application, calculate the first similarity between the target application and the source code application, determine whether the first similarity exceeds the first threshold, and if so, output the corresponding recommended application. otherwise, Dynamically debug recommended applications in the comparison dataset, parse the page in real time, and obtain the page structure information and CSS framework information of the recommended applications; Based on the page structure information and CSS frame information of the recommended application, the similarity of the page structure information and the similarity of the CSS frame information between the target application and the recommended application are calculated respectively. The second similarity is obtained by weighting the similarity between page structure information and CSS frame information; it is then determined whether the second similarity exceeds the second threshold. If so, the corresponding recommended application is output. Otherwise, end; The process of dynamically debugging the recommended applications in the comparison dataset and parsing the pages in real time includes: simulating user click operations on the application, dynamically debugging the application, using the API provided by Appium to parse the application pages in real time, obtaining the source code of the application pages, and saving it as an XML file, which includes the application's page structure information and CSS framework information. For the application's page structure information, the xml.etree.ElementTree library is used to parse the application's page structure information, traverse the tree nodes and add the node tags to a list, and use difflib.SequenceMatcher to compare the similarity of two tag sequences; for the application's CSS framework information, the XML string is parsed into ElementTree objects, and then the XML tree is recursively traversed, checking whether each element has a class attribute, splitting the CSS class name in the attribute value and adding it to a collection; The similarity of the CSS framework between the target application and the control dataset is calculated based on the Jaccard coefficient.

2. The method for detecting similar applications according to claim 1, characterized in that, The process of crawling the system's built-in recommended applications as a reference dataset based on the input target application includes: automatically configuring program dependency packages and downloading Apktool to add to system variables; downloading Appium and NoxPlayer emulator and configuring the usage environment; and using the target application to crawl the system's built-in application service providers' recommended applications after processing by their own recommendation systems.

3. The method for detecting similar applications according to claim 1, characterized in that, The process of calculating the first similarity between the target application and the source code application based on the static features of the source code application includes: obtaining the icon of the source code application, preprocessing the icon and converting it into a grayscale image, and calculating the similarity between the icon of the target application and the icon of the source code application.

4. The method for detecting similar applications according to claim 1, characterized in that, The process of calculating the first similarity between the target application and the source code application based on the static features of the source code application further includes: obtaining the metadata of the source code application, comparing the metadata of the target application with the metadata of the source code application, and calculating the similarity between the metadata of the target application and the metadata of the source code application.

5. The method for detecting similar applications according to claim 1, characterized in that, The process of calculating the first similarity between the target application and the source code application based on the static features of the source code application further includes: obtaining the brief text of the source code application, performing vectorization processing, and calculating the similarity between the text vector of the target application and the text vector of the source code application.

6. The method for detecting similar applications according to claim 1, characterized in that, The process of calculating the first similarity between the target application and the source code application based on the static features of the source code application further includes: using the Apktool tool to parse the apk file, extracting the files with the .so extension and storing them in a set, and using the Jaccard coefficient to iterate and calculate the similarity between the target application and the source code application.

7. A detection device for similar applications, characterized in that, include: The data acquisition module is configured to crawl the system's built-in recommended applications as a comparison dataset based on the input target application. The decompilation module is configured to decompile a comparison dataset to obtain the corresponding source code application. The first similarity module is configured to: calculate the first similarity between the target application and the source code application based on the static features of the source code application, determine whether the first similarity exceeds a first threshold, and if so, output the corresponding recommended application; otherwise, The second similarity module is configured to: dynamically debug the recommended applications in the comparison dataset, parse the pages in real time, and obtain the page structure information and CSS framework information of the recommended applications; Based on the page structure information and CSS frame information of the recommended application, the similarity of the page structure information and the similarity of the CSS frame information between the target application and the recommended application are calculated respectively. The second similarity is obtained by weighting the similarity between page structure information and CSS frame information; it is then determined whether the second similarity exceeds the second threshold. If so, the corresponding recommended application is output. Otherwise, end; The process of dynamically debugging the recommended applications in the comparison dataset and parsing the pages in real time includes: simulating user click operations on the application, dynamically debugging the application, using the API provided by Appium to parse the application pages in real time, obtaining the source code of the application pages, and saving it as an XML file, which includes the application's page structure information and CSS framework information. For the application's page structure information, the xml.etree.ElementTree library is used to parse the application's page structure information, traverse the tree nodes and add the node tags to a list, and use difflib.SequenceMatcher to compare the similarity of two tag sequences; for the application's CSS framework information, the XML string is parsed into ElementTree objects, and then the XML tree is recursively traversed, checking whether each element has a class attribute, splitting the CSS class name in the attribute value and adding it to a collection; The similarity of the CSS framework between the target application and the control dataset is calculated based on the Jaccard coefficient.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the detection method for similar applications as described in any one of claims 1-6.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the method for detecting similar applications as described in any one of claims 1-6.

Citation Information

Patent Citations

  • Precaution method for Android malicious application program based on code behavior similarity matching

    CN105893848A

  • Application program similarity detection method and device and computer equipment

    CN112346779A