Anti-fraud method and system by deeply analyzing APK (Android Package) information and computer equipment

Abstract

The embodiment of the invention discloses an anti-fraud method by deeply analyzing APK information, computer equipment and a system. The method comprises the steps that an APK file is loaded and read, and analysis, decompilation, static analysis and dynamic network package capture are carried out; querying and analyzing the obtained domain name information to obtain an IP address; and inquiring domain name registrant information and user information based on the IP address and the domain name information, and labeling, studying and judging the domain name registrant information and the user information to judge whether an illegal behavior exists or not. By implementing the embodiment of the invention, the beneficial effects are as follows: the APK is automatically analyzed, and the domain name and the server used by the criminal gang can be quickly found according to the criterion; the domain name of the criminal gang and the IP of the server are subjected to certification adjustment and analysis, and related information such as a server user, use time and use business is obtained; the IP and the domain name are analyzed and inquired, so that whether the server is used for illegal purposes or not can be quickly judged; and whether the APK is used for illegal use can be judged by analyzing the APK features.

Description

Technical Field

[0001] The present invention relates to the technical field of online fraud case analysis, and in particular to an anti-fraud method, system and computer equipment through in-depth analysis of APK information. Background Art

[0002] In recent years, with the development of information technology, various types of online fraud cases have continued to increase. Most fraud cases rely on information tools such as mobile phones, mobile application APPs, online payments, and cloud servers. They are characterized by large amounts of information and reliance on computer network services across regions, service providers, and multiple service providers. The collection of online fraud information data, the analysis of crime patterns, and advance warning capabilities have become important topics.

[0003] At present, the traditional analysis methods of online fraud cases have many drawbacks:

[0004] First, it can only extract basic information of mobile application APK, which makes it difficult to find key information related to the case;

[0005] Second, the ability to warn of online fraud is poor, the analysis of criminal activity patterns is unintelligent, and the efficiency of case analysis is low. Summary of the invention

[0006] In view of the technical defects of the prior art, the purpose of the embodiments of the present invention is to provide an anti-fraud method, system and computer device through in-depth analysis of APK information.

[0007] To achieve the above objectives, in a first aspect, an embodiment of the present invention provides an anti-fraud method by deeply analyzing APK information, comprising:

[0008] Loading and reading an APK file from a user, and parsing, decompiling, and statically analyzing the APK file to obtain first information; the first information includes the user's domain name information, a first IP address, and related third-party service information used;

[0009] The APK file is run on a simulator and dynamically captured on a network to obtain second information; the second information includes domain name information, a second IP address, and network packet related information of the APK file;

[0010] Query and resolve the domain name information in the first information or the second information to obtain a third IP address;

[0011] Querying and inspecting the first IP address, the second IP address, the third IP address and the domain name information;

[0012] Querying domain name registrant information and user information based on the first IP address, the second IP address, the third IP address and the domain name information;

[0013] Label and analyze the domain name registrant information and user information to determine whether there is any illegal behavior.

[0014] As a specific implementation of the present application, the APK file is loaded and read from the user, and the APK file is parsed, decompiled and statically analyzed, specifically:

[0015] Load and read the APK file from the user, and parse the APK file to obtain basic information; the basic information includes application name, application ID, signature information, file size, third-party service information used by the file, APK icon, APK md5 information and code information;

[0016] The code information is statically analyzed to obtain the domain name information and the first IP address of the user.

[0017] As a specific implementation of the present application, the first IP address, the second IP address, the third IP address and the domain name information are queried, specifically:

[0018] The first IP address, the second IP address, the third IP address and the domain name information are queried to obtain the corresponding IP address locations and operator information.

[0019] In a second aspect, the embodiment of the present application further provides an anti-fraud system by deeply analyzing APK information, including:

[0020] An APK parsing module, used to load and read an APK file from a user, and parse, decompile and statically analyze the APK file to obtain first information; the first information includes the user's domain name information, the first IP address and basic server information;

[0021] An APK packet capture module, used to perform simulator operation and dynamic network packet capture on the APK file to obtain second information; the second information includes domain name information, a second IP address and network packet related information of the APK file;

[0022] An information query module, used to query and parse the domain name information in the first information or the second information to obtain third information; the third information includes domain name registration information, domain name binding IP information, IP address ownership information, IP address operator information and APK filing information;

[0023] The verification module is used to verify the first IP address, the second IP address and the server.

[0024] As a specific implementation of the present application, the APK parsing module is specifically used for:

[0025] Load and read the APK file from the user, and parse the APK file to obtain basic information; the basic information includes application name, application ID, signature information, file size, third-party service information used by the file, APK icon, APK md5 information and code information;

[0026] The code information is statically analyzed to obtain the domain name information and the first IP address of the user.

[0027] Furthermore, as a preferred implementation of the present application, the anti-fraud system further includes:

[0028] An analysis module, used for analyzing the third information found;

[0029] The inspection module is used to inspect the basic information of the server and obtain server-related information; the server-related information includes the operating system, server development port, server business installation system and database.

[0030] Furthermore, as a preferred implementation of the present application, the certificate adjustment module is also used to:

[0031] Check the server registration information;

[0032] Remote connection server user information, domain name user information, and APK third-party service registration user information;

[0033] Label and analyze the server registration information, server user information, domain name user information, and APK third-party service registration and user information to determine whether there is any illegal behavior.

[0034] In a third aspect, an embodiment of the present invention provides a computer device for performing anti-fraud identification through in-depth analysis of APK information, comprising a processor, an input device, an output device and a memory, wherein the processor, input device, output device and memory are interconnected, wherein the memory is used to store a computer program, and the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method described in the first aspect above.

[0035] The anti-fraud identification solution based on deep analysis of APK information provided by the embodiment of the present invention has the following beneficial effects:

[0036] (1) Automatically analyze APKs to quickly find the domain names and servers used by criminal gangs;

[0037] (2) Investigate and analyze the criminal gang’s domain name and server IP to obtain relevant information such as server users, usage time, and usage business;

[0038] (3) By analyzing and inspecting IP and domain names, it is possible to quickly determine whether the server is used for illegal purposes;

[0039] (4) By analyzing the features of the APK, it is possible to determine whether the APK is used for illegal purposes. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the specific implementation of the present invention or the technical solution in the prior art, the drawings required for use in the specific implementation or the description of the prior art are briefly introduced below.

[0041] Figure 1 is a flow chart of an anti-fraud method by deeply analyzing APK information provided by an embodiment of the present invention;

[0042] Figure 2 yes Figure 1 Another flow chart of the anti-fraud method shown;

[0043] Figure 3 This is a diagram of the process of analyzing the victim's APK after a telecommunications fraud occurs;

[0044] Figure 4 is a structural diagram of a computer device provided by an embodiment of the present invention;

[0045] Figure 5 It is a structural diagram of an anti-fraud system through in-depth analysis of APK information provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0048] The technical problems to be solved by the embodiments of the present invention mainly include:

[0049] (1) Find the server used by the criminal through the criminal APK;

[0050] (2) Find criminal information through servers and IP addresses;

[0051] (3) Determine whether the IP and domain name are used for illegal activities.

[0052] To solve the above technical problems, the technical means of the present invention can be summarized as follows:

[0053] (1) Through the binding relationship between IP and domain name, and the binding relationship between domain name and IP, determine whether it is a label within a unit of time.

[0054] (2) Obtain the domain name and IP address of the backend server through static analysis, and perform static analysis based on application features and keywords.

[0055] (3) Obtain domain name and IP address through dynamic analysis.

[0056] (4) Query the full domain name and historical IP binding relationship through subdomain names to track historical records.

[0057] (5) Query the IP address location and determine the label.

[0058] Please refer to Figure 1 and Figure 2 The embodiment of the present invention provides an anti-fraud method by deeply analyzing APK information, including the steps of:

[0059] S1, load and read the APK file from the user, and parse, decompile and statically analyze the APK file to obtain first information.

[0060] The first information includes the user's domain name information, the first IP address and related third-party service information used.

[0061] In specific implementation, the APK file is loaded and read from the user, and the APK file is parsed to obtain basic information; the basic information includes application name, application ID, signature information, file size, third-party service information used by the file, APK icon, APK md5 information and code information;

[0062] The code information is statically analyzed to obtain the domain name information and the first IP address of the user.

[0063] It should be noted that there may be multiple first IP addresses.

[0064] S2, running the APK file on a simulator and dynamically capturing network packets to obtain second information.

[0065] The second information includes the domain name information of the APK file, the second IP address and network packet related information.

[0066] It should be noted that step S2 can be understood as a process of dynamically analyzing the APK file, and there may also be multiple second IP addresses obtained.

[0067] S3, query and parse the domain name information in the first information or the second information to obtain a third IP address.

[0068] In specific implementation, the domain name information obtained above is queried and parsed to obtain the bound IP address information.

[0069] S4, query and inspect the first IP address, the second IP address, the third IP address and the domain name information.

[0070] In specific implementation, the IP address obtained above is queried to obtain the corresponding IP address location and operator information.

[0071] S5, querying the domain name registrant information and user information based on the first IP address, the second IP address, the third IP address and the domain name information.

[0072] S6, labeling and analyzing the domain name registrant information and user information to determine whether there is any illegal behavior.

[0073] For example, query the full domain name and historical IP binding relationship through the subdomain name, track the historical records, and determine whether there is any illegal behavior based on the historical records and the domain name obtained from the current resolution.

[0074] In actual applications, after a telecommunications fraud occurs, the entire process of analyzing the victim's APK is as follows: Figure 3 shown.

[0075] From the above description, it can be seen that the anti-fraud identification solution based on deep analysis of APK information provided by the embodiment of the present invention has the following beneficial effects:

[0076] (1) Automatically analyze APKs to quickly find the domain names and servers used by criminal gangs;

[0077] (2) Investigate and analyze the criminal gang’s domain name and server IP to obtain relevant information such as server users, usage time, and usage business;

[0078] (3) By analyzing and inspecting IP and domain names, it is possible to quickly determine whether the server is used for illegal purposes;

[0079] (4) By analyzing the features of the APK, it is possible to determine whether the APK is used for illegal purposes.

[0080] Based on the same inventive concept, an embodiment of the present invention also provides a computer device for performing anti-fraud identification by deeply analyzing APK information. Figure 4 As shown, the computer device may include: one or more processors 101, one or more input devices 102, one or more output devices 103 and a memory 104, wherein the processors 101, the input devices 102, the output devices 103 and the memory 104 are interconnected via a bus 105. The memory 104 is used to store a computer program, wherein the computer program includes program instructions, and the processor 101 is configured to call the program instructions to execute the method of the above method embodiment.

[0081] It should be understood that in the embodiment of the present invention, the processor 101 may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0082] The input device 102 may include a keyboard, etc., and the output device 103 may include a display (LCD, etc.), a speaker, etc.

[0083] The memory 104 may include a read-only memory and a random access memory, and provides instructions and data to the processor 101. A portion of the memory 104 may also include a non-volatile random access memory. For example, the memory 104 may also store information on the device type.

[0084] In a specific implementation, the processor 101, input device 102, and output device 103 described in the embodiment of the present invention can execute the implementation method described in the embodiment of the anti-fraud method through deep analysis of APK information provided in the embodiment of the present invention, which will not be repeated here.

[0085] Please refer to Figure 5 The embodiment of the present invention further provides an anti-fraud system by deeply analyzing APK information, including:

[0086] An APK parsing module, used to load and read an APK file from a user, and parse, decompile and statically analyze the APK file to obtain first information; the first information includes the user's domain name information, the first IP address and basic server information;

[0087] An APK packet capture module, used to perform simulator operation and dynamic network packet capture on the APK file to obtain second information; the second information includes domain name information, a second IP address and network packet related information of the APK file;

[0088] An information query module, used to query and parse the domain name information in the first information or the second information to obtain third information; the third information includes domain name registration information, domain name binding IP information, IP address ownership information, IP address operator information and APK filing information;

[0089] An analysis module, used for analyzing the third information found;

[0090] A survey module, used to survey the basic information of the server to obtain server related information; the server related information includes an operating system, a server development port, a server business installation system and a database;

[0091] The verification module is used to verify the first IP address, the second IP address and the server.

[0092] Among them, the APK parsing module is specifically used for:

[0093] Load and read the APK file from the user, and parse the APK file to obtain basic information; the basic information includes application name, application ID, signature information, file size, third-party service information used by the file, APK icon, APK md5 information and code information;

[0094] The code information is statically analyzed to obtain the domain name information and the first IP address of the user.

[0095] Furthermore, the certificate adjustment module is also used for:

[0096] Check the server registration information;

[0097] Information about the user of the remote connection server, the user of the domain name, and the registered user of the APK third-party service, such as Baidu Maps, Alipay, WeChat, customer service registration company or personal information;

[0098] Label and analyze the server registration information, server user information, domain name user information, and APK third-party service registration and user information to determine whether there is any illegal behavior.

[0099] It should be noted that for a more detailed workflow of the system embodiment, please refer to the aforementioned method embodiment part, which will not be repeated here.

[0100] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. An anti-fraud method by deep analysis of APK information, characterized in that: include: Loading and reading an APK file from a user, and parsing, decompiling, and statically analyzing the APK file to obtain first information; The first information includes the user's domain name information, the first IP address and related third-party service information used; The APK file is run on a simulator and dynamically captured on a network to obtain second information; the second information includes domain name information, a second IP address, and network packet related information of the APK file; Query and resolve the domain name information in the first information or the second information to obtain a third IP address; Querying and inspecting the first IP address, the second IP address, the third IP address and the domain name information; Querying domain name registrant information and user information based on the first IP address, the second IP address, the third IP address and the domain name information; Label and analyze the domain name registrant information and user information to determine whether there is any illegal behavior.

2. The anti-fraud method according to claim 1, characterized in that: Load and read the APK file from the user, and parse, decompile and statically analyze the APK file, specifically: Load and read the APK file from the user, and parse the APK file to obtain basic information; the basic information includes application name, application ID, signature information, file size, third-party service information used by the file, APK icon, APK md5 information and code information; The code information is statically analyzed to obtain the domain name information and the first IP address of the user.

3. The anti-fraud method according to claim 1, characterized in that: The first IP address, the second IP address, the third IP address and the domain name information are queried, specifically: The first IP address, the second IP address, the third IP address and the domain name information are queried to obtain the corresponding IP address locations and operator information.

4. An anti-fraud system by deep analysis of APK information, characterized in that: include: An APK parsing module, used to load and read an APK file from a user, and parse, decompile and statically analyze the APK file to obtain first information; the first information includes the user's domain name information, the first IP address and basic server information; An APK packet capture module, used to perform simulator operation and dynamic network packet capture on the APK file to obtain second information; the second information includes domain name information, a second IP address and network packet related information of the APK file; An information query module, used to query and parse the domain name information in the first information or the second information to obtain third information; the third information includes domain name registration information, domain name binding IP information, IP address ownership information, IP address operator information and APK filing information; The verification module is used to verify the first IP address, the second IP address and the server.

5. The anti-fraud system according to claim 4, characterized in that: The APK parsing module is specifically used for: The user loads and reads the APK file, and parses the APK file to obtain basic information; the basic information includes the application name, application ID, signature information, file size, third-party service information used by the file, APK icon, APK's md5 information and code information; The code information is statically analyzed to obtain the domain name information and the first IP address of the user.

6. The anti-fraud system according to claim 4, characterized in that: The anti-fraud system also includes: An analysis module, used for analyzing the third information found; The inspection module is used to inspect the basic information of the server and obtain server-related information; the server-related information includes the operating system, server development port, server business installation system and database.

7. The anti-fraud system according to claim 4, characterized in that: The certificate adjustment module is also used for: Check the server registration information; Remote connection server user information, domain name user information, and APK third-party service registration user information; Label and analyze the server registration information, server user information, domain name user information, and APK third-party service registration and user information to determine whether there is any illegal behavior.

8. A computer device for anti-fraud identification by deep analysis of APK information, characterized in that: The computer device includes a processor, an input device, an output device and a memory, which are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 1 to 3.

Images