Application program similarity automatic analysis method and device, computer equipment and storage medium

Abstract

The invention relates to an application program similarity automatic analysis method and device, computer equipment and a storage medium. The method comprises the following steps: performing picture analysis according to each first application resource picture and each second application resource picture to obtain the consistency of all pictures of an application and the similarity of all pictures of the application; performing picture analysis according to the first suspected startup picture and the second suspected startup picture to obtain a first application key picture similarity; performing picture analysis according to the first dynamic key picture screenshot set and the second dynamic picture screenshot set to obtain a second application key picture similarity; and calculating according to the consistency of all the pictures of the application, the similarity of all the pictures of the application, the similarity of the key pictures of the first application and the similarity of the key pictures of the second application to obtain the comprehensive similarity of the application. By adopting the method, the accuracy and the data comprehensiveness can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of mobile Internet APP detection and analysis, and in particular to a method, device, computer equipment and storage medium for automatic analysis of application program similarity. Background Art

[0002] In recent years, telecommunications network fraud has occurred frequently, and more and more fraudulent applications have appeared. Fraudulent applications imitate regular apps and are extremely confusing. It is difficult for users to distinguish between good and bad applications based on the appearance of the application interface alone. Therefore, it is very important to identify and associate fraudulent apps to reduce the number of users being deceived and improve network security.

[0003] However, traditional technologies that use automatic analysis methods of application similarity to analyze fraudulent apps have problems such as low accuracy or low data comprehensiveness. Summary of the invention

[0004] Based on this, it is necessary to provide an automatic analysis method, device, computer equipment and storage medium for application similarity that can improve accuracy and data comprehensiveness in response to the above technical problems.

[0005] In a first aspect, a method for automatically analyzing application similarity is provided, the method comprising:

[0006] Obtain all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and perform image analysis based on each first application resource image and each second application resource image to obtain the consistency of all application images and the similarity of all application images; wherein the consistency of all application images is used to characterize the ratio of the existence of consistent images in each first application resource image in each second application resource image; the similarity of all application images is used to characterize the ratio of the existence of similar images in each first application resource image in each second application resource image;

[0007] Obtaining a first suspected startup screen image of the application to be analyzed and a second suspected startup screen image of the application to be compared, and obtaining a first application key image similarity after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image; the first application key image similarity is used to characterize the degree of similarity between the first suspected startup screen image and the second suspected startup screen image;

[0008] Obtaining a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared, and performing image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set to obtain a second application key image similarity; the second application key image similarity is used to characterize the ratio of similar images in the first dynamic key screen screenshot set in the second dynamic screen screenshot set;

[0009] The comprehensive similarity of the application programs is obtained by calculating the consistency of all application images, the similarity of all application images, the similarity of the first application key image, and the similarity of the second application key image.

[0010] In one of the embodiments, all first application resource images of the application to be analyzed and all second application resource images of the application to be compared are obtained, including: obtaining the first application resource of the application to be analyzed and the second application resource of the application to be compared; decompiling the first application resource and the second application resource respectively to obtain a first resource directory of the first application resource, the decompiled first application resource, a second resource directory of the second application resource, and the decompiled second application resource; querying the decompiled first application resource according to the first resource directory and the target image file suffix to obtain each first application resource image; querying the decompiled second application resource according to the second resource directory and the target image file suffix to obtain each second application resource image.

[0011] In one of the embodiments, obtaining a first suspected startup screen image of an application to be analyzed and a second suspected startup screen image of an application to be compared includes: performing image size comparison according to each first application resource image to obtain the corresponding first application resource image with the largest image size, performing file size comparison according to each first application resource image with the largest image size to obtain the first application resource image with the largest file size and the largest image size, and determining the first application resource image with the largest file size and the largest image size as the first suspected startup screen image; performing image size comparison according to each second application resource image to obtain the corresponding second application resource image with the largest image size, performing file size comparison according to each second application resource image with the largest image size to obtain the second application resource image with the largest file size and the largest image size, and determining the second application resource image with the largest file size and the largest image size as the second suspected startup screen image.

[0012] In one embodiment, obtaining a first dynamic key screen screenshot set of an application to be analyzed and a second dynamic screen screenshot set of an application to be compared includes: in response to a first startup operation on an Android emulator, obtaining a first application package of the application to be analyzed and installing the first application package; in response to the completion of the installation of the first application package, starting the first application package, and starting a first detection time timing and monitoring a first current running interface picture of the application to be analyzed; in response to the first detection time being greater than or equal to the display time of the startup screen picture of the application to be analyzed, capturing the first running screen picture of the application to be analyzed, and determining the first running screen picture as the first dynamic startup screen screenshot; in response to the first current running interface picture having a registration screen keyword and When a number of input boxes greater than the first preset number appear, a first current running interface picture is captured, and the first current running interface picture is determined as the first dynamic registration screen screenshot; in response to the appearance of login screen keywords in the first current running interface picture and the appearance of a number of input boxes greater than or equal to the second preset number, the first current running interface picture is captured, the first current running interface picture is determined as the first dynamic login screen screenshot, and a judgment is made as to whether the first current running interface picture has been updated; in response to an update to the first current running interface picture, the first current running interface picture is determined as the first dynamic suspected main screen screenshot, and a first dynamic key screen screenshot set is generated according to the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot and the first dynamic suspected main screen screenshot.

[0013] In one embodiment, obtaining a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared includes: in response to a second startup operation on the Android emulator, obtaining a second application package of the application to be compared and installing the second application package; in response to the second application package being installed, starting the second application package, and starting a second detection time timing and monitoring a second current running interface picture of the application to be analyzed; in response to the second detection time being greater than or equal to the display time of the startup screen picture of the application to be compared, capturing a second running screen picture of the application to be compared, and determining the second running screen picture as a second dynamic startup screen screenshot; in response to the registration screen keyword appearing in the second current running interface picture and When a number of input boxes greater than the third preset number appear, a second current running interface picture is captured, and the second current running interface picture is determined as a second dynamic registration screen screenshot; in response to the login screen keyword appearing in the second current running interface picture and a number of input boxes greater than or equal to the fourth preset number appearing, the second current running interface picture is captured, the second current running interface picture is determined as a second dynamic login screen screenshot, and a judgment is made as to whether the second current running interface picture is updated; in response to an update of the second current running interface picture, the second current running interface picture is determined as a second dynamic suspected main screen screenshot, and a second dynamic key screen screenshot set is generated according to the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot and the second dynamic suspected main screen screenshot.

[0014] In one of the embodiments, after performing image analysis on each first application resource image and each second application resource image, the consistency of all application images and the similarity of all application images are obtained, including: performing calculations on each first application resource image and each second application resource image to obtain a first hash value of each first application resource image and a second hash value of each second application resource image; determining the number of target hash values ​​according to each first hash value and each second hash value; the target hash value is the first hash value that has the same hash value among all second hash values; and determining the consistency of all application images according to the quotient of the number of target hash values ​​and the total number of first hash values.

[0015] In one of the embodiments, after performing image analysis on each first application resource image and each second application resource image, the consistency of all application images and the similarity of all application images are obtained, including: performing calculations on each first application resource image and each second application resource image to obtain a first image fingerprint of each first application resource image and a second image fingerprint of each second application resource image; determining the number of first target image fingerprints according to each first image fingerprint and each second image fingerprint; the first target image fingerprint is a first image fingerprint having a first target Hamming distance in the Hamming distance between the first image fingerprint and all second image fingerprints; the first target Hamming distance is a Hamming distance between the first image fingerprint and the second image fingerprint that is greater than a first Hamming distance threshold; and determining the similarity of all application images according to the quotient of the number of first target image fingerprints and the total number of first image fingerprints.

[0016] In one of the embodiments, obtaining the similarity of the first application key image after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image includes: performing calculations based on the first suspected startup screen image and the second suspected startup screen image respectively to obtain a third image fingerprint of the first suspected startup screen image and a fourth image fingerprint of the second suspected startup screen image; determining the Hamming distance between the third image fingerprint and the fourth image fingerprint based on the third image fingerprint and the fourth image fingerprint, and determining the similarity of the first application key image based on the Hamming distance between the third image fingerprint and the fourth image fingerprint.

[0017] In one embodiment, the first dynamic key screen screenshot set includes a first dynamic startup screen screenshot, a first dynamic startup screen screenshot, a first dynamic login screen screenshot and a first dynamic suspected main screen screenshot; the second dynamic key screen screenshot set includes a second dynamic startup screen screenshot, a second dynamic startup screen screenshot, a second dynamic login screen screenshot and a second dynamic suspected main screen screenshot; after performing image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set, the second application key image similarity is obtained, including: calculating according to the first dynamic key screen screenshot set and the second dynamic key screen screenshot set respectively, to obtain the fifth image fingerprint of the first dynamic startup screen screenshot, the sixth image fingerprint of the first dynamic startup screen screenshot, the seventh image fingerprint of the first dynamic login screen screenshot, the eighth image fingerprint of the first dynamic suspected main screen screenshot, the ninth image fingerprint of the second dynamic startup screen screenshot, the the tenth picture fingerprint of the animated screen screenshot, the eleventh picture fingerprint of the second dynamic login screen screenshot, and the twelfth picture fingerprint of the second dynamic suspected main screen screenshot; determine the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint according to the fifth picture fingerprint and the ninth picture fingerprint; determine the Hamming distance between the sixth picture fingerprint and the tenth picture fingerprint according to the sixth picture fingerprint and the tenth picture fingerprint; determine the Hamming distance between the seventh picture fingerprint and the eleventh picture fingerprint according to the seventh picture fingerprint and the eleventh picture fingerprint; determine the Hamming distance between the eighth picture fingerprint and the twelfth picture fingerprint according to the eighth picture fingerprint and the twelfth picture fingerprint; determine the second application key picture similarity according to the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint, the Hamming distance between the sixth picture fingerprint and the tenth picture fingerprint, the Hamming distance between the seventh picture fingerprint and the eleventh picture fingerprint, and the Hamming distance between the eighth picture fingerprint and the twelfth picture fingerprint.

[0018] In a second aspect, a device for automatically analyzing application similarity is provided, the device comprising a first similarity calculation module, a second similarity calculation module, a third similarity calculation module and a comprehensive similarity calculation module.

[0019] Among them, the first similarity calculation module is used to obtain all the first application resource images of the application to be analyzed and all the second application resource images of the application to be compared, and obtain the consistency of all application images and the similarity of all application images after performing image analysis based on each first application resource image and each second application resource image; wherein the consistency of all application images is used to characterize the ratio of the existence of consistent images in each first application resource image in each second application resource image; the similarity of all application images is used to characterize the ratio of the existence of similar images in each first application resource image in each second application resource image; the second similarity calculation module is used to obtain the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared, and obtain the consistency of all application images and the similarity of all application images after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image. to the first application key picture similarity; the first application key picture similarity is used to characterize the similarity between the first suspected startup screen picture and the second suspected startup screen picture; a third similarity calculation module is used to obtain a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared, and obtain the second application key picture similarity after performing picture analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set; the second application key picture similarity is used to characterize the ratio of similar pictures in the first dynamic key screen screenshot set to the second dynamic screen screenshot set; a comprehensive similarity calculation module is used to calculate based on the consistency of all application pictures, the similarity of all application pictures, the similarity of the first application key picture and the similarity of the second application key picture to obtain the comprehensive similarity of the application.

[0020] In a third aspect, a computer device is provided. The computer device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of any method in the above method embodiments are implemented.

[0021] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any method in the above method embodiments are implemented.

[0022] The above-mentioned automatic application similarity analysis method, device, computer equipment and storage medium obtain all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and perform image analysis based on each first application resource image and each second application resource image to obtain the consistency of all application images and the similarity of all application images; then, obtain the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared, and perform image analysis based on the first suspected startup screen image and the second suspected startup screen image to obtain the first application key image similarity; then, obtain the first dynamic key screen screenshot set of the application to be analyzed and the second dynamic screen screenshot set of the application to be compared, and perform image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set to obtain the second application key image similarity; finally, calculate based on the consistency of all application images, the similarity of all application images, the similarity of the first application key image and the similarity of the second application key image to obtain the comprehensive similarity of the application, thereby improving the accuracy and data comprehensiveness, and the automatic analysis of the comprehensive similarity does not require human intervention. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 An application environment diagram of an automatic analysis method for application program similarity in one embodiment;

[0024] Figure 2 A schematic diagram of a flow chart of an automatic application similarity analysis method in one embodiment;

[0025] Figure 3 A schematic diagram of a first process for obtaining all first application resource images of an application to be analyzed and all second application resource images of an application to be compared in one embodiment;

[0026] Figure 4 It is a schematic diagram of a first process of obtaining the consistency of all application pictures and the similarity of all application pictures after performing picture analysis according to each first application resource picture and each second application resource picture in an embodiment;

[0027] Figure 5 A schematic diagram of a second process for obtaining consistency of all application images and similarity of all application images after performing image analysis according to each first application resource image and each second application resource image in an embodiment;

[0028] Figure 6 A schematic diagram of a process of obtaining a first suspected startup screen image of an application to be analyzed and a second suspected startup screen image of an application to be compared in one embodiment;

[0029] Figure 7It is a schematic diagram of a process of obtaining the similarity of a first application key picture after performing picture analysis based on a first suspected startup screen picture and a second suspected startup screen picture in one embodiment;

[0030] Figure 8 A schematic diagram of a first process of obtaining a first dynamic key screen screenshot set of an application to be analyzed and a second dynamic screen screenshot set of an application to be compared in one embodiment;

[0031] Fig. 9 A schematic diagram of a second process of obtaining a first dynamic key screen screenshot set of an application to be analyzed and a second dynamic screen screenshot set of an application to be compared in one embodiment;

[0032] Fig.10 It is a schematic diagram of a process of obtaining the similarity of the second application key picture after performing picture analysis based on the first dynamic key picture screenshot set and the second dynamic picture screenshot set in one embodiment;

[0033] Fig.11 is a structural block diagram of an automatic application similarity analysis device in one embodiment;

[0034] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0036] In order to facilitate understanding of the present application, the present application will be described more fully below with reference to the relevant drawings. Embodiments of the present application are provided in the drawings. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0037] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0038] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first resistor may be referred to as a second resistor, and similarly, a second resistor may be referred to as a first resistor. Both the first resistor and the second resistor are resistors, but they are not the same resistor.

[0039] It can be understood that the “connection” in the following embodiments should be understood as “electrical connection”, “communication connection”, etc. if the connected circuits, modules, units, etc. have electrical signals or data transmission between each other.

[0040] When used herein, the singular forms "a", "an", and "said / the" may also include plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "include / comprise" or "have" etc. specify the presence of stated features, wholes, steps, operations, components, parts or combinations thereof, but do not exclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts or combinations thereof.

[0041] The application similarity analysis method provided in this application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 through a network. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices, and the server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0042] In one embodiment, Figure 2 As shown, a method for analyzing application similarity is provided, which is applied to Figure 1 The server 104 in the example is used for explanation, and the steps include the following steps 201 to 204.

[0043] Step 201, obtain all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and obtain the consistency of all application images and the similarity of all application images after performing image analysis based on each first application resource image and each second application resource image.

[0044] Among them, the application to be analyzed is the application that needs to be analyzed for application similarity. The application to be compared is the reference application that needs to be compared with the application to be analyzed. The consistency of all application images is used to characterize the ratio of the existence of consistent images in each first application resource image in each second application resource image; the similarity of all application images is used to characterize the ratio of the existence of similar images in each first application resource image in each second application resource image. In addition, the application to be analyzed can be but is not limited to a fraudulent application, and the application to be compared can be but is not limited to the genuine application corresponding to the fraudulent application.

[0045] Specifically, the server 104 obtains all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and obtains the consistency of all application images and the similarity of all application images after performing image analysis based on each first application resource image and each second application resource image.

[0046] In one embodiment, if Figure 3 As shown, obtaining all first application resource images of the application to be analyzed and all second application resource images of the application to be compared includes steps 301 to 304.

[0047] Step 301, obtaining a first application resource of an application to be analyzed and a second application resource of an application to be compared;

[0048] Step 302, decompile the first application resource and the second application resource respectively to obtain a first resource directory of the first application resource, the decompiled first application resource, a second resource directory of the second application resource, and the decompiled second application resource;

[0049] Step 303, querying and processing the first application resource after decompilation according to the first resource directory and the target image file suffix to obtain each first application resource image;

[0050] Step 304 , query and process the decompiled second application resources according to the second resource directory and the target image file suffix to obtain each second application resource image.

[0051] Among them, the target image file suffix includes *.jpg and *.png, etc. The server 104 obtains the first application resource of the application to be analyzed and the second application resource of the application to be compared; then, the first application resource and the second application resource are decompiled respectively to obtain the first resource directory of the first application resource, the first application resource after decompilation, the second resource directory of the second application resource, and the second application resource after decompilation; then, query processing is performed on the first application resource after decompilation according to the first resource directory and the target image file suffix to obtain each first application resource image; then, query processing is performed on the second application resource after decompilation according to the second resource directory and the target image file suffix to obtain each second application resource image, thereby improving the efficiency and convenience of obtaining all first application resource images of the application to be analyzed and all second application resource images of the application to be compared.

[0052] In this embodiment, a first application resource of an application to be analyzed and a second application resource of an application to be compared are obtained; then, the first application resource and the second application resource are decompiled to obtain a first resource directory of the first application resource, a decompiled first application resource, a second resource directory of the second application resource, and a decompiled second application resource; then, query processing is performed on the decompiled first application resource according to the first resource directory and the target image file suffix to obtain each first application resource image; then, query processing is performed on the decompiled second application resource according to the second resource directory and the target image file suffix to obtain each second application resource image, thereby improving the efficiency and convenience of obtaining all first application resource images of the application to be analyzed and all second application resource images of the application to be compared.

[0053] In one embodiment, if Figure 4 As shown, after performing image analysis on each first application resource image and each second application resource image, the consistency of all application images and the similarity of all application images are obtained, including steps 401 to 403.

[0054] Step 401 , performing calculations based on each first application resource picture and each second application resource picture to obtain a first hash value of each first application resource picture and a second hash value of each second application resource picture.

[0055] Step 402: Determine the number of target hash values ​​according to each first hash value and each second hash value.

[0056] Step 403: Determine the consistency of all the images according to the quotient of the number of target hash values ​​and the total number of first hash values.

[0057] Among them, the target hash value is the first hash value that has the same hash value in all the second hash values. It can be understood that the first hash value corresponding to the target hash value has the same hash value in all the second hash values. Server 104 calculates according to each first application resource image and each second application resource image, respectively, to obtain the first hash value of each first application resource image and the second hash value of each second application resource image; determines the number of target hash values ​​according to each first hash value and each second hash value; finally, determines the consistency of all application images according to the quotient of the number of target hash values ​​and the total number of first hash values, thereby improving the efficiency, accuracy and convenience of calculating the consistency of all application images. In addition, the hash value is SHA256.

[0058] In a specific example, the number of target hash values ​​is determined based on each first hash value and each second hash value, including: comparing each first hash value with all second hash values ​​in turn to obtain a comparison result; the comparison result is used to determine whether the corresponding first hash value is the target hash value; and the number of target hash values ​​is counted based on each comparison result. If the consistency of all application images is 100%, it means that all the first application resource images and all the second application resource images are similar. If the consistency of all application images is 50%, it means that half of the first application resource images and all the second application resource images are similar. If the consistency of all application images is 0%, it means that none of the first application resource images and all the second application resource images are similar. The above are only specific examples, and they can be flexibly set according to user needs in actual applications.

[0059] In this embodiment, calculations are performed based on each first application resource image and each second application resource image to obtain a first hash value for each first application resource image and a second hash value for each second application resource image; the number of target hash values ​​is determined based on each first hash value and each second hash value; finally, the consistency of all application images is determined based on the quotient of the number of target hash values ​​and the total number of first hash values, thereby improving the efficiency, accuracy and convenience of calculating the consistency of all application images.

[0060] In one embodiment, if Figure 5 As shown, after performing image analysis on each first application resource image and each second application resource image, the consistency of all application images and the similarity of all application images are obtained, including steps 501 to 503.

[0061] Step 501 , performing calculations based on each first application resource picture and each second application resource picture, respectively, to obtain a first picture fingerprint of each first application resource picture and a second picture fingerprint of each second application resource picture.

[0062] Step 502: Determine the number of first target image fingerprints according to each first image fingerprint and each second image fingerprint.

[0063] Step 503: Determine the similarity of all the images according to the quotient of the number of first target image fingerprints and the total number of first image fingerprints.

[0064] The first target image fingerprint is a first image fingerprint having a first target Hamming distance in the Hamming distances between the first image fingerprint and all the second image fingerprints. That is, the first image fingerprint corresponding to the first target image fingerprint has a first target Hamming distance in the Hamming distances between the first image fingerprint and all the second image fingerprints. The first target Hamming distance is the Hamming distance between the first image fingerprint and the second image fingerprint that is greater than the first Hamming distance threshold.

[0065] Specifically, the server 104 performs calculations based on each first application resource picture and each second application resource picture to obtain a first picture fingerprint of each first application resource picture and a second picture fingerprint of each second application resource picture; then, the number of first target picture fingerprints is determined based on each first picture fingerprint and each second picture fingerprint; then, the similarity of all application pictures is determined based on the quotient of the number of first target picture fingerprints and the total number of first picture fingerprints, thereby improving the efficiency, accuracy and convenience of calculating the similarity of all application pictures.

[0066] In a specific example, the number of first target image fingerprints is determined based on each first image fingerprint and each second image fingerprint, including calculating the corresponding Hamming distance between each first image fingerprint and all second image fingerprints in turn; judging in turn whether the Hamming distance between each first image fingerprint and the corresponding second image fingerprint is greater than the first Hamming distance threshold and obtaining the corresponding judgment result; and counting the number of first target image fingerprints according to each judgment result. If the similarity of all images is 100%, it means that all images of each first application resource image and each second application resource image are similar; if the similarity of all images is 50%, it means that half of the images of each first application resource image and each second application resource image are similar; if the similarity of all images is 0%, it means that none of the images of each first application resource image and each second application resource image are similar. The above are only specific examples, and they can be flexibly set according to user needs in actual applications.

[0067] In this embodiment, calculations are performed based on each first application resource picture and each second application resource picture to obtain a first picture fingerprint of each first application resource picture and a second picture fingerprint of each second application resource picture; then, the number of first target picture fingerprints is determined based on each first picture fingerprint and each second picture fingerprint; then, the similarity of all application pictures is determined based on the quotient of the number of first target picture fingerprints and the total number of first picture fingerprints, thereby improving the efficiency, accuracy and convenience of calculating the similarity of all application pictures.

[0068] Step 202: obtain a first suspected startup screen image of the application to be analyzed and a second suspected startup screen image of the application to be compared, and obtain a first application key image similarity after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image.

[0069] Among them, the similarity of the first application key image is used to characterize the degree of similarity between the first suspected startup screen image and the second suspected startup screen image. Specifically, the server 104 obtains the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared, and obtains the similarity of the first application key image after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image.

[0070] In one embodiment, if Figure 6 As shown, obtaining a first suspected startup screen image of an application to be analyzed and a second suspected startup screen image of an application to be compared includes steps 601 to 602.

[0071] Step 601, after comparing the image sizes of each first application resource image, obtain the corresponding first application resource image with the largest image size, and compare the file sizes of each first application resource image with the largest image size to obtain the first application resource image with the largest file size and the largest image size, and determine the first application resource image with the largest file size and the largest image size as the first suspected startup screen image.

[0072] Step 602, after comparing the picture sizes of each second application resource picture, obtain the corresponding second application resource picture with the largest picture size, and compare the file sizes of each second application resource picture with the largest picture size to obtain the second application resource picture with the largest file size and the largest picture size, and determine the second application resource picture with the largest file size and the largest picture size as the second suspected startup screen picture.

[0073] Specifically, the server 104 performs image size comparison based on each first application resource image to obtain the corresponding first application resource image with the largest image size, performs file size comparison based on each first application resource image with the largest image size to obtain the first application resource image with the largest file size and the largest image size, and determines the first application resource image with the largest file size and the largest image size as the first suspected startup screen image; then, performs image size comparison based on each second application resource image to obtain the corresponding second application resource image with the largest image size, performs file size comparison based on each second application resource image with the largest image size to obtain the second application resource image with the largest file size and the largest image size, and determines the second application resource image with the largest file size and the largest image size as the second suspected startup screen image, thereby improving the efficiency, convenience and accuracy of obtaining the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared.

[0074] In this embodiment, after comparing the image sizes of each first application resource image, the corresponding first application resource image with the largest image size is obtained, and file size comparison is performed on each first application resource image with the largest image size to obtain the first application resource image with the largest file size and the largest image size, and the first application resource image with the largest file size and the largest image size is determined as the first suspected startup screen image; then, after comparing the image sizes of each second application resource image, the corresponding second application resource image with the largest image size is obtained, and file size comparison is performed on each second application resource image with the largest image size to obtain the second application resource image with the largest file size and the largest image size, and the second application resource image with the largest file size and the largest image size is determined as the second suspected startup screen image, thereby improving the efficiency, convenience and accuracy of obtaining the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared.

[0075] In one embodiment, if Figure 7 As shown, after performing image analysis on the first suspected startup screen image and the second suspected startup screen image, obtaining the first application key image similarity includes steps 701 to 702.

[0076] Step 701, performing calculations based on the first suspected startup screen image and the second suspected startup screen image, respectively, to obtain a third picture fingerprint of the first suspected startup screen image and a fourth picture fingerprint of the second suspected startup screen image;

[0077] Step 702: determine the Hamming distance between the third picture fingerprint and the fourth picture fingerprint according to the third picture fingerprint and the fourth picture fingerprint, and determine the first application key picture similarity according to the Hamming distance between the third picture fingerprint and the fourth picture fingerprint.

[0078] Specifically, the server 104 performs calculations based on the first suspected startup screen image and the second suspected startup screen image, respectively, to obtain a third image fingerprint of the first suspected startup screen image and a fourth image fingerprint of the second suspected startup screen image; then, the Hamming distance between the third image fingerprint and the fourth image fingerprint is determined based on the third image fingerprint and the fourth image fingerprint, and the similarity of the first application key image is determined based on the Hamming distance between the third image fingerprint and the fourth image fingerprint, thereby improving the efficiency, convenience and accuracy of calculating the similarity of the first application key image.

[0079] In a specific example, if the Hamming distance between the third image fingerprint and the fourth image fingerprint is 0, it proves that the first suspected startup screen image and the second suspected startup screen image are the same image. If the Hamming distance between the third image fingerprint and the fourth image fingerprint is greater than 10, it means that the first suspected startup screen image and the second suspected startup screen image are completely dissimilar. The above is only a specific example. In actual application, it is flexibly set according to user needs and is not limited here.

[0080] In this embodiment, calculations are performed based on the first suspected startup screen image and the second suspected startup screen image, respectively, to obtain a third picture fingerprint of the first suspected startup screen image and a fourth picture fingerprint of the second suspected startup screen image; then, the Hamming distance between the third picture fingerprint and the fourth picture fingerprint is determined based on the third picture fingerprint and the fourth picture fingerprint, and the similarity of the first application key picture is determined based on the Hamming distance between the third picture fingerprint and the fourth picture fingerprint, thereby improving the efficiency, convenience and accuracy of calculating the similarity of the first application key picture.

[0081] Step 203, obtaining a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared, and performing image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set to obtain a second application key image similarity.

[0082] The second application key picture similarity is used to characterize the ratio of similar pictures in the first dynamic key screenshot set in the second dynamic screenshot set. The server 104 obtains the first dynamic key screenshot set of the application to be analyzed and the second dynamic screenshot set of the application to be compared, and obtains the second application key picture similarity after performing picture analysis based on the first dynamic key screenshot set and the second dynamic screenshot set.

[0083] In one embodiment, if Figure 8 As shown, obtaining a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared includes steps 801 to 806.

[0084] Step 801, in response to a first startup operation on the Android emulator, obtain a first application package of an application to be analyzed, and install the first application package.

[0085] Step 802, in response to the first application package being installed, the first application package is started, and a first detection time is started and a first current running interface picture of the application to be analyzed is monitored.

[0086] Step 803 , in response to the first detection time being greater than or equal to the display time of the startup screen image of the application to be analyzed, capturing a first running screen image of the application to be analyzed, and determining the first running screen image as a first dynamic startup screen screenshot.

[0087] Step 804, in response to the registration screen keyword appearing in the first current running interface picture and the input boxes greater than the first preset number appearing, capture the first current running interface picture, and determine the first current running interface picture as the first dynamic registration screen screenshot.

[0088] Step 805, in response to the appearance of the login screen keyword in the first current running interface picture and the appearance of input boxes greater than or equal to the second preset number, capture the first current running interface picture, determine the first current running interface picture as the first dynamic login screen screenshot, and determine whether the first current running interface picture is updated.

[0089] Step 806, in response to the update of the first current running interface picture, the first current running interface picture is determined as the first dynamic suspected main screen screenshot, and a first dynamic key screen screenshot set is generated based on the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot and the first dynamic suspected main screen screenshot.

[0090] Among them, the server 104 obtains the first application package of the application to be analyzed in response to the first startup operation of the Android emulator, and installs the first application package; then, in response to the completion of the installation of the first application package, the first application package is started, and the first detection time is started and the first current running interface picture of the application to be analyzed is monitored; then, in response to the first detection time being greater than or equal to the display time of the startup screen picture of the application to be analyzed, the first running screen picture of the application to be analyzed is captured, and the first running screen picture is determined as the first dynamic startup screen screenshot; then, in response to the registration screen keyword appearing in the first current running interface picture and the input box appearing greater than the first preset number, the first current running interface picture is captured, and the first current running interface picture is determined as the first dynamic startup screen screenshot. The interface picture is determined to be a first dynamic registration screen screenshot; at the same time, in response to the login screen keyword appearing in the first current running interface picture and an input box greater than or equal to the second preset number appearing, the first current running interface picture is captured, the first current running interface picture is determined to be a first dynamic login screen screenshot, and a judgment is made as to whether the first current running interface picture is updated; finally, in response to the update of the first current running interface picture, the first current running interface picture is determined to be a first dynamic suspected main screen screenshot, and a first dynamic key screen screenshot set is generated according to the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot and the first dynamic suspected main screen screenshot, thereby improving the efficiency, convenience and accuracy of generating the first dynamic key screen screenshot set.

[0091] In a specific example, the first application package may be, but is not limited to, an APK package. The display time of the startup screen image of the application to be analyzed may be, but is not limited to, 5 seconds. The registration screen keywords include registration, mobile phone, invitation code, referral code, verification code, password, register, and password; the login screen keywords include login, login, mobile phone, password, log in, and password. The above are only specific examples. In actual applications, they are flexibly set according to user needs and are not limited here.

[0092] In this embodiment, in response to a first startup operation on the Android emulator, a first application package of the application to be analyzed is obtained and the first application package is installed; then, in response to the completion of the installation of the first application package, the first application package is started, and the first detection time timing and monitoring of the first current running interface picture of the application to be analyzed are started; then, in response to the first detection time being greater than or equal to the display time of the startup screen picture of the application to be analyzed, the first running screen picture of the application to be analyzed is captured, and the first running screen picture is determined as the first dynamic startup screen screenshot; then, in response to the appearance of the registration screen keyword in the first current running interface picture and the appearance of an input box greater than a first preset number, the first current running interface picture is captured, and the first current running interface picture is determined as the first dynamic startup screen screenshot. The first dynamic registration screen screenshot is determined as the first dynamic registration screen screenshot; at the same time, in response to the login screen keyword appearing in the first current running interface picture and an input box greater than or equal to the second preset number appearing, the first current running interface picture is captured, the first current running interface picture is determined as the first dynamic login screen screenshot, and it is determined whether the first current running interface picture is updated; finally, in response to the update of the first current running interface picture, the first current running interface picture is determined as the first dynamic suspected main screen screenshot, and a first dynamic key screen screenshot set is generated according to the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot and the first dynamic suspected main screen screenshot, thereby improving the efficiency, convenience and accuracy of generating the first dynamic key screen screenshot set.

[0093] In one embodiment, if Fig. 9 As shown, obtaining a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared includes:

[0094] Step 901, in response to a second startup operation on the Android emulator, obtain a second application package of the application to be compared, and install the second application package.

[0095] Step 902, in response to the second application package being installed, the second application package is started, and a second detection time is started and a second current running interface picture of the application to be analyzed is monitored.

[0096] Step 903 , in response to the second detection time being greater than or equal to the display time of the startup screen image of the application to be compared, capturing a second running screen image of the application to be compared, and determining the second running screen image as a second dynamic startup screen screenshot.

[0097] Step 904, in response to the registration screen keyword appearing in the second current running interface picture and the input boxes greater than the third preset number appearing, capture the second current running interface picture, and determine the second current running interface picture as the second dynamic registration screen screenshot.

[0098] Step 905, in response to the login screen keyword appearing in the second current running interface picture and the input boxes greater than or equal to the fourth preset number appearing, capture the second current running interface picture, determine the second current running interface picture as the second dynamic login screen screenshot, and determine whether the second current running interface picture is updated.

[0099] Step 906, in response to the update of the second current running interface picture, the second current running interface picture is determined as the second dynamic suspected main screen screenshot, and a second dynamic key screen screenshot set is generated based on the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot and the second dynamic suspected main screen screenshot.

[0100] Specifically, in response to the second startup operation on the Android emulator, the server 104 obtains the second application package of the application to be compared and installs the second application package; then, in response to the completion of the installation of the second application package, the second application package is started, and the second detection time is started and the second current running interface picture of the application to be analyzed is monitored; then, in response to the second detection time being greater than or equal to the display time of the startup screen picture of the application to be compared, the second running screen picture of the application to be compared is captured, and the second running screen picture is determined as the second dynamic startup screen screenshot; then, in response to the registration screen keyword appearing in the second current running interface picture and the input box greater than the third preset number appearing, the second current running interface picture is captured, and the second current running interface picture is determined as the second dynamic startup screen screenshot. The interface picture is determined to be a second dynamic registration screen screenshot; at the same time, in response to the login screen keyword appearing in the second current running interface picture and an input box greater than or equal to the fourth preset number appearing, the second current running interface picture is captured, the second current running interface picture is determined to be a second dynamic login screen screenshot, and a judgment is made as to whether the second current running interface picture is updated; finally, in response to the update of the second current running interface picture, the second current running interface picture is determined to be a second dynamic suspected main screen screenshot, and a second dynamic key screen screenshot set is generated according to the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot and the second dynamic suspected main screen screenshot, thereby improving the efficiency, convenience and accuracy of generating the second dynamic key screen screenshot set.

[0101] In this embodiment, in response to a second startup operation on the Android emulator, a second application package of the application to be compared is obtained and the second application package is installed; then, in response to the completion of the installation of the second application package, the second application package is started, and the second detection time timing and monitoring of the second current running interface picture of the application to be analyzed are started; then, in response to the second detection time being greater than or equal to the display time of the startup screen picture of the application to be compared, the second running screen picture of the application to be compared is captured, and the second running screen picture is determined as the second dynamic startup screen screenshot; then, in response to the registration screen keyword appearing in the second current running interface picture and the input box greater than the third preset number appearing, the second current running interface picture is captured, and the second current running interface picture is determined as the second dynamic startup screen screenshot. The second current running interface picture is determined as the second dynamic registration screen screenshot; at the same time, in response to the login screen keyword appearing in the second current running interface picture and an input box greater than or equal to the fourth preset number appearing, the second current running interface picture is captured, the second current running interface picture is determined as the second dynamic login screen screenshot, and it is determined whether the second current running interface picture is updated; finally, in response to the update of the second current running interface picture, the second current running interface picture is determined as the second dynamic suspected main screen screenshot, and a second dynamic key screen screenshot set is generated according to the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot and the second dynamic suspected main screen screenshot, thereby improving the efficiency, convenience and accuracy of generating the second dynamic key screen screenshot set.

[0102] In one embodiment, if Fig.10 As shown, the first dynamic key screen screenshot set includes the first dynamic startup screen screenshot, the first dynamic startup screen screenshot, the first dynamic login screen screenshot and the first dynamic suspected main screen screenshot; the second dynamic key screen screenshot set includes the second dynamic startup screen screenshot, the second dynamic startup screen screenshot, the second dynamic login screen screenshot and the second dynamic suspected main screen screenshot; after performing image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set, the second application key image similarity is obtained, including steps 1001 to 100

[0103] Step 1001, calculate according to the first dynamic key screen screenshot set and the second dynamic key screen screenshot set respectively, to obtain the fifth picture fingerprint of the first dynamic startup screen screenshot, the sixth picture fingerprint of the first dynamic startup screen screenshot, the seventh picture fingerprint of the first dynamic login screen screenshot, the eighth picture fingerprint of the first dynamic suspected main screen screenshot, the ninth picture fingerprint of the second dynamic startup screen screenshot, the tenth picture fingerprint of the second dynamic startup screen screenshot, the eleventh picture fingerprint of the second dynamic login screen screenshot and the twelfth picture fingerprint of the second dynamic suspected main screen screenshot.

[0104] Step 1002: Determine the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint according to the fifth picture fingerprint and the ninth picture fingerprint.

[0105] Step 1003: Determine the Hamming distance between the sixth picture fingerprint and the tenth picture fingerprint according to the sixth picture fingerprint and the tenth picture fingerprint.

[0106] Step 1004: determine the Hamming distance between the seventh picture fingerprint and the eleventh picture fingerprint according to the seventh picture fingerprint and the eleventh picture fingerprint.

[0107] Step 1005: determine the Hamming distance between the eighth picture fingerprint and the twelfth picture fingerprint according to the eighth picture fingerprint and the twelfth picture fingerprint.

[0108] Step 1006, determining based on the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint, the Hamming distance between the sixth picture fingerprint and the tenth picture fingerprint, the Hamming distance between the seventh picture fingerprint and the eleventh picture fingerprint, and the Hamming distance between the eighth picture fingerprint and the twelfth picture fingerprint.

[0109] Specifically, the server 104 calculates according to the first dynamic key screen screenshot set and the second dynamic key screen screenshot set respectively, and obtains the fifth picture fingerprint of the first dynamic startup screen screenshot, the sixth picture fingerprint of the first dynamic startup screen screenshot, the seventh picture fingerprint of the first dynamic login screen screenshot, the eighth picture fingerprint of the first dynamic suspected main screen screenshot, the ninth picture fingerprint of the second dynamic startup screen screenshot, the tenth picture fingerprint of the second dynamic startup screen screenshot, the eleventh picture fingerprint of the second dynamic login screen screenshot, and the twelfth picture fingerprint of the second dynamic suspected main screen screenshot; then, according to the fifth picture fingerprint and the ninth picture fingerprint, the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint is determined; then, according to the sixth picture fingerprint and The tenth picture fingerprint determines the Hamming distance between the sixth picture fingerprint and the tenth picture fingerprint; then, the Hamming distance between the seventh picture fingerprint and the eleventh picture fingerprint is determined according to the seventh picture fingerprint and the eleventh picture fingerprint; at the same time, the Hamming distance between the eighth picture fingerprint and the twelfth picture fingerprint is determined according to the eighth picture fingerprint and the twelfth picture fingerprint; finally, the second application key picture similarity is determined according to the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint, the Hamming distance between the sixth picture fingerprint and the tenth picture fingerprint, the Hamming distance between the seventh picture fingerprint and the eleventh picture fingerprint, and the Hamming distance between the eighth picture fingerprint and the twelfth picture fingerprint, thereby improving the efficiency, convenience and accuracy of calculating the second application key picture similarity.

[0110] In this embodiment, calculations are performed based on the first dynamic key screen screenshot set and the second dynamic key screen screenshot set to obtain the fifth picture fingerprint of the first dynamic startup screen screenshot, the sixth picture fingerprint of the first dynamic startup screen screenshot, the seventh picture fingerprint of the first dynamic login screen screenshot, the eighth picture fingerprint of the first dynamic suspected main screen screenshot, the ninth picture fingerprint of the second dynamic startup screen screenshot, the tenth picture fingerprint of the second dynamic startup screen screenshot, the eleventh picture fingerprint of the second dynamic login screen screenshot, and the twelfth picture fingerprint of the second dynamic suspected main screen screenshot; then, the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint is determined based on the fifth picture fingerprint and the ninth picture fingerprint; then, the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint is determined based on the sixth picture fingerprint and the tenth picture fingerprint. The image fingerprint determines the Hamming distance between the sixth image fingerprint and the tenth image fingerprint; then, the Hamming distance between the seventh image fingerprint and the eleventh image fingerprint is determined according to the seventh image fingerprint and the eleventh image fingerprint; at the same time, the Hamming distance between the eighth image fingerprint and the twelfth image fingerprint is determined according to the eighth image fingerprint and the twelfth image fingerprint; finally, the second application key image similarity is determined according to the Hamming distance between the fifth image fingerprint and the ninth image fingerprint, the Hamming distance between the sixth image fingerprint and the tenth image fingerprint, the Hamming distance between the seventh image fingerprint and the eleventh image fingerprint, and the Hamming distance between the eighth image fingerprint and the twelfth image fingerprint, thereby improving the efficiency, convenience and accuracy of calculating the second application key image similarity.

[0111] Step 204 , calculate based on the consistency of all application pictures, the similarity of all application pictures, the similarity of the first application key picture and the similarity of the second application key picture to obtain the comprehensive similarity of the application program.

[0112] Specifically, the server 104 calculates the comprehensive similarity of the application program based on the consistency of all application images, the similarity of all application images, the similarity of the first application key image and the similarity of the second application key image, thereby improving the accuracy and comprehensiveness of the data, and automatically analyzing the comprehensive similarity without manual intervention.

[0113] In a specific example, the comprehensive similarity of the application is calculated based on the consistency of all application images, the first weight of the consistency of all application images, the similarity of all application images, the second weight of the similarity of all application images, the similarity of the first application key image, the third weight of the similarity of the first application key image, the similarity of the second application key image, and the fourth weight of the similarity of the second application key image. The above is only a specific example and can be flexibly set according to user needs in actual applications.

[0114] In the above-mentioned application similarity analysis method, all first application resource images of the application to be analyzed and all second application resource images of the application to be compared are obtained, and after performing image analysis based on each first application resource image and each second application resource image, the consistency of all application images and the similarity of all application images are obtained; then, the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared are obtained, and after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image, the first application key image similarity is obtained; then, the first dynamic key screen screenshot set of the application to be analyzed and the second dynamic screen screenshot set of the application to be compared are obtained, and after performing image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set, the second application key image similarity is obtained; finally, the comprehensive similarity of the application is obtained by calculating based on the consistency of all application images, the similarity of all application images, the similarity of the first application key image and the similarity of the second application key image, thereby improving the accuracy and comprehensiveness of the data, and automatically analyzing the comprehensive similarity without manual intervention, thereby avoiding the low-cost and large-scale packaging method affecting the accuracy of the similarity analysis of the APP.

[0115] It should be understood that although Figure 2-10 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 2-10 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0116] Second, as Fig.11 As shown, a device for automatically analyzing application similarity is provided, and the device includes a first similarity calculation module 1101 , a second similarity calculation module 1102 , a third similarity calculation module 1103 and a comprehensive similarity calculation module 1104 .

[0117] Among them, the first similarity calculation module 1101 is used to obtain all the first application resource images of the application to be analyzed and all the second application resource images of the application to be compared, and obtain the consistency of all application images and the similarity of all application images after performing image analysis based on each first application resource image and each second application resource image; wherein the consistency of all application images is used to characterize the ratio of the existence of consistent images in each first application resource image in each second application resource image; the similarity of all application images is used to characterize the ratio of the existence of similar images in each first application resource image in each second application resource image; the second similarity calculation module 1102 is used to obtain the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared, and obtain after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image. to the first application key picture similarity; the first application key picture similarity is used to characterize the similarity between the first suspected startup screen picture and the second suspected startup screen picture; the third similarity calculation module 1103 is used to obtain the first dynamic key screen screenshot set of the application to be analyzed and the second dynamic screen screenshot set of the application to be compared, and obtain the second application key picture similarity after performing picture analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set; the second application key picture similarity is used to characterize the ratio of similar pictures in the first dynamic key screen screenshot set in the second dynamic screen screenshot set; the comprehensive similarity calculation module 1104 is used to calculate based on the consistency of all application pictures, the similarity of all application pictures, the similarity of the first application key picture and the similarity of the second application key picture to obtain the comprehensive similarity of the application.

[0118] In one embodiment, the first similarity calculation module 1101 includes a first acquisition unit.

[0119] Among them, the first acquisition unit is used to obtain the first application resource of the application to be analyzed and the second application resource of the application to be compared; the first acquisition unit is used to decompile the first application resource and the second application resource respectively to obtain the first resource directory of the first application resource, the decompiled first application resource, the second resource directory of the second application resource, and the decompiled second application resource; the first acquisition unit is used to query the first application resource after decompilation according to the first resource directory and the target image file suffix to obtain each first application resource image; the first acquisition unit is used to query the second application resource after decompilation according to the second resource directory and the target image file suffix to obtain each second application resource image.

[0120] In one embodiment, the second similarity calculation module 1102 includes a second acquisition unit.

[0121] Among them, the second acquisition unit is used to obtain the corresponding first application resource picture with the largest picture size after performing picture size comparison according to each first application resource picture, and obtain the first application resource picture with the largest file size and the largest picture size after performing file size comparison according to each first application resource picture with the largest picture size, and determine the first application resource picture with the largest file size and the largest picture size as the first suspected startup screen picture; the second acquisition unit is used to obtain the corresponding second application resource picture with the largest picture size after performing picture size comparison according to each second application resource picture with the largest picture size, and obtain the second application resource picture with the largest file size and the largest picture size after performing file size comparison according to each second application resource picture with the largest picture size, and determine the second application resource picture with the largest file size and the largest picture size as the second suspected startup screen picture.

[0122] In one embodiment, the third similarity calculation module 1103 includes a third acquisition unit.

[0123] Among them, the third acquisition unit is used to respond to the first startup operation of the Android emulator, obtain the first application package of the application to be analyzed, and install the first application package; the third acquisition unit is used to respond to the completion of the installation of the first application package, start the first application package, and start the first detection time timing and monitoring the first current running interface picture of the application to be analyzed; the third acquisition unit is used to respond to the first detection time being greater than or equal to the startup screen picture display time of the application to be analyzed, intercept the first running screen picture of the application to be analyzed, and determine the first running screen picture as the first dynamic startup screen screenshot; the third acquisition unit is used to respond to the first current running interface picture appearing with the registration screen keyword and the input box greater than the first preset number appearing, intercept the first a current running interface picture, and determining the first current running interface picture as the first dynamic registration screen screenshot; a third acquisition unit is used to respond to the appearance of a login screen keyword in the first current running interface picture and the appearance of an input box greater than or equal to a second preset number, capture the first current running interface picture, determine the first current running interface picture as the first dynamic login screen screenshot, and determine whether the first current running interface picture is updated; the third acquisition unit is used to respond to the appearance of an update in the first current running interface picture, determine the first current running interface picture as the first dynamic suspected main screen screenshot, and generate a first dynamic key screen screenshot set according to the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot and the first dynamic suspected main screen screenshot.

[0124] In one embodiment, the third acquisition unit is used to obtain the second application package of the application to be compared and install the second application package in response to the second startup operation of the Android emulator; the third acquisition unit is used to start the second application package in response to the completion of the installation of the second application package, and start the second detection time timing and monitor the second current running interface picture of the application to be analyzed; the third acquisition unit is used to intercept the second running screen picture of the application to be compared in response to the second detection time being greater than or equal to the display time of the startup screen picture of the application to be compared, and determine the second running screen picture as the second dynamic startup screen screenshot; the third acquisition unit is used to respond to the registration screen keyword appearing in the second current running interface picture and the input box greater than the third preset number appearing, A second current running interface picture is captured, and the second current running interface picture is determined as a second dynamic registration screen screenshot; the third acquisition unit is used to respond to the appearance of a login screen keyword in the second current running interface picture and the appearance of an input box greater than or equal to a fourth preset number, capture the second current running interface picture, determine the second current running interface picture as a second dynamic login screen screenshot, and determine whether the second current running interface picture is updated; the third acquisition unit is used to respond to the appearance of an update in the second current running interface picture, determine the second current running interface picture as a second dynamic suspected main screen screenshot, and generate a second dynamic key screen screenshot set according to the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot and the second dynamic suspected main screen screenshot.

[0125] In one embodiment, the first similarity calculation module 1101 includes a first similarity calculation unit.

[0126] Among them, the first similarity calculation unit is used to perform calculations according to each first application resource picture and each second application resource picture, respectively, to obtain a first hash value of each first application resource picture and a second hash value of each second application resource picture; the first similarity calculation unit is used to determine the number of target hash values ​​according to each first hash value and each second hash value; the target hash value is the first hash value for which the same hash value exists among all second hash values; the first similarity calculation unit is used to determine the consistency of all application pictures according to the quotient of the number of target hash values ​​and the total number of first hash values.

[0127] In one embodiment, the first similarity calculation module 1101 includes a second similarity calculation unit.

[0128] Among them, the second similarity calculation unit is used to perform calculations according to each first application resource picture and each second application resource picture respectively, to obtain the first picture fingerprint of each first application resource picture and the second picture fingerprint of each second application resource picture; the second similarity calculation unit is used to determine the number of first target picture fingerprints according to each first picture fingerprint and each second picture fingerprint; the first target picture fingerprint is the first picture fingerprint having a first target Hamming distance in the Hamming distance between all second picture fingerprints; the first target Hamming distance is the Hamming distance between the first picture fingerprint and the second picture fingerprint that is greater than the first Hamming distance threshold; the second similarity calculation unit is used to determine the similarity of all application pictures according to the quotient of the number of first target picture fingerprints and the total number of first picture fingerprints.

[0129] In one embodiment, the second similarity calculation module 1102 includes a third similarity calculation unit.

[0130] Among them, the third similarity calculation unit is used to perform calculations based on the first suspected startup screen image and the second suspected startup screen image, respectively, to obtain a third image fingerprint of the first suspected startup screen image and a fourth image fingerprint of the second suspected startup screen image; the third similarity calculation unit is used to determine the Hamming distance between the third image fingerprint and the fourth image fingerprint based on the third image fingerprint and the fourth image fingerprint, and determine the similarity of the first application key image based on the Hamming distance between the third image fingerprint and the fourth image fingerprint.

[0131] In one embodiment, the first dynamic key screen screenshot set includes a first dynamic startup screen screenshot, a first dynamic startup screen screenshot, a first dynamic login screen screenshot and a first dynamic suspected main screen screenshot; the second dynamic key screen screenshot set includes a second dynamic startup screen screenshot, a second dynamic startup screen screenshot, a second dynamic login screen screenshot and a second dynamic suspected main screen screenshot; the third similarity calculation module 1103 includes a fourth similarity calculation unit.

[0132] Among them, the fourth similarity calculation unit is used to calculate according to the first dynamic key screen screenshot set and the second dynamic key screen screenshot set, respectively, to obtain the fifth picture fingerprint of the first dynamic startup screen screenshot, the sixth picture fingerprint of the first dynamic startup screen screenshot, the seventh picture fingerprint of the first dynamic login screen screenshot, the eighth picture fingerprint of the first dynamic suspected main screen screenshot, the ninth picture fingerprint of the second dynamic startup screen screenshot, the tenth picture fingerprint of the second dynamic startup screen screenshot, the eleventh picture fingerprint of the second dynamic login screen screenshot and the twelfth picture fingerprint of the second dynamic suspected main screen screenshot; the fourth similarity calculation unit is used to determine the Hamming distance between the fifth picture fingerprint and the ninth picture fingerprint according to the fifth picture fingerprint and the ninth picture fingerprint; the fourth similarity calculation unit The fourth similarity calculation unit is used to determine the Hamming distance between the sixth image fingerprint and the tenth image fingerprint according to the sixth image fingerprint and the tenth image fingerprint; the fourth similarity calculation unit is used to determine the Hamming distance between the seventh image fingerprint and the eleventh image fingerprint according to the seventh image fingerprint and the eleventh image fingerprint; the fourth similarity calculation unit is used to determine the Hamming distance between the eighth image fingerprint and the twelfth image fingerprint according to the eighth image fingerprint and the twelfth image fingerprint; the fourth similarity calculation unit is used to determine the second application key image similarity according to the Hamming distance between the fifth image fingerprint and the ninth image fingerprint, the Hamming distance between the sixth image fingerprint and the tenth image fingerprint, the Hamming distance between the seventh image fingerprint and the eleventh image fingerprint, and the Hamming distance between the eighth image fingerprint and the twelfth image fingerprint.

[0133] For the specific definition of the application similarity analysis device, please refer to the definition of the application similarity analysis method above, which will not be repeated here. Each module in the above-mentioned application similarity analysis device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0134] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.12As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store all first application resource images of the application to be analyzed and all second application resource image data of the application to be compared. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for analyzing application similarity is implemented.

[0135] Those skilled in the art will understand that Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0136] In a third aspect, a computer device is provided. The computer device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of any method in the above method embodiments are implemented.

[0137] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any method in the above method embodiments are implemented.

[0138] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct RAMbus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0139] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for automatically analyzing application similarity, the method comprising: Obtain all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and perform image analysis based on each of the first application resource images and each of the second application resource images to obtain the consistency of all application images and the similarity of all application images; wherein the consistency of all application images is used to characterize the ratio of the existence of consistent images in each of the first application resource images in each of the second application resource images; the similarity of all application images is used to characterize the ratio of the existence of similar images in each of the first application resource images in each of the second application resource images; Obtaining a first suspected startup screen image of the application to be analyzed and a second suspected startup screen image of the application to be compared, and obtaining a first application key image similarity after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image; the first application key image similarity is used to characterize the degree of similarity between the first suspected startup screen image and the second suspected startup screen image; Obtaining a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared, and performing image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set to obtain a second application key image similarity; the second application key image similarity is used to characterize the ratio of similar images in the first dynamic key screen screenshot set in the second dynamic screen screenshot set; The comprehensive similarity of the application programs is obtained by calculating the consistency of all the application pictures, the similarity of all the application pictures, the similarity of the first application key pictures, and the similarity of the second application key pictures.

2. The method according to claim 1, characterized in that The obtaining of all first application resource images of the application to be analyzed and all second application resource images of the application to be compared includes: Acquire a first application resource of the application to be analyzed and a second application resource of the application to be compared; Decompiling the first application resource and the second application resource respectively to obtain a first resource directory of the first application resource, the decompiled first application resource, a second resource directory of the second application resource, and the decompiled second application resource; Perform query processing on the decompiled first application resource according to the first resource directory and the target image file suffix to obtain each first application resource image; A query process is performed on the decompiled second application resource according to the second resource directory and the target image file suffix to obtain each second application resource image.

3. The method according to claim 2, characterized in that The obtaining of the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared comprises: Comparing the picture sizes of the first application resource pictures to obtain the first application resource picture with the largest picture size, comparing the file sizes of the first application resource pictures with the largest picture sizes to obtain the first application resource picture with the largest file size, and determining the first application resource picture with the largest file size and the largest picture size as the first suspected startup screen picture; After comparing the image sizes of each of the second application resource images, the corresponding second application resource image with the largest image size is obtained; after comparing the file sizes of each of the second application resource images with the largest image size, the second application resource image with the largest file size is obtained; and the second application resource image with the largest file size and the largest image size is determined as the second suspected startup screen image.

4. The method according to claim 1, characterized in that The obtaining of a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared includes: In response to a first startup operation on the Android emulator, obtaining a first application package of the application to be analyzed, and installing the first application package; In response to the first application package being installed, the first application package is started, and a first detection time is started and a first current running interface picture of the application to be analyzed is monitored; In response to the first detection time being greater than or equal to the display time of the startup screen image of the application to be analyzed, capturing a first running screen image of the application to be analyzed, and determining the first running screen image as a first dynamic startup screen screenshot; In response to the first current running interface picture having a registration screen keyword and having a number of input boxes greater than a first preset number, capturing the first current running interface picture, and determining the first current running interface picture as a first dynamic registration screen screenshot; In response to the appearance of a login screen keyword in the first current running interface picture and the appearance of input boxes greater than or equal to a second preset number, capturing the first current running interface picture, determining the first current running interface picture as a first dynamic login screen screenshot, and determining whether the first current running interface picture is updated; In response to an update of the first current running interface picture, the first current running interface picture is determined as the first dynamic suspected main screen screenshot, and the first dynamic key screen screenshot set is generated based on the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot and the first dynamic suspected main screen screenshot.

5. The method according to claim 4, characterized in that The obtaining of a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared includes: In response to a second startup operation on the Android emulator, obtaining a second application package of the application to be compared, and installing the second application package; In response to the second application package being installed, starting the second application package, and starting a second detection timer and monitoring a second current running interface picture of the application to be analyzed; In response to the second detection time being greater than or equal to the display time of the startup screen image of the application to be compared, capturing a second running screen image of the application to be compared, and determining the second running screen image as a second dynamic startup screen screenshot; In response to the registration screen keyword appearing in the second current running interface picture and the input boxes greater than the third preset number appearing, capturing the second current running interface picture, and determining the second current running interface picture as a second dynamic registration screen screenshot; In response to the login screen keyword appearing in the second current running interface picture and the input boxes greater than or equal to the fourth preset number appearing, capturing the second current running interface picture, determining the second current running interface picture as a second dynamic login screen screenshot, and determining whether the second current running interface picture is updated; In response to an update of the second current running interface picture, the second current running interface picture is determined as a second dynamic suspected main screen screenshot, and the second dynamic key screen screenshot set is generated based on the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot and the second dynamic suspected main screen screenshot.

6. The method according to claim 1, characterized in that The obtaining the consistency of all application pictures and the similarity of all application pictures after performing picture analysis according to each of the first application resource pictures and each of the second application resource pictures includes: Calculate respectively according to each of the first application resource pictures and each of the second application resource pictures to obtain a first hash value of each of the first application resource pictures and a second hash value of each of the second application resource pictures; Determine the number of target hash values ​​according to each of the first hash values ​​and each of the second hash values; the target hash value is the first hash value that has the same hash value among all of the second hash values; The consistency of all the pictures of the application is determined according to a quotient of the number of the target hash values ​​and the total number of the first hash values.

7. The method according to claim 1, characterized in that The obtaining the consistency of all application pictures and the similarity of all application pictures after performing picture analysis according to each of the first application resource pictures and each of the second application resource pictures includes: Calculating respectively according to each of the first application resource pictures and each of the second application resource pictures to obtain a first picture fingerprint of each of the first application resource pictures and a second picture fingerprint of each of the second application resource pictures; Determine the number of first target image fingerprints according to each of the first image fingerprints and each of the second image fingerprints; the first target image fingerprint is the first image fingerprint having a first target Hamming distance in the Hamming distances between the first image fingerprint and all the second image fingerprints; the first target Hamming distance is the Hamming distance between the first image fingerprint and the second image fingerprint that is greater than a first Hamming distance threshold; The similarity of all the application pictures is determined according to the quotient of the number of the first target picture fingerprints and the total number of the first picture fingerprints.

8. The method according to claim 1, characterized in that The obtaining the first application key picture similarity after performing picture analysis based on the first suspected startup screen picture and the second suspected startup screen picture includes: Calculating respectively according to the first suspected startup screen picture and the second suspected startup screen picture to obtain a third picture fingerprint of the first suspected startup screen picture and a fourth picture fingerprint of the second suspected startup screen picture; The Hamming distance between the third picture fingerprint and the fourth picture fingerprint is determined according to the third picture fingerprint and the fourth picture fingerprint, and the first application key picture similarity is determined according to the Hamming distance between the third picture fingerprint and the fourth picture fingerprint.

9. The method according to claim 1, characterized in that: The first dynamic key screen screenshot set includes a first dynamic startup screen screenshot, a first dynamic startup screen screenshot, a first dynamic login screen screenshot and a first dynamic suspected main screen screenshot; the second dynamic key screen screenshot set includes a second dynamic startup screen screenshot, a second dynamic startup screen screenshot, a second dynamic login screen screenshot and a second dynamic suspected main screen screenshot; The obtaining the second application key picture similarity after performing picture analysis according to the first dynamic key screen screenshot set and the second dynamic screen screenshot set includes: Calculating respectively according to the first dynamic key screen screenshot set and the second dynamic key screen screenshot set, to obtain a fifth picture fingerprint of the first dynamic startup screen screenshot, a sixth picture fingerprint of the first dynamic startup screen screenshot, a seventh picture fingerprint of the first dynamic login screen screenshot, an eighth picture fingerprint of the first dynamic suspected main screen screenshot, a ninth picture fingerprint of the second dynamic startup screen screenshot, a tenth picture fingerprint of the second dynamic startup screen screenshot, an eleventh picture fingerprint of the second dynamic login screen screenshot, and a twelfth picture fingerprint of the second dynamic suspected main screen screenshot; Determine a Hamming distance between the fifth image fingerprint and the ninth image fingerprint according to the fifth image fingerprint and the ninth image fingerprint; Determine a Hamming distance between the sixth image fingerprint and the tenth image fingerprint according to the sixth image fingerprint and the tenth image fingerprint; Determining a Hamming distance between the seventh image fingerprint and the eleventh image fingerprint according to the seventh image fingerprint and the eleventh image fingerprint; Determine a Hamming distance between the eighth picture fingerprint and the twelfth picture fingerprint according to the eighth picture fingerprint and the twelfth picture fingerprint; The second application key image similarity is determined according to the Hamming distance between the fifth image fingerprint and the ninth image fingerprint, the Hamming distance between the sixth image fingerprint and the tenth image fingerprint, the Hamming distance between the seventh image fingerprint and the eleventh image fingerprint, and the Hamming distance between the eighth image fingerprint and the twelfth image fingerprint.

10. An automatic application similarity analysis device, characterized in that: The device comprises: A first similarity calculation module is used to obtain all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and obtain the consistency of all application images and the similarity of all application images after performing image analysis based on each of the first application resource images and each of the second application resource images; wherein the consistency of all application images is used to characterize the ratio of the existence of consistent images of each of the first application resource images in each of the second application resource images; and the similarity of all application images is used to characterize the ratio of the existence of similar images of each of the first application resource images in each of the second application resource images; a second similarity calculation module, configured to obtain a first suspected startup screen image of the application to be analyzed and a second suspected startup screen image of the application to be compared, and to obtain a first application key image similarity after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image; the first application key image similarity is used to characterize the degree of similarity between the first suspected startup screen image and the second suspected startup screen image; a third similarity calculation module, configured to obtain a first dynamic key screen screenshot set of the application to be analyzed and a second dynamic screen screenshot set of the application to be compared, and to obtain a second application key picture similarity after performing picture analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set; the second application key picture similarity is used to characterize a ratio of similar pictures in the first dynamic key screen screenshot set in the second dynamic screen screenshot set; The comprehensive similarity calculation module is used to calculate according to the consistency of all the images of the application, the similarity of all the images of the application, the similarity of the first application key image and the similarity of the second application key image to obtain the comprehensive similarity of the application program.

11. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images