Application program similarity automatic analysis method and device, computer device and storage medium

Abstract

The application relates to an application program similarity automatic analysis method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining application all-picture consistency and application all-picture similarity by performing picture analysis on each first application resource picture and each second application resource picture; obtaining first application key picture similarity by performing picture analysis on a first suspected startup picture and a second suspected startup picture; obtaining second application key picture similarity by performing picture analysis on a first dynamic key picture screenshot set and a second dynamic picture screenshot set; and calculating application program comprehensive similarity according to the application all-picture consistency, the application all-picture similarity, the first application key picture similarity and the second application key picture similarity. The method can improve the accuracy and data comprehensiveness.

Description

Technical Field

[0001] This application relates to the field of mobile internet APP detection and analysis technology, and in particular to an automatic application similarity analysis method, apparatus, computer equipment, and storage medium. Background Technology

[0002] Fraudulent apps are highly deceptive by mimicking legitimate apps, making it difficult for users to distinguish between legitimate and fraudulent ones based solely on their interface appearance. Therefore, identifying and associating fraudulent apps is crucial to reducing user losses and improving cybersecurity.

[0003] However, traditional methods for analyzing fraudulent apps using application similarity analysis suffer from low accuracy or limited data comprehensiveness. Summary of the Invention

[0004] Therefore, it is necessary to provide an automatic application similarity analysis method, apparatus, computer device, and storage medium that can improve the accuracy and data comprehensiveness of the above-mentioned technical problems.

[0005] Firstly, a method for automatic analysis of application similarity is provided, the method comprising:

[0006] All first application resource images of the application to be analyzed and all second application resource images of the application to be compared are obtained. After image analysis based on each first application resource image and each second application resource image, the consistency and similarity of all images of the application are obtained. Among them, the consistency of all images of the application is used to characterize the ratio of consistent images of each first application resource image in each second application resource image; the similarity of all images of the application is used to characterize the ratio of similar images of each first application resource image in each second application resource image.

[0007] A first suspected launch screen image of the application to be analyzed and a second suspected launch screen image of the application to be compared are obtained. After image analysis based on the first and second suspected launch screen images, the similarity of the first application key images is obtained. The similarity of the first application key images is used to characterize the degree of similarity between the first and second suspected launch screen images.

[0008] A first set of dynamic key screen screenshots of the application to be analyzed and a second set of dynamic screen screenshots of the application to be compared are obtained. After image analysis based on the first set of dynamic key screen screenshots and the second set of dynamic screen screenshots, the similarity of key images of the second application is obtained. The similarity of key images of the second application is used to characterize the ratio of similar images in the first set of dynamic key screen screenshots and the second set of dynamic screen screenshots.

[0009] The overall similarity of the application is calculated based on the consistency of all images in the application, the similarity of all images in the application, the similarity of the first key image in the application, and the similarity of the second key image in the application.

[0010] In one embodiment, obtaining all first application resource images of the application to be analyzed and all second application resource images of the application to be compared includes: obtaining the first application resources of the application to be analyzed and the second application resources of the application to be compared; decompiling the first application resources and the second application resources respectively to obtain a first resource directory of the first application resources, the decompiled first application resources, a second resource directory of the second application resources, and the decompiled second application resources; querying the decompiled first application resources according to the first resource directory and the target image file extension to obtain each first application resource image; and querying the decompiled second application resources according to the second resource directory and the target image file extension to obtain each second application resource image.

[0011] In one embodiment, obtaining a first suspected launch screen image of the application to be analyzed and a second suspected launch screen image of the application to be compared includes: comparing the image sizes of each first application resource image to obtain the first application resource image with the largest corresponding image size; comparing the file sizes of each first application resource image with the largest image size to obtain the first application resource image with the largest file size; and determining the first application resource image with the largest file size as the first suspected launch screen image; comparing the image sizes of each second application resource image to obtain the second application resource image with the largest corresponding image size; comparing the file sizes of each second application resource image with the largest image size to obtain the second application resource image with the largest file size; and determining the second application resource image with the largest file size as the second suspected launch screen image.

[0012] In one embodiment, acquiring a first set of dynamic key screen screenshots of the application to be analyzed and a second set of dynamic screen screenshots of the application to be compared includes: in response to a first startup operation on an Android emulator, acquiring a first application package of the application to be analyzed and installing the first application package; in response to the completion of the installation of the first application package, launching the first application package and starting a first detection timer and monitoring the first currently running interface image of the application to be analyzed; in response to the first detection time being greater than or equal to the display time of the startup screen image of the application to be analyzed, capturing the first running screen image of the application to be analyzed and identifying the first running screen image as the first dynamic startup screen screenshot; in response to the appearance of registration screen keywords in the first currently running interface image and If more than a first preset number of input boxes appear, capture a screenshot of the first currently running interface and identify it as the first dynamic registration screen screenshot; if the login screen keyword appears in the first currently running interface image and more than or equal to a second preset number of input boxes appear, capture a screenshot of the first currently running interface image and identify it as the first dynamic login screen screenshot, and determine whether the first currently running interface image has been updated; if the first currently running interface image has been updated, identify it as the first dynamic suspected main screen screenshot, and generate a set of first dynamic key screen screenshots based on the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot, and the first dynamic suspected main screen screenshot.

[0013] In one embodiment, acquiring a first set of dynamic key screen screenshots of the application to be analyzed and a second set of dynamic screen screenshots of the application to be compared includes: in response to a second startup operation on an Android emulator, acquiring a second application package of the application to be compared and installing the second application package; in response to the completion of the installation of the second application package, launching the second application package and starting a second detection timer and monitoring the second currently running interface image of the application to be analyzed; in response to the second detection time being greater than or equal to the startup screen image display time of the application to be compared, capturing the second running screen image of the application to be compared and identifying the second running screen image as the second dynamic startup screen screenshot; in response to the appearance of registration screen keywords in the second currently running interface image and If more than a third preset number of input boxes appear, capture a screenshot of the second currently running interface and identify it as the screenshot of the second dynamic registration screen. If the second currently running interface image displays login screen keywords and more than or equal to a fourth preset number of input boxes, capture a screenshot of the second currently running interface and identify it as the screenshot of the second dynamic login screen, and determine if the second currently running interface image has been updated. If the second currently running interface image has been updated, identify it as the screenshot of the second dynamic suspected main screen, and generate a set of second dynamic key screen screenshots based on the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot, and the second dynamic suspected main screen screenshot.

[0014] In one embodiment, the consistency and similarity of all images in the application are obtained by performing image analysis based on each first application resource image and each second application resource image, including: calculating a first hash value for each first application resource image and a second hash value for each second application resource image based on each first application resource image and each second application resource image respectively; determining the number of target hash values ​​based on each first hash value and each second hash value; the target hash value is the first hash value that has the same hash value among all second hash values; and determining the consistency of all images in the application based on the quotient of the number of target hash values ​​and the total number of first hash values.

[0015] In one embodiment, after performing image analysis on each first application resource image and each second application resource image, the consistency and similarity of all images in the application are obtained, including: calculating the first image fingerprint of each first application resource image and the second image fingerprint of each second application resource image based on each first application resource image and each second application resource image respectively; determining the number of first target image fingerprints based on each first image fingerprint and each second image fingerprint; the first target image fingerprint is a first image fingerprint that has a first target Hamming distance among the Hamming distances between it and all second image fingerprints; the first target Hamming distance is the Hamming distance between the first image fingerprint and the second image fingerprint that is greater than a first Hamming distance threshold; and determining the similarity of all images in the application based on the quotient of the number of first target image fingerprints and the total number of first image fingerprints.

[0016] In one embodiment, the similarity of a first application key image is obtained by performing image analysis based on a first suspected startup screen image and a second suspected startup screen image, including: calculating a third image fingerprint of the first suspected startup screen image and a fourth image fingerprint of the second suspected startup screen image based on the first suspected startup screen image and the second suspected startup screen image respectively; determining the Hamming distance between the third image fingerprint and the fourth image fingerprint based on the third image fingerprint and the fourth image fingerprint; and determining the similarity of the first application key image based on the Hamming distance between the third image fingerprint and the fourth image fingerprint.

[0017] In one embodiment, the first set of dynamic key screen screenshots includes a first dynamic startup screen screenshot, a first dynamic login screen screenshot, and a first dynamic suspected home screen screenshot; the second set of dynamic key screen screenshots includes a second dynamic startup screen screenshot, a second dynamic login screen screenshot, and a second dynamic suspected home screen screenshot; after performing image analysis based on the first and second sets of dynamic key screen screenshots, the similarity of the second application key images is obtained, including: calculating the fifth image fingerprint of the first dynamic startup screen screenshot, the sixth image fingerprint of the first dynamic startup screen screenshot, the seventh image fingerprint of the first dynamic login screen screenshot, the eighth image fingerprint of the first dynamic suspected home screen screenshot, the ninth image fingerprint of the second dynamic startup screen screenshot, and the second dynamic key screen screenshot, respectively, based on the first and second sets of dynamic key screen screenshots. The fingerprints of the tenth image from the animated screenshot, the eleventh image from the second dynamic login screen screenshot, and the twelfth image from the second dynamic suspected main screen screenshot are used to determine the Hamming distance between the fifth and ninth image fingerprints. The Hamming distance between the sixth and tenth image fingerprints is also determined based on the fingerprints of the fifth and tenth images. The Hamming distance between the seventh and eleventh image fingerprints is further determined based on the fingerprints of the seventh and eleventh images. The Hamming distance between the eighth and twelfth image fingerprints is then used to determine the similarity of the second application key images.

[0018] Secondly, an automatic application similarity analysis device is provided, the device comprising a first similarity calculation module, a second similarity calculation module, a third similarity calculation module, and a comprehensive similarity calculation module.

[0019] The first similarity calculation module is used to acquire all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and to obtain the consistency and similarity of all images of the application after performing image analysis on each first application resource image and each second application resource image; wherein, the consistency of all images of the application is used to characterize the ratio of consistent images among each first application resource image and the similarity of all images of the application; the similarity of all images of the application is used to characterize the ratio of similar images among each first application resource image and each second application resource image. The second similarity calculation module is used to acquire the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared, and to obtain the consistency and similarity of all images of the application after performing image analysis on each first suspected startup screen image and the second suspected startup screen image. The system employs a first application key image similarity module, which characterizes the degree of similarity between a first suspected startup screen image and a second suspected startup screen image. A third similarity calculation module acquires a set of first dynamic key screen screenshots of the application to be analyzed and a set of second dynamic screen screenshots of the application to be compared. It then performs image analysis based on these two sets to obtain the second application key image similarity. The second application key image similarity characterizes the ratio of similar images found in the first dynamic key screen screenshot set within the second dynamic screen screenshot set. Finally, a comprehensive similarity calculation module calculates the comprehensive application similarity based on the consistency of all application images, the similarity of all application images, the similarity of the first application key image, and the similarity of the second application key image.

[0020] Thirdly, a computer device is provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods described in the above method embodiments.

[0021] Fourthly, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of any of the methods described in the above method embodiments.

[0022] The aforementioned automatic application similarity analysis method, apparatus, computer equipment, and storage medium acquire all first application resource images of the application to be analyzed and all second application resource images of the application to be compared. After image analysis of each first and second application resource image, the consistency and similarity of all application images are obtained. Next, a first suspected startup screen image of the application to be analyzed and a second suspected startup screen image of the application to be compared are acquired. After image analysis of the first and second suspected startup screen images, the similarity of key images of the first application is obtained. Then, a set of first dynamic key screen screenshots of the application to be analyzed and a set of second dynamic screen screenshots of the application to be compared are acquired. After image analysis of the first and second dynamic screen screenshots, the similarity of key images of the second application is obtained. Finally, the overall application similarity is calculated based on the consistency, similarity, and similarity of key images of the first and second applications. This improves accuracy and data comprehensiveness, and the automatic analysis of the overall similarity requires no manual intervention. Attached Figure Description

[0023] Figure 1 This is an application environment diagram of an automatic application similarity analysis method in one embodiment;

[0024] Figure 2 This is a flowchart illustrating an automatic application similarity analysis method in one embodiment;

[0025] Figure 3 This is a schematic diagram of a first process for obtaining all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, in one embodiment.

[0026] Figure 4 This is a schematic diagram of the first process in one embodiment, which obtains the consistency and similarity of all images in an application after performing image analysis based on each first application resource image and each second application resource image.

[0027] Figure 5 This is a schematic diagram of a second process in one embodiment, which obtains the consistency and similarity of all images in an application after performing image analysis based on each first application resource image and each second application resource image.

[0028] Figure 6 This is a schematic diagram of the process of obtaining a first suspected startup screen image of the application to be analyzed and a second suspected startup screen image of the application to be compared in one embodiment;

[0029] Figure 7This is a flowchart illustrating the process of obtaining the similarity of a key image of a first application after image analysis based on a first suspected startup screen image and a second suspected startup screen image in one embodiment.

[0030] Figure 8 This is a schematic diagram of a first process for obtaining a first set of dynamic key screen screenshots of the application to be analyzed and a second set of dynamic screen screenshots of the application to be compared, in one embodiment.

[0031] Figure 9 This is a schematic diagram of a second process for obtaining a first set of dynamic key screen screenshots of the application to be analyzed and a second set of dynamic screen screenshots of the application to be compared, in one embodiment.

[0032] Figure 10 This is a schematic diagram of the process of obtaining the similarity of the second application key image after image analysis based on the first dynamic key image screenshot set and the second dynamic image screenshot set in one embodiment.

[0033] Figure 11 This is a structural block diagram of an application similarity automatic analysis device in one embodiment;

[0034] Figure 12 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0036] To facilitate understanding of this application, a more complete description will be provided below with reference to the accompanying drawings, which illustrate embodiments of the present application. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that the disclosure of this application will be thorough and complete.

[0037] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0038] It is understood that the terms "first," "second," etc., used herein may be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of this application, a first resistor may be referred to as a second resistor, and similarly, a second resistor may be referred to as a first resistor. Both the first resistor and the second resistor are resistors, but they are not the same resistor.

[0039] It is understood that the term "connection" in the following embodiments should be understood as "electrical connection," "communication connection," etc., if the connected circuits, modules, units, etc., have electrical signal or data transmission with each other.

[0040] When used herein, the singular forms of “a,” “an,” and “the” may also include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “comprising,” “including,” or “having,” etc., specify the presence of the stated feature, whole, step, operation, component, part, or combination thereof, but do not preclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts, or combinations thereof.

[0041] The application similarity analysis method provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, and portable wearable devices, and server 104 can be a standalone server or a server cluster consisting of multiple servers.

[0042] In one embodiment, such as Figure 2 As shown, an application similarity analysis method is provided, which can be applied to... Figure 1 Taking server 104 as an example, the explanation includes the following steps 201 to 204.

[0043] Step 201: Obtain all first application resource images of the application to be analyzed and all second application resource images of the application to be compared. After performing image analysis on each first application resource image and each second application resource image, obtain the consistency and similarity of all images of the application.

[0044] The application to be analyzed is the application for which application similarity analysis needs to be performed. The application to be compared is the reference application to be used for comparison with the application to be analyzed. All image consistency is used to characterize the ratio of consistent images among the first application resource images and among the second application resource images; all image similarity is used to characterize the ratio of similar images among the first application resource images and among the second application resource images. Furthermore, the application to be analyzed may be, but is not limited to, a fraudulent application, while the application to be compared may be, but is not limited to, the legitimate application corresponding to the fraudulent application.

[0045] Specifically, server 104 obtains all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and performs image analysis based on each first application resource image and each second application resource image to obtain the consistency and similarity of all images of the application.

[0046] In one embodiment, such as Figure 3 As shown, all first application resource images of the application to be analyzed and all second application resource images of the application to be compared are obtained, including steps 301 to 304.

[0047] Step 301: Obtain the first application resources of the application to be analyzed and the second application resources of the application to be compared;

[0048] Step 302: Decompile the first application resource and the second application resource respectively to obtain the first resource directory of the first application resource, the decompiled first application resource, the second resource directory of the second application resource, and the decompiled second application resource.

[0049] Step 303: Query the first application resources based on the first resource directory and the target image file extension to obtain the images of each first application resource;

[0050] Step 304: Query the second application resources based on the second resource directory and the target image file extension to obtain the images of each second application resource.

[0051] The target image file extensions include *.jpg and *.png, etc. Server 104 obtains the first application resources of the application to be analyzed and the second application resources of the application to be compared. Then, it decompiles the first and second application resources respectively, obtaining the first resource directory of the first application resource, the decompiled first application resource, the second resource directory of the second application resource, and the decompiled second application resource. Next, it queries the decompiled first application resource based on the first resource directory and the target image file extensions to obtain each first application resource image. Then, it queries the decompiled second application resource based on the second resource directory and the target image file extensions to obtain each second application resource image, thereby improving the efficiency and convenience of obtaining all first application resource images of the application to be analyzed and all second application resource images of the application to be compared.

[0052] In this embodiment, the first application resources of the application to be analyzed and the second application resources of the application to be compared are obtained. Then, the first application resources and the second application resources are decompiled to obtain the first resource directory of the first application resources, the decompiled first application resources, the second resource directory of the second application resources, and the decompiled second application resources. Next, the first application resource images are obtained by querying the first resource directory and the target image file extension in the decompiled first application resources. Then, the second application resource images are obtained by querying the second resource directory and the target image file extension in the decompiled second application resources. This improves the efficiency and convenience of obtaining all first application resource images of the application to be analyzed and all second application resource images of the application to be compared.

[0053] In one embodiment, such as Figure 4 As shown, after performing image analysis based on the first application resource images and the second application resource images, the consistency and similarity of all images in the application are obtained, including steps 401 to 403.

[0054] Step 401: Calculate the first hash value of each first application resource image and the second hash value of each second application resource image based on each first application resource image and each second application resource image respectively.

[0055] Step 402: Determine the number of target hash values ​​based on each first hash value and each second hash value.

[0056] Step 403: Determine the consistency of all images based on the quotient of the number of target hash values ​​and the total number of first hash values.

[0057] The target hash value is the first hash value that has the same hash value among all the second hash values. This means that the first hash value corresponding to the target hash value has the same hash value among all the second hash values. Server 104 calculates the first hash value and the second hash value of each first application resource image and each second application resource image based on the first and second hash values ​​respectively; it determines the number of target hash values ​​based on the first and second hash values; finally, it determines the consistency of all application images based on the quotient of the number of target hash values ​​and the total number of first hash values, thus improving the efficiency, accuracy, and convenience of calculating the consistency of all application images. Furthermore, the hash value is SHA256.

[0058] In a specific example, determining the number of target hash values ​​based on each first hash value and each second hash value includes: sequentially comparing each first hash value with all second hash values ​​to obtain comparison results; using the comparison results to determine whether the corresponding first hash value is the target hash value; and counting the number of target hash values ​​based on each comparison result. A 100% consistency rate across all images means that all images in the first and second application resource images are similar; a 50% consistency rate means that about half of the images in the first and second application resource images are similar; and a 0% consistency rate means that no images in the first and second application resource images are similar. This is just a specific example; in actual applications, it should be flexibly set according to user needs.

[0059] In this embodiment, a first hash value for each first application resource image and a second hash value for each second application resource image are calculated based on each first application resource image and each second application resource image, respectively. The number of target hash values ​​is determined based on each first hash value and each second hash value. Finally, the consistency of all images in the application is determined based on the quotient of the number of target hash values ​​and the total number of first hash values, which improves the efficiency, accuracy, and convenience of calculating the consistency of all images in the application.

[0060] In one embodiment, such as Figure 5 As shown, after performing image analysis based on the first application resource images and the second application resource images, the consistency and similarity of all images in the application are obtained, including steps 501 to 503.

[0061] Step 501: Calculate the first image fingerprint of each first application resource image and the second image fingerprint of each second application resource image based on each first application resource image and each second application resource image respectively.

[0062] Step 502: Determine the number of fingerprints in the first target image based on the fingerprints of each first image and each second image.

[0063] Step 503: Determine the similarity of all images based on the quotient of the number of fingerprints in the first target image and the total number of fingerprints in the first image.

[0064] Wherein, the first target image fingerprint is the first image fingerprint that has a first target Hamming distance among the Hamming distances between it and all second image fingerprints. In other words, the first image fingerprint corresponding to the first target image fingerprint has a first target Hamming distance among the Hamming distances between it and all second image fingerprints. The first target Hamming distance is the Hamming distance between the first image fingerprint and the second image fingerprint that is greater than a first Hamming distance threshold.

[0065] Specifically, server 104 calculates the first image fingerprint of each first application resource image and the second image fingerprint of each second application resource image based on each first application resource image and each second application resource image respectively; then, it determines the number of first target image fingerprints based on each first image fingerprint and each second image fingerprint; then, it determines the similarity of all application images based on the quotient of the number of first target image fingerprints and the total number of first image fingerprints, thereby improving the efficiency, accuracy and convenience of calculating the similarity of all application images.

[0066] In a specific example, the number of fingerprints for the first target image is determined based on the fingerprints of each first image and each second image. This includes calculating the Hamming distance between each first image fingerprint and all second image fingerprints sequentially; determining whether the Hamming distance between each first image fingerprint and its corresponding second image fingerprint is greater than a first Hamming distance threshold and obtaining the corresponding determination result; and counting the number of fingerprints for the first target image based on each determination result. A 100% similarity across all images indicates that all images in the first and second application resource images are similar; a 50% similarity indicates that about half of the images in the first and second application resource images are similar; and a 0% similarity indicates that no images in the first and second application resource images are similar. This is just a specific example; in actual applications, the settings should be flexibly adjusted according to user needs.

[0067] In this embodiment, the first image fingerprint of each first application resource image and the second image fingerprint of each second application resource image are calculated based on each first application resource image and each second application resource image, respectively. Then, the number of first target image fingerprints is determined based on each first image fingerprint and each second image fingerprint. Finally, the similarity of all images in the application is determined based on the quotient of the number of first target image fingerprints and the total number of first image fingerprints, which improves the efficiency, accuracy and convenience of calculating the similarity of all images in the application.

[0068] Step 202: Obtain the first suspected launch screen image of the application to be analyzed and the second suspected launch screen image of the application to be compared, and obtain the key image similarity of the first application after image analysis based on the first suspected launch screen image and the second suspected launch screen image.

[0069] The first application key image similarity is used to characterize the degree of similarity between the first suspected startup screen image and the second suspected startup screen image. Specifically, the server 104 obtains the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared, and obtains the first application key image similarity after performing image analysis based on the first suspected startup screen image and the second suspected startup screen image.

[0070] In one embodiment, such as Figure 6 As shown, the process of obtaining a first suspected startup screen image of the application to be analyzed and a second suspected startup screen image of the application to be compared includes steps 601 to 602.

[0071] Step 601: After comparing the image sizes of each first application resource image, obtain the first application resource image with the largest corresponding image size. Then, compare the file sizes of each first application resource image with the largest image size to obtain the first application resource image with the largest file size. Finally, determine the first application resource image with the largest file size as the first suspected startup screen image.

[0072] Step 602: After comparing the image sizes of each second application resource image, obtain the second application resource image with the largest corresponding image size. Then, compare the file sizes of each second application resource image with the largest image size to obtain the second application resource image with the largest file size. Finally, determine the second application resource image with the largest file size as the second suspected startup screen image.

[0073] Specifically, server 104 compares the image sizes of each first application resource image to obtain the first application resource image with the largest corresponding image size. Then, it compares the file sizes of each largest first application resource image to obtain the first application resource image with the largest file size. This first application resource image with the largest file size is identified as the first suspected startup screen image. Subsequently, server 104 compares the image sizes of each second application resource image to obtain the second application resource image with the largest corresponding image size. Then, it compares the file sizes of each largest second application resource image to obtain the second application resource image with the largest file size. This second application resource image with the largest file size is identified as the second suspected startup screen image. This improves the efficiency, convenience, and accuracy of obtaining the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared.

[0074] In this embodiment, the largest first application resource image is obtained by comparing the image sizes of each first application resource image. Then, the largest file size of the first application resource image is obtained by comparing the file sizes of each largest first application resource image. This largest file size first application resource image is identified as the first suspected launch screen image. Subsequently, the largest second application resource image is obtained by comparing the image sizes of each second application resource image. Then, the largest file size of the second application resource image is obtained by comparing the file sizes of each largest second application resource image. This largest file size second application resource image is identified as the second suspected launch screen image. This improves the efficiency, convenience, and accuracy of obtaining the first suspected launch screen image of the application to be analyzed and the second suspected launch screen image of the application to be compared.

[0075] In one embodiment, such as Figure 7 As shown, the similarity of the first application key image is obtained by analyzing the first suspected startup screen image and the second suspected startup screen image, including steps 701 to 702.

[0076] Step 701: Calculate the third image fingerprint of the first suspected startup screen image and the fourth image fingerprint of the second suspected startup screen image based on the first suspected startup screen image and the second suspected startup screen image respectively.

[0077] Step 702: Determine the Hamming distance between the third image fingerprint and the fourth image fingerprint based on the third image fingerprint and the fourth image fingerprint, and determine the similarity of the first application key image based on the Hamming distance between the third image fingerprint and the fourth image fingerprint.

[0078] Specifically, server 104 calculates the third image fingerprint of the first suspected startup screen image and the fourth image fingerprint of the second suspected startup screen image based on the first suspected startup screen image and the second suspected startup screen image, respectively. Then, it determines the Hamming distance between the third and fourth image fingerprints based on the third and fourth image fingerprints, and determines the similarity of the first application key image based on the Hamming distance between the third and fourth image fingerprints, thereby improving the efficiency, convenience and accuracy of calculating the similarity of the first application key image.

[0079] In a specific example, if the Hamming distance between the fingerprints of the third and fourth images is 0, it proves that the first and second suspected startup screen images are the same image. If the Hamming distance between the fingerprints of the third and fourth images is greater than 10, it means that the first and second suspected startup screen images are completely dissimilar. The above is just a specific example. In actual applications, the settings can be flexibly adjusted according to user needs, and no restrictions are imposed here.

[0080] In this embodiment, the third image fingerprint of the first suspected startup screen image and the fourth image fingerprint of the second suspected startup screen image are calculated based on the first suspected startup screen image and the second suspected startup screen image, respectively. Then, the Hamming distance between the third image fingerprint and the fourth image fingerprint is determined based on the third image fingerprint and the fourth image fingerprint, and the similarity of the first application key image is determined based on the Hamming distance between the third image fingerprint and the fourth image fingerprint, which improves the efficiency, convenience and accuracy of calculating the similarity of the first application key image.

[0081] Step 203: Obtain the first set of dynamic key screen screenshots of the application to be analyzed and the second set of dynamic screen screenshots of the application to be compared. Then, perform image analysis based on the first set of dynamic key screen screenshots and the second set of dynamic screen screenshots to obtain the similarity of key images of the second application.

[0082] The second application key image similarity is used to characterize the ratio of similar images in the first dynamic key screen screenshot set and the second dynamic screen screenshot set. Server 104 obtains the first dynamic key screen screenshot set of the application to be analyzed and the second dynamic screen screenshot set of the application to be compared, and obtains the second application key image similarity after performing image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set.

[0083] In one embodiment, such as Figure 8 As shown, obtaining a first set of dynamic key screen screenshots of the application to be analyzed and a second set of dynamic screen screenshots of the application to be compared includes steps 801 to 806.

[0084] Step 801: In response to the first startup operation on the Android emulator, obtain the first application package of the application to be analyzed and install the first application package.

[0085] Step 802: In response to the completion of the installation of the first application package, start the first application package, and start the first detection timer and monitor the first currently running interface image of the application to be analyzed.

[0086] Step 803: In response to the first detection time being greater than or equal to the display time of the startup screen image of the application to be analyzed, the first running screen image of the application to be analyzed is captured, and the first running screen image is determined as the first dynamic startup screen screenshot.

[0087] Step 804: In response to the appearance of registration screen keywords in the first currently running interface image and the appearance of more than the first preset number of input boxes, capture the first currently running interface image and determine the first currently running interface image as the first dynamic registration screen screenshot.

[0088] Step 805: In response to the appearance of login screen keywords in the first currently running interface image and the appearance of more than or equal to the second preset number of input boxes, capture the first currently running interface image, determine the first currently running interface image as the first dynamic login screen screenshot, and determine whether the first currently running interface image has been updated.

[0089] Step 806: In response to the update of the first currently running interface image, the first currently running interface image is determined as the first dynamic suspected main screen screenshot, and a set of first dynamic key screen screenshots is generated based on the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot, and the first dynamic suspected main screen screenshot.

[0090] In this process, server 104, in response to the first startup operation of the Android emulator, obtains the first application package of the application to be analyzed and installs the first application package; then, in response to the completion of the installation of the first application package, it starts the first application package and starts a first detection timer and monitors the first currently running interface image of the application to be analyzed; next, in response to the first detection time being greater than or equal to the display time of the startup screen image of the application to be analyzed, it captures the first running screen image of the application to be analyzed and identifies the first running screen image as the first dynamic startup screen screenshot; then, in response to the appearance of registration screen keywords and the appearance of more than a first preset number of input boxes in the first currently running interface image, it captures the first currently running interface image and identifies the first currently running interface as the first dynamic startup screen screenshot. The interface image is identified as a screenshot of the first dynamic registration screen. Simultaneously, in response to the appearance of login screen keywords and the presence of more than or equal to a second preset number of input boxes in the first currently running interface image, the first currently running interface image is captured and identified as the first dynamic login screen screenshot. It is then determined whether the first currently running interface image has been updated. Finally, in response to an update to the first currently running interface image, it is identified as a screenshot of the first dynamic suspected main screen. Based on the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot, and the first dynamic suspected main screen screenshot, a set of key screenshots for the first dynamic screen is generated, improving the efficiency, convenience, and accuracy of generating the set of key screenshots for the first dynamic screen.

[0091] In a specific example, the first application package may be, but is not limited to, an APK package. The splash screen image display time of the application to be analyzed may be, but is not limited to, 5 seconds. Keywords for the registration screen include registration, mobile phone, invitation code, referral code, verification code, password, register, and password; keywords for the login screen include login, login, mobile phone, password, login, and password. The above are just specific examples, and in actual applications, they can be flexibly set according to user needs, and there are no restrictions here.

[0092] In this embodiment, in response to the first startup operation of the Android emulator, the first application package of the application to be analyzed is obtained and installed; then, in response to the completion of the installation of the first application package, the first application package is launched, and the first detection timer and the monitoring of the first currently running interface image of the application to be analyzed are started; next, in response to the first detection time being greater than or equal to the display time of the startup screen image of the application to be analyzed, the first running screen image of the application to be analyzed is captured, and the first running screen image is determined as the first dynamic startup screen screenshot; then, in response to the appearance of registration screen keywords and the appearance of more than a first preset number of input boxes in the first currently running interface image, the first currently running interface image is captured, and the first currently running interface is set as the first dynamic startup screen screenshot. The first dynamic registration screen screenshot is identified as the first dynamic login screen screenshot. Simultaneously, in response to the appearance of login screen keywords and the presence of more than or equal to a second preset number of input boxes in the first currently running interface image, the first currently running interface image is captured and identified as the first dynamic login screen screenshot. It is then determined whether the first currently running interface image has been updated. Finally, in response to an update to the first currently running interface image, it is identified as the first dynamic suspected main screen screenshot. Based on the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot, and the first dynamic suspected main screen screenshot, a set of key dynamic screen screenshots is generated, improving the efficiency, convenience, and accuracy of generating the first dynamic key screen screenshot set.

[0093] In one embodiment, such as Figure 9 As shown, a first set of dynamic key screenshots of the application to be analyzed and a second set of dynamic screenshots of the application to be compared are obtained, including:

[0094] Step 901: In response to the second launch operation on the Android emulator, obtain the second application package of the application to be compared, and install the second application package.

[0095] Step 902: In response to the completion of the installation of the second application package, start the second application package, and start the second detection timer and monitor the second currently running interface image of the application to be analyzed.

[0096] Step 903: In response to the second detection time being greater than or equal to the display time of the startup screen image of the application to be compared, capture the second running screen image of the application to be compared, and determine the second running screen image as the second dynamic startup screen screenshot.

[0097] Step 904: In response to the appearance of registration screen keywords in the second current running interface image and the appearance of more than the third preset number of input boxes, capture the second current running interface image and determine the second current running interface image as the second dynamic registration screen screenshot.

[0098] Step 905: In response to the appearance of login screen keywords and the appearance of more than or equal to the fourth preset number of input boxes in the second current running interface image, capture the second current running interface image, determine the second current running interface image as the second dynamic login screen screenshot, and determine whether the second current running interface image has been updated.

[0099] Step 906: In response to the update of the second currently running interface image, the second currently running interface image is identified as the second dynamic suspected main screen screenshot, and a set of second dynamic key screen screenshots is generated based on the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot, and the second dynamic suspected main screen screenshot.

[0100] Specifically, in response to the second launch operation of the Android emulator, server 104 obtains the second application package of the application to be compared and installs the second application package; then, in response to the completion of the installation of the second application package, it launches the second application package and starts the second detection timer and monitors the second current running interface image of the application to be analyzed; next, in response to the second detection time being greater than or equal to the display time of the launch screen image of the application to be compared, it captures the second running screen image of the application to be compared and identifies the second running screen image as the second dynamic launch screen screenshot; then, in response to the appearance of registration screen keywords and more than a third preset number of input boxes in the second current running interface image, it captures the second current running interface image and identifies the second current running interface as the second dynamic launch screen screenshot. The interface image is identified as a screenshot of the second dynamic registration screen. Simultaneously, in response to the appearance of login screen keywords and the presence of more than or equal to a fourth preset number of input boxes in the second currently running interface image, the second currently running interface image is captured and identified as the screenshot of the second dynamic login screen. It is then determined whether the second currently running interface image has been updated. Finally, in response to an update to the second currently running interface image, it is identified as a screenshot of the second dynamic suspected main screen. Based on the screenshots of the second dynamic startup screen, the second dynamic registration screen, the second dynamic login screen, and the second dynamic suspected main screen, a set of key screenshots for the second dynamic screen is generated, improving the efficiency, convenience, and accuracy of generating this set.

[0101] In this embodiment, in response to the second startup operation on the Android emulator, the second application package of the application to be compared is obtained and installed; then, in response to the completion of the installation of the second application package, the second application package is launched, and the second detection timer and the monitoring of the second current running interface image of the application to be analyzed are started; next, in response to the second detection time being greater than or equal to the display time of the startup screen image of the application to be compared, the second running screen image of the application to be compared is captured, and the second running screen image is determined as the second dynamic startup screen screenshot; then, in response to the appearance of registration screen keywords and more than a third preset number of input boxes in the second current running interface image, the second current running interface image is captured, and the second current running interface is set as the second dynamic startup screen screenshot. The first image is identified as a screenshot of the second dynamic registration screen. Simultaneously, in response to the appearance of login screen keywords and the presence of more than or equal to a fourth preset number of input boxes in the second currently running interface image, the second currently running interface image is captured and identified as the screenshot of the second dynamic login screen. It is then determined whether the second currently running interface image has been updated. Finally, in response to an update to the second currently running interface image, it is identified as a screenshot of the second dynamic suspected main screen. Based on the screenshots of the second dynamic startup screen, the second dynamic registration screen, the second dynamic login screen, and the second dynamic suspected main screen, a set of key screenshots for the second dynamic screen is generated, improving the efficiency, convenience, and accuracy of generating this set.

[0102] In one embodiment, such as Figure 10 As shown, the first set of dynamic key screen screenshots includes a first dynamic startup screen screenshot, a first dynamic login screen screenshot, and a first dynamic suspected home screen screenshot; the second set of dynamic key screen screenshots includes a second dynamic startup screen screenshot, a second dynamic login screen screenshot, and a second dynamic suspected home screen screenshot; image analysis is performed based on the first and second sets of dynamic key screen screenshots to obtain the similarity of the second application's key images, including steps 1001 to 100.

[0103] Step 1001: Calculate the fingerprints of the first dynamic key screen screenshot set and the second dynamic key screen screenshot set to obtain the fifth image fingerprint of the first dynamic startup screen screenshot, the sixth image fingerprint of the first dynamic startup screen screenshot, the seventh image fingerprint of the first dynamic login screen screenshot, the eighth image fingerprint of the first dynamic suspected main screen screenshot, the ninth image fingerprint of the second dynamic startup screen screenshot, the tenth image fingerprint of the second dynamic startup screen screenshot, the eleventh image fingerprint of the second dynamic login screen screenshot, and the twelfth image fingerprint of the second dynamic suspected main screen screenshot.

[0104] Step 1002: Determine the Hamming distance between the fifth and ninth image fingerprints based on the fifth and ninth image fingerprints.

[0105] Step 1003: Determine the Hamming distance between the sixth and tenth image fingerprints based on the sixth and tenth image fingerprints.

[0106] Step 1004: Determine the Hamming distance between the seventh and eleventh image fingerprints based on the seventh and eleventh image fingerprints.

[0107] Step 1005: Determine the Hamming distance between the eighth and twelfth image fingerprints based on the eighth and twelfth image fingerprints.

[0108] Step 1006: Determine the distance based on the Hamming distance between the fifth and ninth fingerprint images, the Hamming distance between the sixth and tenth fingerprint images, the Hamming distance between the seventh and eleventh fingerprint images, and the Hamming distance between the eighth and twelfth fingerprint images.

[0109] Specifically, server 104 calculates the fingerprints of the following images based on the first set of dynamic key screen screenshots and the second set of dynamic key screen screenshots: the fifth image fingerprint of the first dynamic startup screen screenshot, the sixth image fingerprint of the first dynamic startup screen screenshot, the seventh image fingerprint of the first dynamic login screen screenshot, the eighth image fingerprint of the first dynamic suspected main screen screenshot, the ninth image fingerprint of the second dynamic startup screen screenshot, the tenth image fingerprint of the second dynamic startup screen screenshot, the eleventh image fingerprint of the second dynamic login screen screenshot, and the twelfth image fingerprint of the second dynamic suspected main screen screenshot. Then, it determines the Hamming distance between the fifth and ninth image fingerprints based on the fifth and ninth image fingerprints. Next, it calculates the Hamming distance between the sixth and ninth image fingerprints based on the second image fingerprint. The Hamming distance between the sixth and tenth image fingerprints is determined by the tenth image fingerprint. Then, the Hamming distance between the seventh and eleventh image fingerprints is determined based on the seventh and eleventh image fingerprints. Simultaneously, the Hamming distance between the eighth and twelfth image fingerprints is determined based on the eighth and twelfth image fingerprints. Finally, the similarity of the second application key image is determined based on the Hamming distances between the fifth and ninth image fingerprints, the sixth and tenth image fingerprints, the seventh and eleventh image fingerprints, and the eighth and twelfth image fingerprints. This improves the efficiency, convenience, and accuracy of calculating the similarity of the second application key image.

[0110] In this embodiment, the fingerprints of the first dynamic key screen screenshot set, the second dynamic key screen screenshot set, and the third dynamic key screen screenshot set are calculated to obtain the fifth image fingerprint of the first dynamic startup screen screenshot, the sixth image fingerprint of the first dynamic startup screen screenshot, the seventh image fingerprint of the first dynamic login screen screenshot, the eighth image fingerprint of the first dynamic suspected home screen screenshot, the ninth image fingerprint of the second dynamic startup screen screenshot, the tenth image fingerprint of the second dynamic startup screen screenshot, the eleventh image fingerprint of the second dynamic login screen screenshot, and the twelfth image fingerprint of the second dynamic suspected home screen screenshot. Then, the Hamming distance between the fifth and ninth image fingerprints is determined based on the fifth and ninth image fingerprints. Next, the Hamming distance between the sixth and tenth image fingerprints is determined based on the fifth and ninth image fingerprints. The Hamming distance between the sixth and tenth image fingerprints is determined by the image fingerprints. Then, the Hamming distance between the seventh and eleventh image fingerprints is determined based on the seventh and eleventh image fingerprints. Simultaneously, the Hamming distance between the eighth and twelfth image fingerprints is determined based on the eighth and twelfth image fingerprints. Finally, the similarity of the second application key image is determined based on the Hamming distances between the fifth and ninth, sixth and tenth, seventh and eleventh, and eighth and twelfth image fingerprints. This improves the efficiency, convenience, and accuracy of calculating the similarity of the second application key image.

[0111] Step 204: Calculate the overall similarity of the application based on the consistency of all images in the application, the similarity of all images in the application, the similarity of the first key image in the application, and the similarity of the second key image in the application.

[0112] Specifically, server 104 calculates the overall similarity of the application based on the consistency of all images in the application, the similarity of all images in the application, the similarity of the first key image in the application, and the similarity of the second key image in the application. This improves the accuracy and data comprehensiveness, and the automatic analysis of the overall similarity does not require manual intervention.

[0113] In a specific example, the overall application similarity is calculated based on the consistency of all images, the first weight of the consistency of all images, the similarity of all images, the second weight of the similarity of all images, the similarity of the first key image, the third weight of the similarity of the first key image, and the fourth weight of the similarity of the second key image. The above is only a specific example, and in actual applications, it can be flexibly set according to user needs.

[0114] In the aforementioned application similarity analysis method, all first application resource images of the application to be analyzed and all second application resource images of the application to be compared are obtained. Image analysis is performed on each first and second application resource image to obtain the consistency and similarity of all application images. Next, a first suspected launch screen image of the application to be analyzed and a second suspected launch screen image of the application to be compared are obtained. Image analysis is performed on the first and second suspected launch screen images to obtain the similarity of the first application's key images. Then, a set of first dynamic key screen screenshots of the application to be analyzed and a set of second dynamic screen screenshots of the application to be compared are obtained. Image analysis is performed on the first and second dynamic screen screenshots to obtain the similarity of the second application's key images. Finally, the overall application similarity is calculated based on the consistency, similarity, and similarity of all application images, thus improving accuracy and data comprehensiveness. Furthermore, the automatic analysis of the overall similarity requires no manual intervention, avoiding the impact of low-cost, mass packaging methods on the accuracy of app similarity analysis.

[0115] It should be understood that, although Figures 2-10 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figures 2-10 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0116] Secondly, such as Figure 11 As shown, an automatic application similarity analysis device is provided, the device including a first similarity calculation module 1101, a second similarity calculation module 1102, a third similarity calculation module 1103 and a comprehensive similarity calculation module 1104.

[0117] The first similarity calculation module 1101 is used to acquire all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and to obtain the consistency and similarity of all images of the application after performing image analysis on each first application resource image and each second application resource image; wherein, the consistency of all images of the application is used to characterize the ratio of consistent images among each first application resource image and the similarity of all images of the application; the similarity of all images of the application is used to characterize the ratio of similar images among each first application resource image and each second application resource image; the second similarity calculation module 1102 is used to acquire the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared, and to obtain the consistency and similarity of all images of the application after performing image analysis on each first suspected startup screen image and the second suspected startup screen image. The first application key image similarity is used to characterize the degree of similarity between the first suspected startup screen image and the second suspected startup screen image. The third similarity calculation module 1103 is used to obtain the first dynamic key screen screenshot set of the application to be analyzed and the second dynamic screen screenshot set of the application to be compared, and to obtain the second application key image similarity after image analysis based on the first dynamic key screen screenshot set and the second dynamic screen screenshot set. The second application key image similarity is used to characterize the ratio of similar images in the first dynamic key screen screenshot set and the second dynamic screen screenshot set. The comprehensive similarity calculation module 1104 is used to calculate the comprehensive similarity of the application based on the consistency of all images in the application, the similarity of all images in the application, the similarity of the first application key image, and the similarity of the second application key image.

[0118] In one embodiment, the first similarity calculation module 1101 includes a first acquisition unit.

[0119] The first acquisition unit is used to acquire the first application resources of the application to be analyzed and the second application resources of the application to be compared; the first acquisition unit is used to decompile the first application resources and the second application resources respectively to obtain the first resource directory of the first application resources, the decompiled first application resources, the second resource directory of the second application resources, and the decompiled second application resources; the first acquisition unit is used to query the decompiled first application resources according to the first resource directory and the target image file extension to obtain the images of each first application resource; the first acquisition unit is used to query the decompiled second application resources according to the second resource directory and the target image file extension to obtain the images of each second application resource.

[0120] In one embodiment, the second similarity calculation module 1102 includes a second acquisition unit.

[0121] The second acquisition unit is used to compare the image sizes of each first application resource image to obtain the first application resource image with the largest corresponding image size, compare the file sizes of each first application resource image with the largest image size to obtain the first application resource image with the largest file size, and determine the first application resource image with the largest file size as the first suspected startup screen image; the second acquisition unit is used to compare the image sizes of each second application resource image to obtain the second application resource image with the largest corresponding image size, compare the file sizes of each second application resource image with the largest image size to obtain the second application resource image with the largest file size, and determine the second application resource image with the largest file size as the second suspected startup screen image.

[0122] In one embodiment, the third similarity calculation module 1103 includes a third acquisition unit.

[0123] The third acquisition unit is configured to, in response to the first startup operation on the Android emulator, acquire the first application package of the application to be analyzed and install the first application package; the third acquisition unit is configured to, in response to the completion of the installation of the first application package, launch the first application package and start the first detection timer and monitor the first currently running interface image of the application to be analyzed; the third acquisition unit is configured to, in response to the first detection time being greater than or equal to the display time of the startup screen image of the application to be analyzed, capture the first running screen image of the application to be analyzed and determine the first running screen image as the first dynamic startup screen screenshot; the third acquisition unit is configured to, in response to the appearance of registration screen keywords and the appearance of more than a first preset number of input boxes in the first currently running interface image, capture the first... The first current running interface image is identified as a screenshot of the first dynamic registration screen. The third acquisition unit is used to capture the first current running interface image in response to the appearance of login screen keywords and the appearance of more than or equal to a second preset number of input boxes in the first current running interface image, identify the first current running interface image as a screenshot of the first dynamic login screen, and determine whether the first current running interface image has been updated. The third acquisition unit is used to identify the first current running interface image as a screenshot of the first dynamic suspected main screen in response to the update of the first current running interface image, and generate a set of first dynamic key screen screenshots based on the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot, and the first dynamic suspected main screen screenshot.

[0124] In one embodiment, the third acquisition unit is configured to, in response to the second startup operation on the Android emulator, acquire the second application package of the application to be compared and install the second application package; the third acquisition unit is configured to, in response to the completion of the installation of the second application package, launch the second application package and start a second detection timer and monitor the second currently running interface image of the application to be analyzed; the third acquisition unit is configured to, in response to the second detection time being greater than or equal to the display time of the startup screen image of the application to be compared, capture the second running screen image of the application to be compared and determine the second running screen image as the second dynamic startup screen screenshot; the third acquisition unit is configured to, in response to the appearance of registration screen keywords and the appearance of more than a third preset number of input boxes in the second currently running interface image, capture the second running screen image of the application to be compared and determine the second running screen image as the second dynamic startup screen screenshot; The first unit captures a screenshot of the second currently running interface and identifies it as a screenshot of the second dynamic registration screen. The second unit is used to capture a screenshot of the second currently running interface when the login screen keyword appears in the second currently running interface and there are more than or equal to a fourth preset number of input boxes. The second unit identifies the second currently running interface as a screenshot of the second dynamic login screen and determines whether the second currently running interface has been updated. The third unit is used to identify the second currently running interface as a screenshot of the second dynamic suspected main screen when the second currently running interface has been updated. The second unit generates a set of screenshots of the second dynamic key screen based on the screenshots of the second dynamic startup screen, the second dynamic registration screen, the second dynamic login screen, and the second dynamic suspected main screen.

[0125] In one embodiment, the first similarity calculation module 1101 includes a first similarity calculation unit.

[0126] The first similarity calculation unit is used to calculate the first hash value of each first application resource image and the second hash value of each second application resource image based on each first application resource image and each second application resource image respectively; the first similarity calculation unit is used to determine the number of target hash values ​​based on each first hash value and each second hash value; the target hash value is the first hash value that has the same hash value among all second hash values; the first similarity calculation unit is used to determine the consistency of all images in the application based on the quotient of the number of target hash values ​​and the total number of first hash values.

[0127] In one embodiment, the first similarity calculation module 1101 includes a second similarity calculation unit.

[0128] The second similarity calculation unit is used to calculate the first image fingerprint of each first application resource image and the second image fingerprint of each second application resource image based on each first application resource image and each second application resource image respectively; the second similarity calculation unit is used to determine the number of first target image fingerprints based on each first image fingerprint and each second image fingerprint; the first target image fingerprint is the first image fingerprint that has a first target Hamming distance among the Hamming distances between it and all second image fingerprints; the first target Hamming distance is the Hamming distance between the first image fingerprint and the second image fingerprint that is greater than the first Hamming distance threshold; the second similarity calculation unit is used to determine the similarity of all images in the application based on the quotient of the number of first target image fingerprints and the total number of first image fingerprints.

[0129] In one embodiment, the second similarity calculation module 1102 includes a third similarity calculation unit.

[0130] The third similarity calculation unit is used to calculate the third image fingerprint of the first suspected startup screen image and the fourth image fingerprint of the second suspected startup screen image based on the first suspected startup screen image and the second suspected startup screen image respectively; the third similarity calculation unit is used to determine the Hamming distance between the third image fingerprint and the fourth image fingerprint based on the third image fingerprint and the fourth image fingerprint, and to determine the similarity of the first application key image based on the Hamming distance between the third image fingerprint and the fourth image fingerprint.

[0131] In one embodiment, the first set of dynamic key screen screenshots includes a first dynamic startup screen screenshot, a first dynamic login screen screenshot, and a first dynamic suspected home screen screenshot; the second set of dynamic key screen screenshots includes a second dynamic startup screen screenshot, a second dynamic login screen screenshot, and a second dynamic suspected home screen screenshot; the third similarity calculation module 1103 includes a fourth similarity calculation unit.

[0132] The fourth similarity calculation unit is used to calculate the fifth image fingerprint of the first dynamic key screen screenshot, the sixth image fingerprint of the first dynamic startup screen screenshot, the seventh image fingerprint of the first dynamic login screen screenshot, the eighth image fingerprint of the first dynamic suspected home screen screenshot, the ninth image fingerprint of the second dynamic startup screen screenshot, the tenth image fingerprint of the second dynamic startup screen screenshot, the eleventh image fingerprint of the second dynamic login screen screenshot, and the twelfth image fingerprint of the second dynamic suspected home screen screenshot based on the fifth and ninth image fingerprints. The first unit is used to determine the Hamming distance between the sixth and tenth image fingerprints based on the sixth and tenth image fingerprints; the second unit is used to determine the Hamming distance between the seventh and eleventh image fingerprints based on the seventh and eleventh image fingerprints; the third unit is used to determine the Hamming distance between the eighth and twelfth image fingerprints based on the eighth and twelfth image fingerprints; the fourth unit is used to determine the similarity of the second application key image based on the Hamming distance between the fifth and ninth image fingerprints, the Hamming distance between the sixth and tenth image fingerprints, the Hamming distance between the seventh and eleventh image fingerprints, and the Hamming distance between the eighth and twelfth image fingerprints.

[0133] Specific limitations regarding the application similarity analysis device can be found in the limitations of the application similarity analysis method described above, and will not be repeated here. Each module in the aforementioned application similarity analysis device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0134] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 12As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and the database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores all first application resource images of the application to be analyzed and all second application resource image data of the applications to be compared. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an application similarity analysis method.

[0135] Those skilled in the art will understand that Figure 12 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0136] Thirdly, a computer device is provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods described in the above method embodiments.

[0137] Fourthly, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of any of the methods described in the above method embodiments.

[0138] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0139] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An automatic application similarity analysis method, the method comprising: All first application resource images of the application to be analyzed and all second application resource images of the application to be compared are obtained. Image analysis is performed on each of the first and second application resource images to obtain the consistency and similarity of all images in the application. The consistency of all images in the application represents the ratio of consistent images among each of the first application resource images and the ratio of similar images among each of the second application resource images. A first suspected launch screen image of the application to be analyzed and a second suspected launch screen image of the application to be compared are obtained. After image analysis based on the first suspected launch screen image and the second suspected launch screen image, a first application key image similarity is obtained. The first application key image similarity is used to characterize the degree of similarity between the first suspected launch screen image and the second suspected launch screen image. A first set of dynamic key screen screenshots of the application to be analyzed and a second set of dynamic key screen screenshots of the application to be compared are obtained. After image analysis based on the first set of dynamic key screen screenshots and the second set of dynamic key screen screenshots, a second application key image similarity is obtained. The second application key image similarity is used to characterize the ratio of similar images in the first set of dynamic key screen screenshots and the second set of dynamic key screen screenshots. The overall similarity of the application is calculated based on the consistency of all images in the application, the similarity of all images in the application, the similarity of key images in the first application, and the similarity of key images in the second application. The step of obtaining the first suspected startup screen image of the application to be analyzed and the second suspected startup screen image of the application to be compared includes: After comparing the image sizes of each first application resource image, the first application resource image with the largest corresponding image size is obtained. Then, the file size of each first application resource image with the largest image size is compared to obtain the first application resource image with the largest file size and the largest image size. The first application resource image with the largest file size and the largest image size is determined as the first suspected startup screen image. After comparing the image sizes of each second application resource image, the second application resource image with the largest corresponding image size is obtained. Then, the file size of each second application resource image with the largest image size is compared to obtain the second application resource image with the largest file size and the largest image size. The second application resource image with the largest file size and the largest image size is determined as the second suspected startup screen image.

2. The method according to claim 1, characterized in that, The acquisition of all first application resource images of the application to be analyzed and all second application resource images of the application to be compared includes: Obtain the first application resources of the application to be analyzed and the second application resources of the application to be compared; The first application resource and the second application resource are decompiled respectively to obtain the first resource directory of the first application resource, the decompiled first application resource, the second resource directory of the second application resource, and the decompiled second application resource. Based on the first resource directory and the target image file extension, query the first application resource after decompilation to obtain each first application resource image; Based on the second resource directory and the target image file extension, query the decompiled second application resources to obtain each second application resource image.

3. The method according to claim 1, characterized in that, The process of acquiring the first set of dynamic key screenshots of the application to be analyzed and the second set of dynamic screenshots of the application to be compared includes: In response to the first launch operation of the Android emulator, the first application package of the application to be analyzed is obtained and the first application package is installed; In response to the completion of the installation of the first application package, the first application package is launched, and the first detection timer is started and the first currently running interface image of the application to be analyzed is monitored; In response to the first detection time being greater than or equal to the display time of the startup screen image of the application to be analyzed, the first running screen image of the application to be analyzed is captured, and the first running screen image is determined as the first dynamic startup screen screenshot; In response to the appearance of registration screen keywords and the appearance of more than a first preset number of input boxes in the first currently running interface image, the first currently running interface image is captured and determined as the first dynamic registration screen screenshot; In response to the appearance of login screen keywords and the appearance of more than or equal to a second preset number of input boxes in the first currently running interface image, the first currently running interface image is captured, the first currently running interface image is determined as the first dynamic login screen screenshot, and it is determined whether the first currently running interface image has been updated. In response to the update of the first currently running interface image, the first currently running interface image is determined as the first dynamic suspected main screen screenshot, and the first dynamic key screen screenshot set is generated based on the first dynamic startup screen screenshot, the first dynamic registration screen screenshot, the first dynamic login screen screenshot, and the first dynamic suspected main screen screenshot.

4. The method according to claim 3, characterized in that, The process of acquiring the first set of dynamic key screenshots of the application to be analyzed and the second set of dynamic screenshots of the application to be compared includes: In response to a second launch operation on the Android emulator, a second application package of the application to be compared is obtained and installed; In response to the completion of the installation of the second application package, the second application package is launched, and the second detection timer and the second currently running interface image of the application to be analyzed are started; In response to the second detection time being greater than or equal to the startup screen image display time of the application to be compared, the second running screen image of the application to be compared is captured, and the second running screen image is determined as the second dynamic startup screen screenshot; In response to the appearance of the registration screen keywords in the second current running interface image and the appearance of more than a third preset number of input boxes, the second current running interface image is captured and determined as the second dynamic registration screen screenshot; In response to the appearance of the login screen keyword in the second current running interface image and the appearance of more than or equal to the fourth preset number of input boxes, the second current running interface image is captured, the second current running interface image is determined as the second dynamic login screen screenshot, and it is determined whether the second current running interface image has been updated. In response to the update of the second currently running interface image, the second currently running interface image is identified as the second dynamic suspected main screen screenshot, and the second dynamic key screen screenshot set is generated based on the second dynamic startup screen screenshot, the second dynamic registration screen screenshot, the second dynamic login screen screenshot, and the second dynamic suspected main screen screenshot.

5. The method according to claim 1, characterized in that, The step of obtaining the consistency and similarity of all images in the application after performing image analysis based on each of the first application resource images and each of the second application resource images includes: The first hash value of each first application resource image and the second hash value of each second application resource image are calculated based on each first application resource image and each second application resource image, respectively. The number of target hash values ​​is determined based on each of the first hash values ​​and each of the second hash values; the target hash value is the first hash value that has the same hash value among all the second hash values. The consistency of all images in the application is determined by the quotient of the number of target hash values ​​and the total number of the first hash values.

6. The method according to claim 1, characterized in that, The step of obtaining the consistency and similarity of all images in the application after performing image analysis based on each of the first application resource images and each of the second application resource images includes: The first image fingerprint of each first application resource image and the second image fingerprint of each second application resource image are calculated based on each first application resource image and each second application resource image, respectively. The number of first target image fingerprints is determined based on each of the first image fingerprints and each of the second image fingerprints; the first target image fingerprint is the first image fingerprint that has a first target Hamming distance among the Hamming distances between it and all the second image fingerprints; the first target Hamming distance is the Hamming distance between the first image fingerprint and the second image fingerprint that is greater than a first Hamming distance threshold; The similarity of all images in the application is determined by the quotient of the number of fingerprints in the first target image and the total number of fingerprints in the first image.

7. The method according to claim 1, characterized in that, The step of obtaining the first application key image similarity after image analysis based on the first suspected startup screen image and the second suspected startup screen image includes: The third image fingerprint of the first suspected startup screen image and the fourth image fingerprint of the second suspected startup screen image are calculated based on the first suspected startup screen image and the second suspected startup screen image, respectively. The Hamming distance between the third image fingerprint and the fourth image fingerprint is determined based on the third image fingerprint and the fourth image fingerprint, and the similarity of the first application key image is determined based on the Hamming distance between the third image fingerprint and the fourth image fingerprint.

8. The method according to claim 1, characterized in that, The first set of dynamic key screen screenshots includes a first dynamic startup screen screenshot, a first dynamic registration screen screenshot, a first dynamic login screen screenshot, and a first dynamic suspected main screen screenshot; the second set of dynamic key screen screenshots includes a second dynamic startup screen screenshot, a second dynamic registration screen screenshot, a second dynamic login screen screenshot, and a second dynamic suspected main screen screenshot. The step of obtaining the second application key image similarity after image analysis based on the first set of dynamic key image screenshots and the second set of dynamic image screenshots includes: The fingerprints of the first dynamic key screen screenshot set, the second dynamic key screen screenshot set, and the fifth image fingerprint of the first dynamic startup screen screenshot, the sixth image fingerprint of the first registration startup screen screenshot, the seventh image fingerprint of the first dynamic login screen screenshot, the eighth image fingerprint of the first dynamic suspected main screen screenshot, the ninth image fingerprint of the second dynamic startup screen screenshot, the tenth image fingerprint of the second dynamic registration screen screenshot, the eleventh image fingerprint of the second dynamic login screen screenshot, and the twelfth image fingerprint of the second dynamic suspected main screen screenshot are obtained by calculating based on the first dynamic key screen screenshot set and the second dynamic key screen screenshot set respectively. The Hamming distance between the fifth image fingerprint and the ninth image fingerprint is determined based on the fifth image fingerprint and the ninth image fingerprint. The Hamming distance between the sixth image fingerprint and the tenth image fingerprint is determined based on the sixth image fingerprint and the tenth image fingerprint; The Hamming distance between the seventh image fingerprint and the eleventh image fingerprint is determined based on the seventh image fingerprint and the eleventh image fingerprint; The Hamming distance between the eighth image fingerprint and the twelfth image fingerprint is determined based on the eighth image fingerprint and the twelfth image fingerprint; The similarity of the second application key images is determined based on the Hamming distance between the fifth and ninth image fingerprints, the Hamming distance between the sixth and tenth image fingerprints, the Hamming distance between the seventh and eleventh image fingerprints, and the Hamming distance between the eighth and twelfth image fingerprints.

9. An automatic application similarity analysis device, characterized in that, The device includes: The first similarity calculation module is used to acquire all first application resource images of the application to be analyzed and all second application resource images of the application to be compared, and to obtain the consistency of all images and the similarity of all images of the application after performing image analysis based on each first application resource image and each second application resource image; wherein, the consistency of all images of the application is used to characterize the ratio of consistent images among each first application resource image and each second application resource image; the similarity of all images of the application is used to characterize the ratio of similar images among each first application resource image and each second application resource image. The second similarity calculation module is used to acquire a first suspected launch screen image of the application to be analyzed and a second suspected launch screen image of the application to be compared, and to obtain a first application key image similarity after image analysis based on the first suspected launch screen image and the second suspected launch screen image; the first application key image similarity is used to characterize the degree of similarity between the first suspected launch screen image and the second suspected launch screen image; wherein, acquiring the first suspected launch screen image of the application to be analyzed and the second suspected launch screen image of the application to be compared includes: comparing the image sizes of each first application resource image to obtain the first application resource image with the largest corresponding image size, comparing the file sizes of each first application resource image with the largest image size to obtain the first application resource image with the largest file size and the largest image size, and determining the first application resource image with the largest file size and the largest image size as the first suspected launch screen image; comparing the image sizes of each second application resource image to obtain the second application resource image with the largest corresponding image size, comparing the file sizes of each second application resource image with the largest image size to obtain the second application resource image with the largest file size and the largest image size as the second suspected launch screen image; The third similarity calculation module is used to obtain a first set of dynamic key screen screenshots of the application to be analyzed and a second set of dynamic key screen screenshots of the application to be compared, and to obtain a second application key image similarity after performing image analysis based on the first set of dynamic key screen screenshots and the second set of dynamic key screen screenshots; the second application key image similarity is used to characterize the ratio of similar images in the first set of dynamic key screen screenshots and the second set of dynamic key screen screenshots. The comprehensive similarity calculation module is used to calculate the comprehensive similarity of the application based on the consistency of all images in the application, the similarity of all images in the application, the similarity of key images in the first application, and the similarity of key images in the second application.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images