Method and system for extracting fraud-related application data
By building a feature library and matching features, the problem that traditional forensic methods cannot identify and extract application data of camouflage APP is solved, and efficient identification and data extraction of camouflage APP is achieved.
Patent Information
- Application Number
- CN202510043765.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-10
- Publication Date
- 2025-05-02
AI Technical Summary
Traditional evidence forensics cannot effectively identify and extract application data from fraud-related APPs that are replaced by changing package names or disguised as legal applications.
By obtaining the feature data of multiple sample applications, a feature library is built, and using this feature library to match the forensic applications to extract their application data.
Without relying on package names and front-end interfaces, it can identify and extract disguised application data, improving the accuracy of evidence forensics.
Smart Images
Figure CN119919154A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of data processing technology, and in particular to a method and system for extracting fraud-related application data. Background Art
[0002] With the rapid development of mobile Internet, a large number of fraudulent APPs (Applications) have appeared on the market. Some fraudulent APPs (such as fake shopping APPs) disguise themselves as other legitimate applications by changing package names and modifying front-end interfaces to evade supervision and evidence collection. Such APPs are extremely concealed. Traditional evidence collection methods mainly rely on identifying the package names of known APPs, which cannot cope with the situation where the package names of niche APPs are changed or disguised, and cannot identify and extract application data in a timely manner. Summary of the invention
[0003] The purpose of the present invention is to provide a method for extracting fraudulent application data to solve the above technical problems;
[0004] The present invention also aims to provide a system for extracting fraudulent application data to solve the above technical problems;
[0005] A method for extracting fraud-related application data, comprising:
[0006] Step S1, obtaining characteristic data of multiple sample applications;
[0007] Step S2, constructing a feature library by using the feature data as feature items;
[0008] Step S3, performing feature matching on the application to be forensically collected using the feature library, and extracting application data of the application to be forensically collected according to the matching result;
[0009] Step S4, forming a forensic report based on the application data.
[0010] Preferably, step S1 comprises,
[0011] The file directory of the sample application is traversed and analyzed to obtain the characteristic data, where the characteristic data includes file type, storage format, directory structure, and storage path of a specific file.
[0012] Preferably, the storage format includes a database table structure, node information of an XML file, and node information of a JSON file.
[0013] Preferably, the file types include database files, the XML files and the JSON files.
[0014] Preferably, step S3 comprises,
[0015] Determine whether there is a feature entry matching the application to be verified in the feature library; if not, extract the feature data in the application data and return to execute step S2; if yes, parse and extract the application data of the application to be verified according to the parsing strategy corresponding to the feature entry.
[0016] Preferably, the forensic report in step S4 includes the matching result, the feature data and the location where the feature data is extracted.
[0017] A system for extracting fraudulent application data, comprising:
[0018] A feature library construction module, which obtains feature data of various sample applications and constructs a feature library based on the feature data;
[0019] A feature matching module, connected to the feature library building module, performs feature matching on the application to be forensically collected using the feature library, and extracts application data of the application to be forensically collected according to the matching result;
[0020] A report generation module is connected to the feature matching module to form a forensic report based on the application data.
[0021] Preferably, the feature library construction module includes:
[0022] A sample application analysis unit, traversing the file directory of the sample application and analyzing to obtain the feature data;
[0023] The feature library forming unit is connected to the sample application analyzing unit and uses the feature data as feature items to form the feature library.
[0024] Preferably, the feature matching module includes:
[0025] A feature judgment unit is connected to the feature library construction module. When the feature entry matching the application to be verified does not exist in the feature library, the feature data in the application data is extracted and stored in the feature library. When the feature entry matching the application to be verified exists in the feature library, the application data of the application to be verified is parsed and extracted according to the parsing strategy corresponding to the feature entry.
[0026] Preferably, the sample application and the application to be collected evidence are both fraud-related applications.
[0027] The beneficial effect of the present invention is that: by adopting the above technical solution, there is no need to rely on the package name and the front-end interface, and the application data can be identified based on feature library matching, so that disguised application data can be identified and the accuracy of forensics can be improved. BRIEF DESCRIPTION OF THE DRAWINGS
[0028] Figure 1It is a step diagram of the method for extracting fraud-related application data of the present invention;
[0029] Figure 2 is a schematic diagram of a system for extracting fraudulent application data according to the present invention;
[0030] Figure 3 It is a schematic diagram of a feature library construction module of the present invention;
[0031] Figure 4 is a schematic diagram of a feature matching module of the present invention;
[0032] Figure 5 It is a flow chart for extracting fraud-related application data in an embodiment of the present invention.
[0033] In the attached figure: 1. Feature library construction module; 11. Sample application analysis unit; 12. Feature library formation unit; 2. Feature matching module; 21. Feature judgment unit; 3. Report generation module. DETAILED DESCRIPTION
[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0035] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.
[0036] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but they are not intended to limit the present invention.
[0037] A method for extracting fraudulent application data, such as Figure 1 As shown, including
[0038] Step S1, obtaining characteristic data of multiple sample applications;
[0039] Step S2, constructing a feature library using the feature data as feature items;
[0040] Step S3, using the feature library to perform feature matching on the application to be forensically collected, and extracting application data of the application to be forensically collected according to the matching results;
[0041] Step S4, forming a forensic report based on the application data.
[0042] Specifically, the present invention provides a method for extracting fraud-related application data. By establishing a feature library and performing feature matching based on the feature library, automatic extraction of applications to be collected forensics is achieved. Application data with disguised or changed package names can be extracted without relying on package names or interface features, and ultimately a forensic report is formed, which greatly improves the efficiency and accuracy of application forensics.
[0043] In a preferred embodiment, step S1 includes:
[0044] Traverse the file directory of the sample application and analyze it to obtain feature data. The feature data includes file type, storage format, directory structure, and storage path of specific files. The directory structure of different APP files is different.
[0045] The storage format includes database table structure, node information of XML file, and node information of JSON file;
[0046] File types include database files, XML files, and JSON files.
[0047] Specifically, based on the analysis of the APP file directory structure and data storage format, automatic extraction of application data is achieved.
[0048] Starting from the root directory of the sample application, a traversal algorithm (such as depth-first search or breadth-first search) is used to visit each file and folder in turn.
[0049] During the traversal process, record the file name, path, folder hierarchy and other information to fully understand the file directory structure of the sample application.
[0050] For each file traversed, its type is determined by the file extension or file header information. If the file extension is a common database file extension (such as .db, .sqlite, etc.), it is determined to be a database file; if the extension is .xml, it is determined to be an XML file (Extensible Markup Language file); if it is .json, it is a JSON file (JavaScript Object Notation file). At the same time, the location of these files in the file directory, that is, the storage path, is recorded.
[0051] After determining that a file is a database file, use the corresponding database parsing tool to open the file. Identify the tables in the database and obtain the name of each table. Then, analyze the fields of each table to determine the field name, field data type (such as integer, text, date, etc.) and field constraints (such as whether it is a primary key, whether it is allowed to be empty, etc.).
[0052] For XML files, an XML parser is used to load the file. During the parsing process, each node in the XML file is identified, and the node name and the hierarchical relationship of the node (parent-child node relationship, etc.) are recorded.
[0053] For JSON files, first parse the file content to determine its overall structure. If the JSON file contains nested objects or arrays, record the nesting level and structural relationship. Then, read the values in the key-value pairs, classify and record them according to the data type of the value (such as string, number, Boolean value, array, object, etc.), and record the key name at the same time.
[0054] The file types, storage paths and feature data obtained from analyzing different storage formats are integrated.
[0055] For example, for a database file stored in a specific path, its file type (database file), storage path, and database table structure information are associated; similar processing is performed on XML files and JSON files to form a complete feature data record, ready for subsequent storage in the feature library.
[0056] By learning its file directory structure, data storage format and recording the specific storage location and data characteristics, an extensible feature library is constructed.
[0057] In a preferred embodiment, step S3 includes:
[0058] Determine whether there is a feature entry matching the application to be forensically collected in the feature library. If not, extract the feature data in the application data and return to execute step S2. If yes, parse and extract the application data of the application to be forensically collected according to the parsing strategy corresponding to the feature entry.
[0059] Specifically, for any given APP to be forensically collected, its file directory structure is scanned, the file type and storage location are analyzed, and then matched with the entries in the feature library. Based on the matching results, the application data of the APP is accurately located and extracted without relying on the package name or interface features.
[0060] As the sample size increases, the feature library is automatically updated, and the APP feature information stored in the library is continuously expanded through new samples, thereby improving the recognition accuracy of emerging or changed APPs.
[0061] The system performs a comprehensive scan of the application to be forensically collected starting from its root directory, and uses the traversal algorithm in step S1 to access each file and folder in the application in turn.
[0062] In this process, the file name and path are recorded in detail to determine the file storage location information. At the same time, the type of each file is determined by the file extension or file header features to determine whether it belongs to a database file, XML file, or JSON file.
[0063] The file type, storage location and other information of the application to be forensically collected obtained through scanning are compared with the feature entries in the feature library one by one.
[0064] For file types, check whether the database files, XML files, and JSON files in the application to be forensically collected match the corresponding file type features in the feature library;
[0065] For storage location, check whether the storage path of the comparison file in the application is consistent with the file storage path characteristics of similar applications recorded in the feature library. At the same time, for database files, further compare their table structure (table name, field name, field type, etc.) to see if they match the database table structure characteristics in the feature library; for XML files, check whether their node information (node name, hierarchical relationship, attributes, etc.) is the same as the XML node characteristics in the feature library; for JSON files, compare their values and their structures (key-value pair content, nesting level, etc.) to see if they match the JSON file characteristics in the feature library.
[0066] If a feature entry that completely matches the application to be verified is found in the feature library, it means that the data storage feature of the application has been identified. The application data can be accurately extracted from the application to be verified based on the extraction method and location information corresponding to the feature entry recorded in the feature library.
[0067] If no matching feature entry is found in the feature library, unique feature data is extracted from the application to be forensically verified, including the new file type (if any), new storage format features, and corresponding storage location information.
[0068] Then, these newly extracted feature data are returned as new feature entries to execute step S2, and added to the feature library so that similar applications can be subsequently identified and processed, thereby realizing dynamic expansion of the feature library and improving the ability to process APPs.
[0069] When the next application to be collected is identified, the feature matching and data extraction operations are attempted again in the updated feature library. Through such a cycle and dynamic update mechanism, it is possible to continuously adapt to newly emerging application features and improve forensic capabilities.
[0070] In a preferred embodiment, the forensic report in step S4 includes the matching results, feature data, and the location where the feature data is extracted.
[0071] Specifically, after data extraction is completed, a forensic report will be generated, which records the feature matching process, the specific location of data extraction, and the extracted data content. This information can be used as effective evidence for judicial evidence collection to ensure the integrity and availability of data.
[0072] A system for extracting fraudulent application data, referring to Figure 2 ,include,
[0073] A feature library construction module 1 obtains feature data of various sample applications and constructs a feature library based on the feature data;
[0074] The feature matching module 2 is connected to the feature library building module 1, uses the feature library to perform feature matching on the application to be forensic, and extracts application data of the application to be forensic according to the matching result;
[0075] The report generation module 3 is connected to the feature matching module 2 to form a forensic report based on the application data.
[0076] Specifically, the present invention also provides a system for extracting fraudulent application data, which can bypass the dependence on package names and automatically identify and extract application data by analyzing the data storage characteristics of the APP. No matter how it is disguised, it can achieve accurate data extraction.
[0077] In a preferred embodiment, referring to Figure 3 , the feature library construction module 1 includes,
[0078] The sample application analysis unit 11 traverses the file directory of the sample application and analyzes it to obtain feature data;
[0079] The feature library forming unit 12 is connected to the sample application analyzing unit 11 and forms a feature library using the feature data as feature items.
[0080] Specifically, by establishing and maintaining a feature library, the application data storage location of unknown or disguised apps can be automatically identified and data can be extracted through feature matching.
[0081] Starting from the root directory of the sample application, use the depth-first search or breadth-first search algorithm to systematically access each file and folder. During the traversal process, accurately record key information such as the name, complete path, and hierarchical relationship of each file, so as to build a detailed file directory structure map of the sample application.
[0082] For each file traversed, the file type is accurately determined by checking the file extension (such as .db for database files, .xml for XML files, and .json for JSON files) and the file header features. Once the file type is determined, targeted storage format analysis is performed based on its type.
[0083] If it is a database file, use the corresponding database parsing tool to open the file and analyze the table structure in the database in detail, including identifying the names of all tables, carefully analyzing the names of the fields in each table, data types (such as integers, text, dates, etc.), and constraints on the fields (such as primary key constraints, non-null constraints, etc.).
[0084] For XML files, use an XML parser to load the file content and interpret the node information. Record the name of each node, the hierarchical relationship between nodes (such as parent-child node, sibling node relationship), and the attributes that the node may carry (including attribute name and attribute value).
[0085] For JSON files, use JSON parsing technology to parse the file content and clarify its overall structure, especially whether there are nested objects or arrays and the nested hierarchical relationship. At the same time, carefully read the values in the key-value pairs and classify and record them according to their data types (such as strings, numbers, Boolean values, arrays, objects, etc.), and remember to record the key names.
[0086] The file type, storage location and detailed feature data obtained from the above steps and analyzed for different storage formats are organically integrated.
[0087] For example, for a database file located in a specific path, its file type (database file), storage path, and complete database table structure information are associated; similar comprehensive integration is also performed on XML files and JSON files to form complete and associated feature data records.
[0088] The feature library forming unit 12 receives the integrated feature data transmitted by the sample application analyzing unit 11. For each set of feature data, it is converted into a feature entry in the feature library. The feature entry contains all key feature information related to the file type, storage location and storage format extracted from the sample application, and is organized and stored in a structured, easy to retrieve and compare manner.
[0089] Build the framework of the feature library with appropriate data structures (such as database tables, data dictionaries, etc.) and determine the storage method and indexing mechanism of feature entries so that feature matching operations can be performed quickly later.
[0090] The feature entries obtained from the analysis of each sample application are stored in the feature library in sequence to complete the initial construction of the feature library.
[0091] For example, the user data of an APP may be stored in a SQLite database. The location of the database file and its table structure, field names and other information will be stored in the library as feature entries.
[0092] As more and more sample applications are analyzed and feature data are extracted, the feature library is continuously enriched and expanded, gradually covering more types and features of application data storage modes, laying a solid foundation for the subsequent accurate identification and extraction of data from fraud-related applications or other unknown applications.
[0093] In a preferred embodiment, referring to Figure 4 , the feature matching module 2 includes,
[0094] The feature judgment unit 21 is connected to the feature library construction module 1. When there is no feature entry matching the application to be forensic in the feature library, the feature data in the application data is extracted and stored in the feature library. When there is a feature entry matching the application to be forensic in the feature library, the application data of the application to be forensic is parsed and extracted according to the parsing strategy corresponding to the feature entry.
[0095] Specifically, the feature library is automatically updated as new samples are added. When a new app is analyzed, its file structure and storage features are compared with the features in the existing library. If new features are found (such as new database structures or file types), the system automatically adds these new features to the feature library to ensure that the feature library can be dynamically expanded.
[0096] Different features in the feature library represent different APP types, and corresponding parsing strategies are set in the feature library.
[0097] Different types of apps store data in different ways. For example, in a JSON file, even for the same node, different apps store values in different formats and field names.
[0098] For social apps, the focus is on parsing user information (extracting usernames, avatar URLs, etc. from specific storage locations according to their structures), chat records (obtaining senders, receivers, message content, time, etc. based on the storage format), and user relationship data (friend lists, group information, etc.).
[0099] For example, for a social APP, after it is identified as a social type through the feature library, its user information, chat records and other specific application data are analyzed according to the data extraction and analysis strategy of social APP. When it is necessary to collect evidence for a certain APP, the system will first traverse the file directory of the APP and analyze the file type and location in it, trying to match it with the data features in the feature library.
[0100] For example, if there is a specific XML node or database table name in the APP that matches the entry in the feature library, the feature will be marked as a match, and the system will further automatically extract this data based on the matching results.
[0101] When the feature matching module 2 receives an application to be forensically collected, the feature judgment unit 21 first performs a comprehensive scan of the application to be forensically collected. Starting from the root directory of the application, the sample application file directory is traversed in a similar manner as in the feature library construction module 1, and all files and folders in the application are accessed in sequence to obtain basic information such as the name, path, and file type (judged by extension or file header) of each file.
[0102] The feature data of the application to be forensically collected is compared with all the feature entries in the feature library one by one. During the comparison process, various detailed features related to file type, storage location and storage format (such as database table structure, XML node information, JSON file structure and value, etc.) are strictly compared.
[0103] If any feature of the application to be forensically collected cannot find a match in the feature library, it means that the application has a new feature. At this time, the feature judgment unit 21 will extract the complete feature data of the application, including all file types, storage locations and storage format features obtained by the previous analysis.
[0104] The extracted new feature data are passed to the feature library forming unit 12 of the feature library building module 1, and these new feature data are stored as new feature entries in the feature library according to the storage structure and format requirements of the feature library, thereby completing the dynamic update of the feature library.
[0105] In a preferred embodiment, both the sample application and the application to be collected are fraud-related applications.
[0106] Reference Figure 5 In one embodiment, the process of extracting application data of a niche APP includes:
[0107] First, multiple niche apps are collected as sample applications, the file structure and data storage format of these niche apps are analyzed, and the file directory structure, storage format and location are extracted, and the extracted file directory structure, storage format and location are stored in the database.
[0108] Then scan the file directory structure of the application to be forensic, compare the file structure and format, and extract the application data of the application to be forensic.
[0109] Finally, the extracted application data is summarized into a forensic report.
[0110] The above description is only a preferred embodiment of the present invention, and does not limit the implementation mode and protection scope of the present invention. For those skilled in the art, it should be aware that all solutions obtained by equivalent substitutions and obvious changes made using the description and illustrations of the present invention should be included in the protection scope of the present invention.
Claims
1. A method for extracting fraudulent application data, characterized in that: include, Step S1, obtaining characteristic data of multiple sample applications; Step S2, constructing a feature library by using the feature data as feature items; Step S3, performing feature matching on the application to be forensically collected using the feature library, and extracting application data of the application to be forensically collected according to the matching result; Step S4, forming a forensic report based on the application data.
2. The method for extracting fraudulent application data according to claim 1, characterized in that: Step S1 comprises, The file directory of the sample application is traversed and analyzed to obtain the characteristic data, where the characteristic data includes file type, storage format, directory structure, and storage path of a specific file.
3. The method for extracting fraudulent application data according to claim 2, characterized in that: The storage format includes a database table structure, node information of an XML file, and node information of a JSON file.
4. The method for extracting fraudulent application data according to claim 3, characterized in that: The file types include database files, the XML files, and the JSON files.
5. The method for extracting fraudulent application data according to claim 1, characterized in that: Step S3 comprises, Determine whether there is a feature entry matching the application to be verified in the feature library; if not, extract the feature data in the application data and return to execute step S2; if yes, parse and extract the application data of the application to be verified according to the parsing strategy corresponding to the feature entry.
6. The method for extracting fraudulent application data according to claim 1, characterized in that: The forensic report in step S4 includes the matching result, the feature data and the location where the feature data is extracted.
7. A system for extracting fraudulent application data, characterized in that: include, A feature library construction module, which obtains feature data of various sample applications and constructs a feature library based on the feature data; A feature matching module, connected to the feature library building module, performs feature matching on the application to be forensically collected using the feature library, and extracts application data of the application to be forensically collected according to the matching result; A report generation module is connected to the feature matching module to form a forensic report based on the application data.
8. The system for extracting fraudulent application data according to claim 7, characterized in that: The feature library construction module includes: A sample application analysis unit, traversing the file directory of the sample application and analyzing to obtain the feature data; The feature library forming unit is connected to the sample application analyzing unit and uses the feature data as feature items to form the feature library.
9. The system for extracting fraudulent application data according to claim 8, characterized in that: The feature matching module includes: A feature judgment unit is connected to the feature library construction module. When the feature entry matching the application to be verified does not exist in the feature library, the feature data in the application data is extracted and stored in the feature library. When the feature entry matching the application to be verified exists in the feature library, the application data of the application to be verified is parsed and extracted according to the parsing strategy corresponding to the feature entry.
10. The system for extracting fraudulent application data according to claim 7, characterized in that: The sample application and the application to be collected evidence are both fraud-related applications.