Dynamic Loading File Extraction for Android Container Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing malicious Android applications that utilize dynamic loading mechanisms are inefficient, as they often extract unnecessary files and struggle to identify and recover files deleted post-loading, hindering effective analysis.
Innovation Solution
A method and apparatus for dynamic loading file extraction that conducts first and second analyses to identify files with critical extensions and deleted files within an Android container, re-executing the application to extract deleted files, and storing them separately for analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all generated files are extracted to identify dynamically loaded files, then the probability of finding the target file increases, but unnecessary files (cache, data storage) are also extracted increasing analysis workload
Solution Approach 1:
The patent segments the file extraction process into two distinct analysis phases: first analysis focuses on extracting files with critical extensions (DEX, jar, zip, APK, SO) while second analysis identifies deleted files through deletion logs. This segmentation allows the system to target specific file types rather than extracting all generated files, reducing unnecessary analysis workload while maintaining identification accuracy
Solution Approach 2:
The patent applies local quality by differentiating file extraction strategies based on file characteristics. Files with critical extensions are extracted through extension comparison, while deleted files are identified through deletion log analysis. This localized approach ensures that only files with specific qualities (critical extensions or deletion status) are extracted, filtering out unnecessary cache and data storage files
2Loss of time
If files are extracted immediately, then analysis can begin, but deleted files cannot be recovered for analysis
Solution Approach 1:
The patent performs preliminary action by conducting second analysis to identify deleted files through deletion logs before the extraction process completes. By checking deletion logs in advance and noting file paths of deleted files, the system prepares to recover these files during re-execution, preventing permanent loss of dynamically loaded file information
Solution Approach 2:
The patent implements discarding and recovering by allowing deleted files to be removed from the Android container during normal operation, then recovering them through re-execution of the malicious application. The system discards the original deleted files but recovers them by running the application again and extracting files based on deletion log information, ensuring no loss of analyzable data
3Loss of information
If the application is re-executed to recover deleted files, then deleted files can be extracted, but analysis time increases
Solution Approach 1:
The patent performs preliminary action by conducting deletion log analysis during the first execution phase to identify which files were deleted and their locations. This preliminary identification means that when re-execution occurs, the system only needs to extract specific known files rather than analyzing all generated files again, significantly reducing the time penalty of re-execution
Data Source
AI summary
Provided is a method and apparatus of dynamic loading file extraction. The method for extracting a specific dynamic generated file of an application running in an Android container environment includes conducting first analysis to identify if a file extension that is stored in the Android container corresponds to a preset critical extension, to extract a file with the critical extension, and conducting second analysis to identify a deleted file standing for a file deleted after stored in the Android container, and running the application again and extracting the deleted file based on a result of the second analysis.