Similarity Hash for Android Executable Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Android applications, particularly Dalvik executables, often employ obfuscation techniques to evade detection by traditional antivirus systems, making it difficult to recognize similarity and identify malicious code effectively.
Innovation Solution
A similarity hash is generated by extracting characteristics from executable classes and transforming them into class fingerprint strings using minwise hashing, allowing for efficient comparison with known malicious hashes to determine potential maliciousness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional antivirus techniques use signatures and characteristics to identify malicious applications, then detection accuracy for known malware is improved, but obfuscation techniques can easily evade detection by changing code signatures
Solution Approach 1:
The patent segments the Android application code into individual method-level instructions and extracts structural characteristics from each segment. Instead of analyzing the entire application as one unit, it breaks down the code into manageable segments (methods) and extracts features like control flow graphs and instruction sequences from each segment, making the detection process more granular and resistant to overall code obfuscation.
Solution Approach 2:
The patent transforms the application code from its original form into a different parameter representation - specifically, converting code structure into graph-based features (control flow graphs, call graphs) and then into numerical vectors. This parameter transformation ensures that obfuscation techniques that modify surface-level code characteristics do not affect the underlying structural parameters that the detection system analyzes.
2Measurement precision
If detailed code analysis is performed to improve malware detection, then detection precision is improved, but computational complexity and processing time increase
Solution Approach 1:
The patent extracts only the essential structural characteristics from the application code - specifically control flow relationships, method call patterns, and instruction sequence features. It takes out and isolates these key structural elements while discarding unnecessary code details, achieving high detection precision with reduced computational complexity by focusing only on the most discriminative features.
Solution Approach 2:
The patent creates simplified graphical representations (copies) of the actual code structure - control flow graphs and call graphs that capture the essential structural relationships without requiring analysis of every code detail. These graphical copies serve as efficient proxies for the full code, enabling precise detection with lower computational overhead.
3Reliability
If code obfuscation techniques are used to protect proprietary applications, then code security is improved, but similarity detection between applications becomes difficult
Solution Approach 1:
The patent changes the parameter space from surface-level code characteristics (variable names, comments, exact instruction sequences) to deep structural parameters (control flow patterns, method call relationships, graph topology). This parameter transformation allows the system to detect similarities in underlying code structure even when obfuscation techniques modify the surface parameters, thus maintaining both security and detectability.
Data Source
AI summary
A method of generating a similarity hash for an executable includes extracting a plurality of characteristics for one or more classes in the executable, and transforming the plurality of characteristics into a set of one or more class fingerprint strings corresponding to the one or more classes. The set of class fingerprint strings is transformed into a hash string using minwise hashing, such that a difference between hash strings for different executables is representative of the degree of difference between the executables. The hash of a target executable is compared with hashes of known malicious executables to determine whether the target executable is likely malicious.