Application Package Repackaging Detection via Characteristic Data Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Android platform faces significant challenges in protecting against malware due to the ability of crackers to repackaged applications by modifying or adding malicious code, which can then be signed and distributed through marketplaces and internet forums, leading to rapid propagation of malware.
Innovation Solution
A computing environment security method that dissolves an application package into data sets representing various aspects, analyzes characteristic relationships, and determines if the package is repackaged by comparing these data sets with a database, thereby identifying and preventing the installation or release of repackaged malicious applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code signing mechanism is implemented for application protection, then application integrity is ensured, but crackers can still repackage modified applications by obtaining root access and re-signing
Solution Approach 1:
The patent performs preliminary analysis of application packages before they are installed or distributed. It extracts characteristic data from the package structure, code, resources, and manifest files, then compares this data against a database of known legitimate applications. This preliminary security check prevents repackaged applications from being distributed through marketplaces or installed on devices, addressing the vulnerability where traditional code signing fails to prevent repackaging by crackers who obtain root access.
2Measurement precision
If traditional code signing is used, then developer verification is achieved, but it cannot detect repackaged applications with modified code
Solution Approach 1:
The patent segments the application package into multiple components for comprehensive analysis: package structure, code elements, resource files, and manifest information. Each segment is analyzed separately to extract characteristic data, allowing the system to detect modifications in any part of the application. This multi-dimensional segmentation enables detection of repackaged applications that traditional code signing mechanisms cannot identify, as it examines the actual content rather than just the signature.
3Ease of operation
If application packages are freely distributed, then accessibility is improved, but malware propagation risk increases
Solution Approach 1:
The patent introduces an intermediary security analysis system between application distributors and end users. This intermediary automatically analyzes application packages by extracting characteristic data and comparing it against a database of legitimate applications. The system acts as a mediator that enables free distribution while preventing malware propagation, as it automatically identifies and blocks repackaged applications before they reach users, thus maintaining accessibility while eliminating the security risk.
Data Source
AI summary
A computing environment security method is provided. The method includes: a) dissolving an application package to be tested to obtain at least one data set, wherein each data set corresponds to contents with respect to one of a plurality of aspects of the application package; and b) evaluating whether the application package is a repackaged application according to the at least one data set. Step (b) includes: c) for each data set, analyzing a characteristic relationship of the contents with respect to the aspect corresponding to the data set to accordingly generate characteristic data for the data set; and d) determining whether the application package to be tested is a repackaged application package according to the characteristic data of the at least one data set and a search result obtained from a database, wherein the search result corresponds to the characteristic data within a corresponding distance.