Mobile App Repackaging Detection via File Format Fingerprints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques struggle to effectively protect mobile devices from malicious applications, particularly in detecting repackaged applications that can introduce malicious elements.
Innovation Solution
The system performs static and dynamic analysis on mobile device applications to distinguish between original and repackaged applications, using techniques such as examining file format fingerprints and analyzing application behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing detection techniques are used, then mobile devices can be protected to some extent, but repackaged applications with malicious elements cannot be effectively detected
Solution Approach 1:
The patent segments the application analysis into multiple independent fingerprint checks (e.g., checking for modified manifest files, altered resource files, changed code structures) rather than relying on a single complex detection method. This segmentation allows the system to detect repackaged applications through multiple simpler, targeted checks, improving reliability without proportionally increasing overall complexity.
Solution Approach 2:
The patent performs preliminary fingerprint extraction and comparison before full application execution or installation. By pre-computing and storing fingerprints of legitimate applications, the system can quickly compare suspected applications against these known-good references, enabling early detection of repackaged apps and avoiding more complex analysis until necessary.
2Measurement precision
If comprehensive static and dynamic analysis is performed, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent implements a tiered analysis approach where fingerprint comparison is performed first as a partial check. Only applications that fail this initial fingerprint match proceed to more comprehensive static and dynamic analysis. This partial action strategy maintains high detection precision for obvious cases while reducing average processing time by avoiding full analysis on all applications.
Solution Approach 2:
The patent applies different levels of analysis depth to different parts of the application based on fingerprint match results. Applications with matching fingerprints receive minimal local quality checks, while those with mismatches or suspicious characteristics undergo more intensive localized analysis of specific code sections or resources, optimizing the balance between precision and time consumption.
Data Source
AI summary
A set of repackaging fingerprints generated independently of a particular original application is received. The set of repackaging fingerprints comprises a plurality of predetermined indicators of build-related structure that is independent of the particular original application's code structure. A mobile application is received. The received mobile application is analyzed for one or more indicators that the received mobile application is a repackaged version of the particular original application, using at least one repackaging fingerprint. In response to a result of the analysis, the received mobile application is categorized as a repackaged application.