Descriptive Entropy Analysis for Mobile Software Similarity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for determining the similarity of mobile software are inefficient in identifying malicious applications due to modifications in source codes and obfuscations, leading to security issues and increased malware detection challenges.
Innovation Solution
A method based on descriptive entropy distribution is employed, involving reverse-engineering decompilation to extract function characteristics, calculating descriptive entropies, integrating and comparing these entropies to calculate similarity scores between mobile software pairs, using tools like Androguard for decompilation and formulae to determine entropy values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional similarity determination methods are used, then the process is simple, but the accuracy deteriorates due to source code modifications and obfuscations
Solution Approach 1:
The patent segments the mobile software into functional components by extracting function characteristics through decompilation. Each function is analyzed separately to obtain its compression code and descriptive entropy, allowing precise comparison of functional elements rather than treating the entire software as a monolith. This segmentation enables accurate similarity detection even when source codes are modified or obfuscated.
Solution Approach 2:
The patent transforms the software analysis from traditional source code comparison to descriptive entropy-based comparison. By converting function characteristics into numerical entropy values and comparing their distributions, the system achieves more accurate similarity determination. The parameter transformation from binary code comparison to continuous entropy distribution comparison resolves the accuracy issue.
2Measurement precision
If comprehensive similarity analysis is performed, then the detection accuracy improves, but the calculation time increases
Solution Approach 1:
The patent extracts only the essential functional characteristics from the mobile software through decompilation and compression. By taking out only the necessary function compression codes and their descriptive entropies, the system reduces the amount of data that needs to be processed and compared, thereby reducing calculation time while maintaining detection accuracy.
Solution Approach 2:
The patent applies partial action by analyzing only the functional characteristics that are most relevant for similarity determination, rather than performing exhaustive analysis of all software components. The descriptive entropy method provides sufficient statistical information for accurate comparison without requiring complete code review, thus balancing accuracy and time efficiency.
3Measurement precision
If source codes are decompiled and analyzed, then the similarity determination accuracy improves, but the processing complexity increases
Solution Approach 1:
The patent introduces descriptive entropy as an intermediary representation between the raw function compression codes and the final similarity comparison. This intermediary transformation simplifies the comparison process by converting complex functional characteristics into comparable numerical distributions, reducing the processing complexity while maintaining analysis accuracy.
Data Source
AI summary
Disclosed is a description-entropy-based intelligent detection method for a big data mobile software similarity. The method comprises the following steps: acquiring a path of mobile software, and reading a file of the mobile software according to the path; performing preliminary reverse engineering decompilation on the file of the mobile software to obtain function characteristics of each piece of mobile software; counting distribution of description entropy of each piece of mobile software by means of description entropy in the function characteristics; further integrating description entropy of each piece of mobile software, after integration, comparing description entropy distribution conditions among the mobile software, and carrying out similarity score calculation to obtain similarity scores among the mobile software; and outputting the similarity scores of all mobile software to obtain a mobile software similarity result. According to the method, a source code of the mobile software is acquired by means of decompilation, a function compression code is acquired, and then the description entropy is acquired; and the description entropy is used as an information amount for representing an object and used for similarity detection of the mobile software, thus greatly increasing the speed of intelligent calculation of software similarity.