Virus APK Identification via Segmented Characteristic Code Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying virus APK files on Android devices are ineffective due to their vulnerability to modifications such as changing the APK's HASH, signature, or class names, allowing virus makers to evade detection easily.
Innovation Solution
A method and device that utilize a preset virus database of characteristic codes to identify virus APKs by scanning and analyzing executable and text files, generating virus characteristic codes based on instructions, constants, or header information, and matching them against the database to determine if a target APK is malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If HASH-based identification is used to identify virus APK, then identification speed is improved, but identification accuracy deteriorates because virus makers can easily change the HASH by modifying the APK file
Solution Approach 1:
The patent segments the APK file into multiple components (DEX files, manifest files, resource files, etc.) and extracts characteristic codes from each segment. Instead of relying on a single HASH of the entire file, the system analyzes multiple segmented parts to generate comprehensive characteristic codes, making it difficult for virus makers to evade detection by simple file modifications.
Solution Approach 2:
The patent performs preliminary analysis of APK files to extract and store characteristic codes in a database before actual virus identification occurs. By pre-processing and storing key特征 codes during APK installation or scanning, the system enables rapid subsequent identification without needing to re-analyze entire files, thus improving speed while maintaining accuracy through pre-established reference data.
2Reliability
If signature-based identification is used to identify virus APK, then identification accuracy is improved, but ease of operation deteriorates because virus makers can easily change the signature to evade detection
Solution Approach 1:
The patent extracts characteristic codes from multiple segmented parts of the APK including DEX files, manifest files, and resource files. By analyzing multiple segments rather than relying solely on the signature, the system creates a multi-dimensional identification approach that remains effective even when signatures are modified.
Solution Approach 2:
The system uses characteristic codes that can serve multiple identification purposes across different APK variants. These codes are extracted from fundamental structural elements that remain consistent across virus variations, enabling the same identification mechanism to work universally against different types of virus modifications including signature changes.
3Reliability
If class name scanning is used to identify virus APK, then identification accuracy is improved, but device complexity increases due to the need to parse and analyze multiple class files
Solution Approach 1:
The patent performs preliminary extraction of characteristic codes from class files during the initial scanning phase and stores them in a database. When identifying viruses, the system compares pre-extracted characteristic codes rather than parsing entire class files in real-time, significantly reducing the complexity of the identification process while maintaining high accuracy.
Solution Approach 2:
The patent extracts only the essential characteristic codes from class files and other APK components rather than analyzing the entire file structure. By taking out only the key identifying features and storing them separately, the system reduces the complexity of subsequent identification operations while preserving identification accuracy.
4Reliability
If comprehensive APK analysis is performed to identify virus variants, then identification accuracy is improved, but loss of time increases due to the need to analyze multiple files and components
Solution Approach 1:
The patent performs comprehensive analysis in advance by extracting characteristic codes from all APK components during installation or initial scanning and storing them in a database. This preliminary action enables rapid subsequent identification of virus variants through simple code comparison, eliminating the need for time-consuming re-analysis of entire APK files while maintaining comprehensive identification accuracy.
Solution Approach 2:
The patent creates copies of essential characteristic codes from APK files and stores them in a database for rapid comparison. Instead of repeatedly analyzing original APK files, the system uses these pre-created code copies for quick matching operations, significantly reducing analysis time while preserving the ability to accurately identify virus variants.
Data Source
AI summary
Disclosed are a method and a device for identifying a virus APK. The method comprises: presetting a virus database comprising virus characteristic codes; detecting that a designated file in a target Android installation package APK contains at least one of the virus characteristic codes; and determining that the target Android installation package APK is a virus APK. In the application, the virus APK and a variation thereof can be rapidly, accurately and effectively identified, thereby improving the security of an APK application.