Anti-reinforcement fast detection method of Android platform cloning application program

Abstract

The invention discloses an anti-reinforcement fast detection method of an Android platform cloning application program. The method comprises a preprocessing stage and an accurate detection stage. At the preprocessing stage, keywords are extracted from function description of the application program by using the natural language processing technology so as to construct vectors, and suspicious cloning application program pairs with similar functions are quickly searched by using an improved searching method based on a balanced binary tree. At a formal detection stage, the invention provides an application program birthmark that is based on interface layout features and are completely independent from source codes, so that the influence of the reinforcement technology can be effectively defended, and finally the similarity between the suspicious cloning application program pairs can be accurately calculated by using a similarity calculation method based on a tree editing distance. By adoption of the anti-reinforcement fast detection method, the interference of the reinforcement technology can be effectively defended, meanwhile the fast detection of the cloning applications can be achieved, and thus the practicability is very high.

Description

technical field [0001] The invention relates to the fields of mobile security and clone software detection, in particular to a fast detection method for an anti-hardening Android platform clone application program. Background technique [0002] Android has gradually occupied a dominant position in the mobile market, but it has also attracted a large number of malicious attacks. Most of these malicious programs spread rapidly by cloning existing applications, which not only poses a threat to user security, but also affects the income of legitimate developers. At present, the detection methods for cloned applications on the Android platform can be divided into two categories: one is the detection method based on code reuse: through static analysis of the program code, a specific program birthmark, such as a program dependency graph, a program flow chart, etc., is constructed to complete The calculation of similarity; the other is the detection method based on interface simila...

AI Technical Summary

Problems solved by technology

[0003] The clone detection methods described above have several drawbacks that prevent them from being widely used

Among them, the detection method based on code reuse relies on the analysis of code characteristics, and more and more cloning attackers use reinforcement technology to hide the DEX code files in the cloned program, making the detection method based on code reuse invalid; The method of interface features has a large time overhead when extracting interface features and performing similarity calculations, and has great limitations

Images