An android software repackaging detection method based on interface icon characteristics

Abstract

The invention discloses an Android software repackaging detection method based on interface icon characteristics, which comprises the following steps: S1, dynamically executing an Android application,screening each interface, and dumping all icons of the interface; S2, classifying the dumped icons according to styles to obtain an icon-style-interface tree, and taking the icon-style-interface treeas an application software birthmark; S3, calculating similarity of the icon-style-interface tree of to-be-compared Android application pairs, when the similarity of a pair of the icon-style-interface tree is greater than a threshold value, the two corresponding applications are judged to be repackaged. According to the Android software similarity comparison method, the visual feature, namely theicon, is combined with the strategy of dynamically executing the Android application, so that the resistance to two anti-detection modes, namely code confusion and encryption, is improved, and the repackaging detection accuracy of the Android application is improved.

Description

technical field [0001] The invention belongs to the technical field of software applications, and in particular relates to a method for detecting Android software repackaging based on interface icon features. Background technique [0002] The popularity of smart devices represented by smartphones and the rapid development of mobile Internet technology have promoted the vigorous development of the mobile Internet software industry. Compared with traditional PC software, emerging mobile applications such as Alipay and WeChat are closer to users' daily life, and their market size is huge and growing rapidly. Application repackaging has become one of the main ways for malicious software to spread, threatening the security and privacy of users, infringing on the intellectual property rights and economic interests of developers / publishers, hindering the innovation of mobile application products, and seriously endangering the mobile Internet industry. normal order and ecology. ...

AI Technical Summary

Problems solved by technology

However, by means of encryption and obfuscation, attackers who perform repackaging will add codes and controls that confuse automated analysis software into the code

In this regard, static analysis methods are almost completely ineffective

However, the use of dynamic analysis methods not based on visual features is easy to misjudgment when the application has undergone code obfuscation and interface obfuscation. Two interfaces that are similar to humans may be completely different in software implementation.

Images