Anti-obfuscation Android application similarity detection method based on API call

Jieming GU; Bowen SUN; Peng WU; Qi LI; Yanhui GUO

doi:10.11959/j.issn.2096-109x.2018001

您当前的位置：

首页 >

文章列表页 >

Anti-obfuscation Android application similarity detection method based on API call

Papers | 更新时间：2024-06-03

- Anti-obfuscation Android application similarity detection method based on API call
- Chinese Journal of Network and Information Security Vol. 4, Issue 1, Pages: 63-68(2018)
- 作者机构：
  
  1. 北京邮电大学网络空间安全学院，北京 100876
  2. 天地互联与融合北京市重点实验室，北京 100876
  3. 四川大学计算机学院，四川成都 610015
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018001
  CLC： TP399
- Online First：2018-01，
  
  Published：15 January 2018
- 稿件说明：
移动端阅览
Jieming GU, Bowen SUN, Peng WU, et al. Anti-obfuscation Android application similarity detection method based on API call[J]. Chinese Journal of Network and Information Security, 2018, 4(1): 63-68.
DOI：

Jieming GU, Bowen SUN, Peng WU, et al. Anti-obfuscation Android application similarity detection method based on API call[J]. Chinese Journal of Network and Information Security, 2018, 4(1): 63-68. DOI： 10.11959/j.issn.2096-109x.2018001.

摘要

传统的移动应用相似性检测方法存在特征提取复杂、检测效率较低等问题。针对上述问题，提出基于API调用的抗混淆Android应用相似性检测方法，首先从DEX文件中提取引用API序列，应用反编译后对引用API进行频数统计；然后构建应用的特征向量，以此计算应用之间的相似度。实验结果证明，该方法具有较高的准确率。

Abstract

The traditional Android application similarity detection methods have the problem of complex feature extraction and low detecting efficiency.Regarding the issue above

an anti-obfuscation Android application similarity detection method based on API call was proposed.Firstly

it extracts referenced API sequence from the dex file.Counting the number of referenced API after decompiling the application to build feature vector.Finally

calculate the application similarity through feature vector.The experimental results show that the method has high accuracy.

关键词

Keywords

references

Smartphone OS Market Share,2016 Q3 [EB/OL ] . http://www.idc.com/promo/smartphone-market-share/os http://www.idc.com/promo/smartphone-market-share/os .

Analysis:how much difference does Google play and App store differ? [EB/OL ] . http://www.chinaz.com/manage/2017/0223/662587.shtml http://www.chinaz.com/manage/2017/0223/662587.shtml .

NetQin.Global mobile report of first half of 2012 [EB/OL ] . http://cn.nq.com/neirong/2012shang.pdf http://cn.nq.com/neirong/2012shang.pdf .

SHEKHAR S , DIETZ M , WALLACH D S . AdSplit:separating smartphone advertising from applications [J ] . Dissertations ＆ Theses-Gradworks , 2012 , 54 ( 1 ):99.

ZHOU Y , JIANG X . Dissecting android malware:characterization and evolution [C ] // 2012 IEEE Symposium on Security and Privacy . 2012 : 95 - 109 .

HANNA S , HUANG L , WU E , et al . Juxtapp:a scalable system for detecting code reuse among android applications [C ] // The International Conference on Detection of Intrusions and Malware,and Vulnerability Assessment . 2012 : 62 - 81 .

ZHOU W , ZHOU Y , JIANG X , et al . Detecting repackaged smartphone applications in third-party android marketplaces [C ] // ACM Conference on Data and Application Security and Privacy . 2012 : 317 - 326 .

LI S . Juxtapp and DStruct:detection of similarity among Android applications [EB/OL ] . https://www2.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-111.html https://www2.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-111.html .

HUANG H , ZHU S , LIU P , et al . A framework for evaluating mobile App repackaging detection algorithms [C ] // The International Conference on Trust and Trustworthy Computing . 2013 : 169 - 186 .

CHEN K , LIU P , ZHANG Y . Achieving accuracy and scalability simultaneously in detecting application clones on android markets [C ] // The 36th International Conference on Software Engineering . 2014 : 175 - 186 .

路程 , 张淼 , 徐国爱 . 基于源代码静态分析技术的Android应用恶意行为检测模型 [J ] . 2011 .

LU C , ZHANG M , XU G A . Android application malicious behavior detection model based on source static analysis technology [J ] . 2011 .

SOH C , TAN H B K , ARNATOVICH Y L , et al . Detecting clones in Android applications through analyzing user interfaces [C ] // IEEE International Conference on Program Comprehension . 2015 : 163 - 173 .

JesusFreke . smali/baksmali:an assembler/disassembler for Android's dex format [EB/OL ] . http://code.google.com/p/smali/ http://code.google.com/p/smali/ .

刘方圆 , 孟宪佳 , 汤战勇 , 等 . 基于smali代码混淆的Android应用保护方法 [J ] . 山东大学学报(理学版) , 2017 ( 3 ): 44 - 50 .

LIU F Y , MENG X J , TANG Z Y , et al . Android application protection method based on smali code confusion [J ] . Journal of Shandong University(Nature Science) , 2017 ( 3 ): 44 - 50 .

Dedexer:dedexer is a disassembler tool for DEX files [EB/OL ] . http://dedexer.sourceforge.net/ http://dedexer.sourceforge.net/ .

LINARES-VASQUEZ M , HOLTZHAUER A , POSHYVANYK D . On auto-matically detecting similar android apps [C ] // The 24th International Conference on Program Comprehension (ICPC) . 2016 : 1 - 10 .

ZHOU W , ZHOU Y , GRACE M , et al . Fast,scalable detection of piggybacked mobile applications [C ] // The 3rd ACM conference on data and application security and privacy . 2013 : 185 - 196 .

Apktool.A tool for reverse engineering android apk files [EB/OL ] . https://ibotpeaches.github.io/Apktool/ https://ibotpeaches.github.io/Apktool/ .

ZHANG Z Y , WANG J , CHENG H M . An approach for spatial index of text information based on cosine similarity [J ] . Computer Science , 2005 .

DESNOS A , GUEGUEN G . Android:from reversing to decompilation [J ] . Proc of Black Hat Abu Dhabi , 2011 .

Views

2922

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

DNNobfus: a study on obfuscation-based edge-side model protection framework

Review of path branch obfuscation

Accelerating cryptographic computation with parallel computing mechanisms in Android platform

Review of side-channel privacy inference of Android mobile devices

Static-analysis-based event input generation approach for Android application

Related Author

WANG Yang

YANG Xiaolin

ZHANG Liqiang

CHENG Binlin

YAN Fei

ZHAO Xinmiao

SONG Feiyang

Yuefei ZHU

Related Institution

Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering,Wuhan University

School of Cyber Science and Technology, Shandong University

Inspur Intelligent Technology Company Limited

Inspur Academy of Science and Technology

Beijing Bangcle Security Technology Co.,Ltd.

⁰