基于API调用的抗混淆Android应用相似性检测方法

谷杰铭; 孙博文; 吴鹏; 李祺; 郭燕慧

doi:10.11959/j.issn.2096-109x.2018001

您当前的位置：

首页 >

文章列表页 >

基于API调用的抗混淆Android应用相似性检测方法

学术论文 | 更新时间：2024-06-03

- 基于API调用的抗混淆Android应用相似性检测方法
- Anti-obfuscation Android application similarity detection method based on API call
- 网络与信息安全学报 2018年4卷第1期页码：63-68
- 作者机构：
  
  1. 北京邮电大学网络空间安全学院，北京 100876
  2. 天地互联与融合北京市重点实验室，北京 100876
  3. 四川大学计算机学院，四川成都 610015
- 作者简介：
  
  [ "谷杰铭（1993-），男，河北邢台人，北京邮电大学硕士生，主要研究方向为移动安全、恶意软件检测。" ]
  [ "孙博文（1994-），男，辽宁沈阳人，北京邮电大学硕士生，主要研究方向为网络安全、恶意软件检测。" ]
  [ "吴鹏（1982-），男，四川广元人，四川大学博士生，主要研究方向为恶意软件检测、软件抄袭、软件安全加固。" ]
  [ "李祺（1981-），女，北京人，博士，北京邮电大学副教授，主要研究方向为网络安全、机器学习、物联网安全。" ]
  [ "郭燕慧（1974-），女，河北唐山人，博士，北京邮电大学副教授，主要研究方向为网络安全、机器学习、信息安全管理。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61401038)
- DOI：10.11959/j.issn.2096-109x.2018001
  中图分类号： TP399
- 网络首发：2018-01，
  
  纸质出版：2018-01-15
- 稿件说明：
移动端阅览
谷杰铭, 孙博文, 吴鹏, 等. 基于API调用的抗混淆Android应用相似性检测方法[J]. 网络与信息安全学报, 2018,4(1):63-68.

Jieming GU, Bowen SUN, Peng WU, et al. Anti-obfuscation Android application similarity detection method based on API call[J]. Chinese Journal of Network and Information Security, 2018, 4(1): 63-68.
谷杰铭, 孙博文, 吴鹏, 等. 基于API调用的抗混淆Android应用相似性检测方法[J]. 网络与信息安全学报, 2018,4(1):63-68. DOI： 10.11959/j.issn.2096-109x.2018001.

Jieming GU, Bowen SUN, Peng WU, et al. Anti-obfuscation Android application similarity detection method based on API call[J]. Chinese Journal of Network and Information Security, 2018, 4(1): 63-68. DOI： 10.11959/j.issn.2096-109x.2018001.

摘要

传统的移动应用相似性检测方法存在特征提取复杂、检测效率较低等问题。针对上述问题，提出基于API调用的抗混淆Android应用相似性检测方法，首先从DEX文件中提取引用API序列，应用反编译后对引用API进行频数统计；然后构建应用的特征向量，以此计算应用之间的相似度。实验结果证明，该方法具有较高的准确率。

Abstract

The traditional Android application similarity detection methods have the problem of complex feature extraction and low detecting efficiency.Regarding the issue above

an anti-obfuscation Android application similarity detection method based on API call was proposed.Firstly

it extracts referenced API sequence from the dex file.Counting the number of referenced API after decompiling the application to build feature vector.Finally

calculate the application similarity through feature vector.The experimental results show that the method has high accuracy.

关键词

Keywords

references

Smartphone OS Market Share,2016 Q3 [EB/OL ] . http://www.idc.com/promo/smartphone-market-share/os http://www.idc.com/promo/smartphone-market-share/os .

Analysis:how much difference does Google play and App store differ? [EB/OL ] . http://www.chinaz.com/manage/2017/0223/662587.shtml http://www.chinaz.com/manage/2017/0223/662587.shtml .

NetQin.Global mobile report of first half of 2012 [EB/OL ] . http://cn.nq.com/neirong/2012shang.pdf http://cn.nq.com/neirong/2012shang.pdf .

SHEKHAR S , DIETZ M , WALLACH D S . AdSplit:separating smartphone advertising from applications [J ] . Dissertations ＆ Theses-Gradworks , 2012 , 54 ( 1 ):99.

ZHOU Y , JIANG X . Dissecting android malware:characterization and evolution [C ] // 2012 IEEE Symposium on Security and Privacy . 2012 : 95 - 109 .

HANNA S , HUANG L , WU E , et al . Juxtapp:a scalable system for detecting code reuse among android applications [C ] // The International Conference on Detection of Intrusions and Malware,and Vulnerability Assessment . 2012 : 62 - 81 .

ZHOU W , ZHOU Y , JIANG X , et al . Detecting repackaged smartphone applications in third-party android marketplaces [C ] // ACM Conference on Data and Application Security and Privacy . 2012 : 317 - 326 .

LI S . Juxtapp and DStruct:detection of similarity among Android applications [EB/OL ] . https://www2.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-111.html https://www2.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-111.html .

HUANG H , ZHU S , LIU P , et al . A framework for evaluating mobile App repackaging detection algorithms [C ] // The International Conference on Trust and Trustworthy Computing . 2013 : 169 - 186 .

CHEN K , LIU P , ZHANG Y . Achieving accuracy and scalability simultaneously in detecting application clones on android markets [C ] // The 36th International Conference on Software Engineering . 2014 : 175 - 186 .

路程 , 张淼 , 徐国爱 . 基于源代码静态分析技术的Android应用恶意行为检测模型 [J ] . 2011 .

LU C , ZHANG M , XU G A . Android application malicious behavior detection model based on source static analysis technology [J ] . 2011 .

SOH C , TAN H B K , ARNATOVICH Y L , et al . Detecting clones in Android applications through analyzing user interfaces [C ] // IEEE International Conference on Program Comprehension . 2015 : 163 - 173 .

JesusFreke . smali/baksmali:an assembler/disassembler for Android's dex format [EB/OL ] . http://code.google.com/p/smali/ http://code.google.com/p/smali/ .

刘方圆 , 孟宪佳 , 汤战勇 , 等 . 基于smali代码混淆的Android应用保护方法 [J ] . 山东大学学报(理学版) , 2017 ( 3 ): 44 - 50 .

LIU F Y , MENG X J , TANG Z Y , et al . Android application protection method based on smali code confusion [J ] . Journal of Shandong University(Nature Science) , 2017 ( 3 ): 44 - 50 .

Dedexer:dedexer is a disassembler tool for DEX files [EB/OL ] . http://dedexer.sourceforge.net/ http://dedexer.sourceforge.net/ .

LINARES-VASQUEZ M , HOLTZHAUER A , POSHYVANYK D . On auto-matically detecting similar android apps [C ] // The 24th International Conference on Program Comprehension (ICPC) . 2016 : 1 - 10 .

ZHOU W , ZHOU Y , GRACE M , et al . Fast,scalable detection of piggybacked mobile applications [C ] // The 3rd ACM conference on data and application security and privacy . 2013 : 185 - 196 .

Apktool.A tool for reverse engineering android apk files [EB/OL ] . https://ibotpeaches.github.io/Apktool/ https://ibotpeaches.github.io/Apktool/ .

ZHANG Z Y , WANG J , CHENG H M . An approach for spatial index of text information based on cosine similarity [J ] . Computer Science , 2005 .

DESNOS A , GUEGUEN G . Android:from reversing to decompilation [J ] . Proc of Black Hat Abu Dhabi , 2011 .

浏览量

2922

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNNobfus：一种基于混淆的端侧模型保护框架技术研究

路径分支混淆研究综述

基于Android平台并行运算机制的密码运算加速方案

Android移动设备边信道隐私推测研究综述

基于静态分析的Android应用事件输入生成方法