基于API调用的抗混淆Android应用相似性检测方法

doi:10.11959/j.issn.2096-109x.2018001

Abstract

Abstract:

The traditional Android application similarity detection methods have the problem of complex feature extraction and low detecting efficiency.Regarding the issue above,an anti-obfuscation Android application similarity detection method based on API call was proposed.Firstly,it extracts referenced API sequence from the dex file.Counting the number of referenced API after decompiling the application to build feature vector.Finally,calculate the application similarity through feature vector.The experimental results show that the method has high accuracy.

Key words: application similarity, Android, reverse engineering, anti-obfuscation

CLC Number:

TP399

Jieming GU,Bowen SUN,Peng WU,Qi LI,Yanhui GUO. Anti-obfuscation Android application similarity detection method based on API call[J]. Chinese Journal of Network and Information Security, 2018, 4(1): 63-68.

Figures/Tables 7

References 20

[1]	Smartphone OS Market Share,2016 Q3[EB/OL]. .
[2]	Analysis:how much difference does Google play and App store differ?[EB/OL]. .
[3]	NetQin.Global mobile report of first half of 2012[EB/OL]. .
[4]	SHEKHAR S , DIETZ M , WALLACH D S . AdSplit:separating smartphone advertising from applications[J]. Dissertations ＆ Theses-Gradworks, 2012,54(1):99.
[5]	ZHOU Y , JIANG X . Dissecting android malware:characterization and evolution[C]// 2012 IEEE Symposium on Security and Privacy. 2012: 95-109.
[6]	HANNA S , HUANG L , WU E ,et al. Juxtapp:a scalable system for detecting code reuse among android applications[C]// The International Conference on Detection of Intrusions and Malware,and Vulnerability Assessment. 2012: 62-81.
[7]	ZHOU W , ZHOU Y , JIANG X ,et al. Detecting repackaged smartphone applications in third-party android marketplaces[C]// ACM Conference on Data and Application Security and Privacy. 2012: 317-326.
[8]	LI S . Juxtapp and DStruct:detection of similarity among Android applications[EB/OL]. .
[9]	HUANG H , ZHU S , LIU P ,et al. A framework for evaluating mobile App repackaging detection algorithms[C]// The International Conference on Trust and Trustworthy Computing. 2013: 169-186.
[10]	CHEN K , LIU P , ZHANG Y . Achieving accuracy and scalability simultaneously in detecting application clones on android markets[C]// The 36th International Conference on Software Engineering. 2014: 175-186.
[11]	路程, 张淼, 徐国爱 . 基于源代码静态分析技术的Android应用恶意行为检测模型[J]. 2011.
	LU C , ZHANG M , XU G A . Android application malicious behavior detection model based on source static analysis technology[J]. 2011.
[12]	SOH C , TAN H B K , ARNATOVICH Y L ,et al. Detecting clones in Android applications through analyzing user interfaces[C]// IEEE International Conference on Program Comprehension. 2015: 163-173.
[13]	JesusFreke. smali/baksmali:an assembler/disassembler for Android's dex format[EB/OL]. .
[14]	刘方圆, 孟宪佳, 汤战勇 ,等. 基于smali代码混淆的Android应用保护方法[J]. 山东大学学报(理学版), 2017(3): 44-50.
	LIU F Y , MENG X J , TANG Z Y ,et al. Android application protection method based on smali code confusion[J]. Journal of Shandong University(Nature Science), 2017(3): 44-50.
[15]	Dedexer:dedexer is a disassembler tool for DEX files[EB/OL]. .
[16]	LINARES-VASQUEZ M , HOLTZHAUER A , POSHYVANYK D . On auto-matically detecting similar android apps[C]// The 24th International Conference on Program Comprehension (ICPC). 2016: 1-10.
[17]	ZHOU W , ZHOU Y , GRACE M ,et al. Fast,scalable detection of piggybacked mobile applications[C]// The 3rd ACM conference on data and application security and privacy. 2013: 185-196.
[18]	Apktool.A tool for reverse engineering android apk files[EB/OL]. .
[19]	ZHANG Z Y , WANG J , CHENG H M . An approach for spatial index of text information based on cosine similarity[J]. Computer Science, 2005.
[20]	DESNOS A , GUEGUEN G . Android:from reversing to decompilation[J]. Proc of Black Hat Abu Dhabi, 2011.

Metrics

Recommended 0

No Suggested Reading articles found!

名称	格式	描述
header	header_item	文件头结构
string_ids	string_id_item[]	字符串列表，包含文件中使用的所有字符串
type_ids	type_id_item[]	类型标识符列表，包含文件引用的所有类型（类、数组、基本类型）的标识符
proto_ids	proto_id_item[]	方法原型标识符列表，包含文件引用的所有方法的原型
field_ids	field_id_item[]	字段标识符列表，包含文件中引用的所有字段的标识符
method_ids	method_id_item[]	方法标识符列表，包含文件中引用的所有方法的标识符
class_defs	class_def_item[]	类定义列表
data	ubyte[]	数据区，包含上述各表的全部支撑数据
link_data	ubyte[]	静态链接文件所使用的数据

	名称	描述
class_idx		类型标识符列表的索引，用于描述方法的所属类。所指向的类不能为基本数据类型
proto_idx		方法原型标识符列表的索引，用于描述方法的原型
name_idx		字符串列表的索引，用于描述方法的名称

名称	描述
shorty_idx	字符串列表的索引，由方法的返回类型和参数列表组成的字符串，用于描述方法原型
retrun_type_idx	类型标识符列表的索引，用于描述方法原型的返回值类型
parameters_off	指向DexTypeList结构体。DexTypeList结构存放方法的参数列表，如果方法没有参数，值为0

名称	描述
class_idx	类型标识符列表的索引，描述具体的class类型
access_flags	描述class的访问类型，如public、final、static等
superclass_idx	类型标识符列表的索引，描述superclass的类型
interfaces_off	如果类中含有接口声明或实现，interfaceOff会指向一个DexTypeList结构，否则这里的值为0
source_file_idx	字符串列表的索引，表示类所在的源文件名称
annotations_off	指向注解目录结构，根据类型不同会有注解类、注解方法、注解字段与注解参数，如果类中没有注解，值为0
class_data_off	指向DexClassData结构，记录类用到的数据
static_value_off	指向DexEncodedArray结构，记录类中的静态数据

Anti-obfuscation Android application similarity detection method based on API call

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 7

References 20

Related Articles 15

Metrics

Recommended 0

[1]	Zhanhui YUAN, Zhi YANG, Hongqi ZHANG, Shuyuan JIN, Xuehui DU. Android complex information flow analysis method based on communicating sequential process [J]. Chinese Journal of Network and Information Security, 2021, 7(5): 156-168.
[2]	Fan CHAO, Zhi YANG, Xuehui DU, Bing HAN. Classified risk assessment method of Android application based on multi-factor clustering selection [J]. Chinese Journal of Network and Information Security, 2021, 7(2): 161-173.
[3]	Xin ZHANG,Weizhong QIANG,Yueming WU,Deqing ZOU,Hai JIN. Mining behavior pattern of mobile malware with convolutional neural network [J]. Chinese Journal of Network and Information Security, 2020, 6(6): 35-44.
[4]	Fan CHAO,Zhi YANG,Xuehui DU,Yan SUN. Android malware detection method based on deep neural network [J]. Chinese Journal of Network and Information Security, 2020, 6(5): 67-79.
[5]	Pu GENG,Yuefei ZHU. Review of path branch obfuscation [J]. Chinese Journal of Network and Information Security, 2020, 6(2): 12-18.
[6]	Ning FANG,Weibing CAO,Donghe NI,Guandong DI. Accelerating cryptographic computation with parallel computing mechanisms in Android platform [J]. Chinese Journal of Network and Information Security, 2019, 5(1): 50-55.
[7]	Futian SHI,Jian MAO,Jianwei LIU. Review of side-channel privacy inference of Android mobile devices [J]. Chinese Journal of Network and Information Security, 2018, 4(4): 12-21.
[8]	Xiaoyan ZHU,Hui ZHANG,Jianfeng MA. Privacy protection system based on Hook for Android [J]. Chinese Journal of Network and Information Security, 2018, 4(4): 38-47.
[9]	Hui-ying YAN,Zhen-ji ZHOU,Li-fa WU,Zheng HONG,He SUN. Symbolic execution based control flow graph extraction method for Android native codes [J]. Chinese Journal of Network and Information Security, 2017, 3(7): 33-46.
[10]	Yi-lin YE,Zhen-ji ZHOU,Zheng HONG,Hui-ying YAN,Li-fa WU. Static-analysis-based event input generation approach for Android application [J]. Chinese Journal of Network and Information Security, 2017, 3(6): 21-32.
[11]	Ya-wei WANG,Chang-gen PENG,Hong-fa DING,Kai ZHOU. Identity authentication scheme of Android client based on identifiers [J]. Chinese Journal of Network and Information Security, 2017, 3(4): 32-38.
[12]	Xiao-min ZHANG,Jing LUI,Jun-xi ZHUANG,Ying-xu LAI. Research on Android malware detection based on permission and behavior [J]. Chinese Journal of Network and Information Security, 2017, 3(3): 51-57.
[13]	Yi-min YANG,Tie-ming CHEN. Android malware family classification method based on the image of bytecodeConstruction of MDS matrices [J]. Chinese Journal of Network and Information Security, 2016, 2(6): 38-43.
[14]	Jia CHEN,Shan-qing1 GUO. Toward discovering and exploiting private server-side Web API [J]. Chinese Journal of Network and Information Security, 2016, 2(12): 27-38.
[15]	Jing-qiang LIU,Bin LI,Li-zhang CHEN,Bin CHEN. Research based on the method of Android system active defense without Root permission [J]. Chinese Journal of Network and Information Security, 2016, 2(1): 65-73.