KR101992698B1 - Method and system for identifying cheating application - Google Patents

Abstract

A computer program stored on a computer readable recording medium for executing a cheating application identification method and system, and a cheating application identification method in combination with the computer device, is disclosed. The cheating application identification method includes the steps of: analyzing an identification target application to identify whether or not a cheating application is to be extracted, and extracting a URI scheme (Uniform Resource Identifier scheme) included in the identification target application; Requesting the processing of the interaction using the extracted URI scheme, and identifying, as a cheating application, the identification target application when the processing of the interaction is proceeding.

Description

[0001] METHOD AND SYSTEM FOR IDENTIFYING CHEATING APPLICATION [0002]

The following description relates to a cheating application identification method and system, and more particularly, to a cheating application identification method and system capable of determining whether or not a cheating application is an application based on an application component, And a computer program stored on a computer readable recording medium for executing the identification method.

A cheating application that changes the behavior of an application is intended to hide the execution of a cheating application from the system, so that it can be created and edited in a wide variety of versions or versions, Is being distributed.

A technique for identifying such a cheating application is to extract a hash value of executable files included in a previously detected cheating application, extract a hash value for executable files for an identification target application, which is an application to be identified, There is a method of comparing the hash values. For example, Korean Patent Registration No. 10-1628837 relates to a method and system for detecting a malicious application or a malicious web site. The malicious application or malicious web site is detected by using a hash value of an executable file among related information of the application. , It is judged again whether or not the malicious information is used by using the hash value of the library file in the resource file of the signature information.

However, in order to compare the hash values of all the applications installed in the system with the hash values of the cheating application in such conventional technologies, it is necessary to check the contents of all the executable files of all the applications, There is a problem that it takes a lot of time because the hash value of the files must be generated and the contents of the executable files must be checked.

In addition, when the cheating application includes the same function but includes only the changed executable file, there is a problem that the cheating application can not be identified because the hash value is changed.

A cheating application identification method and system capable of detecting a cheating application using specific components of an application, and a computer program stored in a computer-readable recording medium for executing a cheating application identification method in combination with the computer device.

A computer program stored in a computer readable recording medium for executing a cheating application identification method in combination with a computer, the method comprising: analyzing an identification target application to identify whether or not a cheating application is included, Extracting a URI scheme (Uniform Resource Identifier scheme); Requesting an operating system of the computer in which the identification target application is installed processing of an interaction using the extracted URI scheme; And identifying, as a cheating application, the identification target application when processing of the interaction is proceeding.

Analyzing an identification target application to identify whether or not the application is a cheating application, and extracting a URI scheme (Uniform Resource Identifier scheme) included in the identification target application; Requesting an operating system of a computer in which the identification target application is installed to perform an interaction process using the extracted URI scheme; And identifying, as a cheating application, the identification target application when the processing of the interaction is proceeding.

And a program for causing the computer to execute the cheating application identification method is recorded in the computer-readable recording medium.

You can use the specific components of your application to detect the cheating application. For example, a cheating application can identify a new version of a cheating application that has changed some content by detecting the cheating application with a particular component that is unlikely to change or is unlikely to change to provide the same functionality .

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention.
2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention.
FIG. 3 is a flowchart illustrating an example of a method of identifying an application by interacting with a system in an embodiment of the present invention.
FIG. 4 is a diagram illustrating an example of identifying an application by interacting with a system according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 5 is a flowchart illustrating a method of identifying a cheating application according to whether an application to be identified exists in a process file or a list, according to an exemplary embodiment of the present invention.
6 is a flowchart illustrating an example of a method for identifying a cheating application through a file name and / or a storage path of a specific file, according to an embodiment of the present invention.
7 is a diagram illustrating an example of a method of identifying a cheating application using a hash value in an embodiment of the present invention.
8 is a flow diagram illustrating an example of a method for identifying a cheating application based on a package identifier, in an embodiment of the present invention.
9 is a diagram showing an example of an Android APK file in an embodiment of the present invention.
10 is a diagram showing an example of an iOS IPA file in an embodiment of the present invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

The cheating application identification method according to embodiments of the present invention can be implemented through an electronic device or a server to be described later, and a cheating application identification method according to embodiments of the present invention can be performed through such an electronic device or server have. For example, an application implemented as a computer program according to an embodiment of the present invention may be installed and driven in an electronic device, and the electronic device may determine whether the identified application is a cheating application according to control of the driven application have. The computer program may be stored on a computer readable recording medium in combination with an electronic device to execute a cheating application identification method. In another embodiment, the server may determine whether the identification target application is a cheating application according to the control of the application described above. For example, the electronic device can check whether or not each application installed in the system is a cheating application as an identification target application. As another example, the server can check whether or not each application installed in the electronic device is a cheating application as an identification target application. As another example, the server may determine whether a specific application installed on the server is a cheating application as an identification target application.

1 is a diagram illustrating an example of a network environment according to an embodiment of the present invention. 1 shows an example in which a plurality of electronic devices 110, 120, 130, 140, a plurality of servers 150, 160, and a network 170 are included. 1, the number of electronic devices and the number of servers are not limited to those shown in FIG.

The plurality of electronic devices 110, 120, 130, 140 may be a fixed terminal implemented as a computer device or a mobile terminal. Examples of the plurality of electronic devices 110, 120, 130 and 140 include a smart phone, a mobile phone, a navigation device, a computer, a notebook, a digital broadcast terminal, a PDA (Personal Digital Assistants) ), And tablet PCs. For example, although FIG. 1 illustrates the shape of a smartphone as an example of the electronic device 110, in embodiments of the present invention, other electronic devices 120 (for example, , 130, 140) and / or servers 150, 160. In addition,

The communication method is not limited, and may include a communication method using a communication network (for example, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) that the network 170 may include, as well as a short-range wireless communication between the devices. For example, the network 170 may be a personal area network (LAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN) , A network such as the Internet, and the like. The network 170 may also include any one or more of a network topology including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree or a hierarchical network, It is not limited.

Each of the servers 150 and 160 is a computer device or a plurality of computers that communicate with a plurality of electronic devices 110, 120, 130 and 140 through a network 170 to provide commands, codes, files, Lt; / RTI > devices. For example, the server 150 may be a system that provides a first service to a plurality of electronic devices 110, 120, 130, 140 connected through a network 170, 170, and 140 to the first and second electronic devices 110, 120, 130, and 140, respectively. More specifically, the server 160 provides an installation file (for example, an application package file) for installation of an application (computer program) as a second service to a plurality of electronic devices 110, 120, 130 and 140 Lt; / RTI > In addition, the server 150 may provide a service to the plurality of electronic devices 110, 120, 130, and 140 as a first service to confirm whether or not the application is a cheating application. These services are only one embodiment for describing the network environment, and in reality, the services provided by each of the servers 150 and 160 in the network environment may vary widely.

2 is a block diagram illustrating an internal configuration of an electronic device and a server according to an embodiment of the present invention. . 2 illustrates an internal configuration of the electronic device 1 (110) and the server 150 as an example of the electronic device. Other electronic devices 120, 130, 140 and server 160 may also have the same or similar internal configuration as electronic device 1 110 or server 150 described above.

The electronic device 1 110 and the server 150 may include memories 211 and 221, processors 212 and 222, communication modules 213 and 223 and input / output interfaces 214 and 224. The memories 211 and 221 may be a computer-readable recording medium and may include a permanent mass storage device such as a random access memory (RAM), a read only memory (ROM), and a disk drive. The non-decaying mass storage device such as a ROM and a disk drive may be included in the electronic device 110 or the server 150 as a separate persistent storage device different from the memory 211 or 221. The memory 211 and the memory 221 are provided with an operating system and at least one program code (for example, a program installed in the electronic device 1 (110) and used for a browser or an application installed in the electronic device 1 Code) can be stored. These software components may be loaded from a computer readable recording medium separate from the memories 211 and 221. [ Such a computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD / CD-ROM drive, and a memory card. In other embodiments, the software components may be loaded into memory 211, 221 via communication modules 213, 223 rather than a computer readable recording medium. For example, at least one program is a program (e.g., a program) installed by files provided by a file distribution system (e.g., server 150) that distributes installation files of developers or applications via network 170 May be loaded into the memory 211, 221 based on the above-described application.

Processors 212 and 222 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input / output operations. The instructions may be provided to the processors 212 and 222 by the memories 211 and 221 or the communication modules 213 and 223. For example, the processor 212, 222 may be configured to execute a command received in accordance with a program code stored in a recording device, such as the memory 211, 221.

The communication modules 213 and 223 may provide functions for the electronic device 1 110 and the server 150 to communicate with each other through the network 170 and may be provided to the electronic device 1 110 and / May provide a function for communicating with another electronic device (e.g., electronic device 2 120) or another server (e.g., server 160). The request generated by the processor 212 of the electronic device 1 110 according to the program code stored in the recording device such as the memory 211 is transmitted to the server 170 via the network 170 under the control of the communication module 213 150 < / RTI > Conversely, control signals, commands, contents, files, and the like provided under the control of the processor 222 of the server 150 are transmitted to the communication module 223 of the electronic device 110 via the communication module 223 and the network 170 213 to the electronic device 1 (110). For example, control signals, commands, contents, files, and the like of the server 150 received through the communication module 213 can be transmitted to the processor 212 or the memory 211, (The above-mentioned persistent storage device), which may further include a storage medium 110.

The input / output interface 214 may be a means for interfacing with the input / output device 215. For example, the input device may include a device such as a keyboard or a mouse, and the output device may include a device such as a display. As another example, the input / output interface 214 may be a means for interfacing with a device having integrated functions for input and output, such as a touch screen. The input / output device 215 may be composed of the electronic device 1 (110) and one device. The input / output interface 224 of the server 150 may be a means for interfacing with the server 150 or an interface with a device (not shown) for input or output that the server 150 may include. More specifically, the processor 212 of the electronic device 1 (110) uses the data provided by the server 150 or the electronic device 2 (120) in processing commands of the computer program loaded in the memory 211 A service screen or contents can be displayed on the display through the input / output interface 214. [

Also, in other embodiments, electronic device 1 110 and server 150 may include more components than the components of FIG. However, there is no need to clearly illustrate most prior art components. For example, electronic device 1 110 may be implemented to include at least a portion of input / output devices 215 described above, or may be implemented with other components such as a transceiver, Global Positioning System (GPS) module, camera, Elements. More specifically, when the electronic device 1 (110) is a smart phone, the acceleration sensor, the gyro sensor, the camera module, various physical buttons, buttons using a touch panel, input / output ports, A vibrator, and the like may be further included in the electronic device 1 (110).

FIG. 3 is a flowchart illustrating an example of a method of identifying an application by interacting with a system in an embodiment of the present invention. The cheating application identification method according to the present embodiment can be performed by a computer apparatus such as the electronic apparatus 1 (110) or the server 150 described above. In this embodiment, a process of performing the cheating application identification method by the electronic device 110 will be described. The processor 212 of the electronic device 1 110 may be implemented to execute a control instruction according to a code of an operating system included in the memory 211 or a code of at least one computer program. Here, the processor 212 determines whether or not the electronic device 1 (110) is performing steps (310 to 330) included in the cheating application identification method according to the embodiment of FIG. 3 according to the control command provided by the code stored in the electronic device 1 ) Of the electronic device 1 (110).

In step 310, the electronic device 110 analyzes the identification target application to identify whether the application is a cheating application, and extracts a URI scheme (Uniform Resource Identifier scheme) included in the identification target application. A URI is a unique address that represents a resource in a computer network, such as the Internet, and provides location information for a particular resource. For example, when the electronic device 1 (110) opens a link to a specific URI, the resource (HTML document, image, etc.) corresponding to the URI is found and downloaded. At this time, a URI scheme can be utilized as information identifying the type of downloaded resource and how to handle it. For example, the "http" of the URI "http://www.naver.com" or "ftp" of "ftp://file.mycompany.com" may be a URI scheme. On the other hand, there is a URI scheme that can be defined by the user, such as a custom URI scheme. For example, a user may define and use a custom URI scheme, such as "lineapp" in "lineapp: //" or "com.linecorp.game" in "com.linecorp.game://". The electronic device 1 (110) can identify and extract the URI scheme included in the identification target application.

In step 320, the electronic device 110 may request the operating system of the computer on which the identification target application is installed to process the interaction using the extracted URI scheme. Here, the computer can correspond to the electronic device 1 (110). In another embodiment, when the server 150 wants to identify whether or not the identification target application installed in the electronic device 1 110 is a cheating application, the computer can be the electronic device 1 (110), and the server 150 In the case where it is desired to identify whether or not a cheating application of an identification target application installed in the server 150 is a computer, the computer 150 may be a server.

In one embodiment, the operating system may include an Android operating system or an iOS operating system. In this case, the electronic device 1 (110) determines whether the identification target application requests the Android OS to process the Intent using the URI scheme or the open possibility of the URL (uniform resource locator) corresponding to the URI scheme You can request processing from the iOS operating system. As a more specific example, in the case of the Android operating system, the electronic device 110 may request the processing of the intent for the extracted URI scheme, such as "Intent (Intent.ACTION_VIEW," lineapp: //) In the case of the iOS operating system, electronic device 110 may request processing of the open possibility of a URL containing an extracted URI scheme such as "canOpenURL:" lineapp: //.

In step 330, when the processing of the interaction proceeds, the electronic device 1 (110) can identify the identification target application as a cheating application. As described above, the electronic device 1 (110) can interpret that the process of interaction is proceeding as the identification target application interacts with the operating system, and the interaction with the operating device itself can be judged as the existence of the cheating application. In other words, the electronic device 1 (110) can identify the identification target application that interacts with the operating system as a cheating application.

In another embodiment, the electronic device 1 (110) can identify the identification target application as a cheating application when the identification target application is an application for processing an intent containing a specific request in the Android operating system. For example, as in the above example, when the identification target application requests the Android operating system to process the intent using the URI scheme such as "Intent (Intent.ACTION_VIEW," lineapp: //) (110) can identify the identified application as a cheating application.

In another embodiment, the electronic device 1 (110) can identify the identification target application as a cheating application when the identification target application is an application for processing a URL containing a specific request in the iOS operating system. For example, when the identification target application requests URL processing using a URI scheme such as [[UIApplication sharedApplication] canOpenURL: "lineapp: //"], the electronic device 1 110 identifies the identification target application as a cheating application can do.

In other words, as in the embodiment of FIG. 3, the processing of the request of the processing of the interaction using the extracted URI scheme itself may be judged as a condition of the cheating application, and the operating system may be provided with an intent or URL Can be judged as a condition of the cheating application.

As described above, in the above-described embodiments, it is possible to determine whether the application is a cheating application based on a specific component of the application such as a URL scheme, rather than the entire execution file. Interactions with the operating system using these specific components can detect new versions of the cheating application as they are detectable even with some changes to the contents of the cheating application.

FIG. 4 is a diagram illustrating an example of identifying an application by interacting with a system according to an exemplary embodiment of the present invention. Referring to FIG. 4 shows an example in which the electronic device 1 110 analyzes the package file 410 of the identification target application and extracts the URI scheme 420 and requests the intent or URL processing using the extracted URI scheme 420 Respectively. At this time, when the operating system directly processes such a request, it can be confirmed that a package and / or an application corresponding to the corresponding scheme exists. If such an operation occurs, it can be determined that the identification target application is a cheating application.

In addition, as described above, the identification target application may be identified as a cheating application by the action itself of requesting the processing of the intent or the URL described above. This identification can be made by checking whether the identification target application includes a code for the above-mentioned request.

Also, the electronic device 1 (110) may analyze the extracted URI scheme and determine a package identifier corresponding to the extracted URI scheme. For example, based on "lineapp" in "lineapp: //" and "com.linecorp.game" in "com.linecorp.game://", you would use {"com.linecorp.app", "com.linecorp. game "}. < / RTI > At this time, the electronic device 1 (110) may compare the package identifier returned from the operating system with the determined package identifier in response to the interaction process, thereby identifying the application to be cheated.

FIG. 5 is a flowchart illustrating a method of identifying a cheating application according to whether an application to be identified exists in a process file or a list, according to an exemplary embodiment of the present invention.

The electronic device 1 110 in step 510 may store the previously identified process information in association with the previously identified cheating application in the same operating system as the operating system of the electronic device 1 110 as the previously identified cheating application runs .

In step 520, the electronic device 1 (110) may analyze a file or a list indicating process information of the operating system. For example, for a previously identified cheating application, information about processes in the 'proc' file of Android can be managed and electronic device 1 110 can store such process information. Thereafter, the electronic device 1 (110) analyzes a file or a list indicating the process information of the operating system of the electronic device 110 (110) when attempting a cheating application, and stores the stored process information in the analyzed file or list You can check if you are.

In step 530, the electronic device 110 may identify the application corresponding to the process information stored in the file or list as a cheating application, if the process information stored in the file or list is included.

In this way, the electronic device 1 (110) can identify the cheating application based on the process information in the same operating system in this embodiment. Such process information can also be utilized as a specific component of an application.

The steps 510 to 530 of the cheating application identification method according to the embodiment of FIG. 5 may be performed in parallel with the preceding embodiments, or may be performed independently. For example, the embodiments described above, the embodiment of FIG. 5, and the embodiments to be described later may be performed independently of each other, but may be performed in parallel. For example, electronic device 1 110 may perform a plurality of different embodiments in parallel, so that if a particular application identifies a cheating application through at least one of the multiple embodiments, It can be finally determined as a cheating application. As another example, the electronic device 110 may perform a plurality of different embodiments in parallel, so that if a particular application identifies a cheating application through at least two of the plurality of embodiments, It can finally make the decision as an application.

As already described, embodiments of the present invention may identify a cheating application based on a particular component of an application. At this time, there are components in which a new version of the cheating application for providing the same function is not included in the category of changeable content, and some components are included in the category of changeable content. Accordingly, it should be understood that the present invention may be practiced by combining two or more of the plurality of embodiments that are presented in consideration of the possibility of not identifying a new version of the cheating application according to the components specified in at least one embodiment of the present invention It is possible. As in the embodiment of FIG. 3, embodiments that utilize components that are independent of changes in a particular content may be performed independently.

In another embodiment, the electronic device 1 (110) can identify the identification target application as a cheating application when the storage path of the file associated with the identification target application includes information for identification of another application installed in the computer. For example, when installing an application in the electronic device 1 (110), there is a unique file location used by the application. For example, there is a default storage path such as "/sdcard/Android/data/com.google.android.music/cache". At this time, the electronic device 1 (110) can extract information for identifying another application such as " com.goole.android.music "in the storage path. At this time, the electronic device 1 (110) can determine that the file associated with the identification target application is stored in the storage path of another application, not the storage path for the identification target application. In this case, the electronic device 1 (110) can identify the identification target application as a cheating application.

6 is a flowchart illustrating an example of a method for identifying a cheating application through a file name and / or a storage path of a specific file, according to an embodiment of the present invention.

In step 610, the first electronic device 110 may store a file name or a storage path of the selected file among the files included in the previously identified cheating application.

In step 620, the electronic device 1 (110) can check whether a file name or a file corresponding to the storage path exists among the files included in the identification target application.

In step 630, the electronic device 1 (110) can identify the application to be identified as a cheating application when there is a file corresponding to the stored file name or storage path.

As described above, in the cheating application identification method according to the present embodiment, the electronic device 1 (110) can identify the application having the same file name or storage path as the file name or storage path of the specific file included in the identified cheating application as a cheating application have. For example, specific file names and / or storage paths that are associated with the cheating application, such as file names such as "gamehacker.png", "HelloWorld.png", or "/ system / xbin / .

At this time, the file name and the storage path of the specific file included in the identified application can be selected so as to maximize the uniqueness of only the cheating application. As described above, the present embodiment may be performed in parallel with one of the other embodiments in consideration of the case where the uniqueness is not corrected only by the file name and the storage path. For example, when the embodiment of FIG. 3 and the present embodiment are performed together to determine that the identification target application is identified as a cheating application in both embodiments, the electronic device 110 can finally determine the identification target application as a cheating application have.

Alternatively, the embodiment of FIG. 6 may be performed independently. In this case, the electronic device 1 (110) can identify the identification target application as a cheating application when the corresponding file includes the cheating function in the step 630 and the cheating function is included in the corresponding file. In other words, after a specific file is first selected through a file name or a storage path, it is determined whether the selected specific file includes a cheating function (for example, a rooting function) have.

In addition, the file name of the file selected in the embodiment of FIG. 6 may include the file name of the file that the identified cheating application executes during the operation. In addition, the storage path of the selected file may include a storage path of the generated file to be used by the operating system according to the installation of the identified cheating application.

7 is a diagram illustrating an example of a method of identifying a cheating application using a hash value in an embodiment of the present invention.

In step 710, the electronic device 110 updates the first hash value of a predefined one of the files included in the pre-identified cheating application or a predetermined hash value of some items among the items included in the first file Can be generated and stored.

In step 720, the first electronic device 110 generates a second hash value for a predetermined item among the items included in the second file of the predetermined type or the second file of the files included in the identification target application can do.

In step 730, the electronic device 1 (110) compares the first hash value with the second hash value and identifies the identified application as a cheating application if they are identical to each other.

As described above, the hash value of the executable file of the cheating application identified in the prior art is generated, and the hash values of all the executable files of the identification target application are generated in order to compare the identification target application. On the other hand, in the embodiment of FIG. 7, the type of the file to generate the hash value can be determined in advance. For example, the first file and the second file of the predetermined types are executable and linking format (ELF) files, executable Mach-O (Mach Object) files, executable PE (Portable Executable) And may include at least one file. If the predetermined type of file is an ELF file, the electronic device 1 (110) generates the hash value only for the ELF file among the executable files of the identification target application, thereby greatly reducing the time required for generating the hash value have. Alternatively, a hash value may be generated using only a specific item of a specific kind of file. For example, some predetermined items may include a header of a certain kind of file. In other words, the electronic device 1 (110) can generate a hash value by checking only the header of the ELF file. Therefore, the time required for generating the hash value can be further reduced. The compressed file can contain a 'ZIP' file.

8 is a flow diagram illustrating an example of a method for identifying a cheating application based on a package identifier, in an embodiment of the present invention.

In step 810, electronic device 1 110 may store the package identifier of the identified cheating application. Such a package identifier may include a package name or a bundle ID.

In step 820, the electronic device 1 (110) can identify the first application as a cheating application when a first application having the same package identifier as the stored package identifier is installed in the computer in association with the operating system.

As described above, the electronic device 1 (110) can determine whether or not the identification target application is a cheating application by utilizing the package identifier as a specific component of the identification target application. This embodiment can also be implemented in parallel with at least one of the other embodiments described above.

FIG. 9 is a diagram illustrating an example of an Android APK file in an embodiment of the present invention, and FIG. 10 is a diagram illustrating an example of an iOS IPA file in an embodiment of the present invention. As shown in the first dashed box 910 in Fig. 9 and the second dashed box 1010 in Fig. 10, it can be seen that the package of the application contains a file with a specific file name "HelloWorld.png ". As described in the embodiment of FIG. 6, the electronic device 1 (110) can identify a cheating application by utilizing a specific file name or storage path identified through the identified cheating application as a specific component of the application. The application corresponding to the Android APK file of Fig. 9 and the application corresponding to the iOS IPA file of Fig. 10 can be identified as a cheating application according to the embodiment of Fig.

As already mentioned, certain components used in some embodiments may not guarantee uniqueness for a cheating application. For this occasion, it has already been described in detail that two or more embodiments can proceed in parallel.

As described above, according to the embodiments of the present invention, a cheating application can be detected using a specific component of an application. For example, a cheating application can identify a new version of a cheating application that has changed some content by detecting the cheating application with a particular component that is unlikely to change or is unlikely to change to provide the same functionality .

The system or apparatus described above may be implemented as a hardware component, a software component or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be embodyed temporarily. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (20)

A computer program stored on a computer-readable medium for executing a cheating application identification method in combination with the computer,
The cheating application identification method comprises:
Analyzing an identification target application to identify whether or not the application is a cheating application, and extracting a URI scheme (Uniform Resource Identifier scheme) included in the identification target application;
Requesting an operating system of the computer in which the identification target application is installed processing of an interaction using the extracted URI scheme; And
Identifying the identified target application as a cheating application when processing of the interaction proceeds;
And a computer program product. The method according to claim 1,
The cheating application identification method includes:
Analyzing the extracted URI scheme to determine a package identifier corresponding to the extracted URI scheme; And
Identifying an application to be cheered by comparing a package identifier returned from the operating system with the determined package identifier in response to the interaction process
≪ / RTI > The method according to claim 1,
The operating system includes an Android operating system or an iOS operating system,
The cheating application identification method comprises:
The identification target application requests the Android operating system to process an Intent using the URI scheme or requests the iOS operating system to process open possibility for a URL (uniform resource locator) corresponding to the URI scheme , Identifying the identification target application as a cheating application
≪ / RTI > The method according to claim 1,
The cheating application identification method comprises:
Storing the previously identified process information in association with the previously identified cheating application in the same operating system as the operating system as the previously identified cheating application is running;
Analyzing a file or a list indicating process information of the operating system; And
Identifying the application corresponding to the stored process information in the file or list as a cheating application if the file or list contains the stored process information;
≪ / RTI > The method according to claim 1,
The cheating application identification method comprises:
Identifying, as a cheating application, the identification target application when the storage path of the file associated with the identification target application includes information for identifying another application installed in the computer
≪ / RTI > The method according to claim 1,
The cheating application identification method comprises:
Storing a file name or a storage path of a selected file among files included in the identified cheating application;
Checking whether a file corresponding to the stored file name or the storage path exists among the files included in the identification target application; And
Identifying the identification target application as a cheating application when a file corresponding to the stored file name or storage path exists;
≪ / RTI > The method according to claim 6,
Identifying the application to be identified as a cheating application when the file corresponding to the stored file name or storage path exists,
And identifies the identification target application as a cheating application when it is determined that the corresponding file includes the cheating function and the cheating function is included in the corresponding file. The method according to claim 6,
Wherein the file name of the selected file includes a file name of a file to be executed while the identified cheating application is running,
Wherein the storage path of the selected file includes a storage path of a file created for use by the operating system according to installation of the previously identified cheating application. The method according to claim 1,
The cheating application identification method includes:
Generating and storing a first hash value for a predetermined one of the first file selected among the files included in the previously identified cheating application or the items included in the selected first file;
Generating a second hash value for a predetermined part of the items included in the selected second file or the selected second file among the files included in the identification target application; And
Comparing the first hash value with the second hash value to identify the identified application as a cheating application
≪ / RTI > 10. The method of claim 9,
The first file and the second file of the preset types are each composed of at least one of an executable and linking format (ELF) file, an executable Mach-O (Mach Object) file, an executable PE (Portable Executable) File,
And the predetermined item includes a header of the at least one file. The method according to claim 1,
The cheating application identification method includes:
Storing a package identifier of a previously identified cheating application; And
Identifying a first application as a cheating application when a first application having the same package identifier as the stored package identifier is installed in the computer in association with the operating system;
≪ / RTI > Analyzing an identification target application to identify whether or not the application is a cheating application, and extracting a URI scheme (Uniform Resource Identifier scheme) included in the identification target application;
Requesting an operating system of a computer in which the identification target application is installed to perform an interaction process using the extracted URI scheme; And
Identifying the identified target application as a cheating application when processing of the interaction proceeds;
The method comprising the steps of: 13. The method of claim 12,
Analyzing the extracted URI scheme to determine a package identifier corresponding to the extracted URI scheme; And
Identifying an application to be cheered by comparing a package identifier returned from the operating system with the determined package identifier in response to the interaction process
≪ / RTI > 13. The method of claim 12,
The operating system includes an Android operating system or an iOS operating system,
The identification target application requests the Android operating system to process an Intent using the URI scheme or requests the iOS operating system to process open possibility for a URL (uniform resource locator) corresponding to the URI scheme , Identifying the identification target application as a cheating application
≪ / RTI > 13. The method of claim 12,
Storing the previously identified process information in association with the previously identified cheating application in the same operating system as the operating system as the previously identified cheating application is running;
Analyzing a file or a list indicating process information of the operating system; And
Identifying the application corresponding to the stored process information in the file or list as a cheating application if the file or list contains the stored process information;
≪ / RTI > 13. The method of claim 12,
Identifying, as a cheating application, the identification target application when the storage path of the file associated with the identification target application includes information for identifying another application installed in the computer
≪ / RTI > 13. The method of claim 12,
Storing a file name or a storage path of a selected file among files included in the identified cheating application;
Checking whether a file corresponding to the stored file name or the storage path exists among the files included in the identification target application; And
Identifying the identification target application as a cheating application when a file corresponding to the stored file name or storage path exists;
≪ / RTI > 13. The method of claim 12,
Generating and storing a first hash value for a predetermined one of the first file selected among the files included in the previously identified cheating application or the items included in the selected first file;
Generating a second hash value for a predetermined part of the items included in the selected second file or the selected second file among the files included in the identification target application; And
Comparing the first hash value with the second hash value to identify the identified application as a cheating application
≪ / RTI > 13. The method of claim 12,
Storing a package identifier of a previously identified cheating application; And
Identifying a first application as a cheating application when a first application having the same package identifier as the stored package identifier is installed in the computer in association with the operating system;
≪ / RTI > A computer-readable recording medium having recorded thereon a program for causing a computer to execute the method according to any one of claims 12 to 19.

Images