CN105512558A - Android advertisement plug-in detection method based on characteristic of decompilation module - Google Patents

Abstract

The invention discloses an android advertisement plug-in detection method based on a characteristic of a decompilation module, which comprises the following steps: first, collecting sample android applications of an advertisement plug-in and decompiling the sample android applications to form a Java file; carrying out modular decomposition by taking a second level package of the Java file as the demarcation point; marking all modules as an advertisement plug-in module and a non-advertisement plug-in module; then, extracting a words count characteristic sequence of every module to form a module set; establishing a mapping vector so that elements in the module set can be mapped into a characteristic space vector S; inputting the characteristic space vector S into a classifier to learn and train the classifier so that the detection modules are automatically classified into two classes; and finally, detecting an advertisement plug-in of an unknown application sample by utilizing the trained classifier. The android advertisement plug-in detection method has the advantages of simplifying the module division process, improving the module division efficiency, detecting a large amount of mobile application programs in short time and realizing fast detection of the advertisement plug-in contained in mobile applications.

Description

A kind of android ad plug-in detection method based on decompiling modular character

Technical field

The invention belongs to mobile application security field, relate to the detection of Mobile solution ad plug-in, specifically a kind of android ad plug-in detection method based on decompiling modular character.

Background technology

In recent years, along with the fast development of mobile Internet industry, aspects such as and the high speed of mobile intelligent terminal is popularized, causing Mobile solution to be innovated constantly, Mobile solution content covered navigation, reading, weather, education, fashion, shopping, social activity, pay, call a taxi.

Because user is to the heavy demand of Mobile solution, cause current business model to embed advertisement by Mobile solution, and by advertisement be divided into obtain income have a great vogue.Along with the industry size of Mobile solution advertisement constantly expands, the security risk that Mobile solution advertisement faces highlights day by day.The safety problems such as traffic consumes, malice is deducted fees, privacy is stolen, hinder developing of Mobile solution advertising sector.

Mobile Internet develops into now, major part Mobile solution adopts the mode of free download, to attract user, set up ad distribution channel, realize the backward charge of internet type, import advertising display by customer flow, the backward charge profit model collecting respective advertisement expense to advertiser obtains the extensive support in market, be one of most important marketing methods in current mobile Internet market, have huge user base and development space.And to provide content and service to be difficult to promote to the forward direction charging mode that user collects the charges;

The quick growth in moving advertising market causes domesticly emerging hundred moving advertising platforms, and these advertising platforms are not of uniform size, very different, mainly rely on integrated ad plug-in in Mobile solution, collect the displaying expense of advertiser; But the industry standard that the ad plug-in that they provide is ununified, brings certain risk and hidden danger to mobile security; Therefore the ad plug-in contained in necessary detection Android software.

At present, the SDK (SoftwareDevelopmentKit) of ad plug-in wraps the person of being developed and imports in application package, so In the view of developer, without the specific implementation of concern ad plug-in unit, only need be configured as requested, and ad plug-in and application function are separated completely, equally, application can also import other plug-in unit as required, as game plug-in unit, pay plug and some other service plug (map plug-in unit).The function of these plug-in units and design are all separate with the function of application itself, so can consider modular thought in the process detecting plug-in unit, the global feature of extraction module detects.

Propose in document " the automatic detection based on the Android ad plug-in of semantic analysis ": Module Division also detects ad plug-in in conjunction with semantic analysis, in this module partition method, routine package name entirety is divided, then the independence analyzed between modules divides plug-in unit, finally obtain the feature in modules, although the method can mutual relationship between comparatively accurate acquisition module, and realize the decomposition of module, but this method consumes a large amount of calculating, affect efficiency, a large amount of application program efficiency is detected for reality lower.

Summary of the invention

The present invention is directed to the existing method short time, to detect a large amount of mobile applications efficiency lower, can not realize detecting the ad plug-in comprised in Mobile solution fast, propose a kind of android ad plug-in detection method based on decompiling modular character.

Concrete steps are as follows:

The sample Android that step one, collection have ad plug-in applies, and decompiles into Java file to each sample Android application;

Step 2, scanning record all bag name paths of Java file, be called separation with secondary packet, carries out decomposition module to each sample Android application;

Apply for each sample Android, be called separation with secondary packet, will have identical one, the APMB package of secondary packet name is planned in same module, is the individual different module of m by each sample Android application decomposition; M determines according to application size, is integer;

Step 3, modules for each sample Android application decomposition, by whether containing ad plug-in bag name, be labeled as ad plug-in module and non-ad plug-in module respectively.

Step 4, extract each sample Android apply in the word number feature of modules, obtain the characteristic sequence of each module.

For each module, travel through the content in all Java files, by the symbol filtering of the non-letters such as punctuate wherein, space, do not add up dittograph, only different word numbers is added up, obtain the unique word Number Sequence comprised in the Java code of respective modules, the Serial No. obtained is namely as the modular character of respective modules.

Step 5, the characteristic sequence comprising modules set of m module that each sample Android is applied.

The Serial No. of each module is as the element of in module collection.

Step 6, structure map vector and are all mapped to by the element in module collection in feature space vector S;

Feature space vector S comprises two set: module collection and testing result set; Each module characteristic of correspondence Serial No. is as the element in module collection; The corresponding mapping result of each module: what the feature numeral sequence pair being labeled as ad plug-in module was answered is mapped as 1; What the feature numeral sequence pair being labeled as non-ad plug-in module was answered is mapped as 0, and all mapping result are kept in testing result set.

Step 7, feature space vector S is input to sorter, learning training is carried out to sorter, realizes automatically carrying out two classification to detection module.

KNN algorithm is adopted to enter learning training to the ad plug-in module marked and non-ad plug-in module;

The sorter that step 8, utilization train, carries out the detection of ad plug-in to the application sample of the unknown;

First, Java file is decompiled into the application sample of the unknown; Then be called separation with the secondary packet of Java file, decomposition module is carried out to sample Android application;

Then, extract the word number feature of modules in unknown applications sample, obtain the modular character sequence that each module is corresponding.

Finally the characteristic sequence of unknown applications sample is input in the sorter trained and detects, if detect containing ad plug-in module, namely judge that this unknown sample contains ad plug-in.

The invention has the advantages that:

1, based on an android ad plug-in detection method for decompiling modular character, simplify the process of Module Division, improve the efficiency of Module Division.

2, based on an android ad plug-in detection method for decompiling modular character, eliminate the process extracting semantic feature in ad plug-in, simplify the process of feature extraction.

3, based on an android ad plug-in detection method for decompiling modular character, do not need to distinguish different SDK version, cover the version of all SDK.

4, based on an android ad plug-in detection method for decompiling modular character, for the application be confused, the method for statistics word number feature, the impact do not obscured.

5, a kind of android ad plug-in detection method based on decompiling modular character, the feature obtained then is not related to explanatory notes part, and method before, the feature of acquisition from the semantic feature of file internal, so accomplish the accurate acquisition of very accurate guarantee feature to the Module Division of file.

Accompanying drawing explanation

Fig. 1 is a kind of android ad plug-in detection method process flow diagram based on decompiling modular character of the present invention.

Embodiment

Below in conjunction with accompanying drawing, specific embodiment of the invention method is described in detail.

The method that a kind of android ad plug-in based on decompiling modular character of the present invention detects, have employed android decompiling analytical technology, dis-assembling ad plug-in is applied, adopt the thought of decomposition module, application moduleization is decomposed, (advertisement module is comprised to modules, non-advertisement module) carry out the extraction of modular character, by the classical KNN algorithm (k nearest neighbour classification algorithm) of machine learning, make ad plug-in detection system can detect the ad plug-in comprised in application, there is the advantage that can detect a large amount of Mobile solution the short time, with the meaning that the Mobile solution ad plug-in meeting market today demand detects fast.

As shown in Figure 1, concrete steps are as follows:

The sample Android that step one, collection have ad plug-in applies, and decompiles into Java file to each sample Android application;

Have collected 300 sample Android with ad plug-in in this enforcement altogether to apply, from GooglePlay official store and domestic third party store as pea pods, application treasured, mobile MM store etc.

For Android decompiling, utilize Java grammer to analyze, Android program (binary executable through compiling) is decompiled into Java code.The instrument Dex2jar instrument utilizing Google to issue, decompiles into Jar bag the DEX binary file in Android application program, then uses Jad instrument to decompile into Jar file bag for opening the Java file understood.

Step 2, scanning record all bag name paths of Java file, be called separation with secondary packet, carries out decomposition module to sample Android application;

The Java file that the whole decompiling of traverse scanning obtains, in the process of traverse scanning, records all bag name paths of overall Java file, can obtain overall APMB package according to bag name path.

Apply for each sample Android, be called separation with secondary packet, will have identical one, the APMB package of secondary packet name is planned in same module, with this standard by each sample Android application decomposition for the different module of m; M determines according to application size, is integer; Through decomposition module in this enforcement, obtain 2902 modular character data altogether.

By collecting the bag name of different ad plug-in in the present embodiment, obtain the bag name of 66 sections of Common Advertising plug-in units in android market altogether, form is as shown in table 1.Can be found by the bag name information in analytical table, the difference between different ad plug-in bag names, is embodied in the difference of secondary packet name.So decomposition module focus on secondary packet name, will have mutually same, belonging among same module of secondary packet name.

Table 1

Step 3, modules for each sample Android application decomposition, by whether containing ad plug-in bag name, be labeled as ad plug-in module and non-ad plug-in module respectively.

Android application is detected to the characteristic information usually needing to extract overall applicability, and in entirety, the information of non-ad plug-in part can cause interference to the information of ad plug-in part, affects the accuracy rate that ad plug-in detects.Utilizing the thought of decomposition module, is the ad plug-in module only comprising ad plug-in by the application decomposition of entirety, and does not comprise the non-ad plug-in module of ad plug-in; Then the characteristic information by extracting ad plug-in module carries out the detection of ad plug-in.

Being directed to modules, is ad plug-in module by the module definition containing ad plug-in bag name, and the module definition not containing ad plug-in bag name is non-ad plug-in module.

Such as: 4 ad plug-in modules contain 4 kinds of ad plug-in bags, are respectively: domob, adview, adwo, youmi.

Step 4, extract each sample Android apply in the word number feature of modules, obtain the modular character sequence that each module is corresponding.

After using the thought of decomposition module that all Java files have been carried out decomposition module, all modules are carried out to the extraction of modular character.The statistical treatment of word number is carried out for the Java code in each module.In the process of process, travel through the content in all Java files, by the symbol filtering of the non-letters such as punctuate wherein, space, and do not add up dittograph, only different word numbers is added up, obtain the unique word Number Sequence comprised in the Java code of respective modules, form is as shown in table 2, and table 2 shows part of module statistics in a sample application, and front 3 modules are ad plug-in module, on the books in Table 1, rear 6 modules are non-ad plug-in module; The Serial No. obtained is namely as the modular character of respective modules.

Table 2

Module	Word Number Sequence
		cn.domob	128 43 28 47 28 138 325 49 40 33 … 148 150 26 30
com.admob	112 31 203 48 42 36 305 72 45 267 … 48 70 294 63
		com.adsmogo	37 198 142 36 278 37 122 162 74 37 … 55 59 29 119
com.feedback	36 39 36 41 131 64 40 40 70 41 40 … 45 101 131 42
		com.iceberg	35 158 40 78 98 50 37 44 32 339 51 … 317 63 56 147
com.joboevan	27 30 53 34 33 68 36 37 33 58 61 … 103 142 345 118
		com.mobclick	191 48 61 46 35 211 68 43 59 39 24 77 … 186 31 27 28
com.suizong	117 199 104 30 30 46 48 38 139 86
		com.z	66 40 62 38 36 66 37 46 296 161 136 … 33 31 58 53

Step 5, the characteristic sequence comprising modules set of m module that each sample Android is applied.

The Serial No. of each module is as the element of in module collection.

Step 6, structure map vector and are mapped to by the characteristic sequence of each module in feature space vector S;

In order to realize the detection of ad plug-in, first needing training classifier, sorter being detected automatically and the module of detection is divided into ad plug-in module and non-ad plug-in module.

First define a feature space vector S, include two set in feature space vector S, one is module collection, and another is testing result set.Each module characteristic of correspondence Serial No. is as the element of in module collection; Each module is to there being a mapping result; Ad plug-in module feature numeral sequence pair answer be mapped as 1; Non-ad plug-in module feature numeral sequence pair answer be mapped as 0, all mapping result are kept in testing result set.

Step 7, feature space vector S is input to sorter, learning training is carried out to sorter, realizes automatically carrying out two classification to detection module.

Adopt machine learning KNN algorithm to carry out learning training, using the input of feature space vector S as sorter, by the learning training of the extensive sample of sorter, make sorter can carry out two classification to the module detected.

In actual experiment, 10 folding cross-validation methods are adopted by the learning training of the extensive sample of sorter, detailed process is as follows: the data in the module collection in step 5 are divided into 10 equal portions at random, wherein 1 part is retained the data of automatically carrying out the sorter of two classification as checking, other 9 parts are used for training, cross validation 10 times, every 1 part of checking 1 time, by revising the parameter in the process of training study, reach the effect of best detection ad plug-in.

The sorter that step 8, utilization train, carries out the detection of ad plug-in to the application sample of the unknown;

Utilize and succeeded in school the sorter that automatically can carry out two classification, ad plug-in detection is carried out to the application sample of the unknown, first, Java file is decompiled into the application sample of the unknown; Then be called separation with the secondary packet of Java file, decomposition module is carried out to sample Android application;

Then, extract the word number feature of modules in unknown applications sample, obtain the modular character sequence that each module is corresponding.

Finally the characteristic sequence of unknown applications sample is input in the sorter trained and detects, if detect containing ad plug-in module, namely judge that this unknown sample contains ad plug-in.By to detecting the judgement whether containing advertisement module in sample, realize the quick detection of sample application ad plug-in.

The present invention selects the evaluation index that machine learning classification algorithm is conventional: Precision, Recall, F-measure and FPR (rate of false alarm) evaluate the effect that the present invention carries out the sorter of two classification automatically;

The value of Precision represents the accuracy rate being judged to ad plug-in module, the value of Recall represents the accuracy rate that ad plug-in is detected, because data set is unbalanced, the effect of result to algorithm introducing next comprehensive Precision and the Recall of F-measure is assessed.

TP (TruePositive) is positive positive sample by model prediction, is called and is judged as genuine accuracy;

FP (FalsePositive) is positive negative sample by model prediction, is called rate of false alarm;

FN (FalseNegative) is negative positive sample by model prediction, can be called rate of failing to report.

Precision (positive sample predictions correct result number/be judged to positive sample number):

$\mathrm{Pr}ecision=\frac{TP}{TP+FP}$

Recall (positive sample predictions correct result number/positive sample actual number):

$\mathrm{Re}call=\frac{TP}{TP+FN}$

F-measure：

$F-measure=\frac{2*\mathrm{Pr}ecision*\mathrm{Re}call}{\mathrm{Pr}ecision+\mathrm{Re}call}$

Comprise two parts data in whole experiment: a part is that 300 sample Android with ad plug-in apply, after being used for extracting feature Serial No., train the sorter automatically carrying out two classification, sorter can be detected automatically and whether contain ad plug-in; Another part is the unknown application sample whether comprising ad plug-in, verifies whether comprise ad plug-in after the feature Serial No. of same extraction unknown applications sample to sorter;

The sorter automatically carrying out two classification utilizing KNN algorithm to obtain, 400 the application samples whether the unknown being comprised to ad plug-in detect, and the result detecting ad plug-in is as shown in table 3 below:

Table 3

Algorithm	Precision	Recall	F-measure
				KNN	0.996	0.914	0.953

As can be seen here, the sorter automatically carrying out two classification adopting KNN algorithm to obtain, when detecting ad plug-in, can reach the rate of precision of 99.6%.

The present invention is on the basis of bag name form summarizing 66 sections of Mobile solution ad plug-in, propose a kind of to divide secondary packet name, and do not analyze the method for the incidence relation between each bag, in the feature of binding modules, the accurate detection achieving ad plug-in of final efficiently and accurately, and save a large amount of analysis times.

Claims (5)

1., based on an android ad plug-in detection method for decompiling modular character, it is characterized in that, concrete steps are as follows:

The sample Android that step one, collection have ad plug-in applies, and decompiles into Java file to each sample Android application;

Step 2, scanning record all bag name paths of Java file, be called separation with secondary packet, carries out decomposition module to each sample Android application;

Apply for each sample Android, be called separation with secondary packet, will have identical one, the APMB package of secondary packet name is planned in same module, is the individual different module of m by each sample Android application decomposition; M determines according to application size, is integer;

Step 3, modules for each sample Android application decomposition, by whether containing ad plug-in bag name, be labeled as ad plug-in module and non-ad plug-in module respectively;

Step 4, extract each sample Android apply in the word number feature of modules, obtain the characteristic sequence of each module;

Step 5, the characteristic sequence comprising modules set of m module that each sample Android is applied;

The Serial No. of each module is as the element of in module collection;

Step 6, structure map vector and are all mapped to by the element in module collection in feature space vector S;

Step 7, feature space vector S is input to sorter, learning training is carried out to sorter, realizes automatically carrying out two classification to detection module;

KNN algorithm is adopted to enter learning training to the ad plug-in module marked and non-ad plug-in module;

The sorter that step 8, utilization train, carries out the detection of ad plug-in to the application sample of the unknown.

2. a kind of android ad plug-in detection method based on decompiling modular character as claimed in claim 1, it is characterized in that, described step one is specially: for Android decompiling, Java grammer is utilized to analyze, Android program is decompiled into Java code through the binary executable of compiling, utilize Dex2jar instrument, DEX binary file in Android application program is decompiled into Jar bag, and then Jar file bag is decompiled into the Java file for opening by use Jad instrument.

3. a kind of android ad plug-in detection method based on decompiling modular character as claimed in claim 1, it is characterized in that, described step 4 is specially: for each module, travel through the content in all Java files, by the symbol filtering of the non-letters such as punctuate wherein, space, do not add up dittograph, only different word numbers is added up, obtain the unique word Number Sequence comprised in the Java code of respective modules, the Serial No. obtained is namely as the modular character of respective modules.

4. a kind of android ad plug-in detection method based on decompiling modular character as claimed in claim 1, it is characterized in that, described step 6 is specially: feature space vector S comprises two set: module collection and testing result set; Each module characteristic of correspondence Serial No. is as the element in module collection; The corresponding mapping result of each module: what the feature numeral sequence pair being labeled as ad plug-in module was answered is mapped as 1; What the feature numeral sequence pair being labeled as non-ad plug-in module was answered is mapped as 0, and all mapping result are kept in testing result set.

5. a kind of android ad plug-in detection method based on decompiling modular character as claimed in claim 1, it is characterized in that, described step 8 is specially: first, decompiles into Java file to the application sample of the unknown; Then be called separation with the secondary packet of Java file, decomposition module is carried out to sample Android application;

Then, extract the word number feature of modules in unknown applications sample, obtain the modular character sequence that each module is corresponding;

Finally the characteristic sequence of unknown applications sample is input in the sorter trained and detects, if detect containing ad plug-in module, namely judge that this unknown sample contains ad plug-in.