KR20140030989A - Method of obtaining signature of apk files for android operating system, and computer-readable recording medium with apk file signature computing program for the same - Google Patents

Abstract

The present invention relates to a technique capable of effectively detecting a malicious code or a whitelist program in the Android operating system and, more specifically, to a technique capable of effectively detecting a malicious code or a whitelist program in the Android operating system as compared to the conventional mobile anti-virus product by extracting the signatures of an APK file quickly and accurately by using the characteristics of an Android application and the structure of a compressed file. According to the present invention, the unique signatures of a target application can be extracted rapidly and accurately by using the characteristics of an Android application and the structure of a compressed file without extracting a hash value for the whole application file to discriminate a malicious code or a whitelist program, thereby detecting polymorphic viruses while checking the malicious code or the whitelist program at 80 to 250 times faster than the prior art. [Reference numerals] (AA) Start; (BB) End; (S11) Identify an APK file extension; (S12) Request to check a malicious file; (S13) Start to analyze an APK file; (S14) Search the position of a classes.dex file; (S15) Search the unique information of the classes.dex file; (S16) Determine a malicious code(malicious/polymorphous) using the unique information of the classes.dex file as a first signature; (S17) Is the APK file determined as the malicious code using the first signature?; (S18,S23) Process the malicious code; (S19) Decompress a header(32byte) of the classes.dex file; (S20) Extract SHA-1 information(20byte) from the decompression released header(32byte); (S21) Determine a malicious code(malicious/polymorphous) using a hash value(SHA-1 information) of the classes.dex file as a second signature; (S22) Is the APK file determined as the malicious code using the second signature?; (S24) Check completed?

Description

How to extract the signature of the ASP file in the Android operating system, and the computer-readable recording medium for recording the ASP file signature extraction program for this purpose. PROGRAM FOR THE SAME}

The present invention relates to a technology that can effectively detect malware or whitelist programs in the Android operating system. More specifically, the present invention extracts the signature of the APK file using the characteristics of the Android application and the structure of the compressed file quickly and accurately to effectively detect malware or whitelist programs of the Android operating system compared to the mobile antivirus products of the prior art. It is about technology that can be.

Android operating system is widely used in mobile devices, but the security is very weak, malicious applications are increasing rapidly. However, the basic mobile malware detection and blocking program has a disadvantage that the scan rate is very slow and the structure cannot cope with polymorphic (variant) virus.

More specifically, as the prior art, Patent Application No. 10-2010-0004386 and Patent Application No. 10-2010-0020015 and the like are malicious applications as shown through the flowcharts of FIGS. 1 and 2. By extracting the hash value and comparing the hash value of the APK (Application PacKage) file pre-registered with the inspection engine, it is judged as malicious code or whitelist.

This prior art is a method of extracting the hash value of the APK file for the Android application to be examined and compares it with the hash value database of the malicious application already registered. In the prior art, since the hash value is extracted by reading the entire file in some cases, it takes a long time. In addition, the prior art has a disadvantage in that it is cumbersome to detect a polymorphic virus to be detected without registering a large number of signatures for individual polymorphism.

Accordingly, in the technical field, there is an urgent need for technology development that can effectively detect malicious codes and whitelist programs for applications of the Android operating system.

[Related Technical Literature]

1. Diagnosis method of malicious code and dangerous file on Android terminal platform (Patent Application No. 10-2010-0004386)

2. Malware detection device and method, recording medium recording program therefor (Patent Application No. 10-2010-0020015)

An object of the present invention is to provide a technology that can effectively detect malware or whitelist programs in the Android operating system. More specifically, an object of the present invention is to extract the signature of the APK file quickly and accurately by using the characteristics of the Android application and the structure of the compressed file to effectively remove malware or whitelist programs of the Android operating system compared to the mobile antivirus products of the prior art. It is to provide a technology that can be detected.

The present invention for achieving the above object is a signature extraction method of the APK file for detecting malicious or variant applications on the Android operating system, the first step of analyzing the APK file to search the location of the classes.dex file data in the APK file ; A second step of acquiring classes.dex file peculiar information from the retrieved classes.dex file data; A third step of determining whether the APK file is a malicious code by setting the acquired classes.dex file unique information as a primary signature; And a fourth step of performing a predetermined malicious code process when it is determined that the malicious code is determined as the primary signature.

In addition, the present invention includes a fifth step of identifying a header area in the above-described classes.dex file data; A sixth step of decompressing the identified classes.dex header area; A seventh step of obtaining a hash value according to the field format from the decompressed classes.dex header area; An eighth step of determining whether the APK file is a malicious code by setting the obtained hash value as a secondary signature; If it is determined that the malicious code is determined as the secondary signature, the ninth step of performing a predetermined malicious code processing may be further included.

Meanwhile, in the present invention, the unique information of the classes.dex file includes one or more of CRC information, pre-compression file size information of the APK file, and post-compression file size information, and the classes.dex header area after decompression 32 bytes of the front end of the .dex file data, and the hash value may be configured to include a SHA-1 value corresponding to 20 bytes of the rear end of the classes.dex header area.

On the other hand, the computer-readable recording medium according to the present invention records the APK file signature extraction program for executing the signature extraction method of the APK file in the Android operating system as described above.

According to the present invention provides a convenience that can effectively detect malicious or white list programs in the Android operating system. In other words, by extracting the unique signature of the target application quickly and accurately by using the characteristics of the Android application and the structure of the compressed file, it is possible to extract the entire hash value by separating malicious or whitelists. While 80-250 times faster than the prior art, the detection of the polymorphic variant virus provides a possible effect.

1 and 2 are diagrams showing a malware detection method for an Android application in the prior art.
3 is a diagram illustrating an Android operating system-based mobile terminal in which a signature extraction method of an APK file according to the present invention is implemented.
4 is a flowchart illustrating a signature extraction method of an APK file according to the present invention.
FIG. 5 is a diagram for explaining intrinsic values of classes.dex included in an APK file. FIG.
FIG. 6 is a diagram for explaining a hash value of classes.dex included in a polymorphic virus. FIG.
7 is a diagram illustrating an example of a classes.dex file.

Hereinafter, the present invention will be described in detail with reference to the drawings.

3 is a diagram illustrating an internal configuration of a mobile terminal 10 (hereinafter, referred to as a 'mobile terminal') based on an Android operating system suitable for implementing a signature extraction method of an APK file according to the present invention. FIG. 4 is a flowchart illustrating a signature extraction method of an APK file according to the present invention. FIG. 5 is a diagram illustrating an intrinsic value of classes.dex included in an APK file, and FIG. 6 is a polymorphism. A diagram for explaining the hash value of classes.dex included in the variant virus. 7 is a diagram showing an example of the structure of the classes.dex file.

First, referring to FIG. 3, the mobile terminal 10 includes a wireless transceiver 11, an I / O interface 12, a central controller 13, a signature extraction module 14, a touch screen 15, Including the storage unit 16, it may be further provided with other components. At this time, the signature extraction module 14 is a real-time file detection means 14a, primary signature determination means 14b, APK file analysis means 14c, secondary signature determination means 14d, header information analysis means 14e. It is provided. Hereinafter, the signature extraction method of the APK file in the Android operating system will be described in detail with reference to FIGS. 3 to 7 based on the configuration of the signature extraction module 14.

The real-time file detection means 14a identifies that the extension of the file read from the storage unit 16 via the wireless transmission / reception unit 11 or the I / O interface 12 is an APK in response to the control operation of the central control unit 13. (S11). Step S11 is performed to search for an APK file in a compressed form by a ZIP compression algorithm provided for application installation in the Android operating system.

After step S11, the APK file analyzing means 14c receives a malicious file inspection request for the corresponding Android application from the central control unit 13 (S12), and accordingly starts analyzing the APK file (S13). By analyzing the APK file, the primary signature determination means 14b obtains the primary signature and determines whether there is a malicious code through the process, and for steps related to the primary signature (S14) to (S18), and [ This will be described with reference to FIG. 5 and FIG. 6.

After step S13, the APK file analysis means 14c searches for the location of classes.dex in the APK file (S14). APK files of applications running on the Android operating system are finally repackaged into a "classes.dex" file, which brings all the applications together. An application with the same processing capability will have the same "classes.dex" file, which is why you are looking for the location of the classes.dex file data within the ZIP compressed APK file.

After step S14, the APK file analysis means 14c searches for the unique information of the classes.dex file from the classes.dex file data in the APK file (S15). Looking at the structure of the compressed file used in the mobile terminal 10 based on the Android operating system, the information of the unique hash value, the file size, and the data size after the compression of all the files included in the compression are stored in a predetermined position of the compressed file. It is stored. Therefore, by referring to the structure of the compressed file, the location of the "classes.dex" file data, which is the core file of the Android application, is found from the APK file, and unique information such as the unique hash value and the size before and after compression is read. It is to look for unique information and use it as the primary signature.

With reference to FIG. 5 will be described in more detail. 5 is an exemplary diagram showing unique information about the classes.dex file included in the APK file. In the APK file of FIG. 5, the classes.dex file is included in the outline of the drawing, and underlined parts include date and time information, cyclic redundancy checks (CRC) information, file size information before compression, and file size after compression. Unique information such as information. Accordingly, if the unique information of the classes.dex file is used as a signature, an Android application-specific primary signature corresponding to the APK file can be obtained without decompressing the APK file or obtaining a hash value of the entire APK file. have.

FIG. 6 is a diagram showing unique information of the classes.dex file included in the polymorphic variant virus. That is, in the case of an APK file including a virus of a polymorphic variant, as shown in [FIG. 6 (a)] and [FIG. 6 (b)], it is partially different from the APK file shown in FIG. Since the unique information of the classes.dex file is maintained throughout [Fig. 5], [6 (a)], and [Fig. 6 (b)], all variants can be detected with one pattern (primary signature). have.

Using the unique information of the classes.dex file acquired by the APK file analyzing means 14c in step S15 as the primary signature, the primary signature determining means 14b determines whether the APK file is a malicious code (malicious application). Determine (S16). For this purpose, the first signature value for malware is registered in advance.

If it is determined in step S16 that the APK file is not malicious code, the process returns to the previous step S12 and waits for a malicious file inspection request for another APK file (Android application) (S17).

If it is determined in step S16 that the APK file is a malicious code (malignant application, polymorphic variant application), the APK file analyzing means 14c preferably outputs the first warning on the touch screen 15 and the APK. The malicious code processing is performed on the file (S18). In this case, the malicious code processing may be an action of deleting the APK file or moving the APK file to a specially designated folder. When the malicious code is found, the process is known in the art and is not a feature of the present invention. It is not described in detail herein.

As described above, if the primary signature matches, the APK file can be detected by being classified as a malicious list or a white list, but it is preferable to further perform the following process for more accurate detection.

First, the header information analyzing means 14e decompresses the header area corresponding to the previous 32 bytes of classes.dex file data in the APK file (S19). Fig. 7 shows the classes.dex file structure. The header information analyzing means 14e refers to this file structure and reads the hash value (SHA-1 Signature) from the classes.dex file data and uses it as the secondary signature of the APK file to more precisely determine whether the APK file is malicious code. You can judge.

After step S19, the header information analyzing means 14e extracts SHA-1 (Secure Hash Algorithm-1) information corresponding to the last 20 bytes of the header region (32 bytes) decompressed in step S19. (S20). More specifically, in the "classes.dex" file shown in FIG. 7, preferably, only 32 bytes of header parts are decompressed, and the hash value (SHA-1 Signature), which is 20 bytes, is converted into a unique signature (secondary signature). It is preferable to use. This configuration has the advantage of quickly and accurately obtaining application-specific signatures without decompressing the entire APK file or extracting the hash value of the entire file.

After the step S20, the header information analyzing means 14e determines whether the APK file is malicious (malignant and polymorphic variant application) by utilizing the SHA-1 information of the classes.dex file as the secondary signature (S21). For this purpose, the second signature value for the malware is registered in advance.

If it is determined in step S21 that the APK file is not malicious code, the process returns to the previous step S12 and waits for a malicious file inspection request for another APK file (Android application) (S22).

If it is determined in step S21 that the APK file is a malicious code (malignant application, polymorphic variant application), the header information analyzing means 14e preferably outputs the secondary warning on the touch screen 15 and the APK. The malicious code processing is performed on the file (S23). In this case, the malicious code processing may be an action of deleting the APK file or moving the APK file to a specially designated folder. When the malicious code is found, the process is known in the art and is not a feature of the present invention. It is not described in detail herein.

After the step S23, the header information analyzing means 14e determines whether or not the inspection of all the APK files stored in the storage unit 16 is finished (S24).

As a result of the determination in step S24, when the inspection of all APK files stored in the storage unit 16 is completed (completed), the header information analyzing means 14e stops the malicious and variant application detection process by signature extraction. On the other hand, if the inspection of all APK files is not finished as a result of the determination of step S24, the process returns to step S12 to repeatedly perform the process of steps S12 to S24.

The present invention can also be embodied in the form of computer readable code on a computer readable recording medium. At this time, the computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage, and the like, and may be implemented in the form of a carrier wave . The computer-readable recording medium can also be stored and executed by a computer-readable code in a distributed manner on a networked computer system. And functional programs, codes, and code segments for implementing the present invention can be easily deduced by programmers skilled in the art to which the present invention belongs.

As described above, the embodiments of the present invention have been disclosed in the present specification and drawings, and although specific terms have been used, they have been used only in a general sense to easily describe the technical contents of the present invention and to facilitate understanding of the invention. And is not intended to limit the scope of the invention. It will be apparent to those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

10: mobile terminal
11: wireless transceiver
12: I / O Interface
13: central control unit
14: signature extraction module
14a: Real-time file detection means
14b: Primary signature determining means
14c: APK file analysis tool
14d: Second signature determination means
14e: header information analysis means
15: touch screen
16: storage

Claims (5)

As a signature extraction method of APK file for detecting malicious or variant applications on Android operating system,
A first step of analyzing a APK file to search for locations of classes.dex file data in the APK file;
A second step of acquiring classes.dex file peculiar information from the retrieved classes.dex file data;
A third step of determining whether the APK file is a malicious code by setting the acquired classes.dex file unique information as a primary signature;
A fourth step of performing a predetermined malicious code process when it is determined that the malicious code is a result of the determination by the primary signature;
Signature extraction method of the APK file in the Android operating system is configured to include.
The method according to claim 1,
A fifth step of identifying a header area in the retrieved classes.dex file data;
A sixth step of decompressing the identified classes.dex header area;
A seventh step of obtaining a hash value according to a field format from the decompressed classes.dex header area;
An eighth step of determining whether the APK file is a malicious code by setting the obtained hash value as a secondary signature;
A ninth step of performing a preset malicious code process when it is determined that the malicious code is a malicious code;
Signature extraction method of the APK file in the Android operating system is configured to include more.
The method according to claim 2,
The classes.dex file peculiar information may include at least one of CRC information, pre-compression file size information, and post-compression file size information of the APK file.
The method of claim 3,
The classes.dex header area is 32 bytes before the decompressed classes.dex file data;
The hash value is a signature extraction method of the APK file in the Android operating system, characterized in that comprises a SHA-1 value corresponding to the last 20 bytes in the classes.dex header area.
A computer-readable recording medium having recorded thereon an APK file signature extraction program for executing a signature extraction method of an APK file in an Android operating system according to any one of claims 1 to 4.

Images