KR20160090566A - Apparatus and method for detecting APK malware filter using valid market data - Google Patents

Abstract

An object of the present invention is to provide an apparatus and method for detecting APK malware by using valid market data, which can provide a detection result having high reliability by using a few computing resources in a network accessible environment, and which can determine new malware at its early stage, which cannot be detected by a vaccine program. The apparatus comprises: an APK separation unit which extracts meta data from a target APK file collected from an untrusted APK source; an actual data input unit which collects live data of an innocent target APK file from a trusted third party based on a package name included in the meta data of the target APK file extracted by the APK separation unit; a filter manager which determines whether the target APK file collected from the untrusted APK source is malicious by comparing the meta data of the target APK file extracted by the APK separation unit with the live data of the innocent target APK file collected by the actual data input unit; and a detection result output unit which outputs a detection result determined by the filter manager.

Description

[0001] Apparatus and method for detecting APK malware using valid market data [

The present invention relates to an apparatus and method for examining an APK malicious code, and more particularly, to an apparatus and method for determining malicious or non-maliciousness of an APK file using online data without performing an existing static or dynamic analysis will be.

Smartphones are spreading rapidly around the world. By 2013, mobile phone penetration is about 4.3% of the world's population, about 1.6 billion people are using smartphones.

As the functions of the smartphone become closer to the user's life, the information required to provide the service is also closely related to the user. If such sensitive information is used without being protected safely, users may cause personal information leakage or property damage. In fact, there has been an explosion in cases of stalking other users' private lives with stalking apps or smart TV hacks, or financially damaging smsing and pharming attacks. These attacks can also lead to social threats beyond individual levels.

In order to prevent attacks targeting smartphones, security devices exist and operate in the OS itself. Therefore, it is not easy for the attacker to find the vulnerability of the system under normal usage environment, and as the patch is continuously updated through the update, the attack method using the system vulnerability is not easily done. Therefore, most of the attacks are made by inducing users to install malicious applications on the victim's terminal.

The spread of malicious applications to attack smartphones can be done by way of sneezing, Drive By Download, or by pretending to be a normal application. In spite of the spreading through limited paths, the speed of dissemination is enormous due to the fact that smartphones are always carried and periodically checked by users.

In addition, such malicious applications are not only increasing in speed and type, but also becoming increasingly difficult to detect.

There are static analysis method and dynamic analysis method as a method of analyzing such malicious code in the past.

The static analysis method is a method of analyzing without executing a program, and is roughly divided into a white-box and a black-box. White-box is a method of analyzing a source file, and black-box is a method of performing only binary. Because Android applications are built on Java, APK files are unpacked and extracted and decompiled, making them somewhat obfuscated but similar to source code.

Therefore, APK static analysis can try similar approach to white-box even if it is given only in black-box environment, and it is easy to analyze compared to Windows PE format or Linux ELF format. C & C server addresses, or dangerous system calls, are analyzed using a variety of techniques, from relatively simple tasks in the program to sophisticated API traces. However, static analysis has limitations in automation, and human analysis and definition of malicious patterns must be defined, which requires a lot of human resources to maintain and repair.

In addition, APK dynamic analysis is a method of monitoring and analyzing the operation inside the computer by directly executing and manipulating the program. In the case of Android, the Dalvik VM is operated based on the Linux kernel, and the application is operated on this VM. Therefore, in order to perform the analysis, it is necessary to install, run and manipulate the application to be checked in the real Android terminal or simulator to monitor the operation of Dalvic VM, the log history, and the operation of the kernel, Application.

In this way, since the APK dynamic analysis method basically requires the real terminal or the virtual machine to operate, the computing resources required are considerably larger than the static analysis method introduced above.

In order to overcome the limitations of the static and dynamic analysis methods, a method using machine learning has been actively studied. This has the advantage of being able to automate many parts using machine learning and also to find hidden features that the analyst does not care at design time. However, using machine learning increases the operation cost because it requires a large amount of computation, and if the maintenance is wrong, the computation amount becomes large and continuous operation becomes impossible. In addition, due to the nature of machine learning, reliability is low when there is not enough learning and there is a limit to lowering the false positive rate even if a great deal of money is invested in maintenance and optimization.

Especially, it is not easy to maintain the machine learning module in an environment in which the attack method is continuously changed, such as malicious code discrimination, and a lot of studies are still required to solve the false-positive rate problem.

Patent Registration No. 10-1386605: Method for Detecting Malicious Code through Rights Information Management Patent Document 10-1056283: Malicious Code Detection Apparatus and Method Thereof

SUMMARY OF THE INVENTION Accordingly, the present invention has been made in an effort to solve the above problems, and it is an object of the present invention to provide a test result that obtains high reliability with less computing resources in an environment in which a network can be used and discriminate a new malicious code The present invention provides an apparatus and method for inspecting an APK malicious code using available market data.

It is another object of the present invention to provide an APK malicious code using effective market data that can determine not only whether an application is malicious but also innocence through a platform characteristic that information of an application distributed in a normal path can be inquired, And an inspection apparatus and method.

Other objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned can be clearly understood by those skilled in the art from the following description.

In order to accomplish the above object, an apparatus for inspecting an APK malicious code using effective market data according to the present invention is a device for inspecting an APK malicious code which is collected from an untrusted APK source including a black market, a third party market, The live data of a target APK file having innocence collected in a trust institution represented by Google Play based on metadata extracted from the APK file (Meta-Data) and the package name of the extracted metadata, Data) are compared with each other to determine whether the target APK file is malicious.

According to another aspect of the present invention, there is provided an apparatus for inspecting an APK malicious code using effective market data, comprising: an APK separator for extracting meta data from a target APK file collected at an unreliable APK source; An actual data input unit for collecting actual data of a target APK file having innocence from a trusted authority based on the package name included in the meta data of the target APK file extracted by the separating unit; A filter manager for comparing the meta data of the target APK file with the actual data of the target APK file having the anomalousness collected from the actual data input unit to determine whether the collected target APK file is malicious or not; And a test result output unit for outputting test results.

Preferably, the actual data collected by the actual data input unit is obtained by requesting the trusted authority from the URL generated based on the package name of the metadata extracted by the APK separator.

Preferably, the meta data and the actual data include at least one of a package name, a version name, a version code, a file size of an app, an application request permission, and an APK file internal resolution information.

According to another aspect of the present invention, there is provided a method for inspecting an APK malicious code using effective market data, the method comprising: (A) inputting an APK file to be inspected through an unreliable APK source; The method comprising the steps of: extracting metadata from a target APK file; (B) extracting metadata from a target APK file having an innocence from a trusted authority based on a package name included in metadata extracted from the target APK file through an actual data input unit; (C) comparing the metadata extracted from the target APK file with the actual data of the APK file having no anomaly through a filter manager, and (D) And determining whether the target APK file is malicious or not based on the comparison result.

Preferably, the meta data and the actual data include at least one of a package name, a version name, a version code, a file size of an app, an application request permission, and an APK file internal resolution information.

Preferably, the step (A) includes a step of analyzing and analyzing a format of a target APK file, and a step of extracting metadata of a target APK file from the separated internal file.

Preferably, in the step (B), the URL generated with the metadata package name of the target APK file extracted by the APK separating unit is transmitted through an HTTP request, an API of the market, a query system, And collects actual data (Live-Data) of the target APK file.

As described above, the APK malicious code checking apparatus and method using the available market data according to the present invention can produce reliable results without using static and dynamic analysis methods requiring a large amount of computation and human resources, , There is very little effect compared with the dynamic analysis method.

Because of its light weight, it can be applied to devices with limited battery and performance (such as smartphones) (small, low-end handsets), which can suppress the installation of malicious applications.

In addition, since a central server for collecting and analyzing original applications for obtaining malicious application determination information is not needed, the cost of service construction can be reduced.

In addition, because the original APK is not collected, it can be analyzed at no additional cost to purchase the original application of malicious code, which is disguised as a paid application.

1 is a block diagram illustrating an entire system for inspecting an APK malicious code using effective market data according to an embodiment of the present invention;
2 is a block diagram showing in more detail the internal configuration of the APK malcode checking apparatus 100 of FIG.
3 is a flowchart illustrating an APK malicious code inspecting method using effective market data according to an embodiment of the present invention.
FIG. 4 is a diagram for explaining a case where an APK malicious code inspection method using effective market data according to the present invention is searched and operated on an Android device

Other objects, features and advantages of the present invention will become apparent from the detailed description of the embodiments with reference to the accompanying drawings.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of an apparatus and method for inspecting an APK malicious code using effective market data according to the present invention will now be described with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. It is provided to let you know. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention and are not intended to represent all of the technical ideas of the present invention. Therefore, various equivalents It should be understood that water and variations may be present.

1 is a block diagram illustrating an overall system for inspecting an APK malicious code using effective market data according to an embodiment of the present invention.

As shown in FIG. 1, the APK malware inspection apparatus 100 extracts from the target APK file of the inspection collected from the unreliable APK source 20 including the black market, the third party market, and the Web. (Live-Data) of the target APK file having innocence collected in the trust institution 10 represented by Google Play based on the metadata of the extracted metadata (Meta-Data) and the package name of the extracted metadata ) Are compared with each other to determine whether the target APK file is malicious. At this time, the trust authority 10 depends on what the implementer defines trust authority, and can use a plurality of trust authorities.

2 is a block diagram showing an internal configuration of the APK malcode checking apparatus 100 of FIG. 1 in more detail.

As shown in FIG. 2, the APK malcode checking apparatus 100 includes an APK separating unit 110 for extracting meta data from a target APK file collected by an unreliable APK source 20, An actual data input unit 120 for collecting actual data of a target APK file having innocence from the trust institution 10 based on the package name included in the meta data of the target APK file extracted by the trust management unit 100, The meta data of the target APK file extracted by the APK separator 110 is compared with the actual data of the target APK file having the non-integrity collected by the actual data input unit 120 to determine whether the collected target APK file is malicious And a test result output unit 140 for outputting a test result discriminated by the filter manager 130. [

At this time, the actual data collected by the actual data input unit 120 may be obtained by HTTP requesting a URL generated with the metadata package name of the APK file extracted by the APK separator 110, Or an interface of the trusting organization. The filter manager 130 manages the APK separator 110 and the actual data input unit 120, determines the inspection result, and manages the operation policy.

The metadata and actual data include package name, version name, version code, file size of an app, application request authority, and APK file internal dissolution information.

As described above, the APK malicious code checking apparatus 100 does not use signatures generated by analyzing and downloading all the applications that can be inspected in the server, unlike the conventional method, There is no need for a collection and analysis server by analyzing the APK file that is the object of the inspection by collecting actual data (Live-Data). In addition, through the analysis using the actual data, it is possible to inspect even a paid application which can not be collected and analyzed conventionally due to no dynamic analysis with a large overhead. Given that most malicious applications pretend to be paid applications, the method of collecting APK files directly is not practical, but the present invention does not have this limitation.

The operation of the apparatus for inspecting an APK malicious code using the valid market data according to the present invention will now be described in detail with reference to the accompanying drawings. Like reference numerals in FIG. 1 or FIG. 2 denote the same members performing the same function.

3 is a flowchart illustrating an APK malicious code checking method using effective market data according to an embodiment of the present invention.

As shown in FIG. 3, when an APK file to be inspected, which is collected through downloading or installation from an untrusted APK source 20 including a black market and a web, is first input to a user smart phone (S10), and extracts metadata (Meta-Data) from the input target APK file through the APK separating unit 110 (S20). That is, the input APK file metadata is obtained through the internal files obtained by analyzing the format of the target APK file.

In one embodiment of extracting the metadata of the target APK file from the APK separator 110, the target APK file is depacked to detect the files in the target APK file, and the detected list and the hash And extracts the metadata of the target APK file by implementing an interface to an APK inspector or an APK tool distributed as an open source based on the APK file. It should be noted, however, that this is not a limitation of the present invention.

 Then, a request is made to the trust institution 10 represented by Google Play as a URL generated based on the package name included in the metadata extracted from the target APK file through the actual data input unit 120 to perform innocence (Live-Data) of the target APK file (S30). That is, the collection of the actual data having innocence of the target APK file is performed by the HTTP request, the API of the market, or the URL of the URL created with the metadata package name of the target APK file extracted by the APK separator 110 Query system, or an equivalent trusted interface.

In one embodiment, an HTTP request can be made by creating a URL such as 'http://play.google.com/story/apps/ details? Id = PACKAGENAME'.

At this time, the metadata and actual data include a package name, a version name, a version code, a file size of an app, an app request permission, and an APK file internal resolution information.

It is also a problem after collecting the actual data. Especially, since the information such as permission is not used as an orphan word used by android, it is translated into a human-readable sentence. Therefore, The APK separating unit 110 can compare the extracted metadata with the metadata extracted through the APK file.

When the actual data collection with innocence of the target APK file is completed, the metadata extracted from the target APK file and the actual data of the APK file having no anchor are compared with each other through the filter manager 130 S40).

If the meta data and the actual data are the same or are applied to the policy of the inspection system (S50), the filter manager 130 determines that the target APK file is innocent (S60) If they are not equal to each other or if they are against the policy of the inspection system (S50), it is finally determined that the target APK file is malicious (S70). The same policies as those for non-latest versions are also set up and applied in advance.

FIG. 4 is a diagram for explaining when an AP device malicious code is inspected and operated according to a method of inspecting an APK malicious code using effective market data according to the present invention.

As shown in FIG. 4, it can be seen that the present invention can operate without the assistance of an update and analysis server, and that a database to store signatures is also unnecessary. Also, when a user attempts to install an app through a target APK file received from the web and a black market without operating a separate vaccine application, the APK maliciousness testing apparatus according to the present invention operates and plays Google Play And collects the actual data of the target APK file having the innocence normally distributed. In addition, since it is possible to judge whether the target APK file is malicious based on the collected actual data, it is easier to use and intuitive than the existing vaccine because it can block malicious application installation in advance.

As described above, the present invention is an operation of collating the metadata of the target APK file with the actual data of the information of the application searched by the trust authority 10, and can easily determine whether the target APK file is non-compliant or malicious. This does not require much computation over dynamic or static analysis, so it can be done at an early stage in file analysis to help improve system efficiency. In addition, this method can be used not only for a large-sized system but also for an Android device connected to a network.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. It will be apparent to those skilled in the art that various modifications may be made without departing from the scope of the present invention. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

Claims (9)

(Meta-Data) extracted from the APK file of the inspection to be collected from the unreliable APK source including the black market, the third party market, and the Web and the package name of the extracted metadata, And comparing the actual data (Live-Data) of the target APK file having the innocence collected by the trust institution represented by the play with each other to discriminate whether the target APK file is malicious or not. Malware inspection device. An APK separator for extracting metadata from a target APK file collected at an untrusted APK source,
An actual data input unit for collecting actual data of a target APK file having innocence from a trusted authority based on the package name included in the meta data of the target APK file extracted by the APK separating unit;
A filter manager for comparing the meta data of the target APK file extracted by the APK separating unit with the actual data of the target APK file having the anomalousness collected from the actual data input unit to discriminate whether the collected target APK file is malicious or not; ,
And an inspection result output unit outputting the inspection result determined by the filter manager. 3. The method of claim 2,
Wherein the actual data collected by the actual data input unit is obtained by requesting the trusted authority from the URL generated based on the package name of the metadata extracted by the APK separating unit. 3. The method of claim 2,
Wherein the metadata and the actual data include at least one of a package name, a version name, a version code, a file size of an app, an app request authorization, and an APK file internal decryption information. Device. (A) extracting metadata from a target APK file inputted through an APK separator when an APK file to be inspected is inputted through an untrusted APK source,
(B) collecting actual data (Live-Data) of a target APK file having innocence from a trusted authority based on the package name included in the metadata extracted from the target APK file through the actual data input unit Wow,
(C) comparing metadata extracted from the target APK file with actual data of an anomaly APK file through a filter manager,
(D) judging whether the target APK file is malicious or not, based on the result of the comparison; and detecting the APK malicious code using the valid market data. 6. The method of claim 5,
Wherein the metadata and the actual data include at least one of a package name, a version name, a version code, a file size of an app, an app request authorization, and an APK file internal decryption information. Way. 6. The method of claim 5, wherein step (A)
Analyzing and analyzing the format of the target APK file;
And extracting metadata of a target APK file from the separated internal file. 6. The method of claim 5, wherein step (B)
The URL generated by the metadata package name of the target APK file extracted by the APK separating unit is HTTP requested or the actual data of the target APK file is stored using the interface of the market API, -Data) is collected. The method for inspecting an APK malicious code using effective market data. 6. The method of claim 5,
Wherein the trusted authority includes a trust institution represented by Google Play, and the unreliable APK source includes a black market, a third party market, and a Web.

Images