WO2013089340A1

WO2013089340A1 - Apparatus and method for detecting similarity between applications

Info

Publication number: WO2013089340A1
Application number: PCT/KR2012/007641
Authority: WO
Inventors: 김기영; 고승원; 김세일
Original assignee: 주식회사 안랩
Priority date: 2011-12-16
Filing date: 2012-09-24
Publication date: 2013-06-20
Also published as: KR101214893B1

Abstract

The present invention relates to a technology for detecting similarity between applications, which measures the similarity between applications by utilizing information on the basis of the characteristics of the applications operating on the basis of an Android mobile platform by using analysis of a DEX signature, a developer's signature, and an inside APK file through file information extraction, and by using analysis and comparison of class and method files. According to the present invention, forgeries made by re-packaging Android applications and even similarity between apps can be relatively easily determined. Through this, the rights and interests of an application developer can be protected, and a user can precisely determine whether the corresponding application is normal.

Description

Apparatus and method for detecting similarity of applications

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technique for analyzing an application used in a mobile device, and more particularly, to an apparatus and method for detecting similarity of an application suitable for detecting a match by measuring similarity of applications operating on a mobile platform.

Today, mobile devices have become a necessity of modern people, and various ubiquitous environments are realized by enabling call, message sending, and wireless Internet access through one or more mobile devices per person.

Moreover, the popularity of smart terminals, which combines the advantages of mobile phones and personal digital assistants (PDAs), is increasing significantly in Korea as well as abroad. Since the user can install various kinds of applications in the smart terminal, it is possible to install and drive financial transactions, movie and performance booking, navigation, game applications, etc. in addition to the basic call function.

As the use of smart terminals increases, various applications that can be installed on smart terminals are released. The applications of these smart terminals are downloaded by referring to the characteristics, functions, and user reviews of the corresponding applications by accessing the online market. I can receive it.

In the mobile environment, various applications are produced and distributed for free through the online market, and the distribution paths are not uniform but varied. In particular, the Android (Android) application is operated by a variety of operators rather than a single unified online market, it is relatively difficult to check the uniqueness, similarity, integrity, etc. of the application.

For this reason, various researches have been conducted to perform similarity detection between Android applications. Typical typical similarity detection methods include a classification method using a package name, a file difference technique for a binary file, and Comparison methods using hash functions.

As described above, in the prior art for detecting similarity of the Android application, the classification method using the package name cannot be an accurate classification method because it can be easily repackaged by others, and even when the same configuration file is packaged, Since the internal configuration status of APK (Android PacKage), which is an Android application extension, varies depending on the situation, the CRC / Hash verification method performed on the APK file has no meaning. An alternative is to use DEX_Signature (SHA1) and DEX_CRC. However, this method can check the identity of the application but cannot calculate the similarity.

On the other hand, in the File Difference Checking method, the similarity can be calculated together with the identity check, but the DEX (Dalvik Executable) file including the class file of Java is optimized for the Dalvik VMWare. Considering that, even if only a part of the application code is modified, the similarity between the binary can be greatly changed, there is a problem that it is not a reliable target.

Accordingly, an embodiment of the present invention may provide an apparatus and method for detecting similarity of an application capable of detecting a match by measuring similarity of applications operating on a mobile platform.

In addition, an embodiment of the present invention may provide an apparatus and method for detecting similarity of an application capable of measuring similarity between respective applications by using reverse engineering information based on characteristics of applications operating on an Android mobile platform.

In addition, an embodiment of the present invention, through the analysis of the DEX signature (signature), developer signatures, internal files of the APK, and analysis and comparison of class (method) files in the application running on the Android mobile platform An apparatus and method for detecting similarity of an application capable of measuring similarity between respective applications can be provided.

An apparatus for detecting similarity of an application according to an embodiment of the present invention may include an input unit for receiving a similarity measurement request message of an application, a file extractor for extracting file information from a reference application and a comparison target application associated with the message, and the extraction. A file analysis unit comparing the reference application and the comparison target application based on the file information and analyzing at least one of repackaging, forgery or similarity based on analysis result information of the file analysis unit It may include an analysis unit.

The file information may be at least one of a DEX signature, a developer signature, an APK internal file information, a class and method information in the DEX file.

The file analyzer may include a DEX signature analyzer configured to compare DEX signatures inserted in a DEX header to determine whether the DEX signature is matched, a developer signature analyzer configured to determine whether a developer signature is matched when the DEX signature is matched, and an APK. It may include an APK file analysis unit for comparing the match of the internal file information.

When the DEX signatures do not match, the similarity analyzer may compare class and method information among the extracted file information and determine similarity by measuring a similarity.

The similarity analyzer determines that the comparison target application is the same as the reference application when the developer signature and the file information in the APK match, and the developer signature matches, but the file information in the APK does not match. In this case, the comparison target application may be determined as the repackaging application of the developer.

The similarity analyzer determines that the comparison target application is a repackaging application by someone other than the developer when the developer signature does not match but the file information in the APK matches, and the developer signature does not match. Also, if the file information in the APK does not match, class and method information of the extracted file information may be compared, and similarity may be measured to determine whether forgery by another person.

The similarity detection apparatus may further include an analysis result output unit configured to transmit the similarity analysis result information received from the similarity analysis unit to a user's mobile device or an application store server.

The method for detecting similarity of an application according to an embodiment of the present invention may include receiving a similarity measurement request message of an application, extracting file information from a reference application and a comparison target application associated with the message, and extracting the extracted file. Comparing the reference application with the comparison target application based on the information and analyzing the match; and analyzing at least one or more of repackaging, forgery, or similarity based on the analysis result information on the match. can do.

The file information may be at least one of a DEX signature, a developer signature, file information in an APK, class and method information in a DEX file, and the like.

The analyzing of the matching may include: comparing the DEX signatures inserted in the DEX header to determine whether to match; and if the DEX signatures match, determining whether or not the developer signature is matched; And comparing the information with each other.

The measuring of the similarity may include comparing class and method information in the extracted file information, and determining similarity by measuring the similarity if the DEX signature does not match. .

The process of measuring the similarity may include determining that the comparison target application is the same as the reference application when the developer signature and the file information in the APK match, and the developer signature matches, but the file in the APK If the information does not match, the comparison target application may further include determining that the developer is a repackaging application.

The process of measuring the similarity may include determining that the comparison target application is a repackaging application by someone other than the developer when the developer signature does not match but the file information in the APK matches. If the information does not match and the file information in the APK does not match, the method may further include comparing class and method information among the extracted file information, and determining similarity to determine whether forgery by another person.

The similarity detecting method may further include transmitting similarity analysis result information analyzed through measuring the similarity to a user's mobile device or an application store server.

According to the apparatus and method for detecting similarity of an application according to an embodiment of the present invention, it is possible to relatively easily determine whether forgery through repackaging an Android application, and to accurately determine similarity between apps. This is one of the ways to protect the rights of app developers, which can be used as a copyright protection.

1 is a block diagram illustrating a structure of an apparatus for detecting similarity of an application according to an embodiment of the present invention;

2 is a flowchart illustrating an operation procedure of an apparatus for detecting similarity according to an embodiment of the present invention;

3 is a diagram illustrating analysis result information output through a similarity detection apparatus according to an exemplary embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various forms, and only the embodiments are to make the disclosure of the present invention complete, and common knowledge in the art to which the present invention pertains. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the embodiments of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the contents throughout the specification.

Combinations of each block of the accompanying block diagram and each step of the flowchart may be performed by computer program instructions. These computer program instructions may be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment such that instructions executed through the processor of the computer or other programmable data processing equipment may not be included in each block or flowchart of the block diagram. It will create means for performing the functions described in each step. These computer program instructions may be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular manner, and thus the computer usable or computer readable memory. It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the functions described in each block or flowchart of each step of the block diagram. Computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operating steps may be performed on the computer or other programmable data processing equipment to create a computer-implemented process to create a computer or other programmable data. Instructions that perform processing equipment may also provide steps for performing the functions described in each block of the block diagram and in each step of the flowchart.

In addition, each block or step may represent a portion of a module, segment or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions noted in the blocks or steps may occur out of order. For example, the two blocks or steps shown in succession may in fact be executed substantially concurrently or the blocks or steps may sometimes be performed in the reverse order, depending on the functionality involved.

An embodiment of the present invention is to measure the similarity between each application by using reverse engineering information based on the characteristics of the applications operating on the Android mobile platform, and extracts the DEX signature, developer signature, and Apk internal file through file information extraction. The similarity between each application is measured through analysis and analysis and comparison of class and method files.

Android is a Java-based mobile operating system published by Google Inc. in the United States, and applications written in Java can be executed on a separate processor through a Dalvik virtual machine. And since all the source code of Android is open and distributed, each company or user can develop their own Android program and put it on mobile.

Therefore, the Android Market may be a server where a plurality of mobile device users and a plurality of application providers are connected through a wired / wireless network, and an application is sold when an application is uploaded from each application developer. Through the Android Market, developers can upload free or paid applications.

An embodiment of the present invention may receive the respective application information to measure the similarity from the enterprise or the user in conjunction with the Android market server can measure the similarity with other applications based on any one application.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a structure of an apparatus for detecting similarity of an application according to an embodiment of the present invention.

Referring to FIG. 1, the similarity detection apparatus 100 may include an input unit 110, a file information extractor 120, a DEX signature analyzer 130, a developer signature analyzer 140, an APK file analyzer 150, The similarity analyzer 160 and the analysis result output unit 170 may be included.

In more detail, the input unit 110 may receive a similarity measurement request message for a specific application from a mobile device user, an application developer, or an Android market server operator. In this case, the similarity measurement request message may include an application as a comparison criterion and an application to be compared with this. In one embodiment, the reference application may be an original application of the developer, and the application to be compared may be an application suspected of being changed in the original application.

Accordingly, the input unit 110 may transfer the received similarity measurement request message to the file information extracting unit 120. The file information extractor 120 may extract file information necessary for measuring similarity from each application included in the similarity measurement request message.

In one embodiment, the file information extraction unit 120 extracts the application APK file by reverse engineering, DEX signature (SHA-1) information, developer signature information, APK internal file information (file list, hash information, etc.) and the DEX Header information and class and method information can be extracted.

Since each application is compressed as an APK file, it is decompressed by the deflate compression algorithm, and the MANIFEST file (AndroidManifest.xml), DEX file (classes.dex), resource file (resources.arsc) and META-INF are released. You can check the signature information of the folder. Here, the DEX header can be extracted through static analysis of the DEX file, and class information and method information of the actual data area can be extracted together.

The file information extracted through the file information extractor 120 may be transferred to the DEX signature analyzer 130, the developer signature analyzer 140, and the APK file analyzer 150.

The DEX signature analyzer 13 may analyze whether or not the DEX signature information is matched between the two applications by comparing the DEX signature information that is planted in the header when the DEX is generated. If the DEX signature information is matched, the source code is not changed, and may be the same application or a simple repackaging. Therefore, the DEX signature information may be transmitted to the developer signature analysis unit 140 as DEX signature comparison analysis result information. Can be.

However, when the DEX signature information does not match, since a change has occurred in the source code, the DEX signature comparison analysis result information including the mismatch analysis information may be transmitted to the similarity analysis unit 160.

Meanwhile, the developer signature analyzer 140 may analyze whether the two applications match each other based on the signature code included in the APK file, the developer ID, the signature performed when registering with the Android Market server, or the Google authentication digital signature.

The matched or inconsistent analysis result may be transmitted to the APK file analyzer 150 as developer signature comparison analysis result information.

The APK file analyzer 150 may check the developer signature comparison analysis result information received from the developer signature analyzer 140, and compare the file information in the APK between the reference application and the comparison application.

In other words, you can check the configuration information, file name, and file size of files except DEX files in APK, and if they match all, they can be matched. The analyzed information may be included in the APK internal file comparison analysis result information together with the developer signature comparison analysis result information and transmitted to the similarity analysis unit 160.

Meanwhile, the DEX signature analyzer 130, the developer signature analyzer 140, and the APK file analyzer 150 compare an application to be compared with an application as a reference based on the file information extracted from the file information extractor 120. Comparing with each other to determine whether or not to match, may be referred to collectively as a file analysis unit.

The similarity analysis unit 160 may receive the information of the comparison result of the comparison of the internal APK file from the DEX signature analysis unit 130 and the APK file analysis unit 150, and determine the similarity based on the received comparison analysis result information. Based on this, similarity measurement result information can be generated. The similarity analysis unit 160 checks the received comparison analysis result information and matches the DEX signature and developer signature. If the comparison result of the files in the APK also matches, it may be determined as an application of the original developer. That is, the comparison target application may be determined as the same application as the reference application.

However, if the DEX signature and developer signature match, but the comparison result of the files in the APK does not match, it can be determined as the repackaging application of the original developer. When the DEX signatures match but the developer signatures do not match, and the comparison result of the files in the APK matches, it can be determined as a repackaging application by another person.

Meanwhile, similarity analysis and similarity detection may be performed when the DEX signatures do not match and when the DEX signatures match but the developer signature and the comparison result of the files in the APK do not match.

The similarity determination can be determined based on the class and method information in the DEX file, and can be extracted as the similarity. That is, if all the class and method information included in the reference application match all the class and method information of the comparison application, the similarity may be 100%, and if there is a mismatched file, the similarity is calculated according to the ratio. It can be measured.

The analysis result output unit 170 outputs the analyzed result, and may receive the similarity analysis result information through the similarity analysis unit 160, and deliver the received similarity analysis result information to the Android market server requesting the similarity measurement. Or to an application developer or mobile user device. In this case, the similarity analysis result information may include match list information between each comparison file and similarity measurement result information, and the corresponding information may be provided by an additional request of the similarity measurement requester.

2 is a flowchart illustrating an operation procedure of a similarity detection apparatus according to an embodiment of the present invention.

Referring to FIG. 2, in step 200, the input unit 110 of the similarity detection apparatus 100 receives a similarity measurement request message, and the input similarity measurement request message is transmitted to the file information extraction unit 120. In operation 202, the file information extractor 120 extracts at least one file information of a DEX signature, a developer signature, a file list in the APK, and hash information required for similarity measurement from the application APK file included in the message.

The extracted file information is delivered to the DEX signature analyzer 130, and the DEX signature analyzer 130 determines whether the DEX signature inserted when the DEX is generated is compared through a comparative analysis between the reference application and the comparison application. If the DEX signatures coincide with each other, the process proceeds to step 206 and the DEX signature analysis unit 130 passes the file extraction information and the DEX signature comparison analysis result information to the developer signature analysis unit 140. 140) compares and analyzes whether the developer signatures of the respective applications match.

If the developer signature is matched by comparing the developer signature, the process proceeds to step 208 and the file extraction information and the developer signature comparison analysis result information are transmitted to the APK file analyzer 150, and the APK file analyzer 150 It will determine whether the files in the APK match.

If the file information in the APK is also the same, the process proceeds to step 210, and the result of comparing the APK internal file is analyzed and transmitted to the similarity analyzer 160, and the similarity analyzer 160 matches the DEX signature, the developer signature, and the APK internal file. The two applications are judged to be the same application made by the same developer. Then, the determined result information (similarity analysis result information) is transmitted to the analysis result output unit 170.

As a result, the analysis result output unit 170 outputs the information indicating that the "same application" or "similarity 100%" to the similarity measurement requester in step 212.

However, if the file information in the APK is not the same between the two applications in step 208, the result of the APK internal file comparison analysis is transmitted to the similarity analyzer 160, and the similarity analyzer 160 has the same DEX signature and developer signature. Since the APK internal files do not match, they are determined to be repackaged by the original developer, that is, the upgraded application. The determined result information is transmitted to the analysis result output unit 170.

As a result, the analysis result output unit 170 outputs the information indicating that it is a "repackaging by a developer" or an "upgraded file" to the requestor for similarity measurement in step 212.

However, if the signature of the developer does not match at step 206, the developer signature analyzer 140 transmits the developer signature comparison analysis result information including the same to the APK file analyzer 150, and the APK file analyzer 150. In step 216, the files in the APK are compared and analyzed. If the files in the APK match this, in step 218, the result of comparing the APK internal file comparison result is transmitted to the similarity analyzer 160, and the similarity analyzer 160 matches the DEX signature and the APK internal file, but the developer signature is different. Based on the analysis results, the comparison application is judged to be repackaged by someone other than the original developer. The determined result information is transmitted to the analysis result output unit 170.

As a result, the analysis result output unit 170 outputs the information indicating that the application is a "repackaged application by another person" to the similarity measurement requester in step 212.

In step 216, if the APK file analysis unit 150 compares and analyzes whether the files in the APK match each other, and the files in the APK do not match with each other in the two applications, the process is not a simple change through repackaging. The APK file determination result information including the determination information is transmitted to the similarity analysis unit 160.

The similarity analyzer 160 measures similarity between applications based on class and method information extracted from a DEX file by reverse engineering, and measures similarity based on a comparison result in step 222.

In this case, the DEX signature and developer signature do not match, but if the similarity analysis results, for example, more than 80% of the class and method information, it may be determined that the copyright violation or forgery distribution by others. The determined result information is transmitted to the analysis result output unit 170.

As a result, the analysis result output unit 170 outputs and provides information indicating the "similarity to copyright violation or forgery distribution by another person" to the similarity measurement requester in step 212.

If the DEX signatures do not match in step 204, the similarity analysis unit 160 measures similarity between applications based on class and method information in step 220, and in step 222, similarity is measured based on a comparison result. .

In this case, if the DEX signatures do not match, most of the developer signatures do not match, and even if the developer signatures match, it is determined that the copyright violation or forgery distribution by others. The determined result information is transmitted to the analysis result output unit 170.

Referring to FIG. 3, as the information output through the analysis result output unit 170, the same application 310, a repackaging (upgrade) 320 by a developer, a repackaging 330 by another person, and a third party At least one of copyright violation or forgery distribution suspected (340), the detailed comparison result of the degree of similarity 00% (350) may be output.

In addition, by providing detailed similarity measurement result information such as “view comparison results,” similarity measurement requesters may accurately determine similarity between two applications through the result information.

As described above, an apparatus and method for detecting similarity of an application according to an embodiment of the present invention are for measuring similarity between applications using reverse engineering information based on characteristics of applications operating on an Android mobile platform. The similarity between each application is measured through analysis of DEX signature, developer signature, APK internal file through information extraction, and analysis and comparison of class and method files.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the claims below, but also by those equivalent to the claims.

Claims

An input unit configured to receive a similarity measurement request message between the reference application and the comparison target application;

A file extraction unit for extracting file information from the reference application and the application to be compared;

A file analysis unit comparing the reference application with the comparison target application based on the extracted file information and analyzing whether or not there is a match;

Including a similarity analysis unit for analyzing at least one or more of repackaging, forgery or similarity based on the analysis result information of the file analysis unit,

The file information may include at least one of a DEX signature, a developer signature, an APK internal file information, a class and method information in a DEX file.

Application similarity detection device.
The method of claim 1,

The file analysis unit,

A DEX signature analysis unit which compares the DEX signature extracted from the reference application and the application to be compared to determine whether the DEX signature matches;

A developer signature analysis unit determining whether or not the developer signature extracted from the reference application and the comparison target application is matched when the DEX signatures match;

APK file analysis unit for comparing the match between the reference application and the APK internal file information extracted from the target application;

Apparatus for detecting similarity of the application, characterized in that it comprises a.
The method of claim 2,

The similarity analysis unit,

When the DEX signature does not match, similarity detection of the application, characterized in that for comparing the class and method information of the file information extracted from the reference application and the application to be compared, and measuring the similarity to determine whether the forgery by others Device.
The method of claim 2,

The similarity analysis unit,

If the developer signature and the APK internal file information match, it is determined that the comparison target application is the same as the reference application,

If the developer signature matches, but the APK internal file information does not match, the comparison target application is determined to be a repackaging application of the developer, characterized in that the application similarity detection device.
The method of claim 2,

The similarity analysis unit,

If the developer signature does not match, but the information in the APK internal file matches, the comparison target application is determined to be a repackaging application by someone other than the developer,

If the developer signature does not match, and also the information in the APK internal file does not match, comparing the class and method information in the extracted file information, and measuring the similarity to determine whether the forgery by others Application similarity detection device.
The method of claim 1,

The similarity detection device,

Analysis result output unit for transmitting the similarity analysis result information received from the similarity analysis unit to the user's mobile device or application store server

Apparatus for detecting similarity of the application, further comprising.
Receiving, by the input unit, a similarity measurement request message between the reference application and the comparison target application;

Extracting, by a file extracting unit, file information from the reference application and the application to be compared;

In the file analysis unit, comparing the reference application and the comparison target application on the basis of the extracted file information to analyze the match;

In the similarity analysis unit, including the process of analyzing at least one or more of repackaging, forgery, or similarity based on the analysis result information on the match,

The file information is at least one of a DEX signature, a developer signature, file information in the APK, class and method information in the DEX file.

How to detect similarity in applications.
The method of claim 7, wherein

The process of analyzing the match is,

Comparing the DEX signature inserted into the DEX header extracted from the reference application and the application to be compared to determine whether or not there is a match;

Determining whether the developer signatures extracted from the reference application and the comparison target application match when the DEX signatures match;

Comparing or not matching the APK internal file information extracted from the reference application with the reference application;

The similarity detection method of an application comprising a.
The method of claim 8,

The process of analyzing the similarity,

If the DEX signature does not match, comparing the class and method information in the extracted file information, and measuring the similarity to determine whether the forgery by others

The similarity detection method of an application comprising a.
The method of claim 8,

The process of analyzing the similarity,

Determining that the comparison target application is the same as the reference application when the developer signature and the APK internal file information match;

If the developer signature matches, but the APK internal file information does not match, the comparison target application is determined to be the repackaging application of the developer

The similarity detection method of the application, further comprising.
The method of claim 8,

The process of analyzing the similarity,

If the developer signature does not match, but the information in the APK internal file information, the comparison target application is determined to be a repackaging application by someone other than the developer;

If the developer signature does not match and the internal file information of the APK does not match, comparing the class and method information of the extracted file information, and measuring the similarity to determine whether the forgery by others

The similarity detection method of the application, further comprising.
The method of claim 7, wherein

The similarity detection method,

Transmitting similarity analysis result information analyzed by measuring the similarity to a user's mobile device or an application store server

The similarity detection method of the application, further comprising.