Research On Android Application Repackaging Detection Based On Visual Content Similarity

In the mobile Internet era, Android smart mobile devices increasingly become an integral part of people's life. There are tens of thousands of new mobile applications come into people's vision every day. For some special benefits, some hackers adopt repackaging technology to achieve improper goal, which leads to the arbitrary emergence of repackaged applications. Repackaged application refers to the pirated applications. The hackers decompiled the genuine applications released on the market, and tampered with the content of them. Then the application files were repacked into new applications. Finally, the applications were resigned. The repackaged applications disguised as genuine applications are put into market again to mix with the genuine ones so as to cheat or lure users to download and install. Such repacking behavior of applicaitions not only leads to the loss of the interests of the application's originator, but also causes the leakage of users' privacy and the threat of their property security.In order to strengthen the monitor of pirated application in various application markets and maintain a good ecological environment of Android Application, many research institutions and industry companies are in great efforts to study how to detect repackaged applications. Aiming at solving the problems existing in the detection of repackaged application at present, this thesis presents an improved method based on the calculation of application's visual content similarity to detect repackaged ones. This is a novel method in the field of the detection of repackaged Android application. The main idea is to extract applications' visual layout information through traversing the application interfaces dynamically. Then we generate a unique fingerprint for every application. The repackaged applications will be recognized according to the similarity of applications' fingerprints eventually.Compared with traditional repackaging detection technology, the innovation of the proposed method is that it is based on the visual content of applicaitons. First of all, this method calculates application's visual content. The detection is based on application's visual content rather than its code characteristics. The extraction of application features combines the visual content of the application with the unique characteristics of the dynamic runtime trajectory. So the accuracy of the detection is improved in this way. Secondly, the visual content of the application is obtained by automated traversal technology in the dynamic operation, so the limitations that the reinforcement applications are hard to cope with through previous static detection technology can be overcomed. Finally, a prototype system called ATdroid is implemented.