Research On Repackaging Detection Technology Of Mobile Application Based On Grid-Vector Group Graph

With the continuous popularity of mobile devices,the number of mobile applications is also showing an explosive growth in recent years.Android system is the most widely used mobile operating system which has brought changes to people's life style.However,due to the open-source nature of the Android system and the universality of Android applications,lawbreakers take Android applications as their target and take a series of means to obtain illegal interests from Android applications.Among these methods,repackaging has become one of the most important attacks.Android repackaging in our work refers to the core process of unpacking an Android application package and repackaging it after a probable modification.During repackaging,the decompiled code and/or other resource files of the target apps may be modified.These modifications can be conducted by attackers for their illegal purposes.The repackaged application may infringe the legitimate interests of users and developers and even harm the entire Android market and Android ecological environment.Therefore,it is important to detect the repackaging application in the application market.In order to detect the Android repackaging,researchers put forward many methods and technologies.Software birthmark [1] technology is one of the most important technologies.Software birthmark technology extracts the unique,stable and identifying structural or behavioral features of the software by static or dynamic means.By comparing the birthmarks of different software,software cloning and plagiarism can be further detected.However,many software birthmarks are easily affected by application confusion and encryption which leads to the unreliability of extracted software birthmark information.At the same time,the hybrid structure of mobile application makes it more difficult to extract stable and unified information which further increases the difficulty of repackaging detection.In addition,a lot of work has poor efficiency on repackaging detection and can not be well applied to the application market.In order to make use of the popularity of the original application,the repackaged application usually maintains a similar appearance with the original application.The repackaged application and the original application have a high similarity in the application graphical user interface and the interaction mode.Therefore,it is feasible to extract software birthmark from graphical user interface information.In this paper,we proposed a new software birthmark model: Grid-Vector Group Graph(GVGG)and established the framework of repackaging application detection based on it.It greatly accelerates the calculation speed of similarity between software birthmarks and then we realized a prototype of repackaging detection system.In summary,the main contributions of this paper are as follows:1.Based on the existing abstract software birthmark model,we propose a more accurate and efficient software birthmark model.This model optimizes the data processing method of graphical user interface in the software birthmark,proposes a more efficient encoding method-grid vector coding and establishes the software birthmark model-Grid-Vector Group Graph.The grid vector coding can deal with most of the current application confusion and encryption.At the same time,it can deal with the impact of existing heterogeneous applications and effectively deal with the native Android applications and most hybrid applications.2.Most of the existing software birthmark models are based on calculating the similarity of software birthmark of two applications to detect whether it is a repackaging application pair.We propose a framework of repackaging detection based on Grid-Vector Group Graph which optimizes the maximum weight bipartite graph matching algorithm of JGrapht [2].It greatly optimizes the application similarity calculation algorithm and improves the speed of similarity calculation.The average time of similarity calculation for each pair of applications is only 59 microseconds.Compared with Rep Droid [3] and Region Droid [4],the similarity calculation speed is increased by more than 100 times,which meets the efficiency of large-scale market detection and has the prospect of large-scale market application.3.Based on the software birthmark model-Grid-Vector Group Graph proposed in this paper,we implement the prototype tool system.We integrate the data acquisition module,data storage module,birthmark generation module,birthmark comparison module and detection results visualization module.The system provides application market managers with the supervision and management functions.