DETECTING APPLICATION SIMILARITY

• US 20120233163A1
• Filed: 03/08/2011
• Published: 09/13/2012
• Est. Priority Date: 03/08/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Kirkpatrick, Ficus
• Granted Patent: US 9,733,934 B2
• Time in Patent Office: Days
• US Class Current: 707/737
• CPC Class Codes: G06F 16/24 Querying
• CPC Class Codes: G06F 8/77 Software metrics
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

The subject matter of this disclosure can be implemented in, among other things, a method. In these examples, the method includes selecting for analysis by a computing device, an executable application, and identifying a group of application programming interfaces (APIs) utilized by the application when the application is executed. The method may also identifying a group of related applications that are each related to the application based on the group of APIs utilized by the application, wherein each related application of the group of related applications utilizes one or more APIs of the group of APIs utilized by the application.

Claims

1. A method comprising:

selecting for analysis, by a computing device, an executable application;

identifying, based at least in s art on source code of the application, a group of application programming interfaces utilized by the application when the application is executed; and

identifying a group of related applications that are each related to the application based on the group of application programming interfaces utilized by the application, wherein each related application of the group of related applications utilizes one or more application programming interfaces of the group of application programming interfaces utilized by the application.

2. The method of claim 1, further comprising:

receiving, from a user, an indication of a selected application executable by the computing device, wherein an identifier uniquely identifies the selected application;

retrieving, from a data repository, a group of applications identified as being related to the selected application based on the identifier that uniquely identifies the selected application; and

outputting identifiers for each of the applications of the group of applications to the user.

3. The method of claim 1, further comprising:

identifying a group of images included in the application that are displayed during execution of the application by the computing device;

identifying a second group of related applications that are each related to the application based on the group of images, wherein each related application of the second group of related applications includes one or more images similar to the group of images.

4. The method of claim 1, further comprising:

identifying a group of colors included in the graphics, images, or other visual elements of the application;

identifying a second group of related applications that are each related to the application based on the group of colors included in the application, wherein each related application of the second group of related applications includes a group of colors in the graphics, images, or other visual elements similar to the group of colors included in the graphics, images, or other visual elements of the application.

5. The method of claim 1, further comprising:

monitoring at least one of network and system behavior of the application during its execution of the application by the computing device; and

identifying the group of application programming interfaces utilized by the application during execution of the application based on the monitored behavior of the application.

6. The method of claim 1, further comprising:

applying a filter to the group of application programming interfaces utilized by the application, wherein the filter removes at least one application programming interface from being used in identifying the group of related applications when the at least one application programming interface is utilized by a number of the group of related applications that is greater than a first threshold value or when the at least one application programming interface is utilized by another number of the group of related applications that is less than a second threshold value.

7. The method of claim 1, wherein identifying the group of related applications further comprises:

determining a number of application programming interfaces utilized by each related application of the group of related applications; and

determining a degree of relatedness for each related application of the group of related applications based on the number of application programming interfaces utilized by each application.

8. The method of claim 7, wherein identifying the group of related applications further comprises:

identifying a group of colors included in the graphics, images, or other visual elements of the application; and

determining a second degree of relatedness for each related application of the group of related applications based on the group of colors.

9. The method of claim 8, further comprising:

applying a first weighting factor to the degree of relatedness determined based on the application programming interfaces and applying a second weighting factor to the second degree of relatedness identified based on the group of colors in order to determine a weighted relatedness factor for each application in the group of related applications.

10. The method of claim 9, further comprising:

applying a filter to the weighted relatedness factor, wherein the filter removes applications from the group of related applications when the weighted relatedness factor is less than a threshold value.

11. The method of claim 7, wherein identifying the group of related applications further comprises:

identifying a group of images included in the application that are displayed during execution of the application by the computing device; and

determining a second degree of relatedness for each related application of the group of related applications based on the group of images.

12. The method of claim 11, further comprising:

applying a first weighting factor to the degree of relatedness determined based on the application programming interfaces and applying a second weighting factor to the second degree of relatedness identified based on the group of images in order to determine a weighted relatedness factor for each application in the group of related applications.

13. The method of claim 12, further comprising:

applying a filter to the weighted relatedness factor, wherein the filter removes applications from the group of related applications when the weighted relatedness factor is less than a threshold value.

14. The method of claim 1, further comprising:

storing, in a data repository of the computing device, an indication of an association between the application and each related application of the group of related application.

15. The method of claim 1, wherein the application and the group of related applications are included in an application corpus, the method further comprising:

identifying the application as a malicious application; and

removing one or more applications of the group of related applications from the application corpus based on similarity to the application.

16. The method of claim 15, further comprising:

removing the application from the application corpus based on the application being identified as a malicious application.

17. The method of claim 1, wherein the application and the group of related applications are included in an application corpus, the method further comprising:

removing one of the group of related applications from the application corpus based on similarity to a previously removed application.

18. The method of claim 1, wherein identifying the group of related applications further comprises:

determining the size of the application; and

identifying the group of related applications that are each related to the application based on determined size of the application and the size of each of the group of related applications.

19. A computer-readable storage medium encoded with instructions for causing one or more programmable processors of a computing system to:

select for analysis, by the computing system, an executable application;

identify, based at least in part on code of the application, a group of application programming interfaces utilized by the application when the application is executed; and

identify a group of related applications that are each related to the application based on the group of application programming interfaces utilized by the application, wherein each related application of the group of related applications utilizes one or more application programming interfaces of the group of application programming interfaces utilized by the application.

20. A computing system comprising:

one or more programmable processors;

an application analysis module executable by the one or more programmable processors to select an application for analysis, and identify, based at least in part on code of the application, a group of application programming interfaces utilized by the application, and identify a group of related applications that are each related to the application based on the group of application programming interfaces utilized by the application, wherein each application of the group of related applications utilizes one or more application programming interfaces of the group of application programming interfaces utilized by the application.