METHOD AND DEVICE FOR EXTRACTING CHARACTERISTIC CODE OF APK VIRUS

• US 20150052611A1
• Filed: 03/12/2013
• Published: 02/19/2015
• Est. Priority Date: 03/21/2012
• Status: Active Grant

• Current Assignee: Beijing Qihu Technology Co. Ltd. (360 Security Technology, Inc.)
• Original Assignee: Beijing Qihu Technology Co. Ltd. (360 Security Technology, Inc.)
• Inventors: Wang, Xun, Zhang, Xu
• Granted Patent: US 9,600,668 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Disclosed are a method and a device for extracting a characteristic code of an APK virus. The method comprises: scanning a designated file in an Android installation package APK; extracting an operation instruction in the designated file, and judging whether the operation instruction contains virus information; and if yes, generating a characteristic code of the virus according to the operation instruction. In the application, the characteristic code of the virus APK can be accurately and effectively extracted, so as to facilitate improvement of efficiency and accuracy of identification of the virus APK and a variation thereof, thereby improving the security of an APK application.

Claims

1. A method for extracting a characteristic code of APK virus, comprising:

scanning a designated file in an Android installation package APK;

extracting an operation instruction in the designated file, and judging whether the operation instruction contains virus information; and

if yes, generating a virus characteristic code according to the operation instruction.

2. The method according to claim 1, wherein the designated file comprises an executable file, the executable file comprises a Dex file, the Dex file comprises a classes.dex file, a file with an extension name .jar, and a file in Dex format.

3. The method according to claim 2, wherein the method further comprises:

extracting a constant in a constant pool of the executable file, and judging whether the constant contains virus information;

if yes, generating a virus characteristic code according to the constant.

4. The method according to claim 3, wherein the method further comprises:

extracting header information of the executable file, and judging whether the header information contains virus information;

if yes, generating a virus characteristic code according to the header information.

5. The method according to claim 1, wherein the operation instruction comprises opcode and operand, and the step of judging whether the operation instruction contains virus information comprises:

judging whether the operand includes a pre-defined illegal operand;

and/or

judging whether the combination of the opcode and operand complies with a predefined illegal combination rule.

6. The method according to claim 5, wherein the step of generating a virus characteristic code according to the operation instruction comprises:

regarding the operation instruction itself as the virus characteristic code;

and/or

regarding the opcode of the operation instruction and a character string or wildcard of the operand as the virus characteristic code.

7. The method according to claim 3, wherein the constants in the constant pool in the executable file include constants in character strings, types, fields and methods, and the step of judging whether constants contain virus information comprises:

judging whether constants in the character strings contain pre-defined malicious web address information, malicious file names or malicious number information;

and/or,

judging whether constants in the types, fields an methods invoke a self-defined class name, a self-defined function name, an Android system SDK class name, or an Android system function name;

the step of generating a virus characteristic code according to the constant is regarding the virus information in the constant as the virus characteristic code.

8. The method according to claim 4, wherein the header information of the executable file includes summary information checksum and signature information Signature, and the step of judging whether the header information includes the virus information includes:

judging whether the summary information checksum and/or signature information Signature include a pre-defined illegal character string;

the step of generating the virus characteristic code according to the header information is regarding the summary information checksum and/or signature information Signature as the virus characteristic code.

9. The method according to claim 1, wherein the designated file further comprises a text file, and the operation instruction is a linux command,

the step of judging whether the operation instruction includes the virus information is judging whether the linux command complies with a preset malicious linux command;

the step of generating the virus characteristic code according to the operation instruction is regarding the linux command as the virus characteristic code.

10. The method according to claim 1, wherein the method further comprises:

storing the virus characteristic code in the database.

11. The method according to claim 10, wherein the virus characteristic code comprises:

header information characteristic code, constant characteristic code, operand characteristic code, instruction characteristic code, instruction characteristic code sequence, and class name function name characteristic code;

the step of storing the virus characteristic code in the database comprises;

storing the header information characteristic code, constant characteristic code, operand characteristic code, instruction characteristic code, instruction characteristic code sequence, and class name function name characteristic code respectively in different storage areas of the database;

or

storing the header information characteristic code, constant characteristic code, operand characteristic code, instruction characteristic code, instruction characteristic code sequence, class name function name characteristic code in the database, and marking a classification tag respectively.

12. A device for extracting a characteristic code of APK virus, comprising:

a scanning module configured to scan a designated file in an Android installation package APK;

an instruction extracting module configured to extract an operation instruction in the designated file;

an instruction judging module configured to judge whether the operation instruction contains virus information; and

a first characteristic code generating module configured to generate a virus characteristic code according to the operation instruction if the operation instruction contains the virus information.

13. The device according to claim 12, wherein the designated file comprises an executable file, the executable file comprises a Dex file, the Dex file comprises a classes.dex file, a file with an extension name .jar, and a file in Dex format.

14. The device according to claim 13, wherein it further comprises:

a constant extracting module configured to extract a constant in a constant pool of the executable file;

a constant judging module configured to judge whether the constant includes virus information;

a second characteristic code generating module configured to generate the virus characteristic code according to the constant if the constant contains the virus information.

15. The device according to claim 14, wherein it further comprises:

a header information extracting module configured to extract header information in the executable file;

a header information judging module configured to judge whether the header information includes virus information;

a third characteristic code generating module configured to generate a virus characteristic code according to the header information if the header information contains the virus information.

16. The device according to claim 12, wherein the operation instruction comprises opcode and operand, and the instruction judging module comprises:

a first judging submodule configured to judge whether the operand includes a pre-defined illegal operand;

and/or

a second judging submodule configured to judge whether the combination of the opcode and operand complies with a predefined illegal combination rule.

17. The device according to claim 16, wherein the first characteristic code generating module comprises:

a direct generation submodule configured to regard the operation instruction itself as the virus characteristic code;

and/or

a transformational generation submodule configured to regard the opcode of the operation instruction and a character string or wildcard of the operand as the virus characteristic code.

18. The device according to claim 14, wherein the constants in the constant pool in the executable file include constants in character strings, types, fields and methods, and the constant judging module comprises:

a third judging module configured to judge whether constants in the character strings contain pre-defined malicious web address information, malicious file names or malicious number information;

and/or,

a fourth judging submodule configured to judge whether constants in the types, fields an methods invoke a self-defined class name, a self-defined function name, an Android system SDK class name, or an Android system function name.

19. The device according to claim 12, wherein the designated file further comprises a text file, and the operation instruction is a linux command, and the instruction judging module comprises:

a fifth judging submodule configured to judge whether the linux command complies with a preset malicious linux command.

20. (canceled)

21. (canceled)

22. (canceled)

23. A computer readable medium which stores the computer program comprising computer readable codes, and running of said computer readable codes on a computing device causes said device to carry out a method for extracting a characteristic code of APK virus, said method comprising:

scanning a designated file in an Android installation package APK;

extracting an operation instruction in the designated file, and judging whether the operation instruction contains virus information; and

if yes, generating a virus characteristic code according to the operation instruction.