COMPARING APPLICATIONS AND ASSESSING DIFFERENCES

• US 20150302182A1
• Filed: 04/21/2015
• Published: 10/22/2015
• Est. Priority Date: 10/21/2008
• Status: Active Grant

• Current Assignee: Lookout Incorporated
• Original Assignee: Lookout Incorporated
• Inventors: Strazzere, Tim, Mahaffey, Kevin Patrick, Swami, Yogesh, Wyatt, Timothy Micheal
• Granted Patent: US 9,563,749 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3452 Performance evaluation by statistical analysis
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 2201/88 Monitoring involving counting
• CPC Class Codes: G06F 2213/0038 System on Chip
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud

Abstract

An analysis including a comparison is performed of first and second applications and a determination is made regarding whether the first is a counterfeit version of the second application, or vice-versa. Based on the analysis and comparison, and based on an assessment of the first application, an assessment of the second application may be generated.

Claims

1. A method for identifying counterfeit mobile application programs comprising:

measuring, at a server, a degree of similarity, the measuring including comparing first metadata describing a first mobile application program and second metadata describing a second mobile application program; and

,

if the degree of similarity is within a threshold degree of similarity;

comparing the first mobile application program with the second mobile application program to identify differences between the first and second mobile application programs,

identifying at least one difference between the first and second mobile application programs, and

based on the identified at least one difference, and the degree of similarity being within the threshold degree of similarity, determining that one of the first or second mobile application programs is a counterfeit of the other first or second mobile application programs.

2. The method of claim 1 wherein the determining that one of the first or second mobile application programs is a counterfeit comprises determining that the first mobile application program is the counterfeit of the second mobile application program based on the at least one identified difference being a price of the first mobile application program is less than a price of the second mobile application program.

3. The method of claim 1 wherein the first mobile application program is from a first source of mobile application programs, the second mobile application program is from a second source of mobile application programs, different from the first source, and the method comprises:

designating one of the first or second sources as being an official source for mobile application programs;

if the one official source for mobile application programs is the first source, determining that the second mobile application program is the counterfeit of the first application program; and

if the one official source for mobile application programs is the second source, determining that the first mobile application program is the counterfeit of the second mobile application program.

4. The method of claim 1 wherein the first metadata includes a description of the first mobile application program, and the second metadata includes a description of the second mobile application program.

5. The method of claim 1 wherein the step of measuring, at a server, a degree of similarity comprises at least one of:

comparing a title of the first mobile application program with a title of the second mobile application program,

comparing a description of the first mobile application program with a description of the second mobile application program, or

comparing an application icon of the first mobile application program with an application icon of the second mobile application program.

6. The method of claim 1, the measuring, at a server, a degree of similarity further including detecting code similarity between the first mobile application program and the second mobile application program.

7. The method of claim 1, the measuring, at a server, a degree of similarity further including comparing an application resource of the first mobile application program with an application resource of the second mobile application program, wherein an application resource comprises at least one of images, text, or sound.

8. The method of claim 1 wherein the identified at least one difference comprises the first and second mobile application programs having different package names, the first and second mobile application programs having been signed with different code-signing certificates, the first and second mobile application programs having different requested permissions, the first and second mobile application programs having different digital rights management (DRM) protection, the first and second mobile application programs having different publisher names, the first and second mobile application programs having different account identifiers issued by an ad network, or the first and second mobile application programs having different behavior.

9. The method of claim 1 wherein the identified at least one difference comprises one of the first or second mobile application programs having malware, and the other of the first or second mobile application programs not having malware, and

wherein the one of the first or second mobile application programs having malware is the counterfeit mobile application program.

10. The method of claim 1 wherein the step of comparing the first mobile application program with the second mobile application program to identify differences between the first and second mobile application programs comprises at least one of:

comparing an application binary of the first mobile application program with an application binary of the second mobile application program, or

comparing data extracted from the application binary of the first mobile application program with data extracted from the application binary of the second mobile application program.

11. The method of claim 1 wherein the first and second mobile application programs are from a same source of mobile application programs.

12. A method comprising:

analyzing, at a server, a first mobile application program;

generating a first assessment of the first mobile application program;

correlating a second mobile application program with the first mobile application program using a correlation criterion; and

based on the first assessment of the first mobile application program and the correlation of the second mobile application program with the first mobile application program, generating a second assessment of the second mobile application program.

13. The method of claim 12 comprising before the steps of analyzing a first mobile application program and correlating a second mobile application program:

downloading, over a network, the first mobile application program from a first source of mobile application programs; and

downloading, over the network, the second mobile application program from a second source of mobile application programs, different from the first source.

14. The method of claim 12 comprising before the steps of analyzing a first mobile application program and correlating a second mobile application program:

downloading, over a network, the first and second mobile application program from a source of mobile application programs.

15. The method of claim 12 wherein the correlation criterion comprises a bit sequence, a string value, a media asset, computer code, a package name, a fingerprint of a code signing certificate, a developer name, a developer account, an application icon, an application image, an application title, or extracted statistical properties.

16. The method of claim 12 wherein the step of correlating a second mobile application program with the first mobile application program comprises using a code similarity algorithm.

17. The method of claim 12 comprising if the first assessment includes a determination that the first mobile application program is malicious the second assessment includes a determination that the second mobile application program is malicious.

18. The method of claim 12 wherein the second assessment comprises a determination that the second mobile application program is substantially the same as the first mobile application program.

19. The method of claim 12 wherein the step of generating a second assessment comprises:

comparing application code of the first and second mobile application programs; and

comparing digital rights management (DRM) protection of the first and second mobile application programs, wherein the second assessment includes a determination that the application code of the first and second mobile application programs is the same, and a determination that the DRM protection of the first and second mobile application programs is different.

20. The method of claim 12 wherein the second assessment comprises a determination that the second mobile application program is an upgraded version of the first mobile application program.

21. The method of claim 12 wherein the second assessment comprises a determination that the second mobile application program is a pirated version of the first mobile application program.

22. The method of claim 12 wherein the second assessment comprises a determination that a third party has repackaged the first application program with tampered contents into the second mobile application program.

23. The method of claim 12 wherein the second assessment comprises a determination that the second mobile application program is produced by the same author as the first mobile application program, and the first assessment comprises a determination that the first mobile application program is malicious.

24. A method for reducing the examining of entries in an ordered set by stopping the examining after determining that a threshold number of application programs corresponding to entries in the ordered set have been previously retrieved, the method comprising:

examining a first entry in an ordered set that identifies application programs available from a source of application programs, wherein entries in the ordered set correspond to the application programs available from the source;

determining that an application program corresponding to the first entry has been previously retrieved;

upon determining that the application program corresponding to the first entry has been previously retrieved, updating an overlap counter variable;

comparing the updated overlap counter variable with a threshold overlap value; and

based on the comparison, examining a second entry in the ordered set, the second entry next in the order to the first entry, to determine whether an application program corresponding to the second entry has been retrieved, or determining that application programs corresponding to remaining entries in the ordered set have been previously retrieved and not examining the remaining entries.

25. The method of claim 24 comprising:

after the step of determining that the application program corresponding to the first entry has been previously retrieved, incrementing the overlap counter variable;

if the incremented overlap counter variable is less than the threshold overlap value, examining the second entry in the ordered set; and

if the incremented overlap counter variable is greater than or equal to threshold overlap value, determining that the application programs corresponding to the remaining entries in the ordered set have been previously retrieved, and not examining the remaining entries.

26. The method of claim 24 comprising:

after the step of determining that the application program corresponding to the first entry has been previously retrieved, decrementing the overlap counter variable;

if the decremented overlap counter variable is greater than the threshold overlap value, examining the second entry in the ordered set; and

if the decremented overlap counter variable is less than or equal to the threshold overlap value, determining that the application programs corresponding to the remaining entries in the ordered set have been previously retrieved, and not examining the remaining entries.

27. The method of claim 24, wherein the entries in the ordered set are ordered by publication dates of the corresponding application programs.