Detection of repackaged mobile applications

• US 9,760,711 B1
• Filed: 03/08/2016
• Issued: 09/12/2017
• Est. Priority Date: 09/03/2014
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Zhang, Zhibo, Sun, Liang, Tao, Chengkai, Ma, Kun
• Primary Examiner(s): Shayanfar, Ali
• Application Number:
  US15/064,068
• Time in Patent Office: 553 Days
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A repackaged mobile app that has been unpacked and repackaged back is detected based on similarity of app labels of a target mobile app being evaluated and a reference mobile app. The similarity of the sound of the app label of the target mobile app to the sound of the app label of the reference mobile app may be determined. The similarity of the appearance of the app label of the target mobile app to the appearance of the app label of the reference mobile app may also be determined. The target mobile app may be deemed to be a repackaged mobile app when the app labels of the target and reference mobile apps are deemed to be similar (which may include being the same) but the target and reference mobile apps have different identifiers.

Claims

1. A computer-implemented method comprising:

receiving, in a computer system, a target mobile app that has been obtained from a third-party mobile app market place, the target mobile app being an application program for a mobile computing device that runs a mobile operating system;

generating a sound similarity score by comparing a pronunciation of an app label of the target mobile app to a pronunciation of an app label of a reference mobile app, the sound similarity score being indicative of similarity of the pronunciation of the app label of the target mobile app to the pronunciation of the app label of the reference mobile app;

determining a similarity of the app label of the target mobile app to the app label of the reference mobile app by comparing the sound similarity score to a threshold and by comparing an appearance of the app label of the target mobile app to an appearance of the app label of the reference mobile app, wherein comparing the appearance of the app label of the target mobile app to the appearance of the app label of the reference mobile app comprises converting the app label of the target mobile app into an image and comparing the image of the app label of the target mobile app to an image of the app label of the reference mobile app; and

determining that the target mobile app is a repackaged version of the reference mobile app when the app labels of the target and reference mobile apps are similar but the target and reference mobile apps have different public keys.

2. A system comprising:

a computer system comprising a memory and a processor, wherein the memory comprises instructions that when executed by the processor causes the computer system to;

receive a target mobile app for a mobile computing device that runs a mobile operating system, generate a sound similarity score by comparing a pronunciation of an app label of the target mobile app to a pronunciation of an app label of a reference mobile app, determine similarity of the pronunciation of the app label of the target mobile app to the pronunciation of the app label of the reference mobile app by comparing the sound similarity score to a threshold, determine a similarity of an appearance of the app label of the target mobile app to an appearance of the app label of the reference mobile app by converting the app label of the target mobile app into an image and comparing the image of the app label of the target mobile app to an image of the app label of the reference mobile app, and determine that the target mobile app is a repackaged version of the reference mobile app when the app labels of the target and reference mobile apps are determined to be similar in pronunciation and appearance but the target and reference mobile apps have different public keys,

wherein the target mobile app has been obtained from a third-party mobile app marketplace and the sound similarity score is indicative of similarity of the pronunciation of the app label of the target mobile app to the pronunciation of the app label of the reference mobile app.

3. A computer-implemented method comprising:

receiving a target mobile app in a computer system, the target mobile app having been obtained from a third-party mobile app market place;

generating a sound similarity score by comparing a pronunciation of an app label of the target mobile app to a pronunciation of an app label of a reference mobile app;

generating an appearance similarity score by comparing an appearance of the app label of the target mobile app to an appearance of the reference mobile app by converting the app label of the target mobile app into an image and comparing the image of the app label of the target mobile app to an image of the app label of the reference mobile app;

determining overall similarity of the app label of the target mobile app to the app label of the reference mobile app by comparing the sound similarity score and the appearance similarity score to a threshold; and

determining that the target mobile app is a repackaged version of the reference mobile app when the app labels of the target and reference mobile apps are determined to be similar in pronunciation and appearance but the target and reference mobile apps have different public keys.