Conew Network Technology (beijing) Co., Ltd.

Haifeng Su

Guoqing Yuan

Xin Shu

A method and device for constructing an apk virus signature database and an apk virus detection system. The method comprises: obtaining a given sample set, the sample set being composed of N normal apk file samples and N virus-infected apk file samples; for any sample in the given sample set, separately obtaining M signature values of the sample according to M preset signatures; for any sample in the given sample set, separately obtaining M signature values of the sample according to M preset signatures; for any sample subset i (i=1, . . . , 2M), determining whether the sample subset satisfies the following conditions: the ratio of the total number Ciof samples in the subset to the total number of samples in the given sample set is greater than a preset first threshold and the ratio of the total number Ciof virus-infected samples to Ciis greater than a preset second threshold, and if yes, determining a combination of signature values of M signatures corresponding to the sample subset i as a virus signature; and generating an apk virus signature database comprising a plurality of virus signatures, the apk virus signature database being used for detecting an apk file.

Growing community of inventors

Beijing, China

Haifeng Su