Soongsil University

Jeong Hyun Yi

Jin Hyuk Jung

Hyun Yi Yi

Si Wan Kim

Gun Il Ma

Sunjun Lee

Yong Gu Shin

Kichang Kim

Tae Jin Kim

Jin Sung Kim

Kyu Ho Kim

Yong Jin Park

Minseong Choi

Eun Byeol Ko

Jongsu Lim

Yeong Hun Ban

Min Koo Kang

Sun Jun Lee

Gun-Il Ma

Hyeong Chan Lee

Sung Ryoung Kim

Geon Bae Na

A code sequence based intelligent key code identification method includes extracting Smali code sequence by decompiling an application, vectorizing the extracted Smali code sequence to construct a training dataset, training a deep learning model with the vectorized Smali code sequence to generate a classifier, generating a category classification result using Smali code sequence of a target application as input of the classifier, and identifying and providing important Smali code sequence from which the classification result of the target application is derived. Accordingly, it is possible to objectively evaluate the application using Smali code sequence of the application being actually run.

Code sequence based intelligent key code identification method and recording medium and device for performing the same

A device for automatically identifying anti-analysis techniques by using the signature extraction, includes an extraction unit which extracts a DEX file and an ELF file from an application file after unpacking the application file, which is in an APK format and includes compressed execution code to be executed on Android, a detection unit which receives the acquired signature classified according to types of the signature, analytically compares the input signature with the signature stored in a database, and detects the signature used in anti-analysis techniques, and a determination unit which determines according to the detected signature what anti-analysis technique is applied to the application. According to the present invention, it is possible to enable an appropriate and quick response to damages due to malicious applications by shortening the time required for analysis and automatically recognizing the application to which the anti-analysis technique is applied.

Device for automatically identifying anti-analysis techniques by using signature extraction and method therefor

A method for evaluating the risk of data leakage in an application includes the steps of: extracting a DEX (Dalvik Executable) file and a so (Shared Object) file by decompressing an APK file of a mobile application; extracting DEX code information from the DEX file by parsing the DEX file; translating a content of the so file into IR (Intermediate Representation); extracting IR code information from the translated IR; generating a call-reference structure between the DEX file and the so file by processing the extracted DEX code information and the extracted IR code information; and outputting weakness information according to a risk designated in advance based on the generated call-reference structure. Accordingly, it is possible to extend the call-reference coverage of an android application.

Method for evaluating risk of data leakage in application, recording medium and device for performing the method

A process wrapping method for bypassing native code anti-analysis includes receiving an execution instruction intended to run in an application from an Android framework when the application starts, extracting metadata of string and method from a compiled OAT file using an oatdump tool in the Android framework, determining if anti-analysis techniques are applied by comparing with information of a database (DB) based on the transmitted execution instruction and the extracted metadata, modifying the execution instruction based on the determined information when the anti-analysis technique is applied, and sending the modified execution instruction back to the Android framework. Accordingly, it is possible to provide an environment in which malicious applications to which anti-analysis techniques are applied can be easily analyzed.

Process wrapping method for evading anti-analysis of native codes, recording medium and device for performing the method

A mobile malicious code classification method based on feature selection includes extracting Application Programming Interface (API) feature information including a package name, a class name, a method name and a description from a malicious application of a predefined category, vectorizing a training dataset generated using the package name, the class name and the method name in the API feature information for deep learning, learning the vectorized training dataset to generate a classifier, probabilistically classifying to fit a target malicious application into a category, and defining the category of the target malicious application using a result of the classification and outputting a classification important API. Accordingly, it is possible to deal with malicious behaviors of malicious applications quickly and prevent damage caused by the malicious behaviors.

Mobile malicious code classification method based on feature selection and recording medium and device for performing the same

A mobile application malicious behavior pattern detection method based on Application Programming Interface (API) call graph extraction includes extracting an API Call Graph (ACG) representing an API call flow from benign applications and applications which perform malicious behavior, generating and vectorizing a training dataset for deep learning using the extracted ACG, generating a deep learning algorithm prediction model by training with the vectorized training dataset, extracting ACG features used in the malicious behavior from the generated prediction model and extracting a malicious behavior pattern from an intersection of the malicious applications, and classifying an application which performs malicious behavior through similarity comparison between the extracted malicious behavior pattern and a pattern extracted from the target application. Accordingly, it is possible to detect the malicious behavior itself using the ACG representing an API call flow.

Mobile application malicious behavior pattern detection method based on API call graph extraction and recording medium and device for performing the same

Provided is a method for bypassing an analysis evasion technique, which includes: loading a dummy DEX file; parsing a dummy method containing a dummy code from the dummy DEX file; a bypass point identifying step of determining whether a function to be currently called is a bypass target function to which the analysis evasion technique is applied; a branch target point changing step of changing information according to the determination result so that the dummy code is executed instead of the call target function; and a dummy code executing step of transmitting the dummy code to a framework of the application, so that a modulated framework is executed with a bypass code.

Device and method for bypassing analysis evasion technique, and recording medium for a program for performing the same

Provided is a method of application malware detection based on dynamic Application Programming Interface (API) extraction, and a readable medium and an apparatus for performing the same. The method of application malware detection based on dynamic API extraction includes generating an API classifier which classifies an input API as malicious or benign using API used in a sample application classified as malicious application apps or benign application apps, and inputting a pre-stored target API into the API classifier to classify the target API as malicious or benign.

Method of application malware detection based on dynamic API extraction, and readable medium and apparatus for performing the method

A dynamic code extraction-based automatic anti-analysis evasion and code logic analysis apparatus, includes: a recognition module that extracts a DEX file and a SO file by unpacking an execution code of an application and recognizes an analysis avoidance technique by comparing a signature which is included in the extracted DEX file and SO file; a instrumentation module that extracts a code to be analyzed from a byte code configuring the DEX file and a native code configuring the SO file, compares the extracted code with the data stored in a database, and outputs a code excluding an anti-analysis technique as a log file; and a deobfuscation module that deobfuscates an obfuscated code which is included in the APK on the basis of the output log file and generates an APK file in which an obfuscation technique is released on the basis of the deobfuscated code.

Dynamic code extraction-based automatic anti analysis evasion and code logic analysis apparatus

Provided is a method of application security vulnerability evaluation based on tree boosting and a readable medium and an apparatus for performing the same. The method of application security vulnerability evaluation based on tree boosting includes the step of generating an API classifier which classifies an input API as benign or malicious using a tree boosting-based algorithm, the step of calculating security vulnerability score of API using the API classifier, and the step of classifying a target application as a malicious application or a benign application according to the security vulnerability score of API used in the target application.

Method of application security vulnerability evaluation based on tree boosting, and readable medium and apparatus for performing the method

Disclosed is an apparatus for tamper protection of an application which includes: an input unit that receives codes to be used for an application; a code separator that separates the inputted codes into sensitive codes requiring application tamper protection and general codes including sensitive method calling routine for calling the sensitive codes by analyzing the input codes; an encoder that encrypts the sensitive codes and inserts the address of an sensitive code connector storing the address information of the sensitive codes; a controller that converts the sensitive method calling routine to be able to call dummy codes by inserting the dummy codes to the general codes, inserts vector table generator, to the sensitive codes, and insert a sensitive method calling routine converter, to the sensitive codes; and a code combiner that creates the application by combining the general codes and the sensitive codes.

Apparatus for tamper protection of application code and method thereof

Apparatus for tamper protection of application code based on self modification and method thereof

Disclosure relates to a method of sharing a session key between wireless communication terminals using a variable-length authentication code. The method includes: generating a public key by using an own private key; generating a message including the public key and a first random number and encoding the message using an own secret key to exchange an encrypted message with the other terminal; decoding the encrypted message of the other terminal by receiving a secret key of the other terminal; generating an authentication code by calculating the first random number and a second random number included in the decoded message; obtaining a medium value from the authenticated code; and generating a session key by using a public key included in the decoded message of the other terminal.

Method of sharing a session key between wireless communication terminals using a variable-length authentication code

Provided are method and apparatus for authenticating a password of a user terminal. The method includes: pre-setting, by a user, a password and an identification image for identifying the password; moving a keypad window or an image window realized on a screen of the user terminal according to an action of the user; determining, when a plurality of images included in the image window and a plurality of keys included in the keypad window sequentially overlap with each other, whether a plurality of keys and the identification image corresponding to the password sequentially overlap; and authenticating the password when the plurality of keys and the identification image corresponding to the password sequentially overlap. Accordingly, password information may be protected from a third person observation as the user inputs a pre-set password in an indirect method without having to directly input the pre-set password through an authentication interface.

Method and apparatus for authenticating password of user terminal

Disclosed is an apparatus for code obfuscation includes: an input unit that receives execution codes for android applications; a code analyzer that separates the input execution codes into sensitive codes that needs to be protected from application forgery attack and general codes except for the sensitive codes by analyzing the input execution codes; a dalvik to C code converter that creates native codes by converting the sensitive codes into a C code; an obfuscator that obfuscates the native codes and the general codes; a self code protector that encrypts the obfuscated native codes by adding a tamper-detection code to the obfuscated native codes and then creates self-modified native codes by adding a loading routine; and a code combiner that combines the self-modified native codes with the obfuscated general codes.

Growing community of inventors

Seongnam-si, South Korea

Jeong Hyun Yi