Other

Quanlong Guan

Weiqi Luo

Huanming Zhang

Lin Cui

Zhefu Li

Yuanfen Wu

Chuying Liu

Rongjun Li

Disclosed is a description-entropy-based intelligent detection method for a big data mobile software similarity. The method comprises the following steps: acquiring a path of mobile software, and reading a file of the mobile software according to the path; performing preliminary reverse engineering decompilation on the file of the mobile software to obtain function characteristics of each piece of mobile software; counting distribution of description entropy of each piece of mobile software by means of description entropy in the function characteristics; further integrating description entropy of each piece of mobile software, after integration, comparing description entropy distribution conditions among the mobile software, and carrying out similarity score calculation to obtain similarity scores among the mobile software; and outputting the similarity scores of all mobile software to obtain a mobile software similarity result. According to the method, a source code of the mobile software is acquired by means of decompilation, a function compression code is acquired, and then the description entropy is acquired; and the description entropy is used as an information amount for representing an object and used for similarity detection of the mobile software, thus greatly increasing the speed of intelligent calculation of software similarity.

Description-entropy-based intelligent detection method for big data mobile software similarity

A method for detecting mobile malware, including step S: compressing a mobile software subject to detection and a primary mobile software each containing N functions, wherein each of the functions is compressed into a hash value, a description entropy and a compressed string; S: calculating a quantity of identical functions between the mobile software subject to detection and the primary mobile software; and then finding out a quantity of similar functions using Hdsim method or entropy_descpt_sim method; and then calculating a degree of similarity to obtain a value of similarity; S: comparing the value of similarity with a predetermined threshold value; if the value of similarity is greater then or equal to the predetermined threshold value, the mobile software subject to detection is suspected to repackaging; if the value of similarity is smaller than the predetermined threshold value, the mobile software subject to detection is not suspected to repackaging.

Method for fast and intelligent comparison and security detection of mobile malware big data

Growing community of inventors

Guangdong, China

Quanlong Guan