An Efficient Scheme of Detecting Repackaged Android Applications.docVIP

An Efficient Scheme of Detecting Repackaged Android Applications 　　Abstract 　　The increasing popularity of Android devices gives birth to a large amount of feature?rich applications （or apps） in various Android markets. Since adversaries can easily repackage malicious code into benign apps and spread them， it is urgent to detect the repackaged apps to maintain healthy Android markets. In this paper we propose an efficient detection scheme based on twice context triggered piecewise hash （T?CTPH）， in which CTPH process is called twice so as to generate two fingerprints for each app to detect the repackaged Android applications. We also optimize the similarity calculation algorithm to improve the matching efficiency. Experimental results show that there are about 5% repackaged apps in pre?collected 6438 samples of 4 different types. The proposed scheme improves the detection accuracy of the repackaged apps and has positive and practical significance for the ecological system of the Android markets. 　　Keywords 　　Android； repackage； similarity； edit distance 　　1 Introduction 　　In the past few years， Android has developed strikingly and dominated the smartphone market with its market share exceeding Apple. The IDC study shows Android took up 82.8 percent of worldwide smartphone market in the second quarter of 2015 [1]. The popularity is also propelled by the large collection of feature?rich applications in various markets， including the official marketplaces （such as Google Play） or third?party ones （for example， Amazon Appstore or Wandoujia）， from which Android users can download a wide variety of feature?rich apps about social networking， shopping， playing， etc. These apps in return foster an emerging app?centric business model and drive innovations across personal， social， and enterprise fields. 　　Android application developers usually release their apps in the Android market and get revenue by embedding advertisements or charging directly. However， a large