Patent ID: 11934495
Assignee: FOUNDATION OF SOONGSIL UNIVERSITY INDUSTRY COOPERATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 5:
6. A method for automatically identifying anti-analysis techniques using a device for automatically identifying anti-analysis techniques in mobile environments, comprising:
extracting a DEX file and an ELF file by receiving an application through the device for automatically identifying anti-analysis techniques, and unpacking an execution code compressed in an APK format, and included in the received application;
acquiring a signature by decompiling the extracted DEX file and ELF file and parsing each of decompiled files, wherein the signature includes a character string signature, an API function signature, and a binary signature;
detecting the signature used in anti-analysis technique by receiving the acquired signature classified according to types of the signatures, and analytically comparing the input signature with the signature stored in a database; and
determining the anti-analysis technique applied to the application according to the detected signature,
wherein in detecting the signatures,
a matched character string signature is detected by receiving one or more character string signatures extracted from the parsed DEX file and ELF file, and comparing the received one or more character string signatures with the character string signature stored in the database,
a matched API function signature is detected by receiving one or more API function signatures extracted from the parsed ELF file and comparing the received one or more API function signatures with the API function signature stored in the database, and
a matched binary signature is detected by receiving one or more binary signatures extracted from the parsed ELF file and comparing the received one or more binary signatures with the binary signature stored in the database in advance.