Patent ID: 11934495
Assignee: FOUNDATION OF SOONGSIL UNIVERSITY INDUSTRY COOPERATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A device, comprising:
one or more processors; and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, perform automatically identifying anti-analysis techniques applied to an application in mobile environments,
and further comprising:
automatically identifying anti-analysis techniques applied to an application in mobile environments, comprising:
an extraction unit which extracts a DEX file and an ELF file from an application file after unpacking the application file, which is in an APK format and includes compressed execution code to be executed on Android;
a parsing unit which decompiles the extracted DEX file and ELF file and parses the decompiled files to acquire a signature, wherein the signature includes a character string signature, an API function signature, and a binary signature;
a detection unit which receives the acquired signature classified according to types of the signature, analytically compares the input signature with the signature stored in a database, and detects the signature used in the anti-analysis technique; and
a determination unit which determines according to the detected signature what anti-analysis technique is applied to the application, wherein the detection unit includes a character string detection module, an API detection module, and a binary detection module,
wherein the character string detection module is configured to detect a matched character string signature by receiving one or more character string signatures extracted from the parsed DEX file and ELF file, and comparing the received one or more character string signatures with the character string signature stored in the database,
wherein the API detection module is configured to detect a matched API function signature by receiving one or more API function signatures extracted from the parsed ELF file, and comparing the received one or more API function signatures with the API function signature stored in the database,
wherein the binary detection module is configured to detect a matched binary signature by receiving one or more binary signatures extracted from the parsed ELF file, and comparing the received one or more binary signatures with the binary signature stored in the database in advance.