Description-entropy-based intelligent detection method for big data mobile software similarity
20220058263 · 2022-02-24
Inventors
- Quanlong GUAN (Guangdong, CN)
- Weiqi Luo (Guangdong, CN)
- Chuying LIU (Guangdong, CN)
- Huanming Zhang (Guangdong, CN)
- Lin CUI (Guangdong, CN)
- Zhefu LI (Guangdong, CN)
- Rongjun LI (Guangdong, CN)
Cpc classification
G06F8/74
PHYSICS
International classification
Abstract
Disclosed is a description-entropy-based intelligent detection method for a big data mobile software similarity. The method comprises the following steps: acquiring a path of mobile software, and reading a file of the mobile software according to the path; performing preliminary reverse engineering decompilation on the file of the mobile software to obtain function characteristics of each piece of mobile software; counting distribution of description entropy of each piece of mobile software by means of description entropy in the function characteristics; further integrating description entropy of each piece of mobile software, after integration, comparing description entropy distribution conditions among the mobile software, and carrying out similarity score calculation to obtain similarity scores among the mobile software; and outputting the similarity scores of all mobile software to obtain a mobile software similarity result. According to the method, a source code of the mobile software is acquired by means of decompilation, a function compression code is acquired, and then the description entropy is acquired; and the description entropy is used as an information amount for representing an object and used for similarity detection of the mobile software, thus greatly increasing the speed of intelligent calculation of software similarity.
Claims
1. A method for intelligent determination of similarity of big data mobile softwares based on descriptive entropy, comprising the following steps: S1, acquiring a path for each of the mobile softwares to read the mobile softwares according to the paths; S2, performing a preliminary reverse-engineering decompilation on each of the mobile softwares to acquire function characteristics for each of the mobile softwares; S3, summarizing a descriptive entropy distribution for each of the mobile softwares through descriptive entropies in the function characteristics; S4, integrating the descriptive entropies of the mobile softwares, comparing the descriptive entropy distributions of mobile software pairs based on the integrated descriptive entropy distributions, and calculating similarity scores of the mobile software pairs; and S5, outputting the similarity scores of the mobile softwares to give a mobile software similarity result.
2. The method according to claim 1, wherein the function characteristics include: hash values, function compression codes, and descriptive entropies.
3. The method according to claim 1, wherein, in step S2, the preliminary reverse-engineering decompilation specifically comprises: acquiring source codes for each of the mobile softwares using a decompilation tool, acquiring function compression codes for each of the mobile softwares through the source codes, and calculating a floating point number representing an amount of information of a function or class, that is, the descriptive entropy from each of the function compression codes by the following formula:
Hd(substr.sub.i)=−Σ.sub.i=0.sup.np(substr.sub.i)log.sub.2 p(substr.sub.i) wherein, assuming that each of the function compression codes has n substrings, substr.sub.i is the i.sup.th substring of the function compression code, and p(substr.sub.i) is the occurrence probability of the i.sup.th substring; and storing the function compression codes, descriptive entropies, and hash values for the mobile softwares in corresponding text files.
4. The method according to claim 3, wherein, for the function or class, one function or class corresponds to one function compression code, one descriptive entropy and one hash value; one mobile software corresponds to a set of function compression codes, a set of descriptive entropies, and a set of hash values for corresponding functions.
5. The method according to claim 3, wherein the decompilation tool is Androguard.
6. The method according to claim 1, wherein step S3 specifically comprises: extracting, from each of the text files corresponding to each of the mobile softwares in step S2, a set of descriptive entropies:
Hd={hd.sub.1,hd.sub.2,hd.sub.3, . . . ,hd.sub.n} and a set of corresponding numbers of entropies:
N={n.sub.1,n.sub.2,n.sub.3, . . . ,n.sub.n} wherein, hd.sub.1 to hd.sub.n are the 1.sup.st to the n.sup.th unequal descriptive entropy values of the corresponding mobile software; n.sub.1 to n.sub.n are corresponding numbers of the 1.sup.st to the n.sup.th unequal descriptive entropy values.
7. The method according to claim 6, wherein step S4 specifically comprises: acquiring the sets of descriptive entropies for all the mobile softwares, and integrating the sets of descriptive entropies for all the mobile software in pairs to obtain a union of descriptive entropies for each pair of the mobile softwares; sets of descriptive entropies for mobile software A and mobile software B are as follows:
Hd.sub.A={hd.sub.A1,hd.sub.A2,hd.sub.A3, . . . ,hd.sub.Am};
Hd.sub.B={hd.sub.B1,hd.sub.B2,hd.sub.B3, . . . ,hd.sub.Bn}; wherein, Hd.sub.A is the set of descriptive entropies for mobile software A, Hd.sub.B is the set of descriptive entropies for mobile software B, m is a number of descriptive entropy values of mobile software A, and n is a number of descriptive entropy values of mobile software B; sets of numbers of descriptive entropy values of mobile software A and mobile software B are as follows:
N.sub.A={n.sub.A1,n.sub.A2,n.sub.A3, . . . ,n.sub.Am};
N.sub.B={n.sub.B1,n.sub.B2,n.sub.B3, . . . ,n.sub.Bn}; wherein, N.sub.A is the set of corresponding numbers of descriptive entropy values in Hd.sub.A of mobile software A, and N.sub.B is the set of corresponding numbers of descriptive entropy values in Hd.sub.B of mobile software B; the union of descriptive entropies for the mobile software pair is as follows:
D.sub.A={(x.sub.i,y.sub.i)|x.sub.iΣHd.sub.A∪B,y.sub.iΣY.sub.A};
D.sub.B={(x.sub.i,y.sub.i)|x.sub.iΣHd.sub.A∪B,y.sub.iΣY.sub.B}; a region S.sub.A in a Cartesian coordinate system is defined by the set of discrete points D.sub.A and the X axis; a region S.sub.B in the Cartesian coordinate system is defined by the set of discrete points D.sub.B and the X axis; an intersection area S.sub.A∩B of the regions S.sub.A and S.sub.B is calculated, and a union area S.sub.A∩B of the regions S.sub.A and S.sub.B is calculated; finally the similarity scores are calculated: assuming that the number of elements in the set is N, there is:
Similarity score=S.sub.A∩B/S.sub.A∪B*100
8. The method according to claim 7, wherein m+x=n+y.
9. The method according to claim 1, wherein step S5 specifically comprises: outputting the similarity scores of all mobile softwares, and determining similarities between mobile softwares to obtain a result of mobile software similarity.
Description
BRIEF DESCRIPTION OF THE DRAWINGS
[0042]
[0043]
[0044]
DETAILED DESCRIPTION OF THE INVENTION
[0045] The present invention will be further illustrated with reference to the following example and drawings, which, however, are not intended to limit the embodiments of the present invention.
Example
[0046] Provided is a method for intelligent determination of similarity of big data mobile softwares based on descriptive entropy, as shown in
[0047] Step I, acquiring a path for each of the mobile softwares to read the mobile softwares according to the paths;
[0048] Step II, performing a preliminary reverse-engineering decompilation on each of the mobile softwares to acquire function characteristics for each of the mobile softwares;
[0049] wherein the preliminary reverse-engineering decompilation specifically comprises: acquiring source codes for each of the mobile softwares using a decompilation tool Androguard, acquiring function compression codes for each of the mobile softwares through the source codes, and calculating a floating point number representing an amount of information of a function or class (i.e., the descriptive entropy) from each of the function compression code; and storing the function compression codes, descriptive entropies, and hash values for the mobile softwares in corresponding text files; the descriptive entropy is calculated by the following formula:
Hd(substr.sub.i)=−Σ.sub.i=0.sup.np(substr.sub.i)log.sub.2 p(substr.sub.i);
[0050] wherein, assuming that each of the function compression codes has n substrings, substr.sub.i is the i.sup.th substring of the function compression code, and p(substr.sub.i) is the occurrence probability of the i.sup.th substring;
[0051] furthermore, for the function or class, one function or class corresponds to one mobile software function compression code, one descriptive entropy and one hash value; one mobile software corresponds to a set of function compression codes, a set of descriptive entropies, and a set of hash values for corresponding functions.
[0052] Step III, summarizing a descriptive entropy distribution for each of the mobile softwares through descriptive entropies in the function characteristics, specifically comprising:
[0053] extracting, from each of the text files corresponding to the mobile softwares in step II, a set of descriptive entropies:
Hd={hd.sub.1,hd.sub.2,hd.sub.3, . . . ,hd.sub.n};
[0054] and a set of corresponding numbers of entropies:
N={n.sub.1,n.sub.2,n.sub.3, . . . ,n.sub.n};
[0055] wherein, hd.sub.1 to hd.sub.n are the 1.sup.st to the n.sup.th unequal descriptive entropy values of the corresponding mobile software; n.sub.1 to n.sub.n are corresponding numbers of the 1.sup.st to the n.sup.th unequal descriptive entropy values;
[0056] Step IV, integrating the descriptive entropies of the mobile softwares, comparing the descriptive entropy distributions of mobile software pairs based on the integrated descriptive entropy distributions, and calculating similarity scores of the mobile software pairs; and
[0057] specifically: acquiring the sets of descriptive entropies for all the mobile softwares, and integrating the sets of descriptive entropies for all the mobile software in pairs to obtain a union of descriptive entropies for each pair of the mobile softwares;
[0058] in the present embodiment, mobile software A and mobile software B are selected for comparison:
[0059] sets of descriptive entropies for mobile software A and mobile software B are as follows:
Hd.sub.A={hd.sub.A1,hd.sub.A2,hd.sub.A3, . . . ,hd.sub.Am};
Hd.sub.B={hd.sub.B1,hd.sub.B2,hd.sub.B3, . . . ,hd.sub.Bn};
[0060] wherein, Hd.sub.A is the set of descriptive entropies of mobile software A, and Ah.sub.1 to Ah.sub.m are the 1.sup.st to the m.sup.th unequal descriptive entropies; Hd.sub.B is the set of descriptive entropies of mobile software B, and Bh.sub.1 to Bh.sub.n are the 1.sup.st to the n.sup.th unequal descriptive entropies; m is a number of descriptive entropies of mobile software A, and n is a number of descriptive entropies of mobile software B;
[0061] sets of numbers of descriptive entropy values of mobile software A and mobile software B are as follows:
N.sub.A={n.sub.A1,n.sub.A2,n.sub.A3, . . . ,n.sub.Am};
N.sub.B={n.sub.B1,n.sub.B2,n.sub.B3, . . . ,n.sub.Bn};
[0062] wherein, N.sub.A is the set of corresponding numbers of descriptive entropy values in Hd.sub.A of mobile software A, and An.sub.1 to An.sub.m are the number of the 1.sup.St to the m.sup.th descriptive entropies; N.sub.B is the set of corresponding numbers of descriptive entropy values in Hd.sub.B of mobile software B, and Bn.sub.1 to Bn.sub.n, are the number of the 1.sup.st to the n.sup.th descriptive entropies;
[0063] integrating the descriptive entropy distributions of mobile software A and mobile software B:
[0064] wherein, Hd.sub.A∪B is the union of descriptive entropies of mobile software A and mobile software B, Y.sub.A is the set of corresponding numbers of descriptive entropy values of mobile software A in the union Hd.sub.A∪B, and Y.sub.B is the set of corresponding numbers of descriptive entropy values of mobile software B in the union Hd.sub.A∪B; x is a number of elements in the subtraction of Hd.sub.A from the union Hd.sub.A∪B, and y is a number of elements in the subtraction of Hd.sub.B from the union Hd.sub.A∪B; m+x and n+y are numbers of elements in the union Hd.sub.A∪B;
[0065] calculating similarity scores:
[0066] taking the sets Hd.sub.A∪B and Y.sub.A as a set of discrete points D.sub.A, and the sets Hd.sub.A∪B and Y.sub.B as another set of discrete points D.sub.B, there are:
D.sub.A={(x.sub.i,y.sub.i)|x.sub.i∈Hd.sub.A∪B,y.sub.i∈Y.sub.A};
D.sub.B={(x.sub.i,y.sub.i)|x.sub.i∈Hd.sub.A∪B,y.sub.i∈Y.sub.B};
[0067] a region S.sub.A in a Cartesian coordinate system is defined by the set of discrete points D.sub.A and the X axis; a region S.sub.B in the Cartesian coordinate system is defined by the set of discrete points D.sub.B and the X axis; an intersection area S.sub.A∩B of the regions S.sub.A and S.sub.B is calculated, and a union area S.sub.A∩B of the regions S.sub.A and S.sub.B is calculated; finally the similarity scores are calculated:
[0068] assuming that the number of elements in the set is N, there is:
[0069] wherein, (x.sub.i, y.sub.Ai)∈D.sub.A, (x.sub.i, y.sub.Bi)∈D.sub.B, and (x.sub.mid, y.sub.mid) are the coordinates of the intersection point of a straight line defined by points (x.sub.i, y.sub.Ai) and (x.sub.i+1, y.sub.Ai+1) and a straight line defined by points (x.sub.i, y.sub.Bi) and (x.sub.i+1, y.sub.Bi+1);
[0070] finally the similarity scores are calculated by:
Similarity score=S.sub.A∩B/S.sub.A∪B*100
[0071] Step V, outputting the similarity scores of the mobile softwares to give a mobile software similarity result, outputting the similarity scores of all mobile software pairs, calculating a time and storing in a text file.
[0072] The above example is a preferred embodiment of the present invention, which, however, is not intended to limit the embodiments of the present invention. Any other changes, modifications, substitutions, combinations, simplifications and the like can be made without departing from the spirit and principle of the present invention, and should be equivalent replacement and included in the protection scope of the present invention.