Abstract: Disclosed is a description-entropy-based intelligent detection method for a big data mobile software similarity. The method comprises the following steps: acquiring a path of mobile software, and reading a file of the mobile software according to the path; performing preliminary reverse engineering decompilation on the file of the mobile software to obtain function characteristics of each piece of mobile software; counting distribution of description entropy of each piece of mobile software by means of description entropy in the function characteristics; further integrating description entropy of each piece of mobile software, after integration, comparing description entropy distribution conditions among the mobile software, and carrying out similarity score calculation to obtain similarity scores among the mobile software; and outputting the similarity scores of all mobile software to obtain a mobile software similarity result.

Abstract: A method for detecting mobile malware, including step S1: compressing a mobile software subject to detection and a primary mobile software each containing N functions, wherein each of the functions is compressed into a hash value, a description entropy and a compressed string; S2: calculating a quantity of identical functions between the mobile software subject to detection and the primary mobile software; and then finding out a quantity of similar functions using Hdsim method or entropy_descpt_sim method; and then calculating a degree of similarity to obtain a value of similarity; S3: comparing the value of similarity with a predetermined threshold value; if the value of similarity is greater then or equal to the predetermined threshold value, the mobile software subject to detection is suspected to repackaging; if the value of similarity is smaller than the predetermined threshold value, the mobile software subject to detection is not suspected to repackaging.

Abstract: Disclosed is a description-entropy-based intelligent detection method for a big data mobile software similarity. The method comprises the following steps: acquiring a path of mobile software, and reading a file of the mobile software according to the path; performing preliminary reverse engineering decompilation on the file of the mobile software to obtain function characteristics of each piece of mobile software; counting distribution of description entropy of each piece of mobile software by means of description entropy in the function characteristics; further integrating description entropy of each piece of mobile software, after integration, comparing description entropy distribution conditions among the mobile software, and carrying out similarity score calculation to obtain similarity scores among the mobile software; and outputting the similarity scores of all mobile software to obtain a mobile software similarity result.

Abstract: A method for detecting mobile malware, including step S1: compressing a mobile software subject to detection and a primary mobile software each containing N functions, wherein each of the functions is compressed into a hash value, a description entropy and a compressed string; S2: calculating a quantity of identical functions between the mobile software subject to detection and the primary mobile software; and then finding out a quantity of similar functions using Hdsim method or entropy_descpt_sim method; and then calculating a degree of similarity to obtain a value of similarity; S3: comparing the value of similarity with a predetermined threshold value; if the value of similarity is greater then or equal to the predetermined threshold value, the mobile software subject to detection is suspected to repackaging; if the value of similarity is smaller than the redetermined threshold value, the mobile software subject to detection is not suspected to repackaging.