JP7079664B2 - Cheat application identification method and system - Google Patents

Description

The following description relates to a cheat application identification method and system, and more particularly, a cheat application identification method and system that can determine the presence or absence of a cheat application of the application based on the components of the application, combined with a computer device. It relates to a computer program stored in a computer-readable recording medium to execute the cheat application identification method.

Changing the way an application behaves A cheating application aims to hide the execution of a cheat application so that it cannot be identified by the system, and even if it contains the same functionality, it is extremely diverse with minor changes. Manufactured and distributed in different types and versions.

As a technique for identifying such a cheat application, after extracting the hash value of the executable file included in the cheat application detected in advance, the hash value of the executable file is also applied to the identification target application which is the application to be identified. There is a way to extract and compare the extracted hash values. For example, Patent Document 1 relates to a malicious application or a malicious website detection method and system, and uses the hash value of an executable file, which is one of the related information of the application, to determine the presence or absence of maliciousness, and the determination result. If is not malignant, the configuration is disclosed to re-determine the presence or absence of malignancy by using the hash value of the library file in the signature information resource file.

Korean Registered Patent No. 10-1628837

However, in such a prior art, in order to compare the hash value of all the applications installed on the system with the hash value of the cheat application, check the contents of all the executable files of each of the applications. It has a problem that it takes a lot of time because it is necessary to generate hash values of all executable files for all applications and to check all the contents of the executable files.

Not only this, but if the cheat application contains the same functionality but contains an executable with only minor changes, the hash values will be different and these different versions of the cheat application will be identified. There is also the problem of not being able to do it.

Therefore, the present invention can be read by a computer in order to execute a cheat application identification method in combination with a cheat application identification method and a system or a computer device capable of detecting a cheat application by utilizing a specific component of the application. Provides a computer program stored on a recording medium.

The computer program according to the present invention is a computer program stored in a computer-readable recording medium in order to combine with a computer to execute a cheat application identification method, and the cheat application identification method is the presence or absence of a cheat application. At the stage of analyzing the identification target application to be identified and extracting the URI scheme (Uniform Resource Originfier scene) included in the identification target application, the extracted URI is installed in the operating system of the computer in which the identification target application is installed. It includes a step of requesting the processing of the interaction using the scheme, and a step of identifying the identification target application as a cheat application when the processing of the interaction is performed.

The cheat application identification method according to the present invention is a stage in which the identification target application analyzes the identification target application that attempts to identify the presence or absence of the cheat application and extracts the URI scheme (Uniform Resource Identifier screen) included in the identification target application. It includes a step of requesting the operating system of the installed computer to process an interaction using the extracted URI scheme, and a step of identifying the identification target application as a cheat application when the processing of the interaction is performed.

The computer-readable recording medium according to the present invention contains a program for causing the computer to execute the cheat application identification method.

With the above configuration, it is possible to detect a cheat application by utilizing a specific component of the application. For example, a new version of a cheat application that has been partially modified by detecting the cheat application using certain components that are immutable or unlikely to change to provide the same functionality. Even cheat applications can be identified.

It is a figure which showed the example of the network environment in one Embodiment of this invention. It is a block diagram for demonstrating the internal structure of the electronic device and the server in one Embodiment of this invention. It is a flowchart which showed the example of the method of identifying an application by the presence / absence of an interaction with a system in one Embodiment of this invention. It is a figure which showed the example which identifies the application by the presence / absence of interaction with a system in one Embodiment of this invention. It is a flowchart which showed the method of identifying a cheat application by whether the application to be identified exists in a process file or a list in one Embodiment of this invention. It is a flowchart which showed the example of the method of identifying the cheat application by the file name and / or the storage path of a specific file in one Embodiment of this invention. It is a figure which showed the example of the method of identifying the cheat application by using the hash value in one Embodiment of this invention. It is a flowchart which showed the example of the method of identifying the cheat application based on the package identifier in one Embodiment of this invention. It is a figure which showed the example of the android APK file in one Embodiment of this invention. It is a figure which showed the example of the iOS IPA file in one Embodiment of this invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings.

The cheat application identification method according to the embodiment of the present invention may be realized by the electronic device or the server described below, and the cheat application identification method according to the embodiment of the present invention may be executed by such an electronic device or the server. May be done. For example, an application realized as a computer program according to an embodiment of the present invention may be installed and driven in the electronic device, and the electronic device determines whether the identification target application is a cheat application under the control of the driving application. You may decide. The computer program may be stored on a computer-readable recording medium to combine with the electronic device to perform the cheat application identification method. In another embodiment, the server may determine whether the identified application is a cheat application under the control of the application described above. For example, an electronic device may inspect all applications installed on its system as cheat applications as identified applications. As another example, the server may check each of the applications installed on the electronic device as a cheat application as an identification target application. As another example, the server may determine whether a particular application installed on the server is a cheat application as an identification target application.

FIG. 1 is a diagram showing an example of a network environment according to an embodiment of the present invention. The network environment of FIG. 1 shows an example including a plurality of electronic devices 110, 120, 130, 140, a plurality of servers 150, 160, and a network 170. Such FIG. 1 is merely an example for explaining the invention, and the number of electronic devices and the number of servers are not limited as in FIG.

The plurality of electronic devices 110, 120, 130, 140 may be fixed terminals or mobile terminals realized by a computer device. Examples of a plurality of electronic devices 110, 120, 130, 140 include smartphones, mobile phones, navigation systems, PCs (personal computers), notebook pancons, digital broadcasting terminals, PDAs (Personal Digital Assistants), and PMPs (Tablet Multimedia Players). ), Tablets, etc. As an example, FIG. 1 shows the shape of a smartphone as an example of the electronic device 1 (110), but in the embodiment of the present invention, substantially using a wireless or wired communication method via a network 170. It may mean one of a variety of devices capable of communicating with other electronic devices 120, 130, 140 and / or servers 150, 160.

The communication method is not limited, and not only the communication method utilizing the communication network (for example, mobile communication network, wired Internet, wireless Internet, broadcasting network) that can be included in the network 170, but also the short distance between devices. Wireless communication may be included. For example, the network 170 includes a PAN (personal area network), a LAN (local area network), a CAN (campus area network), a MAN (metropolitan area network), a WAN (wise Internet) network, etc. It may include any one or more of the networks. Further, the network 170 may include any one or more of network topologies, including bus networks, star networks, ring networks, mesh networks, star-bus networks, trees or hierarchical networks, etc. It is not limited to these.

Each of the servers 150 and 160 is realized by a computer device or a plurality of computer devices that communicate with a plurality of electronic devices 110, 120, 130, 140 via a network 170 to provide instructions, codes, files, contents, services, and the like. It's okay. For example, the server 150 may be a system that provides the first service to a plurality of electronic devices 110, 120, 130, 140 connected via the network 170, and the server 160 may also be a plurality connected via the network 170. It may be a system that provides a second service to the electronic devices 110, 120, 130, 140 of the above. As a more specific example, the server 160, as a second service, transfers an installation file (for example, an application program package file) for installing an application (computer program) to a plurality of electronic devices 110, 120, 130, 140. It may be a provided system. Further, the server 150 may provide a service for confirming the presence or absence of a cheat application of a specific application to a plurality of electronic devices 110, 120, 130, 140 as a first service. Such a service is only one embodiment for explaining a network environment, and the services provided by the servers 150 and 160 in an actual network environment are extremely diverse.

FIG. 2 is a block diagram for explaining an internal configuration of an electronic device and a server according to an embodiment of the present invention. In FIG. 2, the internal configuration of the electronic device 1 (110) and the internal configuration of the server 150 will be described as examples for the electronic device. Further, the other electronic devices 120, 130, 140 and the server 160 may have the same or similar internal configuration as the above-mentioned electronic device 1 (110) or the server 150.

The electronic device 1 (110) and the server 150 may include memories 211, 221s, processors 212, 222, communication modules 213, 223, and input / output interfaces 214, 224. The memory 211 and 221 are computer-readable recording media and include a RAM (random access memory), a ROM (read only memory), and a permanent mass storage device such as a disk drive. It's fine. Here, a permanent large-capacity storage device such as a ROM or a disk drive may be included in the electronic device 1 (110) or the server 150 as a permanent storage device separate from the memories 211 and 221. Further, the memory 211 and 221 are installed in the operating system and at least one program code (for example, a browser installed and driven in the electric device 1 (110) and an electronic device 1 (110) for providing a specific service. The code for the installed application etc.) may be stored. Such software components may be loaded from a computer-readable recording medium other than the memories 211 and 221. Such computer-readable recording media may include computer-readable recording media such as floppy (registered trademark) drives, discs, tapes, DVD / CD-ROM drives, and memory cards. In other embodiments, the software components may be loaded into memory 211, 221 through communication modules 213, 223, which are not computer readable recording media. For example, at least one program is a program installed by a file provided by a file distribution system (as an example, the server 150 described above) that distributes a developer or application installation file via a network 170 (as an example, described above). It may be loaded into memory 211, 221 based on the application).

Processors 212 and 222 may be configured to process instructions in a computer program by performing basic arithmetic, logic, and input / output operations. Instructions may be provided to processor 212, 222 by memory 211, 221 or communication modules 213, 223. For example, the processors 212 and 222 may be configured to execute instructions received according to a program code stored in a recording device such as memories 211 and 221.

The communication modules 213 and 223 may provide a function for the electronic device 1 (110) and the server 150 to communicate with each other via the network 170, or may provide another electronic device (as an example, the electronic device 2 (120). )) Or may provide a function for communicating with another server (for example, server 160). As an example, even if the request generated by the processor 212 of the electronic device 1 (110) according to the program code stored in the recording device such as the memory 211 is transmitted to the server 150 via the network 170 under the control of the communication module 213. good. On the contrary, the control signals, instructions, contents, files, etc. provided according to the control of the processor 222 of the server 150 pass through the communication module 223 and the network 170, and pass through the communication module 213 of the electronic device 1 (110) to the electronic device 1. It may be received at (110). For example, the control signals and instructions of the server 150 received through the communication module 213 may be transmitted to the processor 212 and the memory 211, and the contents and files may be further included in the storage medium 1 (110). It may be stored in (permanent storage device described above).

The input / output interface 214 may be a means for an interface with the input / output device 215. For example, the input device may include a device such as a keyboard or mouse, and the output device may include a device such as a display. As another example, the input / output interface 214 may be a means for an interface with a device that integrates functions for input and output, such as a touch screen. The input / output device 215 may be composed of an electronic device 1 (110) and one device. Further, the input / output interface 224 of the server 150 may be concatenated with the server 150, and is a means for an interface with a device (not shown) for input or output that the server 150 can include. You may. As a more specific example, the processor 212 of the electronic device 1 (110) utilizes the data provided by the server 150 and the electronic device 2 (120) in processing the instruction of the computer program loaded in the memory 211. The configured service screens and contents may be displayed on the display through the input / output interface 214.

Also, in other embodiments, the electronic device 1 (110) and the server 150 may include more components than the components of FIG. However, most prior art components need not be clearly shown in the figure. For example, the electronic device 1 (110) may be realized to include at least a part of the above-mentioned input / output device 215, a transceiver, a GPS (Global Positioning System) module, a camera, various sensors, and a database. It may further include other components such as. As a more specific example, when the electronic device 1 (110) is a smartphone, the acceleration sensor, gyro sensor, camera module, various physical buttons, buttons using the touch panel, input / input, which are generally included in the smartphone. Various components such as output ports, accelerometers for vibration, and the like may be realized to be further included in the electronic device 1 (110).

FIG. 3 is a flowchart showing an example of a method of identifying an application according to the presence or absence of interaction with a system in one embodiment of the present invention. The cheat application identification method according to the present embodiment may be executed by a computer device such as the electronic device 1 (110) or the server 150 described above. In this embodiment, a process in which the electronic device 1 (110) executes the cheat application identification method will be described. The processor 212 of the electronic device 1 (110) may be realized to execute a control instruction (instruction) by the code of the operating system included in the memory 211 or the code of at least one computer program. Here, the processor 212 follows the control instruction provided by the code stored in the electronic device 1 (110), and the electronic device 1 (110) includes the steps 310 to 330 included in the cheat application identification method according to the embodiment of FIG. The electronic device 1 (110) may be controlled to execute the above.

At step 310, the electronic device 1 (110) may analyze the identification target application that attempts to identify the presence or absence of the cheat application and extract a URI scheme (Uniform Resource Identifier scheme) included in the identification target application. A URI is the only address that points to a resource in a computer network such as the Internet and provides location information about a particular resource. For example, when a link corresponding to a specific URI is opened in the electronic device 1 (110), resources (HTML documents, images, etc.) corresponding to this URI are searched for and downloaded. At this time, the URI scheme may be utilized as information for identifying the type of the downloaded resource and how it should be processed. For example, "http" of URI "http://www.naver.com" and "ftp" of "ftp: //file.mycompany.com" are URI schemes. On the other hand, there are also URI schemes that can be defined by the user, such as custom URI schemes. For example, the user may define and use a custom URI scheme such as "lineappp" of "lineapp: //" or "com.linecorp.game" of "com.linecorp.game: //". can. The electronic device 1 (110) may confirm and extract the URI scheme included in the identification target application.

At step 320, electronic device 1 (110) may request the operating system of the computer on which the identification target application is installed to process the interaction using the extracted URI scheme. Here, the computer may correspond to the electronic device 1 (110). In another embodiment, if the server 150 attempts to identify the presence or absence of a cheat application of the identification target application installed in the electronic device 1 (110), the computer may be the electronic device 1 (110) and the server 150. If the computer attempts to identify the presence or absence of a cheat application of the identification target application installed on the server 150, the computer may become the server 150.

In one embodiment, the operating system may include an android operating system or an iOS operating system. In this case, in the electronic device 1 (110), the identification target application may request the android operating system to process an intent using the URI scheme, or the URL (uniform Resource) corresponding to the URI scheme. You may request the iOS operating system to handle the openness for the Locator). As a more specific example, in the case of an android operating system, electronic device 1 (110) requests processing of intents for extracted URI schemes such as "Intent (Intent.iOS_VIEW," lineapp: //) ". As another example, in the case of the iOS operating system, the electronic device 1 (110) opens a URL containing an extracted URI scheme such as "canOpenURL:" lineapp "//". You may request action on the possibility.

At step 330, the electronic device 1 (110) may identify the identification target application as a cheat application when the interaction processing is performed. In this way, the electronic device 1 (110) may interpret that the processing of the interaction is performed as the application to be identified interacts with the operating system, and the interaction itself with such an operating system is cheated. It may be judged as the existence of the application. In other words, the electronic device 1 (110) may identify the identification target application that interacts with the operating system as a cheat application.

As another embodiment, the electronic device 1 (110) may identify the identification target application as a cheat application if the identification target application is an application that processes an intent containing a specific request in the android operating system. .. For example, as in the above example, when the identification target application requests the android operating system to process the intent using the URI scheme such as "Intent (Intent.ACTION_VIEW," lineapp: //) ", the electronic device. 1 (110) may identify the identification target application as a cheat application.

As another embodiment, the electronic device 1 (110) may identify the identification target application as a cheat application when the identification target application is an application that processes a URL including a specific request in the iOS operating system. .. For example, when the identification target application requests URL processing using a URI scheme such as [[UIApplication sharedApplication] canOpenURL: "lineapp: //"], the electronic device 1 (110) uses the identification target application as a cheat application. May be identified.

In other words, as in the embodiment of FIG. 3, it may be determined that the system processes the request for processing the interaction using the extracted URI scheme as a condition of the cheat application, and the specific request to the operating system. It may also be determined as a condition of the cheat application to request that the intent or URL containing the cheat application be processed.

As described above, in the above-described embodiment, it is possible to determine the presence or absence of a cheat application for the application based on a specific component of the application, such as a URL scheme, rather than the entire executable file. Interactions with operating systems that utilize these specific components can be detected even if some of the content of the cheat application is changed, so that new versions of cheat applications can also be detected. become.

FIG. 4 is a diagram showing an example of identifying an application according to the presence or absence of interaction with the system in one embodiment of the present invention. FIG. 4 shows that the electronic device 1 (110) analyzes the package file 410 of the identification target application, extracts the URI scheme 420, and requests the processing of the intent and the URL using the extracted URI scheme 420. ing. At this time, if the operating system processes such a request immediately, it may be confirmed that the package and / or application corresponding to the scheme concerned exists, and if such processing occurs, the application to be identified is identified. You may decide that it is a cheat application.

Further, as described above, the identification target application may be identified as a cheat application by the act itself of requesting the processing of the above-mentioned intent or URL. Such identification may be made by confirming that the application to be identified contains the code for the above-mentioned request.

In addition, the electronic device 1 (110) may analyze the extracted URI scheme and determine the package identifier corresponding to the extracted URI scheme. For example, {"com.linecorp.app", "com.linecorp.game" based on "lineapp" of "lineapp: //" and "com.linecorp.game" of "com.linecorp.game: //". } May determine the package identifier. At this time, the electronic device 1 (110) may identify the application to be cheated by comparing the package identifier returned from the operating system as a response to the processing of the interaction with the determined package identifier.

FIG. 5 is a flowchart showing a method of identifying a cheat application according to whether or not an application to be identified exists in a process file or a list in one embodiment of the present invention.

At step 510, electronic device 1 (110) was pre-identified in association with a pre-identified cheat application in the same operating system as electronic device 1 (110) by driving a pre-identified cheat application. Process information may be stored.

At step 520, electronic device 1 (110) may analyze a file or list showing process information for the operating system. For example, for a pre-identified cheat application, information about the process may be managed in an Android® "proc" file, and the electronic device 1 (110) may store such process information. After this, electronic device 1 (110) may analyze a file or list showing the process information of the operating system of electronic device 1 (110) when trying out the cheat application, and the stored process information is analyzed. You may want to check if it exists in the created file or list.

At step 530, the electronic device 1 (110) may identify the application corresponding to the process information stored in the file or list as a cheat application if the process information stored in the file or list is included.

In this way, the electronic device 1 (110) can identify the cheat application based on the process information in the same operating system in this embodiment. Such process information may also be utilized as a specific component of the application.

Steps 510 to 530 of the cheat application identification method according to the embodiment of FIG. 5 may be executed in parallel with the above-described embodiment or may be executed independently. For example, the above-described embodiment, the embodiment shown in FIG. 5, and the embodiments described below may all be executed independently, or may be executed together in parallel. For example, the electronic device 1 (110) is applicable when a plurality of different embodiments are executed together in parallel and a specific application is identified as a cheat application by at least one embodiment of the plurality of embodiments. Application may be finalized as a cheat application. As another example, electronic device 1 (110) executes a plurality of different embodiments together in parallel, and at least two or more embodiments of the plurality of embodiments identify a specific application as a cheat application. If so, the application may be finalized as a cheat application.

As mentioned above, embodiments of the invention can identify cheat applications based on specific components of the application. At this time, the specific component may not be included in the changeable content range in the new version of the cheat application for providing the same function, and the changeable content range may be present. There may be components contained in. Therefore, a plurality of embodiments presented will take into account the possibility that a new version of the cheat application cannot be identified based on the components identified in at least one of the embodiments of the present invention. Two or more of these embodiments may be merged and implemented. An embodiment that utilizes components that are not related to changes in specific content, such as the embodiment of FIG. 3, may be implemented independently.

As another embodiment, when the electronic device 1 (110) includes information for identifying another application installed on the computer in the storage path of the file related to the identification target application, the identification target application May be identified as a cheat application. For example, when installing an application on electronic device 1 (110), there is a unique file location used by the application. For example, there is a storage path that is basically generated such as "/ sdcard / Android / data / com.google.android.music / cache". At this time, the electronic device 1 (110) may extract information for identifying another application such as "com.Google.android.music" from the storage path. At this time, the electronic device 1 (110) may determine that the file related to the identification target application is stored in the storage path of another application, not in the storage path for the identification target application. In this case, the electronic device 1 (110) may identify the identification target application as a cheat application.

FIG. 6 is a flowchart showing an example of a method of identifying a cheat application by a file name and / or a storage path of a specific file in one embodiment of the present invention.

At step 610, the electronic device 1 (110) may store the file name or storage path of the selected file among the files included in the pre-identified cheat application.

At step 620, the electronic device 1 (110) may confirm whether or not a file corresponding to the stored file name or storage path exists among the files included in the identification target application.

At step 630, the electronic device 1 (110) may identify the identification target application as a cheat application if a file corresponding to the stored file name or storage path exists.

As described above, in the cheat application identification method according to the present embodiment, the electronic device 1 (110) is an application having the same file name or storage path as the file name or storage path of the specific file included in the pre-identified cheat application. May be identified as a cheat application. Specific filenames and / or stores included in association with the cheat application, such as file names such as "gamehacker.png", "HelloWorld.png" and storage paths of "/ system / xbin / su". The route may be utilized.

At this time, the file name and storage path of the specific file included in the pre-identified application may be selected so as to maximize the uniqueness of only the cheat application. As described above, the present embodiment may be implemented in parallel with one of the other embodiments, considering the case where the uniqueness is not guaranteed only by the file name and the storage path. For example, when the embodiment of FIG. 3 and the present embodiment are both implemented and the identification target application is identified as a cheat application in all the two embodiments, the electronic device 1 (110) finally uses the identification target application as the cheat application. You may decide.

Alternatively, the embodiment of FIG. 6 may be implemented independently. In this case, the electronic device 1 (110) confirms at step 630 whether the corresponding file includes the cheat function, and if the corresponding file includes the cheat function, the identification target application may be identified as the cheat application. good. In other words, after selecting a specific file by file name or storage route, check whether the selected specific file contains a cheat function (for example, a routing function), and finally the application to be identified. May be determined as a cheat application.

Further, the file name of the file selected in the embodiment of FIG. 6 may include the file name of the file executed while the cheat application identified in advance is being driven. Also, the storage path for the selected file may include a storage path for the file generated to be used by the operating system according to the installation of the pre-identified cheat application.

FIG. 7 is a diagram showing an example of a method of identifying a cheat application using a hash value in one embodiment of the present invention.

At step 710, the electronic device 1 (110) refers to a first file of a preset type among the files included in the pre-identified cheat application or some preset items among the items contained in the first file. The first hash value may be generated and stored.

At step 720, the electronic device 1 (110) has a second hash of a preset type of second file among the files included in the identification target application or a second hash for some preset items among the items included in the second file. You may generate a value.

At step 730, the electronic device 1 (110) may compare the first hash value and the second hash value and, if they are the same, identify the identification target application as a cheat application.

As described above, in the prior art, after generating the hash value of the executable file of the pre-identified cheat application, the hash value of each executable file of the identified application is generated for comparison with the identified application. .. On the other hand, in the embodiment of FIG. 7, the type of the file for generating the hash value can be determined in advance. For example, the first file and the second file of the preset type are an executable ELF (Executable and Linking Form) file, an executable Mach-O (Mach Object) file, and an executable PE (Portable Executable) file. , And at least one of the compressed files. When the preset type file is an ELF file, the electronic device 1 (110) needs to generate a hash value only for the ELF file among the executable files of the identification target application, so that the hash value can be generated. The time required can be significantly reduced. Alternatively, the hash value may be generated by using only a specific item of a specific type of file. For example, some preset items may include headers for certain types of files. In other words, the electronic device 1 (110) may generate a hash value by checking only the header of the ELF file. Therefore, the time required to generate the hash value can be further reduced. The compressed file may include a "ZIP" file.

FIG. 8 is a flowchart showing an example of a method of identifying a cheat application based on a package identifier in one embodiment of the present invention.

At step 810, the electronic device 1 (110) may store the pre-identified cheat application package identifier. Such a package identifier may include a package name or a bundle ID.

At step 820, electronic device 1 (110) identifies the first application as a cheat application if a first application with the same package identifier as the stored package identifier is installed on the computer in association with the operating system. It's okay.

In this way, the electronic device 1 (110) may utilize the package identifier as a specific component of the identification target application to determine the presence or absence of the cheat application of the identification target application. Such embodiments may also be performed in parallel with at least one of the other embodiments described above.

FIG. 9 is a diagram showing an example of an android APK file according to an embodiment of the present invention, and FIG. 10 is a diagram showing an example of an iOS IPA file according to an embodiment of the present invention. As shown in the first dotted line box 910 of FIG. 9 and the second dotted line box 1010 of FIG. 10, it can be seen that the application package contains a file with a specific file name "HelloWorld.png". As described in the embodiment of FIG. 6, the electronic device 1 (110) utilizes a specific file name or storage path grasped based on the pre-identified cheat application as a specific component of the application to cheat. You may identify the application. According to the embodiment of FIG. 6, the application corresponding to the Android APK file of FIG. 9 and the application corresponding to the iOS IPA file of FIG. 10 may be all identified as cheat applications.

As mentioned above, certain components used in some embodiments may not be able to guarantee uniqueness for a cheat application. As described above, two or more embodiments may be implemented in parallel for such a case.

Thus, according to embodiments of the invention, cheat applications can be detected using specific components of the application. For example, a new cheat application that has changed some content by detecting the cheat application using certain components that are immutable or unlikely to change to provide the same functionality. Even a version of the cheat application will be identifiable.

The system or device described above may be implemented by a hardware component, a software component, or a combination of a hardware component and a software component. The apparatus and components described in the embodiments include, for example, a processor, a controller, an ALU (arithmetic logic unit), a digital signal processor, a microcomputer, an FPGA (field programgable gate array), a PLU (programmable logic unit), a microprocessor, and the like. Alternatively, it may be realized by utilizing one or more general-purpose computers or special purpose computers, such as various devices capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on said OS. The processing device may also respond to the execution of the software, access the data, store, manipulate, process, and generate the data. For convenience of understanding, one processing device may be described as being used, but one of ordinary skill in the art may include a plurality of processing elements and / or a plurality of types of processing elements. You can understand. For example, the processing device may include multiple processors or one processor and one controller. Also, other processing configurations such as parallel processors are possible.

The software may include computer programs, codes, instructions, or a combination of one or more of these, configuring the processing equipment to operate at will, or instructing the processing equipment independently or collectively. You may do it. The software and / or data is permanent to any type of machine, component, physical device, virtual device, computer storage medium or device for interpretation based on the processing device or for providing instructions or data to the processing device. It may be materialized or temporarily. The software is distributed on a computer system connected by a network and may be stored or executed in a distributed state. The software and data may be stored on a recording medium readable by one or more computers.

The method according to the embodiment may be realized in the form of program instructions that can be executed by various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be those specially designed and configured for the embodiment, or may be usable known to those skilled in the art of computer software. Examples of computer-readable recording media include hard disks, floppy (registered trademark) discs, magnetic media such as magnetic tapes, optical media such as CD-ROMs and DVDs, and floptic discs. Optical magnetic media such as, and hardware devices specially configured to store and execute program instructions such as ROM, RAM, flash memory, etc. are included. Examples of program instructions include machine language code, such as those generated by a compiler, as well as high-level language code, which is executed by a computer using an interpreter or the like.

As described above, the embodiments have been described based on the limited embodiments and drawings, but those skilled in the art will be able to make various modifications and modifications from the above description. For example, the techniques described may be performed in a different order than the methods described, and / or components such as the systems, structures, devices, circuits described may be in a different form than the methods described. Appropriate results can be achieved even if they are combined or combined, and confronted or replaced by other components or equivalents.

Therefore, even if it is a different embodiment, if it is equivalent to the claims, it belongs to the attached claims.

110, 120, 130, 140: Electronic device 150, 160: Server 170: Network

Claims (20)

A computer program stored on a computer-readable recording medium to combine with a computer to perform a cheat application identification method.
The cheat application identification method is
The stage of analyzing the identification target application that attempts to identify the presence or absence of the cheat application and extracting the URI scheme (Uniform Resource Identifier screen) included in the identification target application.
When the operating system of the computer on which the identification target application is installed is requested to process an interaction using the extracted URI scheme, and when the interaction processing is performed, the identification target application is used as a cheat application. A computer program characterized by including a step of identification. The cheat application identification method is
The determined package identifier is the step of analyzing the extracted URI scheme to determine the package identifier corresponding to the extracted URI scheme, and the package identifier returned from the operating system in response to the processing of the interaction. The computer program of claim 1, further comprising identifying an application subject to cheating as compared to. The operating system includes an android operating system or an iOS operating system.
The cheat application identification method is
The identification target application requests the android operating system to process an intent using the URI scheme, or processes the open possibility for a URL (uniform Resource Locator) corresponding to the URI scheme by the iOS. The computer program according to claim 1, further comprising identifying the identified application as a cheat application when requested to an operating system. The cheat application identification method is
A stage in which a pre-identified cheat application is driven to store pre-identified process information associated with the pre-identified cheat application in the same operating system as the operating system.
The stage of analyzing a file or list showing the process information of the operating system, and if the file or list contains the stored process information, cheat the application corresponding to the stored process information in the file or list. The computer program according to claim 1, further comprising a step of identifying as an application. The cheat application identification method is
When the storage path of the file related to the identification target application contains information for identifying other applications installed on the computer, the feature is to further include a step of identifying the identification target application as a cheat application. The computer program according to claim 1. The cheat application identification method is
The stage of storing the file name or storage path of the selected file among the files included in the identified cheat application,
Among the files included in the identification target application, the stage of confirming whether the file corresponding to the stored file name or the storage route exists, and the case where the file corresponding to the stored file name or the storage route exists. The computer program according to claim 1, further comprising the step of identifying the identification target application as a cheat application. If there is a file corresponding to the stored file name or storage path, the step of identifying the identification target application as a cheat application is
The computer program according to claim 6, wherein it is confirmed whether the corresponding file includes the cheat function, and if the corresponding file includes the cheat function, the identification target application is identified as the cheat application. .. The file name of the selected file includes the file name of the file to be executed while the pre-identified cheat application is running.
6. The storage path for the selected file is characterized by comprising a storage path for the file generated to be used by the operating system in accordance with the installation of the pre-identified cheat application. Computer program. The cheat application identification method is
A step of generating and storing a first hash value for a preset first file among the files included in the identified cheat application or some preset items among the items included in the selected first file. ,
The stage of generating a second hash value for a preset second file of the files included in the identification target application or a preset item among the items included in the selected second file, and the first step. The computer program according to claim 1, further comprising a step of comparing the hash value and the second hash value and, if they are the same, identifying the identification target application as a cheat application. The first file and the second file of the preset type are an executable ELF (Executable Linking Form) file, an executable Mach-O (Mach Object) file, an executable PE (Portable Executable) file, and an executable file. Contains at least one of the compressed files
The computer program according to claim 9, wherein some of the preset items include a header of the at least one file. The cheat application identification method is
The stage of storing the package identifier of the pre-identified cheat application, and if a first application having the same package identifier as the stored package identifier is installed on the computer in association with the operating system, said first. The computer program of claim 1, further comprising identifying the application as a cheat application. A cheat application identification method performed by a computer device,
A step of analyzing an identification target application that attempts to identify the presence or absence of a cheat application by the computer device and extracting a URI scheme (Uniform Resource Identifier scheme) included in the identification target application.
The stage in which the computer device requests the operating system of the computer on which the identification target application is installed to process an interaction using the extracted URI scheme, and
A cheat application identification method comprising a step of identifying the identification target application as a cheat application when the processing of the interaction is performed by the computer device . The stage of analyzing the extracted URI scheme by the computer device to determine the package identifier corresponding to the extracted URI scheme, and
It further comprises the step of identifying the application to be cheated by the computer device by comparing the package identifier returned from the operating system in response to the processing of the interaction with the determined package identifier. , The cheat application identification method according to claim 12. The operating system includes an android operating system or an iOS operating system.
With the computer device, the identification target application may request the android operating system to process an intent using the URI scheme, or may open to a URL (uniform Resource Locator) corresponding to the URI scheme. The cheat application identification method according to claim 12, further comprising the step of identifying the identification target application as a cheat application when requesting the processing of the iOS operating system. A step of storing pre-identified process information in association with the pre-identified cheat application in the same operating system as the operating system by driving the pre-identified cheat application by the computer device .
The stage of analyzing a file or list showing process information of the operating system by the computer device , and
When the file or list contains the stored process information by the computer device, the computer device further includes a step of identifying the application corresponding to the stored process information in the file or list as a cheat application. The cheat application identification method according to claim 12. When the computer device includes information for identifying other applications installed on the computer in the storage path of the file related to the identification target application, the step of identifying the identification target application as a cheat application is performed. The cheat application identification method according to claim 12, further comprising. The stage of storing the file name or storage path of the selected file among the files included in the cheat application identified in advance by the computer device .
The stage of confirming whether or not the file corresponding to the stored file name or storage path exists among the files included in the identification target application by the computer device , and
The cheat according to claim 12, further comprising the step of identifying the identification target application as a cheat application when the computer device has a file corresponding to the stored file name or storage path. Application identification method. The computer device generates a first hash value for a selected first file among the files included in the pre-identified cheat application or some preset items among the items included in the selected first file. And store it,
The step of generating a second hash value for a preset second file among the files included in the identification target application or a preset item among the items included in the selected second file by the computer device. ,and
12. The computer device further includes a step of comparing the first hash value and the second hash value and, if they are the same, identifying the identification target application as a cheat application, according to claim 12. Described cheat application identification method. The stage of storing the pre-identified cheat application package identifier by the computer device , and
If the computer device has a first application with the same package identifier as the stored package identifier installed on the computer in connection with the operating system, further steps to identify the first application as a cheat application. The cheat application identification method according to claim 12, wherein the cheat application identification method comprises. A computer-readable recording medium, wherein a program for causing a computer to execute the method according to any one of claims 12 to 19 is recorded.

Images