Palo Alto Networks, Inc.
Grouping application components for classification and malware detection

Abstract:

A first mobile application is received. A reversing operation is performed on the first mobile application. A static analysis engine is used to determine a plurality of libraries included in the mobile application. Each library included in the plurality of libraries is categorized. A determination that the first mobile application is similar to a second mobile application based at least in part on a comparison of the respective categorizations of the respective libraries included in the respective first and second mobile applications. Commonality in the libraries of the two mobile applications can be used for a variety of purposes including detecting repackaging and also common authorship.