Abstract: Android cracked applications have the risks of infringing on legitimate software rights and spreading malicious code. To detect the payment cracked applications on Android platform, we propose a detection method based on machine learning. Based on the disassembled bytecode file, the call control flow of payment semantic information and the payment database operation function set are constructed. We use a n-gram statistical method and a repeated code sub-block length statistical method to construct the corresponding feature set, and build a multi-classifier detection model with a decision-making mechanism to identify different payment cracked behaviors in Android applications. The experimental results show that the detection accuracy rate of this model is 85.24%, and the area under curve (AUC) value is 0.87. Compared with the baseline methods, the detection rate of payment cracked applications is significantly improved, which effectively solves the detection problem of payment cracked applications.

Key words: Android, payment cracked, software security, feature extraction, machine learning