# Dexofuzzy: Dalvik EXecutable Opcode Fuzzyhash
Dexofuzzy is a similarity digest hash for Android. It extracts Opcode Sequence from Dex file based on Ssdeep and generates hash that can be used for similarity comparison of Android App. Dexofuzzy created using Dex's opcode sequence can find similar apps by comparing hash.
  
## Requirements
Dexofuzzy requires the following modules:
- ssdeep 3.3 or later
## Usage
```
usage: dexofuzzy [-h] [-f SAMPLE_FILENAME] [-d SAMPLE_DIRECTORY]
[-g N M][-s DEXOFUZZY DEXOFUZZY]
[-c CSV_FILENAME] [-j JSON_FILENAME]
[-l LOG_FILENAME]
Dexofuzzy - Dalvik EXecutable Opcode Fuzzyhash
optional arguments:
-h, --help show this help message and exit
-f SAMPLE_FILENAME, --file SAMPLE_FILENAME
the sample to extract dexofuzzy
-d SAMPLE_DIRECTORY, --directory SAMPLE_DIRECTORY
the directory of samples to extract dexofuzzy
-s DEXOFUZZY DEXOFUZZY, --score DEXOFUZZY DEXOFUZZY
score the dexofuzzy of the sample
-g N, --clustering N M N-Gram Tokenizer and M-Partial Matching clustering based on the sample's dexofuzzy
(must include the -d option by default)
-c CSV_FILENAME, --csv CSV_FILENAME
output as CSV format
-j JSON_FILENAME, --json JSON_FILENAME
output as json format
(include method fuzzy or clustering)
-l LOG_FILENAME, --error-log LOG_FILENAME
output the error log
```
### Python API
To compute a Dexofuzzy of `dex file`, use `hash` function:
- _dexofuzzy(dex_binary_data)_
```python
>>> import dexofuzzy
>>> with open('classes.dex', 'rb') as dex:
... dex_data = dex.read()
>>> dexofuzzy.hash(dex_data)
'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
```
- _dexofuzzy_from_file(apk_file_path or dex_file_path)_
```python
>>> import dexofuzzy
>>> dexofuzzy.hash_from_file('Sample.apk')
'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
>>> dexofuzzy.hash_from_file('classes.dex')
'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
```
The `compare` function returns the match between 2 hashes, an integer value from 0 (no match) to 100.
- _compare(dexofuzzy_1, dexofuzzy_2)_
```python
>>> import dexofuzzy
>>> with open('classes.dex', 'rb') as dex:
... dex_data = dex.read()
>>> hash1 = dexofuzzy.hash(dex_data)
>>> hash1
'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
>>> hash2 = dexofuzzy.hash_from_file('classes2.dex')
>>> hash2
'48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5'
>>> dexofuzzy.compare(hash1, hash2)
50
```
## Publication
- Shinho Lee, Wookhyun Jung, Sangwon Kim, Eui Tak Kim, [Android Malware Similarity Clustering using Method based Opcode Sequence and Jaccard Index](https://ieeexplore.ieee.org/iel7/8932631/8939563/08939894.pdf), In: Proceedings of the 2019 International Conference on Information and Communication Technology Convergence, ICTC, 16-18 October 2019.
- Shinho Lee, Wookhyun Jung, Sangwon Kim, Jihyun Lee, Jun-Seob Kim, [Dexofuzzy: Android Malware Similarity Clustering Method using Opcode Sequence](https://www.virusbulletin.com/uploads/pdf/magazine/2019/201911-Dexofuzzy-Android-Malware-Similarity-Clustering-Method.pdf), Virus Bulletin, 25 October 2019.
- Shinho Lee, Wookhyun Jung, Wonrak Lee, HyungGeun Oh, Eui Tak Kim, [Android Malware Dataset Construction Methodology to Minimize Bias-Variance Tradeoff](https://www.sciencedirect.com/science/article/pii/S2405959521001351/pdfft?md5=62c643429a39f8f7e31609fbd89c56a0&pid=1-s2.0-S2405959521001351-main.pdf), ICT Express, 8 October 2021.
## License
Dexofuzzy is licensed under the terms of the Apache license. See [LICENSE](https://github.com/lee1029ng/Dexofuzzy/blob/master/LICENSE) for more information.
Raw data
{
"_id": null,
"home_page": "https://github.com/lee1029ng/Dexofuzzy",
"name": "dexofuzzy",
"maintainer": "",
"docs_url": null,
"requires_python": ">=3.5",
"maintainer_email": "",
"keywords": "Android,Malware,Opcode,Birthmark,Similarity digest hash,N-Gram,M-Partial Matching,Clustering",
"author": "Shinho Lee",
"author_email": "lee1029ng@gmail.com",
"download_url": "https://files.pythonhosted.org/packages/1d/c9/26e0ffe42c113d4ce0c2fd680384d2e2a6874adee58184ba0e9779dfa6d0/dexofuzzy-2.0.0.tar.gz",
"platform": null,
"description": "# Dexofuzzy: Dalvik EXecutable Opcode Fuzzyhash\r\n\r\nDexofuzzy is a similarity digest hash for Android. It extracts Opcode Sequence from Dex file based on Ssdeep and generates hash that can be used for similarity comparison of Android App. Dexofuzzy created using Dex's opcode sequence can find similar apps by comparing hash.\r\n\r\n  \r\n\r\n## Requirements\r\n\r\nDexofuzzy requires the following modules:\r\n\r\n- ssdeep 3.3 or later\r\n\r\n## Usage\r\n\r\n```\r\nusage: dexofuzzy [-h] [-f SAMPLE_FILENAME] [-d SAMPLE_DIRECTORY]\r\n [-g N M][-s DEXOFUZZY DEXOFUZZY]\r\n [-c CSV_FILENAME] [-j JSON_FILENAME]\r\n [-l LOG_FILENAME]\r\n\r\nDexofuzzy - Dalvik EXecutable Opcode Fuzzyhash\r\n\r\noptional arguments:\r\n -h, --help show this help message and exit\r\n -f SAMPLE_FILENAME, --file SAMPLE_FILENAME\r\n the sample to extract dexofuzzy\r\n -d SAMPLE_DIRECTORY, --directory SAMPLE_DIRECTORY\r\n the directory of samples to extract dexofuzzy\r\n -s DEXOFUZZY DEXOFUZZY, --score DEXOFUZZY DEXOFUZZY\r\n score the dexofuzzy of the sample\r\n -g N, --clustering N M N-Gram Tokenizer and M-Partial Matching clustering based on the sample's dexofuzzy\r\n (must include the -d option by default)\r\n -c CSV_FILENAME, --csv CSV_FILENAME\r\n output as CSV format\r\n -j JSON_FILENAME, --json JSON_FILENAME\r\n output as json format\r\n (include method fuzzy or clustering)\r\n -l LOG_FILENAME, --error-log LOG_FILENAME\r\n output the error log\r\n```\r\n\r\n### Python API\r\n\r\nTo compute a Dexofuzzy of `dex file`, use `hash` function:\r\n\r\n- _dexofuzzy(dex_binary_data)_\r\n\r\n```python\r\n>>> import dexofuzzy\r\n>>> with open('classes.dex', 'rb') as dex:\r\n... dex_data = dex.read()\r\n>>> dexofuzzy.hash(dex_data)\r\n'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'\r\n```\r\n\r\n- _dexofuzzy_from_file(apk_file_path or dex_file_path)_\r\n\r\n```python\r\n>>> import dexofuzzy\r\n>>> dexofuzzy.hash_from_file('Sample.apk')\r\n'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'\r\n>>> dexofuzzy.hash_from_file('classes.dex')\r\n'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'\r\n```\r\n\r\nThe `compare` function returns the match between 2 hashes, an integer value from 0 (no match) to 100.\r\n\r\n- _compare(dexofuzzy_1, dexofuzzy_2)_\r\n\r\n```python\r\n>>> import dexofuzzy\r\n>>> with open('classes.dex', 'rb') as dex:\r\n... dex_data = dex.read()\r\n>>> hash1 = dexofuzzy.hash(dex_data)\r\n>>> hash1\r\n'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'\r\n>>> hash2 = dexofuzzy.hash_from_file('classes2.dex')\r\n>>> hash2\r\n'48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5'\r\n>>> dexofuzzy.compare(hash1, hash2)\r\n50\r\n```\r\n\r\n## Publication\r\n\r\n- Shinho Lee, Wookhyun Jung, Sangwon Kim, Eui Tak Kim, [Android Malware Similarity Clustering using Method based Opcode Sequence and Jaccard Index](https://ieeexplore.ieee.org/iel7/8932631/8939563/08939894.pdf), In: Proceedings of the 2019 International Conference on Information and Communication Technology Convergence, ICTC, 16-18 October 2019.\r\n- Shinho Lee, Wookhyun Jung, Sangwon Kim, Jihyun Lee, Jun-Seob Kim, [Dexofuzzy: Android Malware Similarity Clustering Method using Opcode Sequence](https://www.virusbulletin.com/uploads/pdf/magazine/2019/201911-Dexofuzzy-Android-Malware-Similarity-Clustering-Method.pdf), Virus Bulletin, 25 October 2019.\r\n- Shinho Lee, Wookhyun Jung, Wonrak Lee, HyungGeun Oh, Eui Tak Kim, [Android Malware Dataset Construction Methodology to Minimize Bias-Variance Tradeoff](https://www.sciencedirect.com/science/article/pii/S2405959521001351/pdfft?md5=62c643429a39f8f7e31609fbd89c56a0&pid=1-s2.0-S2405959521001351-main.pdf), ICT Express, 8 October 2021.\r\n\r\n## License\r\n\r\nDexofuzzy is licensed under the terms of the Apache license. See [LICENSE](https://github.com/lee1029ng/Dexofuzzy/blob/master/LICENSE) for more information.\r\n",
"bugtrack_url": null,
"license": "Apache License 2.0",
"summary": "Dexofuzzy: Dalvik EXecutable Opcode Fuzzyhash",
"version": "2.0.0",
"project_urls": {
"Homepage": "https://github.com/lee1029ng/Dexofuzzy"
},
"split_keywords": [
"android",
"malware",
"opcode",
"birthmark",
"similarity digest hash",
"n-gram",
"m-partial matching",
"clustering"
],
"urls": [
{
"comment_text": "",
"digests": {
"blake2b_256": "b3295ac5ff464d35a16bb7004944ba6d50e2cd4c5718d4954857bc62780af21d",
"md5": "558e5de978c056fe558a07c477b19114",
"sha256": "1e14aaf0c3f2433a8b6c5181e81da6857f5e60ca4662675fe13abaf515c5048c"
},
"downloads": -1,
"filename": "dexofuzzy-2.0.0-py3-none-any.whl",
"has_sig": false,
"md5_digest": "558e5de978c056fe558a07c477b19114",
"packagetype": "bdist_wheel",
"python_version": "py3",
"requires_python": ">=3.5",
"size": 57071,
"upload_time": "2024-01-01T00:28:44",
"upload_time_iso_8601": "2024-01-01T00:28:44.711602Z",
"url": "https://files.pythonhosted.org/packages/b3/29/5ac5ff464d35a16bb7004944ba6d50e2cd4c5718d4954857bc62780af21d/dexofuzzy-2.0.0-py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"blake2b_256": "1dc926e0ffe42c113d4ce0c2fd680384d2e2a6874adee58184ba0e9779dfa6d0",
"md5": "054de51a58e97b75498eabe8ca05c0f7",
"sha256": "0807d0af9f560e80386e254cf912092c02321d12ba34b87e97daa6c506478ab6"
},
"downloads": -1,
"filename": "dexofuzzy-2.0.0.tar.gz",
"has_sig": false,
"md5_digest": "054de51a58e97b75498eabe8ca05c0f7",
"packagetype": "sdist",
"python_version": "source",
"requires_python": ">=3.5",
"size": 54296,
"upload_time": "2024-01-01T00:28:45",
"upload_time_iso_8601": "2024-01-01T00:28:45.871256Z",
"url": "https://files.pythonhosted.org/packages/1d/c9/26e0ffe42c113d4ce0c2fd680384d2e2a6874adee58184ba0e9779dfa6d0/dexofuzzy-2.0.0.tar.gz",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2024-01-01 00:28:45",
"github": true,
"gitlab": false,
"bitbucket": false,
"codeberg": false,
"github_user": "lee1029ng",
"github_project": "Dexofuzzy",
"travis_ci": false,
"coveralls": false,
"github_actions": false,
"lcname": "dexofuzzy"
}
JSON
