← Back to project catalogue
GP-CY-0ABQ3M8CybersecurityOpen for request

Android clone and fake-app analyser

A static-analysis system for comparing an Android application package with a trusted reference and identifying signs of cloning, repackaging, or misleading identity.

  • Nuxt
  • Vue
  • FastAPI
  • PostgreSQL
  • Python
  • Androguard
  • Docker

Project definition

Problem statement

A fake or repackaged Android application may copy a legitimate name, icon, screens, or code while changing its signing certificate, permissions, embedded endpoints, or behaviour.

The engineering problem is to compare packages using multiple static signals and present traceable evidence without treating visual similarity or a single permission as proof of malicious intent.

Project objectives

  • Extract package identity, signing certificates, manifest data, permissions, components, resources, and selected code features.
  • Compare a candidate APK with a trusted reference package and version.
  • Identify certificate mismatches, suspicious permission changes, copied resources, and changed network endpoints.
  • Produce an explainable risk score supported by individual findings.
  • Measure detection and false-positive performance on prepared benign and repackaged samples.

System design

System modules

01

Package intake

Validates APK files, calculates hashes, records provenance, and processes each sample in an isolated job.

02

Static extractor

Reads certificates, manifest entries, permissions, components, resources, strings, and selected code metadata.

03

Comparison engine

Compares package identity, certificate chains, icons, resources, permissions, components, and endpoints.

04

Risk scorer

Combines documented weighted signals and shows how every signal changes the result.

05

Evidence dashboard

Displays side-by-side differences, matched resources, warnings, confidence, and exported findings.

Methodology

System workflow

  1. 01
    Register reference

    A trusted package is stored with its source, version, hashes, and expected certificate information.

  2. 02
    Upload candidate

    A prepared candidate APK is hashed and sent to the isolated static-analysis worker.

  3. 03
    Extract features

    The system records identity, certificate, manifest, permission, resource, and endpoint features.

  4. 04
    Compare

    Differences and similarities are scored under a versioned rule set.

  5. 05
    Review evidence

    The analyst inspects each signal and records a final classification for evaluation.

Demonstration scenario

A trusted sample and a prepared repackaged variant are compared. The analyser shows a different signing certificate, copied icon resources, two added permissions, and a changed endpoint. The risk score links to each difference while the reviewer records the final sample label.

Engineering

Technical architecture

Web application
Nuxt and Vue for sample intake, side-by-side comparison, finding review, and result export.
Analysis API
FastAPI for package jobs, extracted features, comparisons, risk results, and analyst labels.
Data layer
PostgreSQL for package metadata, hashes, certificates, features, comparisons, findings, and labels.
Static analysis
Python and Androguard for safe package parsing, with perceptual hashing for selected image-resource comparisons.
Isolation
Containerised workers, strict file limits, no application execution, and no outbound access during analysis.

Testing

Evaluation

Evaluation measures

  • Accuracy on prepared trusted, benign variant, cloned, and repackaged samples
  • Precision and recall for certificate, permission, resource, and endpoint findings
  • False-positive rate across legitimate version changes
  • Agreement between calculated risk and documented analyst labels
  • Evidence traceability from score to extracted feature
  • Analysis time and failure handling across package sizes

System boundaries

  • Only applications owned by the student, safely prepared samples, or packages with permission for analysis are included.
  • The system performs static analysis and does not execute unknown applications.
  • A high score indicates evidence requiring review and is not a legal finding or malware verdict.
  • The project does not collect applications from devices or app stores automatically.

Included

  1. 01APK upload, comparison, and evidence dashboard
  2. 02Certificate, manifest, resource, and code-feature analysis
  3. 03Explainable similarity and risk-scoring module
  4. 04Prepared safe APK samples, comparisons, and test results
  5. 05Complete source code in a private GitHub repository
  6. 06Complete project documentation with synopsis, abstract, methodology, analysis diagrams, test results, screenshots, and conclusion
  7. 07Setup and usage guide

Project record

No buyer information is collected on this page.

Permanent project ID
GP-CY-0ABQ3M8
Catalogued
21 Aug 2026
Completed
Pending
Verified
Pending
Demonstration
Added when ready

Handover

After purchase

  1. 01
    Payment is confirmed

    The project is marked unavailable and cannot be purchased again.

  2. 02
    Repository access is granted

    The buyer's submitted GitHub account receives access to the private repository.

  3. 03
    The purchase record is delivered

    The certification sheet is prepared from the reviewed buyer details and sent privately by email.