We propose a repackaging detection technique that takes
advantage of the attacker’s reluctance to significantly alter
elements that characterise an application, without substantially
minimising the attack vector. The data that characterises an application prior to its installation are its name and icon. Since
there is a high probability that little or no modification is likely to
have taken place on these elements of a repackaged application,
image and string comparison algorithms can be used in order to
determine the potential original application by comparing them
against a database of authentic applications.