Malicious behavior detection method and system based on smartphone radio interface layer

Abstract

The invention relates to a malicious behavior detection method and system based on the radio interface layer of a smart phone. When the operating system and the underlying radio hardware perform data exchange and communication, the data instructions are monitored and the instructions are decoded and analyzed, and the operating system is accurately learned from the underlying layer. Information about whether the application layer is performing dial-up, voice communication, data communication, SMS communication, etc. and radio hardware data communication, to make up for the system defect that the smartphone operating system architecture cannot know the current mobile phone data communication status from the bottom layer, and will obtain The relevant application program and the underlying radio hardware communication status data information are intelligently matched with the relevant application program in the user layer of the smartphone operating system to distinguish which applications are legal data communication behaviors and which applications are illegal data communication behaviors, so as to target Various malicious software behaviors can provide timely and powerful protection and improve the security of smartphone users.

Description

technical field [0001] The invention belongs to the technical field of mobile communication, and in particular relates to a method and system for detecting malicious behaviors based on the radio interface layer of smart phones, which can effectively protect malicious communication behaviors of smart phone application programs. Background technique [0002] With the continuous development of mobile phone operating system technology, more and more mobile phone manufacturers choose to use the mainstream smart phone operating system in their new products. Smart phone operating systems have great differences with traditional mobile phones in terms of software installation and application. the difference. Traditional mobile phones only have several prefabricated single software functions, which cannot meet the various needs of users. However, in mainstream smart phone operating systems, a concept of "software market" can be easily used. Choose the application you need from thousa...

AI Technical Summary

Problems solved by technology

[0004] All applications of the Android operating system run independently in the DalvikVM virtual machine. The virtual machine is characterized by providing a virtual operating environment for each application. All communication operations directly interact with the hardware through the virtual machine. The applications that developers can develop through the Application Framework (application framework) also run in the DalvikVM virtual machine. The characteristics of the DalvikVM virtual machine can only obtain data communication operations related to their own programs, and cannot obtain other running data in the operating system. The communication data operation of the application program, due to the characteristics of the DalvikVM virtual machine, many well-known security product developers have failed to develop an application software that can monitor the communication behavior of mobile phones, including Google itself.

Images