Automatic detection method for Android malicious software

Abstract

The invention discloses an automatic detection method for Android malicious software, and belongs to the technical field of system security. The method comprises the following steps: 1) setting a plurality of application programming interface (API) functions as sensitive APIs, disassembling software to be detected and analyzing all sensitive APIs and function call paths from a disassembled code; 2) judging the trigger mode of each sensitive API, analyzing control information triggering the sensitive API, inputting the control information into a dynamic detection sandbox and executing the control to automatically trigger a malicious act if the trigger mode is a user trigger mode, and sending system messages to the dynamic detection sandbox to trigger the malicious act if the trigger mode is a system message trigger mode; and (3) monitoring and recording the conditions of calling the sensitive API by the software and operating data through the dynamic detection sandbox, and judging the software as the malicious software if the call of the sensitive API and the operating data of the call indeed exist. By the method, manual intervention is not required, and the method provides powerful support for detecting large-scale malicious software.

Description

technical field [0001] The invention belongs to the technical field of system security, relates to a malicious software detection method, in particular to an Android malicious software automatic detection method. Background technique [0002] With the rapid development of the mobile Internet and the gradual popularization of smart phones, various smart phone application software has begun to affect all aspects of people's work and life, such as: mobile game software, mobile SNS software, mobile IM software, mobile payment software and mobile positioning service software and so on. At present, the two main camps of smartphone operating systems are Apple's iOS system and Google's Android system. Due to the closed nature of the iOS system, iOS application software needs to be downloaded from its official App Store, and all application software Before being put into the App Store, it needs to go through the strict review of Apple, which can largely ensure the safety of the iOS ...

AI Technical Summary

Problems solved by technology

[0006] In view of the above problems, the purpose of the present invention is to provide an automated Android malware detection method, which combines the advantages of high efficiency of static analysis, strong coverage, and high dynamic detection accuracy, and solves the problem in an Android-based sandbox. In the dynamic detection environment, it is difficult to automatically trigger the problem of malicious behavior, forming a method and system for automatically detecting malicious behavior of Android software

Images