Active defense system based on Android platform software behavior detection

Abstract

The invention relates to an active defense system based on Android platform software behavior detection. The active defense system based on Android platform software behavior detection is used for actively defending mobile phone security threats. According to the active defense system, process data are collected by using a top command or a PS command, and ActivityManager.MemoryInfo () and ActivityManager.AppProcessInfo () which are provided by an API (Application Programming Interface) of Android; the collected data are analyzed by using a PCA (Principal Component Analysis) method, features which best reflect samples are extracted, and the samples are loaded to a neural network model; and partial samples are randomly selected for learning so as to obtain model parameters which serve as model parameters of an evaluation portion, thus, the samples to be detected are evaluated, whether the samples are normal or not is judged, and then, whether some process is abnormal or not is judged. According to the active defense system, PCA dimensionality reduction is introduced into mobile phones in a manner of being combined with a BP (Back Propagation) neural network, so that the traditional computation amount and memory capacity of the BP neural network are reduced, the active defense system can be excellently implemented on mobile devices with limited computing power and storage capacity, such as the mobile phones, and the security of the mobile phones is guaranteed.

Description

technical field [0001] The invention relates to an active defense system based on Android platform software behavior detection. Background technique [0002] The wide application of smartphones today, especially the provision of the Android open platform, makes the Android smartphone market show a huge growth advantage, but also because of the openness of the platform, it is more vulnerable to malicious software attacks. [0003] Currently existing mobile phone security software mainly transplants the security software in the form of comparing feature codes in the PC directly to the mobile phone. The form of signature comparison is very effective for killing known malicious programs, but it is helpless for unknown malicious programs. Nowadays, the number of malicious programs is increasing geometrically. Compared with malicious programs, the generation and update of signature databases are often Lag, many times anti-virus software can not kill unknown malicious programs. A...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the potential safety hazards of the Android platform, the present invention explores a new security detection system based on behavior detection to realize the function of detecting software abnormal behavior, and achieve the effect of active defense with as little storage and calculation as possible

Images