Software malicious behavior modeling and judging method and device, and mobile terminal

Abstract

The invention discloses a software malicious behavior modeling method. The method comprises the steps as follows: generating at least one sensitive action according to the access to a sensitive resource in a mobile terminal; generating at least one context according to a persistent state of a system in the mobile terminal; and generating a malicious behavior model according to one or more sensitive action in the at least one sensitive action and / or one context in the at least one context. According to the method, the malicious behavior model is generated according to the sensitive action acquired by detecting the sensitive resource and the context expressing the state of the system, and whether any behavior executed by software is malicious behavior can be effectively found, so that malicious software can be accurately judged, and the security of the mobile terminal is improved. The invention further discloses a software malicious behavior molding device, a software malicious behavior and malicious software judgment method, and a mobile terminal.

Description

technical field [0001] The present invention relates to the technical field of mobile communications, and in particular to a software malicious behavior modeling method and modeling device, a mobile terminal using the modeling device, a method for judging malicious software behavior, and a method for judging software malicious behavior. Background technique [0002] With the development of software and mobile communication technology, embedding software in mobile terminals (such as mobile phones) has become a main feature of smart phones. As more and more software is implanted into mobile phones, some malicious software is also implanted. Here, malware refers to software that performs malicious acts. These malicious acts include stealing users' private information, eavesdropping on users' calls, etc. For this reason, it is necessary to establish a model for the malicious software in the mobile phone so as to manage the malicious behavior of the above-mentioned malicious so...

AI Technical Summary

Problems solved by technology

[0005] The defect of the executable file-based malicious behavior modeling method is that this method establishes a malicious behavior feature for each malware, and as the number of malware increases, the number of malicious behavior models established by this method is too large, thus giving When the system or security software uses the above modeling methods to perform malicious behavior detection, it brings a lot of resource overhead, which greatly affects system performance

[0007] The disadvantage of the malicious behavior modeling method based on a single sensitive permission is that this method is too general to effectively distinguish between real malware and normal software using the same permission, thus losing the meaning of malicious behavior modeling

[0008] In addition, the traditional malicious behavior modeling method does not consider the internal relationship between privilege access and the system state in which it is located, so it cannot reflect the nature and purpose of malicious behavior.

The traditional malicious behavior modeling method is not customizable, so users cannot customize the malicious behavior model according to their own needs, which leads to the failure to meet the customization needs of users, and the user experience is low

Images