Method and device of recognizing malicious APK files

Abstract

The invention discloses a method and a device of recognizing malicious APK files. The method includes the steps of selecting a predetermined amount of APK file samples; analyzing executable files in the APK file samples and extracting feature strings in the analyzed files; establishing a list of malware feature codes and a list of non-malware feature codes through the feature strings; comparing the feature strings of the APK file samples to the list of malware feature codes and the list of non-malware feature codes so as to obtain string feature vectors of the APK file samples, generating recognition feature vectors of the APK files for permissions applied by a system according to the string feature vectors and the APK file samples; training the recognition feature vectors of the APK file samples, and generating a classification model for recognizing malicious APK files; recognizing the APK files of unknown types by the classification models. The method and device has the advantages that recognition accuracy is high and unknown viruses can be predicted.

Description

technical field [0001] The invention relates to the field of Internet computer security protection, in particular to a method and device for identifying malicious APK files. Background technique [0002] APK is the abbreviation of Android application package file, that is, the Android installation package, which can be understood as the application software installed on the Android terminal. With the popularity and development of Android terminals, a variety of APKs have emerged. For example, some APKs harm users through malicious behaviors such as customizing paid services by SMS, making paid calls, and backing up sensitive data in the user's mobile phone to a specific server. rights and interests. This type of malicious APK sneaks into the user's terminal without the user's knowledge and authorization, bringing hidden dangers to the user's information security and property security. [0003] The methods for identifying malicious APKs in the prior art mainly rely on manua...

AI Technical Summary

Problems solved by technology

The former identification method requires analysts to manually analyze the existing APK program samples to find out the corresponding characteristics, which heavily depends on the ability of virus analysts, so a large number of experienced personnel are required to meet the needs of solving problems, and due to technical Complicated, the efficiency of recognition is relatively low

Moreover, the use of manual summary feature codes can generally only deal with known malicious APKs, and cannot prevent possible problems, so it has a certain lag; the latter identification method is based on simple features or rules or digital signatures. It is easy to be bypassed by virus creators, causing the problem of missing malicious programs

Images