Method and apparatus for identifying malicious apk files

Abstract

The invention discloses a method and device for identifying malicious APK files. The method for identifying malicious APK files includes the following steps: selecting a predetermined number of APK file samples; analyzing executable files in the APK file samples and extracting feature strings in the parsed text; using feature strings to construct a list of malicious program feature codes and non- Malicious program feature code list; the feature string corresponding to the APK file sample is compared with the malicious program feature code list and the non-malicious program feature code list to obtain the character string feature vector of the APK file sample, and according to the character string feature vector and The permission of the APK file sample to the system generates the identification feature vector of the APK file; the identification feature vector of multiple APK file samples is trained to generate a classification model for identifying malicious APK files; the classification model is used to identify unknown types of APK files. APK files are identified. Using the technical scheme of the invention, the recognition accuracy is high, and unknown viruses can be predicted.

Description

technical field [0001] The invention relates to the field of Internet computer security protection, in particular to a method and device for identifying malicious APK files. Background technique [0002] APK is the abbreviation of Android application package file, that is, the Android installation package, which can be understood as the application software installed on the Android terminal. With the popularity and development of Android terminals, a variety of APKs have emerged. For example, some APKs harm users through malicious behaviors such as customizing paid services by SMS, making paid calls, and backing up sensitive data in the user's mobile phone to a specific server. rights and interests. This type of malicious APK sneaks into the user's terminal without the user's knowledge and authorization, bringing hidden dangers to the user's information security and property security. [0003] The methods for identifying malicious APKs in the prior art mainly rely on manua...

AI Technical Summary

Problems solved by technology

The former identification method requires analysts to manually analyze the existing APK program samples to find out the corresponding characteristics, which heavily depends on the ability of virus analysts, so a large number of experienced personnel are required to meet the needs of solving problems, and due to technical Complicated, the efficiency of recognition is relatively low

Moreover, the use of manual summary feature codes can generally only deal with known malicious APKs, and cannot prevent possible problems, so it has a certain lag; the latter identification method is based on simple features or rules or digital signatures. It is easy to be bypassed by virus creators, causing the problem of missing malicious programs

Images