Android malicious code detection system and method based on Opcode backtracking

Abstract

The invention discloses an android malicious code detection system and method based on Opcode backtracking. The method includes the steps that firstly, a rule base is established, and detection strategies are customized by the rule base according to an object to be detected; an API called initially is placed in a queue as a name to be matched; the name to be matched is read from the queue, and names of functions called by all Opcode instructions are obtained by using a dex analysis and Opcode disassembling module; the names of the called functions are contrasted with the name to be matched, the name of the function where the successfully matched Opcode instruction belongs is placed in the queue as a name to be matched, the operations are repeated until the queue is empty, whether a called relational tree conforms to detection rules customized in the rule base or not is analyzed and judged on the basis of the rule base, and if yes, the relational tree is a malicious sample; otherwise the relational tree is safe. According to the Android malicious mode detection system and method based on Opcode backtracking, the problems of false alarm and alarm failure in an existing malicious code detection method can be well solved.

Description

technical field [0001] The invention relates to the technical field of mobile terminal malicious code detection, in particular to an Android malicious code detection system and method based on Opcode backtracking. Background technique [0002] With the development of the mobile Internet and the increasing popularity of smart mobile terminals, user information security is increasingly threatened by malicious codes. All kinds of new malicious codes emerge in an endless stream, which brings new problems to existing detection technologies. [0003] At present, various security vendors have proposed many detection methods in the field of mobile terminal malicious code detection, mainly in the following categories. [0004] The first type of method is to calculate the installation file of the android APK file to obtain a characteristic value, such as the MD5 of the APK file, and detect the malicious code through the characteristic value. However, there are limitations in this de...

AI Technical Summary

Problems solved by technology

This kind of method has some problems of false positives and false

Images