Method and device for detecting malicious software of intelligent mobile terminal

Abstract

The invention discloses a method and a device for detecting malicious software of an intelligent mobile terminal. The user operation is compared with a software behavior and according to behavior characteristics, the malicious software is identified. For continuously emerging new viruses or virus mutations, compared with a conventional detection method, the method and the device do not depend on a malicious code section feature library and a malicious function calling sequence feature library and are also limited to known malicious software, and thus, the method and the device have high universality and high detection rate, malicious behaviors such as malicious charging, privacy stealing and remote control can be well identified and reliable guarantee is provided for safety use of the intelligent mobile terminal.

Description

technical field [0001] The invention relates to the technical field of intelligent mobile terminals, in particular to a method and device for detecting malicious software in an intelligent mobile terminal. Background technique [0002] In recent years, with the rapid development of the mobile Internet, intelligent mobile terminal software has penetrated into various key areas of people's production and life, such as mobile office, electronic payment, car navigation, etc. The number of intelligent mobile terminal software has far exceeded that of traditional PCs. The number of applications. Among the many smart mobile terminal software, the Android camp led by Google adopts an open strategy, so that the number of application software on the platform shows an explosive growth. Compared with the application software on iOS and WP, ​​the current Android application software The number of users and the number of users have taken an absolute advantage. [0003] While the applica...

AI Technical Summary

Problems solved by technology

[0007] 1.2 Disadvantages of Existing Malware Static Detection Techniques

[0008] The detection capabilities of existing malware static detection technologies largely rely on the signature database of malware, and can only detect and kill existing viruses and Trojans, and cannot detect unknown malicious mobile applications.

In addition, for hardened malicious mobile applications, since they have been encrypted and obfuscated, static malware detection technology is difficult to apply

[0009] 2. Existing Malware Dynamic Detection Technology

[0012] 2.2 Disadvantages of Existing Malware Dynamic Detection Technology

[0013] The existing detection methods by analyzing API functions and system core function calls are not high in abstraction, and the sequence characteristics of malicious API calls are too detailed. Therefore, the detection rate of malicious mobile applications with the same malicious behavior pattern but different software implementations is not high.

In addition, because the dynamic detection technology needs to create a separate function call monitoring process, its system resource usage is high, which affects the normal operation of the software.

Images