Virus detection method and device for Android samples

Abstract

The invention discloses a virus detection method and a virus detection device for Android samples. The virus detection method includes: analyzing a dex file to obtain code information which includes packages, classes and method information; locating a program body, corresponding to the code information, in the dex file, and obtaining an opcode sequence corresponding to the program body; matching the opcode sequence with the virus information, and judging whether the opcode sequence includes viruses. According to the virus detection method and a virus detection device for the Android samples, information such as packages, classes and methods in the dev file are extracted, the opcode sequence is obtained by codes and matched with virus features to determine whether the file is infected with the viruses, locating, detecting and killing at the code level can be performed, detection omission of the viruses is avoided, efficiency for detecting and killing the viruses can be improved, detecting and killing of the viruses are performed by a plurality of engines, expansibility is very strong, and speed for detecting and killing the viruses is high.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a virus detection method and device for Android samples. Background technique [0002] With the development of information technology in society, terminals (including various devices such as computers and mobile phones) are becoming more and more important in people's lives. People increasingly rely on terminals to save personal information, such as various account information, private chat records, and even some pictures and photos. Therefore, if the terminal system is threatened by a malicious file (such as a malicious website or a computer virus, etc.), it is easy to cause leakage of personal information and cause inestimable losses to users. In the prior art, virus sample identification using feature code scanning is a relatively common technique, and feature code scanning refers to a method of scanning and judging unknown samples using pre-extracted virus features....

AI Technical Summary

Problems solved by technology

Therefore, if the terminal system is threatened by malicious files (such as malicious URLs or computer viruses, etc.), it is easy to cause leakage of personal information and cause inestimable losses to users.

Images