Method and device for detecting malicious program and client side

Abstract

The invention provides a method and a device for detecting a malicious program and a client side. The method comprises the following steps: obtaining an operation interface of a program to be detected; extracting a control object in the operation interface, and triggering the control object according to a present operation strategy; and obtaining the behavior information of the program to be detected after the control object is triggered, and detecting the malicious program of the program to be detected according to the behavior information. According to the method of the embodiment of the invention, whether the program to be detected contains dangerous acts or not is quickly and effectively identified, and meanwhile, a useful basis is provided for blocking and clearing the malicious program which contains the dangerous acts.

Description

technical field [0001] The invention relates to the field of mobile terminal security, in particular to a malicious program detection method, device and client. Background technique [0002] As operating systems such as Android have become the mainstream operating systems of the mobile Internet, malicious programs targeting Android operating systems have shown a significant increase. Therefore, in this context, it is necessary to quickly and effectively identify harmful behaviors of malicious programs through malicious program analysis methods. At present, the analysis methods of malicious programs mainly include static analysis method and dynamic analysis method. Among them, the dynamic behavior analysis method judges whether it is suspicious according to the characteristics of the program, so it has the characteristics of being able to detect programs with unknown signature codes. Research hotspots in the field of anti-virus security at home and abroad. [0003] In the p...

AI Technical Summary

Problems solved by technology

[0003] In the process of realizing the present invention, the inventors found that the prior art has at least the following problems: the current dynamic analysis method cannot identify malicious programs pretending to be certain functional software. Clicking but actually has no actual function. After the user clicks, the picture will be downloaded or the user will be induced to continue clicking. It is very likely that a malicious SP (Service Provider, Service Provider) will send an order text message, consuming the user's tariff and it is difficult for the user to find out.

Existing dynamic analysis methods cannot quickly and effectively identify the harmful behavior of such malicious programs, and there is no basis for blocking and removing such malicious programs, resulting in huge harm to users from malicious programs

Images