Program behavior feature extraction method, malicious program detection method and device thereof

Abstract

Proposed are a method for retrieving a behavioral feature of software, and a method, an apparatus, and a client for detecting malicious software, where the method for retrieving a behavioral feature of software comprises the following steps: running software to be tested; receiving a first test short message, and acquiring a preset keyword invoked during matching of the software to be tested and the first test short message; and generating a second test short message according to the preset keyword, and retrieving a behavioral feature, which is generated according to the second test short message, of the software to be tested, and adding the behavioral feature into a behavioral feature set corresponding to the software to be tested. According to methods of the embodiments, fast, effective identification of a behavioral feature of malicious software can be implemented, and at the same time, a useful reference is provided for blocking and eliminating malicious software comprising harmful behavior.

Description

technical field [0001] The invention relates to the field of terminal security, in particular to a program behavior feature extraction method, device and client, and a malicious program detection method, device and client. Background technique [0002] With the continuous development of smart mobile terminals, malicious programs targeting smart mobile terminals have also increased significantly. Malicious programs can be added to various mobile applications. When a mobile application with malicious programs is installed on a mobile terminal, the malicious program will run in the background and perform corresponding operations according to received SMS instructions, such as collecting and uploading user location Data such as information or contacts, making calls to fixed numbers or changing user settings, etc., bring great security risks to users. Currently, the program package name and other static features can be analyzed by static analysis technology to determine the prog...

AI Technical Summary

Problems solved by technology

[0003] In the process of realizing the present invention, the inventor found that the prior art has at least the following problems: After the malicious program is encrypted or mutated, the malicious program cannot be accurately identified by static analysis technology

At the same time, for malicious programs controlled by remote control, such as malicious programs controlled by SMS commands, their behavior characteristics will vary according to different remote control commands, and the existing dynamic analysis technology cannot effectively analyze the behavior characteristics of such malicious programs. , user data security still has security risks

Images