Identification method and device of malicious advertisement program and client side

Abstract

The invention provides an identification method and device of a malicious advertisement program and a client side. The method comprises the following steps: operating a program to be tested; obtaining at least one piece of object data generated in an operation process of the program to be tested; and matching at least one piece of object data with a preset malicious advertisement feature library to identify a malicious advertisement program type to which the program to be tested belongs. According to the method of the embodiment of the invention, program variants can be subjected to continuous tracking and classification and are free from the restriction of code obfuscation rival and program encryption, the type of the program to be tested is accurately judged so as to effectively intercept a malicious program to guarantee the data safety of a user.

Description

technical field [0001] The present invention relates to the field of terminal security, in particular to a method, device and client for identifying malicious advertising programs. Background technique [0002] With the popularization of Android and other operating systems in mobile terminals, malicious programs targeting Android and other operating systems show a trend of substantial growth. At the same time, malicious programs can also encrypt their own code, or randomly generate package name characteristics, making the variants of malicious programs extremely active, making it difficult to detect. Therefore, malicious programs and their variants must be effectively identified and judged to ensure the data security of mobile terminal users. At present, mobile terminals mainly analyze malicious programs through static analysis methods, that is, statically scan programs in mobile terminals, extract static character strings of programs, package name features of malicious pro...

AI Technical Summary

Problems solved by technology

[0003] In the process of realizing the present invention, the inventor found that the prior art has at least the following problems: static analysis technology needs to analyze each program, so as to judge and analyze the program according to the extracted static character strings, package name features, etc. less efficient

Moreover, currently, the generation of malicious program package name features has been randomized, and the malicious program will be encrypted at the same time, and it is impossible to track and identify the variants of malicious programs simply through static analysis methods

Therefore, it is difficult for existing static analysis methods to quickly and effectively identify such malicious programs, resulting in a great threat to the security of user data caused by malicious programs.

Images