Malicious code detecting system and method based on dynamic instrumentation

Abstract

The invention discloses a malicious code detecting system and method based on dynamic instrumentation. The method comprises the steps that a software to be detected is uploaded on a system simulator of a mobile terminal; a framework of the software to be detected of the system simulator is ordered again by an instrumentation manger of a server, an instrumentation strategy file is implanted into the system simulator, and one or more probe functions monitor an API function of the framework according to the instrumentation strategy file; a sound monitor of the server communicates with the mobile terminal and receives the operation behaviors and content of the software to be detected which are conducted to the API function and obtained by the probe functions; the detected content is compared with a malicious API sequence feature library, if the detected content exists in the malicious API sequence feature library, the software is marked to have malicious behavior operation, and if the detected extent does not exist in the malicious API sequence feature library, the software is marked to be safe, so that the safety of the software to be detected is determined. By means of the system and method, it is achieved that the software to be detected is installed and operated in the system simulator of the mobile terminal, and malicious codes are detected through instrumentation, so that it is avoided that safety hazards or hidden dangers are caused to the mobile terminal.

Description

technical field [0001] The invention relates to the field of mobile terminal application security, in particular to a detection system and method for detecting malicious behaviors of mobile terminal application programs based on dynamic stub insertion. Background technique [0002] With the development of the mobile Internet, the security of smartphones has become an area of ​​focus for the mobile Internet industry and mobile Internet users. The research on malicious code deformation technologies of mobile smart terminals includes repackaging technology, disassembly technology, flower instruction technology, Bytecode encryption technology and data encryption technology, etc., are divided into three levels according to the degree of danger of malicious code: severe, medium, and low. There are three main research methods. First, detect applications with malicious operations based on the vulnerability characteristics of the existing Android system; second, analyze the code to c...

AI Technical Summary

Problems solved by technology

This method of reporting viruses encountered during the use of the software is based on the premise of suffering safety injuries during actual use, which causes inconvenience to users, and the user may leave a potential threat to the security of mobile devices under the possibility of misoperation.

Images