Attack tree model based Android software hybrid detection method

Abstract

The present invention discloses an attack tree model based Android software hybrid detection method comprising the steps of: using an attack tree model to analyze attack types of various malware, and making a series of dynamic behavior detection rules for each attack path; then, performing hybrid detection including static analysis and dynamic analysis, wherein the static analysis realizes attack ability detection of to-be-tested software, and an analog system event in the dynamic analysis triggers to-be-tested software behaviors of a program; selecting a detecting point during software running by the dynamic analysis according to a result of the attack ability detection of the to-be-tested software, and loading and combining behavior rules; and according to to-be-tested software behaviors of an event trigger program of a component information analog system, forcing the to-be-tested-software to run fully, and performing to-be-tested-software behavior detection according to the behavior rules so as to identify malware. In contrast to the prior art, the attack tree model based Android software hybrid detection method organically combines static analysis and dynamic analysis methods to realize effective detection of malware threatening.

Description

technical field [0001] The invention relates to the field of mobile security, in particular to a hybrid detection technology combining software static detection and dynamic detection, which can detect malicious software based on an attack tree. Background technique [0002] The Android system is an open source mobile phone operating system developed by Google based on Linux. This platform is the first fully customizable, free and open mobile phone platform. In recent years, the Android system has been adopted by more and more mobile phone manufacturers due to its good user experience and high openness. Recent research shows that the Android system now occupies 75% of the smartphone market and maintained a high growth rate of 51.3% in 2013. [0003] The emergence of smart phones has facilitated people's lives, but the accompanying security issues have become increasingly prominent, especially in mobile phones that often store a large amount of personal and private informatio...

AI Technical Summary

Problems solved by technology

Existing Android malware detection schemes can be divided into two types: static analysis and dynamic analysis according to the selected features, but both detection methods have their own shortcomings. Static analysis analyzes APK files through reverse engineering, and the execution efficiency is high, but It is difficult to cover all runtime states, and it is impossible to analyze the program behavior that can only be determined at runtime; dynamic analysis detects based on runtime characteristics, such as power consumption and system calls, etc. Dynamic analysis is relatively accurate, but it faces the problem that malicious code segments are not executed, and at the same time Extensive detection can cause significant system overhead

Images