Android program real-time behavior analysis method and system based on kernel

Abstract

The invention discloses a kernel-based Android application real-time behavior analysis method and a behavior analysis system capable for implementing the method. The method comprises a system call monitoring initialization step, a kernel system call interception monitoring and parsing step, a parsing result-based information logging step and an information log-based application behavior reconstruction step. A system call is intercepted and parsed in a kernel, so that an application file, a network as well as inter-process communication and other particular behaviors of the Android system are reconstructed; the whole behavior analysis process is monitored in real time in the kernel, so that the accuracy of behavior obtaining is guaranteed; meanwhile, the kernel has the highest authority, so that malware is hard to evade the kernel; according to the method, no code in the Android system is modified, so that the performance loss is low; practice proves that a result of the method can serve as key evidence to be obtained and provides a reference for malware detection.

Description

technical field [0001] The invention belongs to the technical field of data processing, and in particular relates to a kernel-based Android program real-time behavior analysis method and system. Background technique [0002] As the popularity of smart mobile devices has increased, so has the malware targeting these devices. As an open source platform, Android has become an operating system with wide influence in the world, and currently occupies 80% of the market share. Therefore, the number of malicious software targeting the Android platform is also very large. At the same time, these malicious software have fast growing trend. There is a large amount of important user privacy information on Android devices, so this type of malware poses a huge threat to mobile phone security. [0003] In view of the above situation, it is very necessary to detect and discriminate malware. This requires understanding the behavior of malware. In recent years, the behavior analysis method...

AI Technical Summary

Problems solved by technology

But these application analysis methods have their own shortcomings

The technical solution based on the Dalvik virtual machine cannot detect the behavior in the local code, and because it is at the same level as the application, it is easy to be detected and avoided by malware

The technical solution based on the virtual machine introspection method can detect the behavior in the local code, but because this type of method runs in a virtual environment, the malware will show different behaviors due to the difference in the execution environment, and the existing malware can detect Their operating environment and the use of anti-forensics technology to circumvent, which makes the accuracy of behavior analysis under the virtual machine introspection scheme cannot be guaranteed

Images