Monitoring method for App behaviors in Android system

Abstract

The invention discloses a monitoring method for App behaviors in an Android system. The method comprises the steps as follows: firstly, writing a kernel module, and performing cross compilation by writing of own Android kernel module; secondly, loading the module into the Android system, and intercepting specific functions (such as functions for reading related information of address books and the like) to obtain corresponding system call information including information about reading through which process and the like; thirdly, returning the corresponding recorded information to an application layer and forming corresponding monitoring log files to achieve system calling interception and monitoring of the whole Android system. According to the monitoring method, monitoring can be performed on system calling generated in both the application layer and a Native layer, and compared with existing monitoring methods for the application layer, the monitoring method has the advantages that protection can be more thorough, and the security protective property on mobile phones is higher; users are enabled to know behaviors of installed software thoroughly, thereby being capable of discovering malicious acts of the software timely.

Description

technical field [0001] The invention relates to an Android system Application (App) software security technology, in particular to a method for monitoring App sensitive behaviors based on the Android system. Background technique [0002] Compared with traditional mobile phones, smart phones have richer functions and stronger data processing capabilities, and the Android system, which has developed rapidly in recent years, has the advantages of open source and strong portability. More and more mobile phones use the Android system as a mobile phone operation system. With the popularization of Android smart phones, more and more security problems exposed by Android smart phones. Therefore, how to protect the security of Android smartphones is a very important topic. [0003] There are a large number of apps available for download in the Android mobile phone market, and some apps are safe; some apps may be implanted with viruses and Trojan horses. Once users download and insta...

AI Technical Summary

Problems solved by technology

At present, some security software on the market mostly monitor system calls at the application layer. For example, the open source Xposed framework is adopted by many security software. This method can only intercept system calls at the application layer.

And if the Trojan is implanted in the Native layer, in this case, the existing security software cannot intercept the Trojan behavior by calling the corresponding system

Images