Precaution method for Android malicious application program based on code behavior similarity matching

Abstract

The invention discloses a precaution method for an Android malicious application program based on code behavior similarity matching. The method comprises the following steps: establishing an application information knowledge base; detecting a repacked malicious program by comparing the characteristics of a homonymic program in the application information knowledge base by a difference verifying module; performing high coverage analysis on an application code by a static analysis module and extracting the permission related to privacy information and API calling information; simulating the program running in a sandbox by a dynamic analysis module, detecting the system calling and the LKM parameter related to the calling, and tracking the specific behavior of recording application; to constructing a multi-dimensional feature vector by utilizing log information through a clustering judging module, performing similarity matching on each feature vector of the malicious application and judging the attribution of the application. According to the method, The light client and heavy server system design is adopted, the client is responsible for lightweight information extraction, the server is responsible for heavy data analysis, and the method can effectively adapt to the reality of resource shortage of electric quantity, operation, storage and the like of the intelligent terminal.

Description

technical field [0001] The invention relates to the field of computer malicious software detection or processing, in particular to a method for preventing Android malicious application programs based on code behavior similarity matching. Background technique [0002] Android is a Linux-based open source operating system developed by Google, mainly used in mobile devices. An Android application is a collection of command sequences written in a computer language developed and run on the Android system in order to complete one or more specific tasks. It is a tool for smart terminals to interact with users and fulfill user needs. Android applications belong to the application layer of the overall architecture of the Android system. In addition to the basic applications built into the system, including desktop, email, phone, SMS, etc., third-party applications written in Java language and local code are more commonly used and interactive by users. Add, expand and optimize the fu...

AI Technical Summary

Problems solved by technology

However, the static analysis in the method only analyzes the API call, and cannot fully judge the purpose of the API call, which is prone to generate a large number of false positives and false positives, and is not feasible for a large number of code obfuscated programs in reality.

The dynamic analysis technology in the method is only to verify the suspicious points of static analysis, the analysis code coverage is low, and the triggering of some events is often random, which will reduce the detection accuracy and practicability

Images