Behavior detection method, server and system for application installation package

Abstract

The invention provides a behavior detection method, server and system for an application installation package. The method comprises the following steps: 1) obtaining the application installation package to be detected; 2) extracting behavioral feature information in the application installation package to be matched with a preset behavioral feature database, performing risk behavior detection and obtaining a behavioral feature matching result, wherein multiple behavioral feature data are saved in the behavioral feature database, and each behavior feature datum is used for identifying at least one risk behavior feature; 3) generating a behavior detection result of the application installation package according to the behavioral feature matching result. According to the behavior detection method, server and system provided by the invention, fast detection can be performed on the application installation package in multiple aspects, so that a user quickly understands whether malicious or all kinds of risk behaviors exist in an APK to be detected or not as well as existing malicious behavioral features, therefore, a terminal used by the user is effectively protected.

Description

technical field [0001] The invention relates to the technical field of information processing, in particular to a behavior detection method, server and system of an application installation package for detecting malicious software under an Android system. Background technique [0002] The gradual popularization of mobile terminals has made it a gathering place for personal privacy. In addition, the advent of the mobile payment era has made mobile terminals widely used as a financial tool. These trends will inevitably lead to the rapid growth of mobile malicious programs. At present, some Android applications have malicious behaviors, such as modifying the original program logic through reverse engineering, embedding advertisements, stealing user privacy information, extortion, etc. These means threaten the security of the Android system and have caused serious damage to users. [0003] In the prior art, in order to detect malicious Android applications, manual means are usu...

AI Technical Summary

Problems solved by technology

However, it relies on manual analysis results, and the matching method is limited to the hash value, so the detection is not comprehensive; and the scanning speed of the detection tool is slow, and it takes a long time to complete the detection, which cannot allow users to quickly understand whether there is any behavior in the APK to be detected. The existence of malicious or various risky behaviors

Images