An android malicious code detection method based on community structure analysis

Abstract

The present invention proposes an Android malicious code detection method based on community structure analysis. In the process of reverse analysis of the target program, firstly, important static feature information such as permissions, functions, classes, and system APIs are automatically obtained; then, using functions and The function call graph is constructed by the calling relationship between functions, and the function call graph is preprocessed; the weighted function call graph is cyclically split and analyzed to obtain the correct division of the community structure; finally, the extracted from the community structure The features are machine-learned to obtain the final judgment result of maliciousness. The method of the invention can quickly analyze the internal structure of the program and detect malicious codes when facing a large number of Android application program samples generated by the "repacking" technology.

Description

technical field [0001] The invention relates to the field of malicious code detection of Android mobile terminal applications, in particular to fast detection of malicious codes of a large number of Android application program samples generated by the "repacking" technology. Background technique [0002] In recent years, as "repackaging" and "code obfuscation" techniques have been widely applied to malicious mobile applications, a lot of research work on malicious code has been carried out around analyzing the internal structure of applications. Many detection methods based on the internal structure characteristics of the program can extract or construct different graph call structures by analyzing the decompiled code of the target program, and then determine the maliciousness of the program by comparing the difference between the graph structure of the target sample and the malicious sample. The research results show that this type of detection method has a better effect in...

AI Technical Summary

Problems solved by technology

[0006] The technical problem to be solved by the present invention is to provide an Android malicious code detection method based on community structure analysis, which solves the time-consuming problems caused by graph similarity comparison in many traditional malicious code detection methods based on structural features, and the construction of a malicious code with a specific The meaningful graph structure is not conducive to fighting against a large number of mutant viruses generated by repackaging technology; it also improves the community generation method and improves the execution efficiency of this method in graph segmentation

Images