Method and system for detecting malicious codes in android system and mobile terminal

Abstract

The invention provides a method and system for detecting malicious codes in an android system. First, in the android system, each executable file is recognized and analyzed, machine instructions of all the executable files are split, a virtual technology is utilized for executing the machine instructions in a simulated mode, a physical environment needed in operation of the instructions is simulated, possible system calling and API calling are simulated, sensitive information generated during simulation execution and simulation calling is monitored and recorded, finally, the sensitive information is matched with features in matching of a rule base, and whether the executable files containing the malicious codes exist is judged. The defects in an existing static detection technology for the malicious codes in the android system are overcome, and the malicious codes in the android system are deeply detected. The invention further discloses a mobile terminal.

Description

[0001] Cross References to Related Applications [0002] This application requires the Chinese patent application number "201510889821.X" submitted by Wuhan Antiy Information Technology Co., Ltd. on December 08, 2015, the title of the invention is "Virtual Technology-Based Malicious Code Detection Method and System under Android System" priority. technical field [0003] The present invention relates to the technical field of malicious code monitoring, in particular to a method and system for detecting malicious codes under the Android system. Background technique [0004] Malicious codes under the current Android system show a more complex development trend. It uses more complex obfuscation and encryption methods, and the encryption algorithm usually uses a custom algorithm, which brings great challenges to the static detection of malicious codes. Malicious codes will Sensitive character strings, execution codes, and execution module files are encrypted, so that existing s...

AI Technical Summary

Problems solved by technology

[0004] Malicious codes under the current Android system show a more complex development trend. It uses more complex obfuscation and encryption methods, and the encryption algorithm usually uses a custom algorithm, which brings great challenges to the static detection of malicious codes. Malicious codes will Sensitive strings, execution codes, and execution module files are encrypted, so that the existing static detection schemes cannot effectively detect them intelligently

Images