Method and system for detecting malicious application of Android system

Abstract

The invention discloses a method and a system for detecting a malicious application of an Android system. The method comprises the following steps: acquiring a privilege characteristic by a reverse engineering de-compilation application program; matching by a behavior chain model for dynamic behavior collection and definition, thereby acquiring a behavior characteristic; combining plentiful privilege characteristics with behavior characteristics, thereby generating a characteristic data sample set; adopting a machine learning algorithm for utilizing the characteristic data sample set to generate a classifier; and inputting the characteristics of an unknown application program to the classifier, thereby acquiring a conclusion indicating if the unknown application program belongs to the malicious application. The invention provides the behavior chain model on the basis of the reverse engineering and the dynamic behavior collection, and then the unknown application program is detected through the machine learning algorithm, so that the efficient recognition for the malicious application is realized, the accuracy is high and the detection method and system provided by the invention are high in efficiency, need not change the system source code and are high in availability.

Description

technical field [0001] The invention relates to the field of mobile Internet information security, in particular to a method and system for detecting malicious applications in an Android system. Background technique [0002] With the rapid popularization of smart phones, people have entered the era of mobile Internet. The publishing model based on the application store has become an important model of mobile applications, and the mobile application industry has grown rapidly. Because mobile applications can obtain a large amount of sensitive information from mobile terminals, and they can generate high profits through the mobile market and advertisers, mobile applications are frequently attacked by hackers, and mobile application security incidents occur frequently. The mixed third-party application market and the lack of centralized and effective security review for a large number of mobile applications have led to a large number of malicious mobile applications being rele...

AI Technical Summary

Problems solved by technology

TaintDroid proposes a system-level dynamic taint analysis tool, which realizes real-time monitoring of information flow of private data by marking sensitive information; however, the static detection method needs to continuously update the feature library of malicious applications, and can only identify known malicious applications

[0004] Dynamic detection method: Based on TaintDroid, Kynoid can realize dynamic detection of information flow between applications and data, provide real-time monitoring, and prevent privacy leakage; based on TaintDroid dynamic detection method, it is necessary to modify the source code of the Android operating system, resulting in This method is difficult to apply

Images