Static detection method and apparatus for repackaged malicious application

Abstract

The invention relates to a static detection method and apparatus for a repackaged malicious application. The method comprises the steps of obtaining API call sequences of an installation package of a to-be-detected application and a correlation relationship between classes which the API call sequences belong to; establishing a class-based function call relational graph; performing clustering division on the classes to obtain a plurality of clusters, and removing a preset number of clusters with the highest correlation relationship between the classes in the clusters to obtain a malicious code cluster; extracting sensitive API call sequences in the API call sequences of the classes in the malicious code cluster, and performing similarity matching on the extracted sensitive API call sequences of the classes and characteristic sequence samples of the malicious application in a pre-established sample library; and determining whether the to-be-detected application is the repackaged malicious application or not. According to the method and the apparatus, malicious codes are extracted by taking the class as a unit without depending on an Android official application, so that relatively high accuracy can be ensured for variant malicious codes.

Description

technical field [0001] The invention relates to the technical field of malicious code detection, in particular to a static detection method and device for repackaging malicious applications. Background technique [0002] With the rapid development of the mobile Internet, due to the convenient portability, excellent performance, and rich functions (such as instant messaging, office processing, online games, etc.) of smart terminals (such as smart phones, tablets, etc.), the sales of smart terminals have grown rapidly. At present, China's mobile Internet users have exceeded 800 million. In 2015, Google Play has exceeded 1.4 million applications. Various third-party application markets in China also have a large number of mobile applications. While these applications bring great convenience to people, they also bring great hidden dangers and risks to information security. A study on the analysis of malicious applications based on the Android system shows that after analyzing 1...

AI Technical Summary

Problems solved by technology

[0004] In the above detection methods, it is assumed that the applications in the official Android application market are native, non-malicious, and not repackaged. This assumption is too optimistic in some aspects to detect repackaged applications in the Android application market.

Moreover, the ability to detect variant malicious code is quite limited, and it is necessary to update the malicious sample library in time

The above two points make the detection accuracy of DroidMOSS low

Images