Application malicious behavior detection method and device in Android system

Abstract

The invention provides a detection method and equipment for an application program malicious act in an Android system. The detection method and equipment are used for detecting a malicious program through which user information is stolen by use of superposed windows. According to the method, if an input instruction is detected, whether window superposition exists is detected; if yes, a window W displayed at the top layer and an application program X corresponding to the window W displayed at the top layer are detected according to preset detection content; and whether window superposition is malicious is judged according to the detection result. Whether the appearance of the window W is malicious is judged according to properties and acts of the window W and the application program X, andtherefore the malicious program through which the user information is stolen by use of the superposed windows is detected.

Description

technical field [0001] The invention relates to computer technology, in particular to a method and device for detecting malicious behaviors of application programs in an Android system. Background technique [0002] Android's system Overlay can superimpose a view in front of the current view of the application. The view can be divided into two types: visible and invisible. If the overlay View is artificially set without any content and the background is transparent, these Views It can become an invisible object. Such an invisible View can have certain functions by adding some other attributes. For example, you can add a type attribute that is always in front of it to make it appear in all application windows of the current Android system. Before; it is also possible to add a flag attribute that captures events other than its interface so that it can capture the user's click event on the screen and so on. [0003] Therefore, in the current popular Android system, there is su...

AI Technical Summary

Problems solved by technology

[0003] Therefore, in the current popular Android system, there is such a security risk about Overlay. The cooperation between the Overlay of the display interface and the Overlay of receiving events can affect the user's judgment on the interactive application program currently in the foreground, thus causing some misunderstandings of the user. Malicious programs can use user misoperations to open some sensitive permissions and functions to steal user privacy, and even achieve the purpose of defrauding users of money

[0004] Therefore, it is necessary to provide a detection method to solve the detection problem of malicious programs that steal user information through malicious windows.

Images