Method and system for detecting blackmail application under Android platform

Abstract

The invention discloses a method for detecting a blackmail application under an Android platform. Through detailed analysis of installation package files of large quantity of blackmail applications, amethod of assigned authority and assigned code segment parameter is used to detect. Compared with a conventional detection method, the method and the system occupy little memory and consume few resources, and can satisfy batch detection requirements. The method and the system effectively improve detection efficiency and detection rate. The invention also discloses a system for detecting a blackmail application under an Android platform.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and system for detecting blackmail applications on an Android platform. Background technique [0002] With the rise of smartphone platforms such as the Android system, malicious codes on mobile terminals have gradually become another major threat in the field of information security. In recent years, the types of malicious code forms have increased dramatically, leading to greater pressure in malicious code detection, and diversified and precise detection methods will become a new choice. [0003] At present, mobile phone ransomware applications have become a major new security threat. Ransomware software will induce users to install and run it. After running, a certain ransomware interface will be placed on the top of the mobile phone screen, and the user will not be able to operate normally by pressing any button on the mobile phone, resulting in failure o...

AI Technical Summary

Problems solved by technology

[0003] At present, mobile phone ransomware applications have become a major new security threat. Ransomware software will induce users to install and run it. After running, a certain ransomware interface will be placed on the top of the mobile phone screen, and the user will not be able to operate normally by pressing any button on the mobile phone, resulting in failure of mobile phone functions. Unable to use the phone normally

Existing technology mostly detects ransomware applications by detecting the top of the Activity. This detection method is highly targeted, but with the advancement of technology, many new ransomware cleverly avoid this method of extortion, using the Android component WindowManager.LayoutParams A method of customizing the interface to cover the screen can block shutdown and other operations, resulting in the mobile phone with a non-removable battery cannot be shut down by removing the battery. The ransomware can be cleared in other ways, and the battery can only be exhausted.

Images