An Android Malicious Application Detection System Based on Multi-running Environment Behavior Comparison

Abstract

An Android malicious application detection system based on multi-operation environment behavior comparison comprises an information extraction module, a dynamic analysis module, an environment detection countering module, a behavior record analysis module and a system operation scheduling module, wherein the information extraction module is used for decompiling a detected APK installation file andproviding data support for subsequent log analysis; the dynamic analysis module is used for dynamic analysis of an Android application by using a sand box technology and recording behaviors executedin the program running process; the environment detection countering module is used for detecting environment detection behaviors in the program running process in real time, carrying out countering according to the detection behaviors of different levels and modifying operation environment detection results in the application into camouflage operation environment characteristics; the behavior record analysis module is used for unified management and analysis of all behavior logs after the to-be-tested application repeatedly runs; the system operation scheduling module is used for controllingthe whole operation process in the system operation process. By means of the method, the behavior difference situation of the application can be captured, whether malicious behaviors exist or not is detected, and the method is suitable for recognizing environment-sensitive malicious applications.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to an Android malicious application detection system based on behavior comparison of multiple operating environments. Background technique [0002] The rapid development of the Internet today has a considerable scale. In recent years, with the rise of smart mobile terminal equipment, the mobile Internet has also developed rapidly, and smart phones and tablet computers are becoming popular in people's lives. With the gradual popularization of smart mobile terminal operating systems, the Android system platform has been welcomed by many mobile device R&D and manufacturers for its convenience and ease of use, excellent remodelability and scalability, and system open source. Gradually has a large number of system enthusiasts and user groups. [0003] It is precisely because of the high user share of the Android system and its unique open source features that the Android syste...

AI Technical Summary

Problems solved by technology

However, with the continuous development of encryption technology and obfuscation technology, it is difficult for static analysis methods to obtain effective information details

Images