Behavior triggering method and system of remote-control malicious-code

Abstract

The invention provides a behavior triggering method and system of remote-control malicious-code. HOOK is carried out on a comparative-type API in the remote-control malicious-code; whether the remote-control malicious-code receives simulated behavior triggering information is judged, if yes, character string information of the comparative-type API in the remote-control malicious-code is acquired,and matching with character string information in a behavior triggering information library is carried out, and otherwise, the steps end; whether the character string information in the comparative-type API is the same as any piece of character string information in the behavior triggering information library is judged, and if yes, a returned value of the comparative-type API is modified accordingto a preset value for triggering a subsequent behavior of the remote-control malicious-code; and otherwise, the character string information in the comparative-type API is saved to a suspect-information library. Through the method and system of the invention, malicious behaviors of remote-control malicious-code can be effectively triggered, and detection capability of dynamic malicious-code detection technology on the remote-control-type malicious-code can be improved.

Description

technical field [0001] The invention relates to the technical field of mobile network security, in particular to a remote control malicious code behavior triggering method and system. Background technique [0002] With the vigorous development of the mobile Internet, malicious codes on mobile devices emerge in endlessly, and the current mainstream mobile malicious code detection technology is mainly based on static code analysis and static feature library matching. After malicious codes have adopted reinforcement technology, static malicious code detection technology has become stretched. As a result, dynamic malicious code detection technology has gradually developed. Dynamic malicious code detection technology mainly monitors the behavior of malicious code at runtime. Therefore, how to make malicious code trigger malicious behavior at runtime is the key to dynamic malicious code detection technology, because only malicious code It can be detected by the dynamic malicious ...

AI Technical Summary

Problems solved by technology

However, for remote control malicious codes, relevant behaviors will only be triggered when they receive instructions specified by the remote control server during operation. SMS, but it is difficult to accurately simulate these instructions when the malicious code is simulated to trigger the SMS sending behavior of the remote control malicious code, which makes the dynamic malicious code detection technology invalid for the remote control type of malicious code

Images