A kind of malicious SO module detection method and related device

Abstract

The invention discloses a malicious so module detection method, system and device and a computer readable storage medium. The malicious so module detection method includes the steps that when a current process is loaded to so modules, and all the so modules loaded with the current process are obtained and serve as suspicious so modules; target so modules different from all predetermined credible so modules are determined in all the suspicious so modules; malicious so modules are determined in the target so modules with the reverse analysis method. In this way, according to the malicious so module detection method, the so modules are detected when the current process can be loaded to the so modules, and real-time detection of the so modules can be achieved; in addition, the detected targetmodules different from the credible so modules in all the suspicious so modules are artificially analyzed with the reverse analysis method, current unknown malicious so modules can be detected accordingly, and the detection accuracy is improved.

Description

technical field [0001] The present invention relates to the field of Android security, and more specifically, relates to a malicious so module detection method, system, device and computer-readable storage medium. Background technique [0002] With the rapid development of the Android smart phone, the Android smart phone has become a very fast-growing mobile terminal product in recent years. Mobile smart terminals are very closely related to people. Unlike traditional PC platforms, users carry them with them and are online in real time. The terminals store a large amount of user privacy data, especially the user's address book, short messages, and call records. Not only that, many functions and services of Android smartphones involve user tariffs, which are directly related to users' economic interests. While smart phones bring convenient information services and good user experience to people, more serious safety hazards follow. Once a user's mobile phone is implanted with...

AI Technical Summary

Problems solved by technology

However, dynamic code injection technology does not need to modify source files, so process injection is difficult to detect and analyze through existing antivirus software, and cannot effectively deal with malicious programs; it cannot actively defend against new viruses, so effective antivirus cannot be performed, and Comprehensively protect the information security of the Android system

Images