Malicious application detection system and method for android mobile phone

Abstract

The invention discloses a malicious application detection system for an android mobile phone, and belongs to the technical field of mobile phone detection. The malicious application detection system for the android mobile phone comprises a positive and negative sample collection module, a static feature extraction module, a dynamic feature extraction module, a neural network module and a monitoring result output module. According to the system, software code-based static analysis is combined with software behavior-based dynamic monitoring, so that a detection method is no longer static analysis purely based on a signature technology and judges whether software is malicious software or not by analyzing codes of the software and a behavior after running of the software; the detection methodis more accurate; and malicious software samples and secure software samples are collected to obtain static eigenvectors and a dynamic feature matrix, and an MLP neural network and an RNN are trainedthrough a large amount of samples to perform automatic learning and detection, so that the efficiency and the accuracy are greatly improved.

Description

technical field [0001] The invention relates to the technical field of mobile phone detection, in particular to a system and method for detecting malicious applications of Android mobile phones. Background technique [0002] Recently, the foreign market data research company Kantar woroldpanel officially announced the latest ranking of the global smartphone market as of the first quarter of 2017. Taking the domestic market as an example, the market share of Android phones has risen from 76.4% last year to 86.4%. , which increased by 10%. The domestic mobile phone manufacturing industry is booming, and the operating system it uses is Android. With the increase of Android mobile phone users, Android malicious applications also increase. According to the report of Qihoo 360, we know that in 2016, 360 Internet The Security Center has intercepted a total of 14.033 million new malicious program samples on the Android platform, with an average of 38,000 new malicious program sampl...

AI Technical Summary

Problems solved by technology

Signature-based detection has the following problems: first, the cycle from the propagation of malware to detection is usually very long, usually weeks or even months, during which many systems have been compromised; second, signature-based detection methods only It can capture malware with signatures, and has no defense against unknown attacks; third, signature-based detection cannot make correct judgments on compressed, encrypted and deformed malicious codes

Detection methods based on software behavior are more accurate than signature-based monitoring, but they are relatively single and incomplete

Images