Android mobile attack traceability method

Abstract

The invention discloses an android mobile attack traceability method, which comprises the following steps that: reading a claim list applied by a malicious application from the AndroidManifest.xml file of the malicious application, and matching with a sensitive permission library to determine sensitive permission; utilizing a data stream analysis tool to extract the sensitive data stream pair of the malicious application, and extracting a sensitive API calling sequence characteristic, context information and constant information between the API calling sequence and the sensitive data stream pair in the sensitive data stream pair; and combining with each piece of information obtained in the above two steps, and utilizing a clustering or classified machine learning method to carry out tracking and traceability on the malicious application. By use of the method, the traceability of the malicious application can be realized, and development personnel or organizations are tracked.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a source tracing method for Android mobile attacks. Background technique [0002] With the rapid development of smart phones and wireless communication technologies, more and more users store personal information on their mobile phones, such information includes address book, geographical location, personal reading habits and even user bank card information, etc. Sensitive information can attract the attention of attackers. Attackers develop various malicious software to infect user devices and obtain users' personal information. Problems such as SMS harassment, extortion, malicious tariffs, and personal information leakage emerge in an endless stream. These malicious softwares have caused severe financial losses and privacy breaches. [0003] Due to its high degree of openness and customizability, the Android system occupies an absolute user market. According to statistics...

AI Technical Summary

Problems solved by technology

The difficulty of dynamic detection is that the generated execution path is difficult to completely cover the entire program code, and some malicious applications will use some means, such as setting the time period for executing malicious behaviors, identifying whether they are in a virtual operating environment, etc., to avoid dynamic detection

The result of dynamic detection depends on whether the execution path is complete, which is prone to false positives

[0007] However, the existing methods for identifying Android malware cannot meet the purpose of mobile attack traceability.

Images