A method and device for monitoring dynamic loading behavior of mobile applications

Abstract

The invention provides a method and a device for monitoring the dynamic loading behavior of a mobile application program, which focuses on monitoring the dynamic loading behavior of an Android application program. The invention monitors the Native layer API of the Android system, records the monitoring log and backs up the file dynamically loaded by the application program. The method includes three parts: monitoring control, dynamic loading behavior monitoring and monitoring log generation. For 32-bit and 64-bit Android applications, the corresponding monitoring methods are proposed. Monitorthe user-specified application or PID process and its children. The method of the invention solves the problem of incomplete monitoring of the dynamic loading behavior of the Android application program by the traditional method, and provides a method foundation and technical support for further malware detection and code analysis work. At the same time, the method proposed by the invention can realize the monitoring of any system function call of the Android Native layer as long as the method is slightly modified.

Description

technical field [0001] The invention belongs to the technical field of Android application program monitoring. The main methods used are process injection and Inline Hook, in particular to a method and device for monitoring dynamic loading behavior of mobile application programs. Background technique [0002] In recent years, mobile devices have become more and more popular in people's work and life. According to the 40th "Statistical Report on Internet Development in China" released by China Internet Network Information Center (CNNIC), as of June 2017 In March, the number of Chinese netizens reached 751 million, accounting for one-fifth of the total number of Internet users in the world. Among them, the number of mobile Internet users reached 724 million, an increase of 28.3 million compared with the end of 2016. The proportion of Internet users using mobile phones to surf the Internet has increased from 95.1% at the end of 2016 to 96.3%. However, the utilization rates of...

AI Technical Summary

Problems solved by technology

[0009] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to provide a method and device for monitoring the dynamic loading behavior of mobile applications. The application program is modified to be compatible with Android 32-bit and 64-bit application programs; on the other hand, the monitoring method of the present invention has good completeness and practicability, and overcomes the incomplete monitoring of the dynamic loading behavior of the application program by the traditional method, being too old, and The shortcomings of the new version of Android system support are not good, and support various system versions above Android 4.0

Images