Android malicious behavior dynamic detection method based on binary dynamic instrumentation

Abstract

The invention relates to an Android malicious behavior dynamic detection method based on binary dynamic instrumentation, and belongs to the technical field of computer and information science. The method comprises the following steps: firstly, triggering all potential malicious behaviors of tested software through an Android dynamic detection framework; then, through a dynamic binary instrumentation technology, constructing a calling sequence of a program to a system API, using an N-Gram model to extract call timing relationship characteristics of a function; finally, inputting the generated time sequence relation characteristics into a trained GBDT (Gradient Boosting Decision Tree, Gradient Boosting Decision Tree) multi-classification algorithm detection model, identifying malicious software, and carrying out fine-grained classification on malicious behaviors of the software. According to the invention, a dynamic binary instrumentation technology is used.A system function calling timesequence feature of the software is extracted without knowing a program source code. Compared with the prior art, the Android malicious behavior detection method has high accuracy for Android malicious behavior detection, malicious behaviors of the software can be divided into six classes. More detailed detection conclusion granularity is achieved, and the detection efficiency of the Android malicious software is effectively improved.

Description

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine

Login to view more

AI Technical Summary

Benefits of technology

The technical effect of this patented technique involves developing an algorithm that accurately identifies unknown programs by analyzing their execution time or timings during different stages of operation (Logged), extracting important functional patterns from these analysis data, such as timing properties like CPU usage rates and memory use levels, and then comparing them against known ones. This helps identify any potential security threats related to those identified systems.

Problems solved by technology

The technical problem addressed in this patents relates to improving the accuracy and reliability of identifying suspended apps (malwaries) due to their vulnerabilities against privacy issues like data breaches and attacks caused through social media platforms. Current approaches involve analyzing executable files without taking any extra steps towards protecting these applets from being exploited.

Images