Detection method and background system of Android malware based on sensitive mode

Abstract

The invention discloses a detection method and a background system of an Android malware based on a sensitive mode. The detection method includes obtaining an APK file of the Android software to be detected, performing a disassembly operation on it to extract authority data and API call data, and then extracting Filter the data to form data samples; read sensitive pattern clusters constructed based on several Android software data samples, and use the number of sensitive pattern clusters as a dimension to construct feature vectors based on the existence and maximum inclusion of data samples; Feed the feature vector into the trained malware detection model and output the detection result. The solution also provides a background system of an application store, which includes a detection method for Android malware based on a sensitive mode, and the detection method is integrated in the background system.

Description

technical field [0001] The invention relates to the field of communication security detection, in particular to a detection method and a background system for Android malware based on a sensitive mode. Background technique [0002] With the rapid development of mobile communication technology, the use of various mobile communication devices such as smart phones and tablet computers is also increasing. In order to provide a good user experience, a variety of mobile terminal operating systems have emerged, among which the Android system occupies most of the market share. According to the global smartphone operating system market research report released by IDC (International Data Corporation), the Android system is far ahead with a market share of 86.7%. [0003] In order to protect Android mobile users from malicious software and create a safe and healthy mobile communication ecosystem, researchers in academia and industry have proposed some techniques and tools for detectin...

AI Technical Summary

Problems solved by technology

The downside of this approach is that it cannot detect unknown malware and malware that uses obfuscation techniques

For example, in static analysis, modeling with a single feature often has the risk of overfitting, and introducing too many features will lead to excessive complexity and dimension disaster

Although dynamic analysis can improve the generalization ability of the detection model to a certain extent, because it needs to execute application software to realize it, the resource cost it requires is still relatively high

Images