Method and system for detecting malicious software of mobile internet

Abstract

The invention discloses a method and a system for detecting malicious software of a mobile internet. The system for detecting the malicious software of the mobile internet comprises an acquisition module, a preprocessing module, a sequence generation module, a sequence sending module, a vectorization module, a malicious software detection module, a malicious code positioning module, a determination module, a visual parameter configuration module, a parameter drawing module and an image generation module. The acquisition module, the preprocessing module, the sequence generation module, the sequence sending module, the vectorization module, the malicious software detection module, the malicious code positioning module, the determination module, the visual parameter configuration module, theparameter drawing module and the image generation module are connected in sequence. According to the system, the transparency problem of the malicious software detection process to the user is solved,the user can see the specific malicious software through the visualization method, the malicious software can be effectively detected, and the difficulty of manual feature selection is avoided.

Description

technical field [0001] The invention relates to the technical field of software detection, in particular to a method and system for detecting malicious software in the mobile Internet. Background technique [0002] Today, Android malware is rampant, and malicious applications that cause various harms to users emerge in an endless stream. At present, the detection of malicious applications is mainly divided into three main directions. The first is based on static code scanning. It needs to maintain a malicious code library, because it compares all the codes of the application to be detected with the malicious code fragments in the malicious library, and once the comparison is successful, the application is considered as a malicious application. The second is an approach based on dynamic system calls. It goes deep into the interior of the Android application and observes the function calls of the application at runtime. The third is a detection method based on network traf...

AI Technical Summary

Problems solved by technology

[0003] However, there are deficiencies in these three methods. The malicious code base of static detection needs to be constantly updated, and it is difficult to find new malicious applications; the dynamic detection method is very difficult to deploy, and even the kernel of the Android system needs to be changed, which is complicated and complicated. Consumes a lot of resources; the method of traffic detection is a method that has attracted more attention recently. This method is generally combined with machine learning algorithms. It only needs to provide a large number of malicious traffic characteristics and normal traffic characteristics to the algorithm, and it can automatically train out A model for distinguishing between good and malicious traffic

However, most traffic monitoring methods need to manually select features that can distinguish between normal and malicious, and the selection of features is very difficult.

At the same time, these detection methods only provide the final detection results, that is, whether the traffic to be tested is normal or malicious. There is no clear indication of how this decision is made and which characteristics indicate it is malicious. So this result is difficult to be very convincing for users

Images