Automatic and efficient high-risk mobile application detection method

Abstract

The invention discloses an automatic and efficient high-risk mobile application program detection method, and the method comprises the following steps: S1, acquiring an SDK list and an authority list of an App to be detected, and converting the SDK list and the authority list into a vector form to obtain a list vector; calculating the similarity between the to-be-detected App and the known high-risk App, and judging the to-be-detected App as a potential risk App; S2, performing dynamic analysis to further judge whether the App is a high-risk App or not, and if yes, marking the App as the high-risk App; S3, manually checking and judging whether the App is a high-risk App, if so, adding the App to a high-risk App library, and marking the App as the high-risk App. According to the method, a mode of taking static analysis and dynamic analysis as a main mode and taking manual auditing as an auxiliary mode is adopted, so that the problems of low efficiency, high cost, low accuracy and the like existing in manual auditing are avoided, and automatic and efficient identification of the high-risk App is realized.

Description

technical field [0001] The invention relates to the field of information security, in particular to an automatic and efficient high-risk mobile application detection method. Background technique [0002] According to statistics released by the Ministry of Industry and Information Technology, as of the end of June 2020, the number of mobile applications (hereinafter referred to as "Apps") monitored in my country's domestic market is 3.59 million, and obtaining information through mobile phones is the choice of most people. However, there are still many potential risks in many apps. For example, there is no unified standard for app application development, inconsistent background data interaction methods, and developers are of different levels and quality. These situations are prone to security risks. Some Apps contain malicious codes that perform specific malicious actions without the user's awareness. Therefore, it is of great significance to detect and discover high-risk a...

AI Technical Summary

Problems solved by technology

The manual review method is time-consuming, and it is difficult to review a large number of new apps in a timely manner, including new versions of existing apps. Moreover, malicious programs in many apps are highly concealed; judging by the domain name depends on the use of the app Whether it is complete to obtain a complete request domain name, whether the domain name database of malicious URLs is complete, and whether the update is timely, etc., are easy to miss

The two review methods have the problems of time-consuming and low accuracy

Images