Android ransomware detection and defense method, device and equipment and readable storage medium

Abstract

The invention discloses an android ransomware detection and defense method, device and equipment and a readable storage medium. The method comprises three parts of to-be-detected android application preprocessing, operation environment detection and detection strategy. The preprocessing of the to-be-detected Android application mainly comprises the steps of detecting a ransomware in the to-be-detected Android application and injecting a monitoring agent into the to-be-detected Android application; the operation environment detection mainly comprises the steps that the monitoring agent detects calling of the ransomware to a framework layer API and Native Library so as to monitor behaviors of the ransomware; the detection strategy is mainly used for judging whether the application is the android ransomware or not according to the android application behavior to be detected. According to the invention, the ransomware in the application can be effectively detected, and malicious behaviors during application running can be analyzed; therefore, Android ransomware attacks are resisted, the user equipment is protected from being damaged by the ransomware, and the safety of the user equipment is protected.

Description

technical field [0001] The present invention relates to the technical field of malicious code detection, in particular to a detection and defense method, device, equipment and readable storage medium for Android ransomware. Background technique [0002] As a contemporary popular malware on Android devices, ransomware usually disguises itself and lures users to install it. After it runs, it will lock the user's device or encrypt important files in the device, and send the user the condition of unlocking the device or decrypting the file. The implementation of extortion has brought great security threats to users. [0003] Android ransomware mainly implements ransomware by displaying ransom text, setting a full-screen floating window, applying for device manager permissions to reset the PIN code, activity hijacking, and encrypting files. Among them, setting a full-screen floating window, applying for device manager permissions to reset the PIN code, and Activity hijacking are...

AI Technical Summary

Problems solved by technology

Although RansomProber can detect encrypted Android ransomware in real time, it is not enough to judge only based on the user operation characteristics in the interface. Existence of screen-locking Android ransomware for detection

Images