Software detection method and device and electronic equipment

Abstract

The invention discloses a software detection method and device and electronic equipment. The method comprises the steps of obtaining a current permission set, a current operation code sequence set and a current function pair set of target software; according to the current permission set and the reference permission set, determining a permission feature vector of the target software; determining an operation code sequence feature vector of the target software according to the current operation code sequence set and the reference operation code sequence set; according to the current function pair set and the reference function pair set, determining a function call feature vector of the target software; and determining whether the type of the target software is a malicious software type or not according to the permission feature vector, the operation code sequence feature vector and the function call feature vector. According to the method and the device, the technical problem of relatively low accuracy of software detection in related technologies is solved.

Description

technical field [0001] The present application relates to the field of computers, and in particular, to a software detection method and apparatus, and electronic equipment. Background technique [0002] Due to the open source nature of the Android (Android) system, the number of Android malware is increasing. These malicious software have seriously violated the legitimate rights and interests of the majority of users, and also brought unpredictable obstacles to the further development of the mobile intelligent terminal industry. [0003] For the various types of malware currently faced by the Android system, there are two methods for detection: dynamic detection and static detection. Among them, dynamic detection mainly collects and analyzes various types of information of the application software when it is running, but this technology Protection techniques (such as code obfuscation and hardening) that can bypass Android application software, the cost of experimentation ar...

AI Technical Summary

Problems solved by technology

These malicious software have seriously violated the legitimate rights and interests of the majority of users, and at the same time brought unpredictable obstacles to the further development of the mobile smart terminal industry

[0003] For all kinds of malicious software faced in the current Android system, there are two existing methods for detection: dynamic detection and static detection. Among them, dynamic detection is mainly to collect and analyze various information when the application software is running, but this technology Can bypass the protection technology of Android application software (such as: code obfuscation and reinforcement), the cost of experimentation is huge, and the code cannot be fully covered

Static detection is mainly through static analysis of Android application software, extracting various static features, and then training and testing classification models through various classification algorithms, so as to achieve the ability to distinguish malware; this kind of mainstream static method has low experimental cost and can Obtain static features more comprehensively, such as permissions, signatures, image resources, etc., but all use a single feature to determine whether the software is malware, and the detection accuracy is low

[0004] That is to say, the detection accuracy of the existing detection method to detect whether the software is malicious software is low

Images