Proxy server having mobile terminal malicious software behavior detection capability and method

Abstract

The invention discloses a proxy server having a mobile terminal malicious software behavior detection capability and a method. The proxy server comprises a static detection module, a dynamic detection module and a flow behavior analysis module, wherein the static detection module is used for performing static detection on downloaded mobile applications by calling a static detection interface; the dynamic detection module is used for performing secondary detection on the mobile applications which are detected to be normal by the static detection module by calling an API interface provided by a third-party dynamic detection service; and the flow behavior analysis module is used for processing flow of applications installed by a user and detecting whether flow behaviors are generated by malicious software or not through a flow detection service model. A novel proxy server having a triple detection capability is designed. Through primary and secondary detection, the security of the mobile applications installed by the user is basically ensured. Through tertiary flow detection, effective identification of malicious behaviors generated by the malicious software is ensured.

Description

technical field

[0001] The invention relates to a working mechanism of a novel proxy server, in particular to a proxy server with mobile terminal malicious software behavior detection capability and a working method. Background technique

[0002] With the rapid popularization of mobile terminals, applications on mobile terminals are emerging in an endless stream. Every day, millions of mobile terminal applications appear in major third-party application markets, such as the domestic Android market, Baidu application market, and Anzhi market. Foreign Google Marketplace, Amazon Store, AppleStore, etc. Although the third-party application market has already scanned the installation files for malicious codes before the mobile application is put on the shelves, it is still found that a large number of malicious applications exist in the major third-party application markets. The DroidDream family of malware, discovered in 2011, had infected more than 260,000 Android devices befo...

Examples

Embodiment

[0191] Embodiment, set up the SVM model of machine learning supervised learning algorithm, concrete steps are:

[0192] 5-1) On the basis of the new unknown malware samples found, add category labels to form a new feature set;

[0193] 5-2) In the new feature set, select part of the data as the training set, and another part of the data as the test set;

[0194] 5-3) encoding the parameters of the SVM model;

[0195] 5-4) Initialization work, complete the preprocessing of data and the initialization of model parameters;

[0196] 5-5) training the SVM model on the network traffic feature set extracted from the training set;

[0197] 5-6) Use the test set to evaluate the classification effect of the model;

[0198] 5-7) Evaluate whether the classification effect meets the end condition;

[0199] 5-8) If the end condition has been reached, each parameter of the SVM model is obtained;

[0200] 5-9) Obtain the SVM model by the obtained parameters;

[0201] 5-10) If the end co...

technical field

[0001] The invention relates to a working mechanism of a novel proxy server, in particular to a proxy server with mobile terminal malicious software behavior detection capability and a working method. Background technique

[0002] With the rapid popularization of mobile terminals, applications on mobile terminals are emerging in an endless stream. Every day, millions of mobile terminal applications appear in major third-party application markets, such as the domestic Android market, Baidu application market, and Anzhi market. Foreign Google Marketplace, Amazon Store, AppleStore, etc. Although the third-party application market has already scanned the installation files for malicious codes before the mobile application is put on the shelves, it is still found that a large number of malicious applications exist in the major third-party application markets. The DroidDream family of malware, discovered in 2011, had infected more than 260,000 Android devices befo...

Examples

Embodiment

[0191] Embodiment, set up the SVM model of machine learning supervised learning algorithm, concrete steps are:

[0192] 5-1) On the basis of the new unknown malware samples found, add category labels to form a new feature set;

[0193] 5-2) In the new feature set, select part of the data as the training set, and another part of the data as the test set;

[0194] 5-3) encoding the parameters of the SVM model;

[0195] 5-4) Initialization work, complete the preprocessing of data and the initialization of model parameters;

[0196] 5-5) training the SVM model on the network traffic feature set extracted from the training set;

[0197] 5-6) Use the test set to evaluate the classification effect of the model;

[0198] 5-7) Evaluate whether the classification effect meets the end condition;

[0199] 5-8) If the end condition has been reached, each parameter of the SVM model is obtained;

[0200] 5-9) Obtain the SVM model by the obtained parameters;

[0201] 5-10) If the end co...

Images