Malicious code detection method and device, electronic device, and storage medium

Abstract

The present disclosure provides a malicious code detection method and device, electronic device, and storage medium, which relate to the field of network information security and can be applied to the scenario of detecting malicious code applications. The malicious code detection method includes: decompiling to obtain the source code of the APK to be detected; slicing the source code to obtain multiple code segments; obtaining the weight values ​​corresponding to each of the multiple code segments; calculating the fuzzy hash value of each code segment based on the weight value; comparing the fuzzy hash value with the malicious code fingerprint library to obtain the similarity of the APK to be detected; and outputting the detection result information of whether the APK to be detected is malicious code based on the similarity. The technical solution of the embodiment of the present disclosure can effectively detect variant malicious codes.

Description

Background Art

[0002] With the continuous development of intelligent communication technology, smart terminals have become one of the important tools of human society. Android operating system has become the main operating system of smart terminals due to its open source nature. This has also made more and more Android smart terminals become targets of malicious code attacks, posing a threat to the system security and user information security of Android smart terminals. Therefore, it is particularly important to detect malicious code in the Android system.

[0003] The detection of Android malicious code can rely on the hash value matching method, but this method requires that the malicious code application is exactly the same as the sample, which makes it impossible to effectively detect the variant malicious code application. For example, changing just one byte may cause the detection to fail completely, posing a threat to the security of the system.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the embodiments of the present disclosure is to provide a malicious code detection method, a malicious code detection device, an electronic device, and a computer-readable storage medium, thereby at least to a certain extent overcoming the problem in the related art that variant malicious codes cannot be effectively detected and thus affect system security.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of an embodiment of the present disclosure, a malicious code detection method is provided, comprising:

[0008] Decompile and obtain the source code of the Android application package APK to be tested;

[0009] Segmenting the source code to obtain multiple code segments;

[0010] Obtaining weight values ​​corresponding to each of the plurality of code segments;

[0011] Calculate a fuzzy hash value for each code segment based on the weight value;

[0012] Compare the fuzzy hash value with the malicious code fingerprint library to obtain the similarity of the APK to be detected;

[0013] Based on the similarity, the detection result information of whether the APK to be detected is malicious code is output.

[0014] In some example embodiments of the present disclosure, based on the above solution, the source code is Smali source code; and the slicing process of the source code includes:

[0015] The source code is divided into code segments according to the start mark .method and the end mark .end.

[0016] In some example embodiments of the present disclosure, based on the aforementioned solution, calculating the fuzzy hash value of each code segment based on the weight value includes:

[0017] Each code segment is sliced ​​by line to obtain multiple line-sliced ​​codes;

[0018] Calculate the fixed-length hash value of each row shard code;

[0019] The fixed-length hash value of each row fragment code is added with the weight value of the code segment where the row fragment code is located, and then concatenated in sequence to obtain a fuzzy hash value of each code segment.

[0020] In some example embodiments of the present disclosure, based on the foregoing solution, obtaining the weight values ​​corresponding to each of the plurality of code segments includes:

[0021] Obtaining first weight values ​​corresponding to respective code segments including system call functions or permissions in the plurality of code segments;

[0022] A second weight value corresponding to each of the code segments that do not include the system call function and the permission in the multiple code segments is obtained, where the second weight value is less than the first weight value.

[0023] In some example embodiments of the present disclosure, based on the foregoing solution, obtaining the first weight value corresponding to the code segment containing the system call function or permission in the multiple code segments includes:

[0024] The first weight value formula is used to calculate the first weight value corresponding to each of the code segments containing the system call function or permission in the multiple code segments; the first weight value formula is:

[0025]

[0026] Wherein, W is the calculated first weight value, code is the number of lines of process code in the code segment, and other is the number of lines of non-process code in the code segment.

[0027] In some example embodiments of the present disclosure, based on the above solution, comparing the fuzzy hash value with the malicious code fingerprint library to obtain the similarity of the APK to be detected includes:

[0028] The fuzzy hash value is compared with the malicious code fingerprint library, and the similarity of the APK to be detected is calculated according to the similarity calculation formula; the similarity calculation formula is:

[0029]

[0030] Wherein, S is the similarity, N is the number of code segments obtained by slicing the source code, and D i Indicates the difference between the fuzzy hash value of the i-th code segment in the N code segments and the malicious code fingerprint library, W i is the weight value of the i-th code segment among the N code segments, max(W i ) is the maximum weight value among the weight values ​​corresponding to the N code segments, and max(L1, L2) is the longest length value of the string compared with the fuzzy hash value and the malicious code fingerprint library.

[0031] In some example embodiments of the present disclosure, based on the aforementioned solution, the outputting of the detection result information of whether the APK to be detected is malicious code based on the similarity includes:

[0032] In response to the similarity being greater than a set threshold, outputting prompt information that the APK to be detected is malicious code;

[0033] In response to the similarity being less than the set threshold, a prompt message is outputted indicating that the APK to be detected is a security code.

[0034] According to a second aspect of an embodiment of the present disclosure, a malicious code detection device is provided, including:

[0035] The decompilation module is used to decompile and obtain the source code of the Android application package APK to be detected;

[0036] A fragmentation module, used for fragmenting the source code to obtain multiple code segments;

[0037] A first acquisition module, used to acquire weight values ​​corresponding to each of the plurality of code segments;

[0038] A calculation module, used for calculating a fuzzy hash value of each code segment based on the weight value;

[0039] A second acquisition module is used to compare the fuzzy hash value with the malicious code fingerprint library to obtain the similarity of the APK to be detected;

[0040] The output module is used to output the detection result information of whether the APK to be detected is malicious code based on the similarity.

[0041] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the malicious code detection methods described above is implemented.

[0042] According to a fourth aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the malicious code detection method according to any one of the above items is implemented.

[0043] The malicious code detection method in the example embodiment of the present disclosure obtains the source code of the APK (Android application package) to be detected by decompiling, and then performs fragmentation processing on the source code to obtain multiple code segments, obtains the weight values ​​corresponding to each of the multiple code segments, and then calculates the fuzzy hash value of each code segment based on the weight value, and obtains the similarity between the fuzzy hash value and the malicious code fingerprint library, and outputs the detection result information of whether the APK to be detected is malicious code based on the similarity, thereby realizing the detection of malicious code. On the one hand, the variant of the variant malicious code application usually only occurs in a certain code or code segment, and the proportion of the entire variant malicious code application is very small. In this way, by fragmenting the source code of the decompiled APK to be detected into multiple code segments, using the fuzzy hash value of the code segment to compare the malicious code fingerprint library, all malicious code segments except the variant code segment can still be matched, and the similarity of the APK to be detected relative to the malicious code fingerprint library can be obtained, so that the variant malicious code can be effectively detected. On the other hand, by setting a weight value for each code segment obtained by the fragmentation process, the weight of the important code in the similarity calculation can be highlighted, and the influence of the non-main code on the similarity calculation can be reduced.

[0044] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0046] Figure 1 A schematic diagram schematically illustrates a malicious code detection method process according to some embodiments of the present disclosure;

[0047] Figure 2A schematic diagram schematically illustrates a method of calculating a fuzzy hash value of each code segment based on a weight value according to some embodiments of the present disclosure;

[0048] Figure 3 A schematic diagram schematically shows a malicious code detection device according to some embodiments of the present disclosure;

[0049] Figure 4 A schematic diagram schematically shows a structure of a computer system of an electronic device according to some embodiments of the present disclosure;

[0050] Figure 5 A schematic diagram of a computer-readable storage medium according to some embodiments of the present disclosure is schematically shown.

[0051] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0052] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete and will fully convey the concept of the example embodiments to those skilled in the art.

[0053] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0054] Furthermore, the drawings are only schematic illustrations and are not necessarily drawn to scale. The block diagrams shown in the drawings are only functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0055] Android malicious code detection can be achieved by using the hash value matching method. The hash values ​​of the application to be detected are matched with the malicious code sample. If they are exactly the same, the application to be detected can be determined to be a malicious application. This method can accurately identify malicious code applications, but for variant malicious applications, or even non-essential code that has only changed one byte, the detection of malicious code will fail, affecting system security. Although the traditional fuzzy hash method can solve this problem to a certain extent, it cannot completely and accurately detect malicious code for applications to be detected that have slightly larger changes, such as large changes in the size of the application to be detected or too many changes in irrelevant code.

[0056] According to the malicious code detection method disclosed in the present invention, the source code of the object to be detected can be obtained by decompiling, and then the source code is segmented into multiple code segments, and a weight value is set for each code segment. The fuzzy hash value of each code segment is calculated based on the weight value, and then the fuzzy hash value is compared with the malicious code fingerprint library to obtain the similarity. Based on the similarity, the detection result information of whether the object to be detected is malicious code is output, which can realize the identification of variant malicious code.

[0057] In this example embodiment, a malicious code detection method is first provided. The malicious code detection method can be applied to terminal devices, such as mobile phones, computers and other electronic devices. Figure 1 The following is a schematic diagram of a malicious code detection method process according to some embodiments of the present disclosure. Figure 1 As shown, the malicious code detection method may include the following steps:

[0058] Step S110, decompiling to obtain the source code of the Android application package APK to be detected;

[0059] Step S120, fragmenting the source code to obtain multiple code segments;

[0060] Step S130, obtaining weight values ​​corresponding to each of the plurality of code segments;

[0061] Step S140, calculating the fuzzy hash value of each code segment based on the weight value;

[0062] Step S150, obtaining the similarity between the fuzzy hash value and the malicious code fingerprint library;

[0063] Step S160: output detection result information of whether the APK to be detected is malicious code based on the similarity.

[0064] According to the malicious code detection method in this example embodiment, on the one hand, the variant of the variant malicious code application usually only occurs in a certain code or code segment, and the proportion of the entire variant malicious code application is very small. In this way, by processing the source code of the decompiled APK to be detected into multiple code segments, using the fuzzy hash value of the code segment to compare the malicious code fingerprint library, all malicious code segments except the variant code segment can still be matched, and the similarity of the APK to be detected relative to the malicious code fingerprint library can be obtained, so that the variant malicious code can be effectively detected, and the security of the Android operating system is improved. On the other hand, by setting a weight value for each code segment obtained by the segmentation process, the weight of important code in the similarity calculation can be highlighted, and the influence of non-main code on the similarity calculation can be reduced.

[0065] The malicious code detection method in this example embodiment will be further described below.

[0066] In step S110, the source code of the APK to be detected is obtained by decompiling.

[0067] For example, the APK to be detected can be decompiled to obtain the Smali source code of the APK to be detected. Smali is a disassembler implementation for the Android virtual machine, which can support features such as annotations, debugging information, and line number information.

[0068] In step S120, the source code is segmented to obtain multiple code segments.

[0069] After the source code of the APK to be detected is obtained through decompilation, the source code can be divided into multiple code segments through segmentation. For example, the source code obtained through decompilation can be Smali source code, and the method in Smali can be described with .method, and the description can be completed with .end mark. Then the Smali source code can be divided into code segments according to the start mark .method and the end mark .end.

[0070] On the one hand, by selecting the decompiled Smali code as the fragmentation processing object, it can prevent the variable name and the call of system function or permission function from being obfuscated. On the other hand, by dividing the Smali source code into code segments according to the starting mark .method and the ending mark .end, and using the divided code segments as the object of malicious code detection, it can effectively avoid the influence of irrelevant fields such as annotations on the calculation results.

[0071] In step S130, weight values ​​corresponding to the plurality of code segments are obtained.

[0072] For example, a corresponding weight value may be set for each code segment to indicate the proportion of each code segment in the entire source code. For Android malicious code applications, they are mainly used by calling system call functions or calling permissions, and system call functions may include, for example, address books, phones, etc. Therefore, a higher weight value may be set for code segments that contain system call functions or permissions.

[0073] In an example embodiment, obtaining weight values ​​corresponding to each of the multiple code segments may include: obtaining a first weight value corresponding to each of the multiple code segments that contains a system call function or permissions; obtaining a second weight value corresponding to each of the multiple code segments that does not contain a system call function and permissions, wherein the second weight value is less than the first weight value.

[0074] For example, the second permission value corresponding to each code segment that does not contain system call functions and permissions can be set to 1 by default, and the first weight value formula shown in the following formula (1) is used to calculate the first weight value corresponding to each code segment that contains system call functions or permissions in multiple code segments. The first weight value formula is:

[0075]

[0076] Wherein, W is the calculated first weight value, code is the number of lines of process code in the code segment, and other is the number of lines of non-process code in the code segment.

[0077] In this way, a higher weight value can be set for the code segment containing the system call function or permission than for other code segments, which highlights the weight of the code segment containing the system call function or permission in the similarity calculation and reduces the influence of non-main code on the similarity calculation.

[0078] In step S140 , a fuzzy hash value of each code segment is calculated based on the weight value.

[0079] Each code segment can be set with its own corresponding weight value. For any code segment, its weight value can be used to calculate the fuzzy hash value of the code segment.

[0080] Reference Figure 2 As shown, a flowchart of a method for calculating a fuzzy hash value of each code segment based on a weight value according to an exemplary embodiment of the present disclosure is schematically shown. Figure 2 As shown, the method for calculating the fuzzy hash value of each code segment based on the weight value may include the following steps S210 to S230:

[0081] In step S210, each code segment is fragmented by line to obtain a plurality of line fragmented codes;

[0082] In step S220, a fixed-length hash value of each row shard code is calculated;

[0083] In step S230, the weight value of the code segment where the line fragment code is located is added to the fixed-length hash value of each line fragment code, and then concatenated in order to obtain a fuzzy hash value of each code segment.

[0084] For example, code segment 1 contains three lines of code, and its weight value is P1. The code segment can be divided into three line-sliced ​​codes, line-sliced ​​code 1, line-sliced ​​code 2, and line-sliced ​​code 3; code segment 2 contains two lines of code, and its weight value is P2. The code segment can be divided into two line-sliced ​​codes, line-sliced ​​code 4 and line-sliced ​​code 5. Then, the fuzzy hash value of code segment 1 can be obtained by the following process: add the weight value P1 to the fixed-length hash values ​​of line-sliced ​​code 1, line-sliced ​​code 2, and line-sliced ​​code 3, respectively, and then splice the line-sliced ​​code 1 with P1 added, the line-sliced ​​code 2 with P1 added, and the line-sliced ​​code 3 with P1 added in the order of the codes before division, that is, splice in the order of "line-sliced ​​code 1→line-sliced ​​code 2→line-sliced ​​code 3". The fuzzy hash value of code segment 2 can be obtained through the following process: add weight value P2 to the fixed-length hash values ​​of row fragment code 4 and row fragment code 5 respectively, and then concatenate row fragment code 4 with P2 added and row fragment code 5 with P2 added in the order of "row fragment code 4→row fragment code 5".

[0085] In step S150, the fuzzy hash value is compared with the malicious code fingerprint library to obtain the similarity of the APK to be detected.

[0086] After obtaining the fuzzy hash value of each code segment, these fuzzy hash values ​​can be compared with the pre-stored malicious code fingerprint library to obtain the similarity of the APK to be detected with respect to the malicious code fingerprint library. The malicious code fingerprint library can store malicious code samples, for example, in the form of code segments.

[0087] In an example embodiment, the fuzzy hash value can be compared with the malicious code fingerprint library, and the similarity of the APK to be detected can be calculated according to the similarity calculation formula. The similarity calculation formula can be expressed as the following formula (2):

[0088]

[0089] Where S is the calculated similarity, N is the number of code segments obtained by slicing the source code obtained in step S110, and D i Indicates the difference between the fuzzy hash value of the i-th code segment in N code segments and the malicious code fingerprint library, W i is the weight value of the i-th code segment among the N code segments, max(W i) is the maximum weight value among the weight values ​​corresponding to the N code segments, and max(L1, L2) is the longest length value of the string compared with the fuzzy hash value and the malicious code fingerprint library.

[0090] Edit distance is a quantitative measure of the difference between two strings (such as English characters), which is measured by looking at how many times it takes to transform one string into another. Based on the measurement principle of edit distance, in an example embodiment, the edit distance can be used to characterize the difference between the fuzzy hash value of a code segment and the malicious code fingerprint library, that is, D i It can be the edit distance.

[0091] In step S160, detection result information of whether the APK to be detected is malicious code is output based on the similarity.

[0092] After obtaining the similarity of the APK to be detected, it can be determined whether the code segment is malicious code based on the similarity.

[0093] In an example embodiment, the obtained similarity can be compared with a set threshold value. In response to the similarity being greater than the set threshold value, a prompt message indicating that the APK to be detected is a malicious code is output, such as displaying the prompt message "APK is a malicious code application" and outputting an alarm prompt tone, etc.; in response to the similarity being less than the set threshold value, a prompt message indicating that the APK to be detected is a safe code is output, such as outputting the prompt message "APK is safe". Exemplarily, the prompt message can also be a change in the state of an icon to indicate whether the APK to be detected is a malicious code. For example, when the icon is green, it means that the APK to be detected is safe, and when it is red, it means that the APK is a malicious code. It should be noted that this is only an example and is not intended to limit the present disclosure. The method of prompting the information, the content of the prompting information, the selection of the icon state, etc. can be adaptively selected according to actual needs.

[0094] In an exemplary embodiment, the similarity of each code segment may also be output to intuitively obtain the security level of the APK to be detected.

[0095] The malicious code detection method provided in this example embodiment can select the decompiled Smali code as the slicing object so that it will not be affected by obfuscation in the variable name and the call of the system call function or permission; when dividing the code segment, the .method code segment can be mainly considered as the object for calculating the hash, avoiding the influence of irrelevant fields such as .annotation on the calculation result; because Android malicious code applications are mainly used by calling system call functions or calling permissions such as the address book and phone, by weighting the code segments containing system function calls or permissions, it can effectively reduce the situation where the malicious code does not match the malicious code fingerprint library due to a large number of modifications to irrelevant code parts; moreover, the weighted algorithm takes into account the proportion of actual process code and other codes such as variable declarations, which can effectively reduce the influence of non-main code on the calculation similarity.

[0096] It should be noted that, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0097] In addition, in this exemplary embodiment, a malicious code detection device is also provided. Figure 3 As shown, the malicious code detection device 300 may include a decompiling module 310, a slicing module 320, a first acquisition module 330, a calculation module 340, a second acquisition module 350 and an output module 360. Among them:

[0098] The decompile module 310 is used to decompile and obtain the source code of the Android application package APK to be detected;

[0099] The fragmentation module 320 is used to fragment the source code to obtain multiple code segments;

[0100] The first acquisition module 330 is used to obtain the weight values ​​corresponding to each of the multiple code segments;

[0101] The calculation module 340 is used to calculate the fuzzy hash value of each code segment based on the weight value;

[0102] The second acquisition module 350 is used to compare the fuzzy hash value with the malicious code fingerprint library to obtain the similarity of the APK to be detected;

[0103] The output module 360 ​​is used to output detection result information of whether the APK to be detected is malicious code based on the similarity.

[0104] In an exemplary embodiment of the present disclosure, based on the above-mentioned solution, the source code may be Smali source code; accordingly, the segmentation module 320 may be specifically used to divide the source code into code segments according to the start mark .method and the end mark .end.

[0105] In an exemplary embodiment of the present disclosure, based on the above solution, the calculation module 340 may include a row slicing subunit, a calculation unit and a weighted processing unit.

[0106] The row slicing subunit is used to slice each code segment by row to obtain multiple row slicing codes;

[0107] The computing unit is used to calculate the fixed-length hash value of each row shard code;

[0108] The weighted processing unit is used to add the weight value of the code segment where the row fragment code is located to the fixed-length hash value of each row fragment code, and then splice them in order to obtain the fuzzy hash value of each code segment.

[0109] In an exemplary embodiment of the present disclosure, based on the above solution, the first acquisition module 330 may include a first acquisition subunit and a second acquisition subunit.

[0110] The first acquisition subunit is used to acquire first weight values ​​corresponding to the code segments containing system call functions or permissions in the multiple code segments;

[0111] The second acquisition subunit acquires a second weight value corresponding to each of the code segments that do not include the system call function and the permission in the multiple code segments, and the second weight value is smaller than the first weight value.

[0112] In an exemplary embodiment of the present disclosure, based on the above-mentioned solution, the first acquisition subunit may be specifically used to calculate the first weight value corresponding to each of the code segments containing the system call function or permission in the multiple code segments using the first weight value formula; the first weight value formula may be the above-mentioned formula (1), that is:

[0113]

[0114] Wherein, W is the calculated first weight value, code is the number of lines of process code in the code segment, and other is the number of lines of non-process code in the code segment.

[0115] In an exemplary embodiment of the present disclosure, based on the above-mentioned solution, the second acquisition module 350 can be specifically used to compare the fuzzy hash value determined by the calculation module 340 with the malicious code fingerprint library, and calculate the similarity of the APK to be detected according to the similarity calculation formula; the similarity calculation formula can be the above-mentioned formula (2), that is:

[0116]

[0117] Among them, S is the calculated similarity, N is the number of code segments obtained by sharding the source code, and D i Indicates the difference between the fuzzy hash value of the i-th code segment in the N code segments and the malicious code fingerprint library, W i is the weight value of the i-th code segment among the N code segments, max(W i ) is the maximum weight value among the weight values ​​corresponding to the N code segments, and max(L1, L2) is the longest length value of the string compared with the fuzzy hash value and the malicious code fingerprint library.

[0118] In an exemplary embodiment of the present disclosure, based on the aforementioned scheme, the output module 360 ​​is specifically used to: in response to the similarity being greater than a set threshold, output a prompt message that the APK to be detected is a malicious code; in response to the similarity being less than the set threshold, output a prompt message that the APK to be detected is a safe code.

[0119] The specific details of each module of the malicious code detection device mentioned above have been described in detail in the corresponding malicious code detection method, so they will not be repeated here.

[0120] It should be noted that although several modules or units of the malicious code detection device are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0121] In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above-mentioned malicious code detection method is also provided.

[0122] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware embodiments, complete software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0123] Refer to the following Figure 4 hereinafter describes an electronic device 400 according to such an embodiment of the present disclosure. Figure 4 The electronic device 400 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0124] like Figure 4As shown, the electronic device 400 is in the form of a general computing device. The components of the electronic device 400 may include but are not limited to: the at least one processing unit 410, the at least one storage unit 420, a bus 430 connecting different system components (including the storage unit 420 and the processing unit 410), and a display unit 440.

[0125] The storage unit stores program codes, which can be executed by the processing unit 410, so that the processing unit 410 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 410 can perform the following steps: Figure 1 The steps shown in: Step S110, decompile to obtain the source code of the Android application package APK to be detected; Step S120, fragment the source code to obtain multiple code segments; Step S130, obtain the weight values ​​corresponding to each of the multiple code segments; Step S140, calculate the fuzzy hash value of each code segment based on the weight value; Step S150, obtain the similarity between the fuzzy hash value and the malicious code fingerprint library; Step S160, output the detection result information of whether the APK to be detected is malicious code based on the similarity.

[0126] The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 421 and / or a cache memory unit 422 , and may further include a read-only memory unit (ROM) 423 .

[0127] The storage unit 420 may also include a program / utility 424 having a set (at least one) of program modules 425, such program modules 425 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0128] Bus 430 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0129] The electronic device 400 may also communicate with one or more external devices 470 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 400, and / or communicate with any device that enables the electronic device 400 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 450. In addition, the electronic device 400 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 460. As shown, the network adapter 460 communicates with other modules of the electronic device 400 via a bus 430. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0130] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0131] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible embodiments, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0132] refer to Figure 5 As shown, a program product 500 for implementing the above-mentioned malicious code detection method according to an embodiment of the present disclosure is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0133] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0134] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0135] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0136] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0137] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0138] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0139] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0140] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A malicious code detection method, characterized in that: include: Decompile and obtain the source code of the Android application package APK to be tested; Segmenting the source code to obtain multiple code segments; Obtaining weight values ​​corresponding to each of the plurality of code segments; Calculate a fuzzy hash value for each code segment based on the weight value; Compare the fuzzy hash value with the malicious code fingerprint library to obtain the similarity of the APK to be detected; Outputting detection result information of whether the APK to be detected is malicious code based on the similarity; Wherein, obtaining the weight values ​​corresponding to each of the plurality of code segments includes: Obtaining first weight values ​​corresponding to respective code segments including system call functions or permissions in the plurality of code segments; Obtaining a second weight value corresponding to each of the code segments that do not include the system call function and the permission in the multiple code segments, where the second weight value is less than the first weight value; The calculation formula of the first weight value is: Wherein, W is a first weight value, code is the number of lines of process code in the code segment, and other is the number of lines of non-process code in the code segment.

2. The malicious code detection method according to claim 1, characterized in that: The source code is Smali source code; and the slicing process of the source code includes: The source code is divided into code segments according to the start mark .method and the end mark .end.

3. The malicious code detection method according to claim 1, characterized in that: The step of calculating the fuzzy hash value of each code segment based on the weight value includes: Each code segment is sliced ​​by line to obtain multiple line-sliced ​​codes; Calculate the fixed-length hash value of each row shard code; The fixed-length hash value of each row fragment code is added with the weight value of the code segment where the row fragment code is located, and then concatenated in sequence to obtain a fuzzy hash value of each code segment.

4. The malicious code detection method according to claim 1, characterized in that: The comparing the fuzzy hash value with the malicious code fingerprint library to obtain the similarity of the APK to be detected includes: The fuzzy hash value is compared with the malicious code fingerprint library, and the similarity of the APK to be detected is calculated according to the similarity calculation formula; the similarity calculation formula is: Wherein, S is the similarity, N is the number of code segments obtained by slicing the source code, and D i Indicates the difference between the fuzzy hash value of the i-th code segment in the N code segments and the malicious code fingerprint library, W i is the weight value of the i-th code segment among the N code segments, max(W i ) is the maximum weight value among the weight values ​​corresponding to the N code segments, and max(L1, L2) is the longest length value of the string compared with the fuzzy hash value and the malicious code fingerprint library.

5. The malicious code detection method according to claim 1, characterized in that: The detection result information of whether the APK to be detected is malicious code is output based on the similarity includes: In response to the similarity being greater than a set threshold, outputting prompt information that the APK to be detected is malicious code; In response to the similarity being less than the set threshold, a prompt message is outputted indicating that the APK to be detected is a security code.

6. A malicious code detection device, characterized in that: include: Decompile module, used to decompile and obtain the source code of the Android application package APK to be detected; A fragmentation module, used for fragmenting the source code to obtain multiple code segments; A first acquisition module, used to acquire weight values ​​corresponding to each of the plurality of code segments; A calculation module, used for calculating a fuzzy hash value of each code segment based on the weight value; A second acquisition module is used to compare the fuzzy hash value with the malicious code fingerprint library to obtain the similarity of the APK to be detected; An output module, used to output detection result information of whether the APK to be detected is malicious code based on the similarity; Wherein, obtaining the weight values ​​corresponding to each of the plurality of code segments includes: Obtaining first weight values ​​corresponding to respective code segments including system call functions or permissions in the plurality of code segments; Obtaining a second weight value corresponding to each of the code segments that do not include the system call function and the permission in the multiple code segments, where the second weight value is less than the first weight value; The calculation formula of the first weight value is: Wherein, W is a first weight value, code is the number of lines of process code in the code segment, and other is the number of lines of non-process code in the code segment.

7. An electronic device comprising: processor; as well as A memory having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by the processor, implement the malicious code detection method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the malicious code detection method according to any one of claims 1 to 5.

Images