Method for detecting malicious behaviors of Android applications in batches

Abstract

The invention provides a method for detecting malicious behaviors of Android applications in batches, and belongs to the technical field of information security. The malicious behavior detection module comprises a data acquisition and monitoring module, a malicious behavior analysis module, a system security protection module, an application permission and data processing and reviewing module, a user behavior analysis and response module, a model updating and optimizing module, a simulation operation and verification module and a code de-obfuscation processing module; the data acquisition and monitoring module collects and monitors application behavior data, the malicious behavior analysis module analyzes and identifies a complex malicious mode, the system security protection module constructs a multi-layer protection system, the application permission and data processing review module reviews permission abuse, and the user behavior analysis and response module records and analyzes a user mode. The model updating and optimizing module ensures detection of novel malicious behaviors, the simulation running and verification module simulates application running, and finally the code de-obfuscation processing module processes code obfuscation conditions.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for batch detecting malicious behaviors of Android applications. Background Art

[0002] With the rapid development of mobile Internet, the Android operating system has become the main operating platform for many mobile applications due to its openness and wide market share. However, this has also provided a breeding ground for malicious software. As the scale of the Android application market continues to expand, a large number of new applications are launched every day. At the same time, malicious developers also use various means to hide malicious behaviors in seemingly normal applications, attempting to steal user privacy, commit fraud, consume system resources, or carry out other harmful activities.

[0003] Traditional methods for detecting malicious behavior in Android applications often rely on manual analysis or a single detection tool, which is inefficient and difficult to cope with the increasingly complex and diverse malicious behaviors. Moreover, the manifestations of malicious behaviors are constantly changing and upgrading. Code obfuscation, dynamic loading of malicious modules and exploitation of system vulnerabilities make detection more difficult. Existing detection technologies are insufficient in accuracy, timeliness and comprehensiveness, and cannot effectively protect users' device security and personal information. To address the above problems, a method for batch detection of malicious behavior in Android applications is proposed. Summary of the invention

[0004] The present invention provides a method for batch detecting malicious behaviors of Android applications, aiming to solve the problem that the manifestations of malicious behaviors in the prior art are constantly changing and upgrading, code obfuscation, dynamic loading of malicious modules and exploitation of system vulnerabilities, which further increase the difficulty of detection, and the existing detection technology is insufficient in accuracy, timeliness and comprehensiveness, and cannot effectively protect the user's device security and personal information.

[0005] The present invention is implemented as follows: comprising a malicious behavior detection module, the malicious behavior detection module comprising a data acquisition and monitoring module, a malicious behavior analysis module, a system security protection module, an application authority and data processing review module, a user behavior analysis and response module, a model update and optimization module, a simulation operation and verification module and a code deobfuscation processing module;

[0006] The data collection and monitoring module is responsible for comprehensively collecting various behavior data of Android applications and monitoring these behaviors in real time;

[0007] The malicious behavior analysis module is responsible for conducting in-depth analysis of the collected data and identifying possible complex malicious behavior patterns;

[0008] The system security protection module is responsible for building a multi-level security protection system, providing protection from the application layer to the system layer to prevent the intrusion and damage of malicious software;

[0009] The application permission and data processing review module is responsible for checking whether the permissions applied for by the application are reasonable, and preventing the application from abusing permissions to carry out malicious behavior;

[0010] The user behavior analysis and response module is responsible for recording and analyzing the normal usage patterns of users, establishing user behavior models, and providing corresponding feedback and processing for detected abnormal behaviors;

[0011] The model update and optimization module is responsible for automatically updating and optimizing the detection model and rule base according to the newly discovered malicious behavior characteristics and changes, to ensure that the system can continuously and effectively detect new malicious behaviors;

[0012] The simulation operation and verification module is responsible for simulating the operation of the Android application in an isolated environment, observing whether its behavior has malicious tendencies, and verifying and supplementing the detection results;

[0013] The code deobfuscation processing module is responsible for processing the code obfuscation in the Android application and restoring the obfuscated code to a clear and readable form so as to perform more accurate malicious behavior analysis.

[0014] Preferably, the data collection and monitoring module includes a real-time behavior monitoring submodule and a dynamic behavior monitoring submodule. The real-time behavior monitoring submodule is responsible for real-time monitoring of the behavior of the application, including network requests, file operations and database access, timely discovering and analyzing suspicious activities, and using dynamic taint analysis technology to track the flow path of sensitive data and identify potential privacy leaks and unauthorized access: utilizing the kernel-level monitoring mechanism of the Android system, embedding special monitoring code to obtain application behavior information, and for dynamic taint analysis, using tag tracking technology to mark sensitive data with specific tags, and then tracking the transfer and changes of these tags in the data processing flow, so as to obtain behavior data at the first time of application operation, timely discover potential threats, and improve the real-time and accuracy of detection. The dynamic behavior monitoring submodule is responsible for real-time monitoring of the dynamic behavior of the application at runtime, including process creation, file reading and writing, and network communication activities, and quickly detecting any abnormal conditions: by deploying process monitoring tools, file system monitoring tools, and network traffic monitoring tools at the operating system level, these tools directly interact with the system kernel to obtain underlying behavior information.

[0015] Preferably, the malicious behavior analysis module includes a deep learning malicious behavior identification submodule, a feature matching submodule and a malicious code detection submodule. The deep learning malicious behavior identification submodule uses a recurrent neural network (RNN) to perform in-depth pattern analysis on the collected Android application behavior data, thereby identifying complex and difficult-to-detect malicious behavior patterns, and combines natural language processing (NLP) technology to parse the semantics of application code to further enhance the ability to identify malicious behaviors hidden by complex technologies such as code obfuscation: using TensorFlow The RNN model is constructed using the ow deep learning framework. For code semantic analysis, the NLP technology of word embedding, syntactic analysis and semantic understanding is used. In the model training stage, learning is carried out through a large amount of marked malicious behavior data. The feature matching submodule is responsible for establishing a comprehensive malicious behavior feature library and quickly identifying known malicious behavior patterns through feature matching: by extracting and summarizing the behavioral features of a large number of known malicious applications, a feature library is constructed, and a hash algorithm is used for feature matching. Key behavioral features are extracted from known malicious applications, and the extracted features are stored in a database. The relevant behavioral data of the Android application to be detected is obtained, and the features of the data to be detected are compared with the feature library using an algorithm. It is determined whether there is a known malicious behavior pattern based on the matching results. The malicious code detection submodule uses code static analysis and dynamic analysis techniques to comprehensively detect whether there are malicious code fragments in Android applications: the static analysis tool FloDroid is used, combined with the dynamic analysis tool Android Debug Bridge (ADB) and the simulator, and detection is performed through control flow analysis, data flow analysis, and taint propagation analysis.

[0016] Preferably, the system security protection module includes a multi-layer protection submodule and a vulnerability scanning submodule. The multi-layer protection submodule is responsible for building a multi-level security protection system from the application layer to the system layer to achieve in-depth defense against malware, add behavioral analysis at the application layer, and integrate an abnormal behavior blocking mechanism at the system layer. Once malicious or abnormal behavior is detected, it is immediately blocked from further execution, thereby providing double security protection for the device: at the application layer, by embedding behavior monitoring code in the application or using the monitoring interface provided by the application framework to collect and analyze application behavior data; at the system layer, using the system's kernel mechanism and firewall rules to achieve abnormal behavior blocking, protection is provided from both the application and system levels, enhancing the depth and comprehensiveness of defense, and effectively preventing the attack and spread of malware; the vulnerability scanning submodule is responsible for scanning and detecting common system vulnerabilities, finding common operating system vulnerabilities and application framework vulnerabilities, and discovering in advance vulnerabilities that may be exploited by malicious applications: using the vulnerability scanning tool OpenVAS, the OpenVAS tool works based on a vulnerability database and a scanning engine, and detects vulnerabilities by sending detection data packets, checking system configurations and service responses. It can actively discover vulnerabilities in the system, repair and reinforce them before malicious applications exploit them, and reduce the risk of the system being attacked.

[0017] Preferably, the application permission and data processing review module includes an application permission analysis submodule and a data encryption detection submodule. The application permission analysis submodule is responsible for conducting an in-depth and detailed review of the permissions applied for by the Android application, comparing the permission range normally required by normal applications, and determining whether the permissions applied for by the detected application are abnormal or exceed a reasonable range, so as to discover possible signs of malicious behavior: obtaining the permission information applied for by the application by parsing the manifest file of the Android application, establishing a database containing common application types and their corresponding normal permission ranges as a reference standard, and using a permission comparison algorithm to compare the permissions of the detected application with the standards in the database one by one; the data encryption detection submodule is responsible for checking the encryption processing method and process of the Android application for data, determining whether it complies with relevant security specifications and compliance requirements, and preventing malicious applications from hiding malicious behavior or sensitive information through encryption: using encryption analysis tools, static and dynamic analysis of the encryption code and modules in the application, establishing compliant encryption policies and standard libraries, and comparing the detection results with them, to ensure that the data encryption processing in the application is legal and compliant, to ensure data security, and to reduce the risk of data leakage.

[0018] Preferably, the user behavior analysis and response module includes a user behavior analysis and anomaly detection submodule and a feedback and response submodule. The user behavior analysis and anomaly detection submodule is responsible for recording and analyzing the normal usage patterns of users, and using machine learning algorithms to build accurate user behavior models to detect and prevent abnormal operation behaviors. At the same time, with the help of complex event processing (CEP) technology, the user's behavior sequence is analyzed in real time, so as to efficiently distinguish normal and abnormal behavior performances: first, by embedding a data acquisition module in the Android system, various click, slide and input behaviors of users operating applications, as well as the time and frequency information of the operations, are collected, and then the decision tree algorithm is used to train the collected data , build a user behavior model, for real-time analysis of user behavior sequences, use the CEP engine, and identify complex behavior patterns by defining event patterns and rules. The feedback and response submodule is responsible for centrally collecting feedback information from each monitoring module, implementing automated response actions for detected malicious behaviors, isolating related applications and sending notifications to users, and introducing adaptive response strategies to intelligently select the most appropriate response measures based on the scope and severity of the malicious behavior: by establishing a centralized feedback information collection center, using message queues or databases to store information from each monitoring module, and the response strategy is implemented through programming, and the response measures are determined according to preset rules and algorithms.

[0019] Preferably, the model update and optimization module is responsible for automatically updating the detection model and rule base according to the newly discovered malicious behavior characteristics, ensuring that the system always maintains a high degree of sensitivity and accurate identification capabilities to new threats: by introducing an online learning mechanism, the model update is completed while the system continues to run services, so that it can flexibly adapt to the ever-changing threat situation, and the incremental learning and transfer learning techniques in machine learning are used to set up a monitoring mechanism in the system. When new malicious behavior characteristics are discovered, the update process is triggered. Through the online learning algorithm, the online variant of stochastic gradient descent (SGD) is used to fine-tune the parameters of the existing model. At the same time, version control tools are used to manage the update of the model and rule base to ensure a smooth transition and traceability of the update.

[0020] Preferably, the simulation operation and verification module is responsible for simulating the operation process of the Android application in a completely isolated environment, observing its various behavioral performances in all directions, so as to accurately determine whether the application has malicious tendencies: using professional sandbox technology to build a virtual environment that is isolated from the real system but has similar functions, by installing the application in the sandbox and simulating various user operations and system interactions to trigger various behaviors of the application, and using monitoring tools to comprehensively monitor and record the application's processes, file operations, network communications and system calls in the sandbox.

[0021] Preferably, the code deobfuscation processing module is responsible for solving the problem of code obfuscation in Android applications, restoring the obfuscated code, and providing a clear, accurate and easy-to-understand code structure for subsequent code analysis: by analyzing the patterns and rules of the obfuscated code, using anti-obfuscation algorithms and tools, these algorithms are based on the grammatical structure, control flow and data flow characteristics of the code to identify the obfuscated parts, and try to restore their original logic.

[0022] Preferably, a method for batch detecting malicious behavior of Android applications comprises the following steps:

[0023] Step 1: The data collection and monitoring module is responsible for comprehensively collecting various behavior data of Android applications and monitoring these behaviors in real time;

[0024] Step 2: The malicious behavior analysis module is responsible for in-depth analysis of the collected data to identify possible complex malicious behavior patterns;

[0025] Step 3: The system security protection module is responsible for building a multi-level security protection system, which provides protection from the application layer to the system layer to prevent the intrusion and damage of malicious software;

[0026] Step 4: The application permission and data processing review module is responsible for checking whether the permissions applied by the application are reasonable, and preventing the application from abusing permissions to carry out malicious behavior;

[0027] Step 5: The user behavior analysis and response module is responsible for recording and analyzing the user's normal usage patterns, establishing a user behavior model, and providing corresponding feedback and processing for detected abnormal behaviors;

[0028] Step 6: The model update and optimization module is responsible for automatically updating and optimizing the detection model and rule base according to the newly discovered malicious behavior characteristics and changes, ensuring that the system can continuously and effectively detect new malicious behaviors;

[0029] Step 7: The simulation operation and verification module is responsible for simulating the operation of Android applications in an isolated environment, observing whether their behavior has malicious tendencies, and verifying and supplementing the detection results;

[0030] Step 8: The code deobfuscation processing module is responsible for handling code obfuscation in Android applications and restoring the obfuscated code to a clear and readable form for more accurate malicious behavior analysis.

[0031] The method for batch detecting malicious behaviors of Android applications provided by the present invention, when the system is used, firstly, the data acquisition and processing module is responsible for collecting current environmental data and microgrid operation data, collecting voltage, current and frequency, deploying sensors to monitor the electrical parameters of the microgrid in real time, converting physical quantities into electrical signals through these sensors, providing original input for data acquisition, the data communication equipment submodule ensures the real-time and accuracy of data collected from various sensors and monitoring equipment, the data preprocessing submodule filters and normalizes the collected data, and provides accurate data support for subsequent control decisions, the database management system submodule is used to store historical and real-time data for control algorithm analysis and decision-making, the control strategy calculation module includes a conventional control rate calculation submodule, an adaptive disturbance compensation rate calculation submodule, a control strategy adjustment submodule and a feedback and iterative optimization submodule, based on The conventional control rate is calculated based on the system model and actual measurement data. The fuzzy logic control algorithm is used to calculate the control input according to the current system state and the expected control target. The adaptive disturbance compensation rate calculation submodule calculates the adaptive disturbance compensation rate according to the actual operation state of the microgrid to adjust and optimize the control strategy. The control strategy adjustment submodule will be used to adjust the control strategy of the microgrid based on the calculated compensation rate. The feedback and iterative optimization submodule is used to feed back the results to the adaptive disturbance compensation rate calculation module when the system continuously monitors the actual response of the microgrid. Then, a filter for controlling voltage stability is designed. The digital signal processor DSP is used to develop an adaptive Kalman filter algorithm to dynamically adjust the filter parameters. Based on the output of the voltage filter, the voltage inside the microgrid is adjusted to ensure the power quality, and the filter parameters are adjusted according to the actual operation conditions to adapt to different operating conditions.

[0032] Then, the energy management and scheduling module is responsible for the energy distribution within the microgrid, optimizes the output of distributed power sources, and improves the energy utilization efficiency within the microgrid. At the same time, it is used to calculate the minimum energy exchange value between microgrids, realize the interconnection and energy mutual assistance between microgrids, and realize the optimal allocation of resources. Then, the coordinated control and optimization module is responsible for building a multi-objective optimization model for the microgrid, and introduces a genetic algorithm to solve the multi-objective model to achieve the optimal operation of the microgrid system under changing conditions, perform global energy optimization configuration, and ensure the effective use of electric energy. A multi-microgrid power scheduling and optimization control strategy is proposed, including a power optimization module and a control module, to improve the economy and stability of the system, and realize information exchange and command coordination between the overall control Agent layer, the local control Agent layer, and the controlled device Agent layer. At the same time, the communication and interconnection module clarifies the communication rules and standards between each level to ensure the effective interaction of information, builds a microgrid control system based on multi-agents, and realizes the coordinated control between the various levels of the microgrid control system. Then, through the simulation and testing module: using Simu li nk simulation software builds a microgrid model, conducts simulation tests, analyzes simulation results, and evaluates the performance and adaptive capabilities of the control system. Finally, the safety and protection module is used to design and implement protection mechanisms to prevent system overload and failure, and provide system security management, including user authentication and operation records. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this technical field, other drawings can be obtained based on these drawings without creative work. As shown in the accompanying drawings, the above and other purposes, features and advantages of the present invention will be clearer. The same reference numerals in all the drawings indicate the same parts. The drawings are not deliberately scaled to the actual size, and the focus is on illustrating the main purpose of the present invention.

[0034] Figure 1 It is a schematic diagram of the flow structure of the method for batch detection of malicious behaviors of Android applications provided by the present invention;

[0035] Figure 2 It is a schematic diagram of the structure of a voltage filter design module of a method for batch detecting malicious behaviors of Android applications provided by the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0037] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the technical field without creative work are within the scope of protection of the present invention.

[0038] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0039] Furthermore, the terms “first”, “second”, etc. are merely used for distinguishing descriptions and should not be understood as indicating or implying relative importance.

[0040] For example, see Figure 1-2 .

[0041] The present embodiment provides a method for batch detecting malicious behaviors of Android applications, including a malicious behavior detection module, which includes a data collection and monitoring module, a malicious behavior analysis module, a system security protection module, an application permission and data processing review module, a user behavior analysis and response module, a model update and optimization module, a simulation operation and verification module, and a code deobfuscation processing module;

[0042] The data collection and monitoring module is responsible for comprehensively collecting various behavior data of Android applications and monitoring these behaviors in real time;

[0043] The malicious behavior analysis module is responsible for in-depth analysis of the collected data and identifying possible complex malicious behavior patterns;

[0044] The system security protection module is responsible for building a multi-level security protection system, providing protection from the application layer to the system layer to prevent the intrusion and damage of malicious software;

[0045] The application permission and data processing review module is responsible for checking whether the permissions applied by the application are reasonable, and preventing the application from abusing permissions to carry out malicious behavior;

[0046] The user behavior analysis and response module is responsible for recording and analyzing the normal usage patterns of users, establishing user behavior models, and providing corresponding feedback and processing for detected abnormal behaviors;

[0047] The model update and optimization module is responsible for automatically updating and optimizing the detection model and rule base according to the newly discovered malicious behavior characteristics and changes, ensuring that the system can continuously and effectively detect new malicious behaviors;

[0048] The simulation operation and verification module is responsible for simulating the operation of Android applications in an isolated environment, observing whether their behavior has malicious tendencies, and verifying and supplementing the detection results;

[0049] The code deobfuscation processing module is responsible for handling code obfuscation in Android applications and restoring the obfuscated code to a clear and readable form for more accurate malicious behavior analysis.

[0050] The data collection and monitoring module includes a real-time behavior monitoring submodule and a dynamic behavior monitoring submodule. The real-time behavior monitoring submodule is responsible for real-time monitoring of the behavior of the application, including network requests, file operations, and database access, timely discovering and analyzing suspicious activities, and using dynamic taint analysis technology to track the flow path of sensitive data and identify potential privacy leaks and unauthorized access: using the kernel-level monitoring mechanism of the Android system, embedding special monitoring code to obtain application behavior information. For dynamic taint analysis, using tag tracking technology to mark sensitive data with specific tags, and then tracking the transfer and changes of these tags in the data processing process, it can obtain behavior data at the first time of application operation, discover potential threats in time, and improve the real-time and accuracy of detection. The dynamic behavior monitoring submodule is responsible for real-time monitoring of the dynamic behavior of the application at runtime, including process creation, file reading and writing, and network communication activities, and quickly detecting any abnormal conditions: by deploying process monitoring tools, file system monitoring tools, and network traffic monitoring tools at the operating system level, these tools directly interact with the system kernel to obtain underlying behavior information;

[0051] The real-time behavior monitoring service is started through the real-time behavior monitoring submodule, and the system kernel is used to capture the application's network request, file operation, database access and other behavioral data, mark the operations involving sensitive data, track the flow of marked sensitive data within the application, analyze the data flow path, query whether sensitive data flows to unauthorized destinations, and determine whether there are any anomalies. Then the dynamic behavior monitoring submodule starts the dynamic behavior monitoring service. The process monitoring tool continuously monitors the application's process creation, the file system monitoring tool tracks the application's read and write operations on files in real time, and the network traffic monitoring tool promptly captures the application's network communication data, and compares and analyzes the monitored data with the preset normal behavior pattern. Once a behavior that does not match the normal pattern is found, it is immediately marked as an anomaly and further processed.

[0052] The malicious behavior analysis module includes a deep learning malicious behavior identification submodule, a feature matching submodule, and a malicious code detection submodule. The deep learning malicious behavior identification submodule uses a recurrent neural network (RNN) to perform in-depth pattern analysis on the collected Android application behavior data, thereby identifying complex and difficult-to-detect malicious behavior patterns. At the same time, it combines natural language processing (NLP) technology to parse the semantics of application code, further enhancing the ability to identify malicious behaviors hidden by complex technologies such as code obfuscation: using TensorFlow The RNN model is constructed using the ow deep learning framework. For code semantic analysis, NLP technologies such as word embedding, syntactic analysis and semantic understanding are used. In the model training phase, learning is performed through a large amount of labeled malicious behavior data. The feature matching submodule is responsible for establishing a comprehensive malicious behavior feature library and quickly identifying known malicious behavior patterns through feature matching: by extracting and summarizing the behavioral features of a large number of known malicious applications, a feature library is constructed, and a hash algorithm is used for feature matching. Key behavioral features are extracted from known malicious applications and the extracted features are stored in a database. The relevant behavioral data of the Android application to be detected is obtained, and the features of the data to be detected are compared with the feature library using an algorithm. Based on the matching results, it is determined whether there is a known malicious behavior pattern. The malicious code detection submodule uses code static analysis and dynamic analysis techniques to comprehensively detect whether there are malicious code fragments in Android applications: the static analysis tool FloDro id is used, combined with the dynamic analysis tool Android Debug Bridge (ADB) and the simulator, and detection is performed through control flow analysis, data flow analysis, and taint propagation analysis.

[0053] Through the deep learning malicious behavior identification submodule, a large amount of Android application behavior data is collected and marked to distinguish normal behavior from malicious behavior. An RNN model is built in the deep learning framework and appropriate parameters are configured. The NLP technology module is integrated with the RNN model. The model is trained using the prepared data and the parameters are continuously adjusted to improve the model performance. The behavior data of the Android application to be detected is input into the trained model for analysis. The feature matching submodule obtains the relevant behavior data of the Android application to be detected, and uses an algorithm to compare the features of the data to be detected with the feature library. Based on the matching results, it is determined whether there are known malicious behavior patterns. The malicious code detection submodule uses tools to perform lexical, grammatical and semantic analysis on the application code, runs the application in a simulated environment, monitors its runtime behavior, and combines the results of static and dynamic analysis to determine whether there is malicious code. After detecting malicious code, a detailed report is generated, including the code location and type.

[0054] The system security protection module includes a multi-layer protection submodule and a vulnerability scanning submodule. The multi-layer protection submodule is responsible for building a multi-level security protection system from the application layer to the system layer to achieve deep defense against malware. It adds behavioral analysis at the application layer and integrates an abnormal behavior blocking mechanism at the system layer. Once malicious or abnormal behavior is detected, it immediately blocks its further execution, thereby providing double security protection for the device: at the application layer, by embedding behavior monitoring code in the application or using the monitoring interface provided by the application framework to collect and analyze application behavior data; at the system layer, the system's kernel mechanism and firewall rules are used to achieve abnormal behavior blocking, and protection is provided at both the application and system levels, which enhances the depth and comprehensiveness of defense and effectively prevents the attack and spread of malware. The vulnerability scanning submodule is responsible for scanning and detecting common system vulnerabilities, finding common operating system vulnerabilities and application framework vulnerabilities, and discovering vulnerabilities that may be exploited by malicious applications in advance: using the vulnerability scanning tool OpenVAS, the OpenVAS tool works based on the vulnerability database and scanning engine, and detects vulnerabilities by sending detection packets, checking system configurations, and service responses. It can actively discover vulnerabilities in the system, repair and reinforce them before malicious applications exploit them, and reduce the risk of system attacks;

[0055] Through the multi-layer protection sub-module, behavior monitoring code is embedded or monitoring interface is configured in the application development stage. When the application is running, behavior data is collected and analyzed in real time. If abnormal behavior is found in the application layer, the relevant information is passed to the system layer. The system layer determines whether to block the behavior based on the preset rules and policies. If it is judged to be malicious or abnormal behavior, the blocking mechanism is activated to prohibit it from continuing to execute. Then the vulnerability scanning tool is configured, including setting the scanning range and selecting the vulnerability library, and starting the vulnerability scanning task. The tool begins to perform a comprehensive scan of the target system. The tool sends various detection requests, collects the system's response and configuration information, compares the collected information with the vulnerability database, identifies possible vulnerabilities, and generates a detailed vulnerability scanning report, including the type, location and severity of the vulnerability. According to the report, take appropriate repair measures to update the system and install patches.

[0056] The application permission and data processing review module includes the application permission analysis submodule and the data encryption detection submodule. The application permission analysis submodule is responsible for conducting an in-depth and detailed review of the permissions applied for by Android applications, comparing the permission range normally required by normal applications, and judging whether the permissions applied for by the detected application are abnormal or exceed the reasonable scope, so as to discover possible signs of malicious behavior: by parsing the manifest file of the Android application to obtain the permission information applied for by the application, establish a database containing common application types and their corresponding normal permission ranges as a reference standard, and use the permission comparison algorithm to compare the permissions of the detected application with the standards in the database one by one. The data encryption detection submodule is responsible for checking the encryption processing method and process of the Android application for data, judging whether it complies with relevant security specifications and compliance requirements, and preventing malicious applications from hiding malicious behavior or sensitive information through encryption: using encryption analysis tools, static and dynamic analysis of the encryption code and modules in the application, establishing compliant encryption policies and standard libraries, and comparing the detection results with them, to ensure that the data encryption processing in the application is legal and compliant, to ensure data security, and to reduce the risk of data leakage;

[0057] The application permission analysis submodule reads the manifest file of the detected Android application, extracts the list of permissions applied for, obtains the normal permission range of the corresponding type of application from the permission database, and compares the permissions of the detected application with the normal permission range one by one. If it is found that the applied permissions exceed the normal range, it is marked as potential malicious behavior and further analyzed. Then the data encryption detection service is started, static code analysis is performed on the detected application, encryption-related code segments are extracted, the application is dynamically monitored in a simulated running environment, data and parameters in the encryption process are obtained, and the detected encryption processing method is compared with the compliant encryption strategy and standard library. If encryption processing that does not meet compliance requirements is found, it is marked as an exception and detailed information is recorded.

[0058] The user behavior analysis and response module includes the user behavior analysis and anomaly detection submodule and the feedback and response submodule. The user behavior analysis and anomaly detection submodule is responsible for recording and analyzing the normal usage patterns of users, and using machine learning algorithms to build accurate user behavior models to detect and prevent abnormal operation behaviors. At the same time, with the help of complex event processing (CEP) technology, the user's behavior sequence is analyzed in real time, so as to efficiently distinguish between normal and abnormal behavior performance: First, by embedding a data collection module in the Android system, various click, slide and input behaviors of users operating applications, as well as the time and frequency information of operations, are collected. Then, the decision tree algorithm is used to train the collected data to build a User behavior model: For real-time analysis of user behavior sequences, the CEP engine is used to identify complex behavior patterns by defining event patterns and rules. The feedback and response submodule is responsible for centrally collecting feedback information from various monitoring modules, implementing automated response actions for detected malicious behaviors, isolating related applications and sending notifications to users. At the same time, an adaptive response strategy is introduced to intelligently select the most appropriate response measures based on the scope and severity of the malicious behavior: by establishing a centralized feedback information collection center, using message queues or databases to store information from each monitoring module, and the response strategy is implemented through programming, and the response measures are determined according to preset rules and algorithms;

[0059] The data collection service is started through the user behavior analysis and anomaly detection submodule to start collecting user behavior data, preprocess and extract features from the collected data, and use machine learning algorithms to train the model. During the application operation, the user's current behavior data is collected in real time, and the current behavior data is input into the trained model for analysis. The behavior sequence is analyzed in real time using CEP technology, and whether it is abnormal behavior is determined based on the analysis results. Then the feedback and response submodule establishes a feedback information collection mechanism, receives information from each monitoring module, and classifies and evaluates the received feedback information. According to the preset adaptive response strategy, the impact scope and severity of the malicious behavior are determined. Based on the judgment results, the corresponding response measures are automatically selected and executed, the application is isolated and the user is notified. At the same time, the results and related information of the response operation are recorded for subsequent analysis and optimization.

[0060] The model update and optimization module is responsible for automatically updating the detection model and rule base based on the newly discovered malicious behavior characteristics, ensuring that the system always maintains a high degree of sensitivity and accurate identification capabilities for new threats: by introducing an online learning mechanism, the model can be updated while the system continues to run services, enabling it to flexibly adapt to the changing threat situation. By using incremental learning and transfer learning technologies in machine learning, a monitoring mechanism is set up in the system. When new malicious behavior characteristics are discovered, the update process is triggered. Through the online learning algorithm, the online variant of stochastic gradient descent (SGD) is used to fine-tune the parameters of the existing model. At the same time, version control tools are used to manage the update of the model and rule base to ensure a smooth transition and traceability of the update.

[0061] By establishing a malicious behavior feature monitoring mechanism, we continuously collect new malicious behavior data. When the new malicious behavior features reach a certain number or importance threshold, we start the update process and use the online learning algorithm to fine-tune the parameters of the existing detection model according to the new data. The updated model parameters are applied to actual detection and tested on a small scale. If the test passes, the updated model is formally deployed and the rule base is updated synchronously. The update process and results are recorded and monitored so that timely backtracking and adjustments can be made when problems arise.

[0062] The simulation operation and verification module is responsible for simulating the operation process of Android applications in a completely isolated environment, observing its various behaviors in all aspects, and accurately judging whether the application has malicious tendencies: using professional sandbox technology to build a virtual environment that is isolated from the real system but has similar functions, by installing applications in the sandbox and simulating various user operations and system interactions to trigger various behaviors of the application, and using monitoring tools to fully monitor and record the application's processes, file operations, network communications and system calls in the sandbox;

[0063] By building a sandbox system on the server, configuring the required hardware resources and software environment, installing the Android application to be tested into the sandbox, simulating common user operations through scripts or manually, and using the monitoring tools in the sandbox, the application's process creation and destruction, file read and write operations, network connection requests, and system resource calls are recorded in real time. The monitored behavioral data is analyzed in detail and compared with known malicious behavior patterns and characteristics. Based on the analysis results, it is determined whether the application has malicious tendencies. If so, further in-depth research is conducted on the specific manifestations and impact range of its malicious behavior. After completing the detection, the relevant data in the sandbox is cleaned up, the sandbox environment is reset, and preparations are made for the next detection.

[0064] The code deobfuscation processing module is responsible for solving the code obfuscation problem in Android applications, restoring the obfuscated code, and providing a clear, accurate and easy-to-understand code structure for subsequent code analysis: by analyzing the patterns and rules of the obfuscated code, using deobfuscation algorithms and tools, these algorithms are based on the syntax structure, control flow and data flow characteristics of the code to identify the obfuscated parts and try to restore their original logic;

[0065] The code deobfuscation processing module receives the code to be deobfuscated, performs a preliminary scan on the code, determines the type and characteristics of the obfuscation, selects the corresponding deobfuscation algorithm according to the obfuscation type, executes the deobfuscation algorithm, gradually restores the structure and logic of the code, verifies and repairs the restored code to ensure its functional integrity and accuracy, and outputs the deobfuscated code for use by the subsequent malicious behavior analysis module.

[0066] Working principle: When the system is used, the real-time behavior monitoring service is first started through the real-time behavior monitoring submodule, and the system kernel is used to capture the application's network request, file operation, database access and other behavior data, mark the operations involving sensitive data, track the flow of marked sensitive data within the application, analyze the data flow path, query whether sensitive data flows to unauthorized destinations, and determine whether there are any anomalies. Then the dynamic behavior monitoring submodule starts the dynamic behavior monitoring service, the process monitoring tool continuously monitors the application's process creation, the file system monitoring tool tracks the application's read and write operations on files in real time, and the network traffic monitoring tool promptly captures the application's network communication data, and compares and analyzes the monitored data with the preset normal behavior pattern. Once a behavior that does not match the normal pattern is found, it is immediately marked as an anomaly and further processed, and then collected through the deep learning malicious behavior recognition submodule. Collect a large amount of Android application behavior data, mark them, distinguish normal behavior from malicious behavior, build an RNN model in the deep learning framework, configure appropriate parameters, integrate the NLP technology module with the RNN model, use the prepared data to train the model, and continuously adjust the parameters to improve the model performance. Input the behavior data of the Android application to be detected into the trained model for analysis. The feature matching submodule obtains the relevant behavior data of the Android application to be detected, uses the algorithm to compare the features of the data to be detected with the feature library, and determines whether there are known malicious behavior patterns based on the matching results. The malicious code detection submodule uses tools to perform lexical, grammatical and semantic analysis on the application code, runs the application in a simulated environment, monitors its runtime behavior, and combines the results of static and dynamic analysis to determine whether there is malicious code. After detecting malicious code, a detailed report is generated, including the code location and type;

[0067] The multi-layer protection submodule embeds behavior monitoring code or configures monitoring interfaces during the application development phase. When the application is running, it collects and analyzes behavior data in real time. If abnormal behavior is found at the application layer, the relevant information is passed to the system layer. The system layer determines whether to block the behavior based on preset rules and policies. If it is determined to be malicious or abnormal behavior, the blocking mechanism is activated to prohibit it from continuing to execute. Then the vulnerability scanning tool is configured, including setting the scanning range and selecting the vulnerability library. The vulnerability scanning task is started, and the tool begins to conduct a comprehensive scan of the target system. The tool sends various detection requests, collects the system's response and configuration information, compares the collected information with the vulnerability database, identifies possible vulnerabilities, and generates a detailed vulnerability scanning report, including the type, location and severity of the vulnerability. According to the report, relevant measures are taken. The corresponding repair measures are taken, the system is updated and patches are installed, and then the permission analysis submodule is applied to read the manifest file of the detected Android application, extract the list of permissions applied for, obtain the normal permission range of the corresponding type of application from the permission database, and compare the permissions of the detected application with the normal permission range one by one. If it is found that the applied permissions exceed the normal range, it is marked as potential malicious behavior and further analyzed. Then the data encryption detection service is started, static code analysis is performed on the detected application, encryption-related code segments are extracted, the application is dynamically monitored in a simulated running environment, data and parameters in the encryption process are obtained, and the detected encryption processing method is compared with the compliant encryption strategy and standard library. If encryption processing that does not meet the compliance requirements is found, it is marked as an exception and detailed information is recorded.

[0068] The data collection service is started through the user behavior analysis and anomaly detection submodule, and user behavior data is collected. The collected data is preprocessed and feature extracted, and the model is trained using machine learning algorithms. During the application operation, the user's current behavior data is collected in real time, and the current behavior data is input into the trained model for analysis. The behavior sequence is analyzed in real time using CEP technology, and whether it is abnormal behavior is determined based on the analysis results. Then the feedback and response submodule establishes a feedback information collection mechanism, receives information from each monitoring module, and classifies and evaluates the received feedback information. According to the preset adaptive response strategy, the impact range and severity of the malicious behavior are determined, and based on the judgment results, the self- Automatically select and execute corresponding response measures, isolate the application and notify the user, and record the results and related information of the response operation for subsequent analysis and optimization. Then establish a malicious behavior feature monitoring mechanism to continuously collect new malicious behavior data. When the new malicious behavior features reach a certain number or importance threshold, start the update process, use the online learning algorithm to fine-tune the parameters of the existing detection model according to the new data, apply the updated model parameters to the actual detection, and conduct a small-scale test verification. If the test passes, the updated model will be formally deployed, and the rule base will be updated synchronously. The update process and results will be recorded and monitored so that timely backtracking and adjustments can be made when problems arise.

[0069] Finally, by building a sandbox system on the server, configuring the required hardware resources and software environment, installing the Android application to be detected into the sandbox, simulating common user operations through scripts or manually, and using the monitoring tools in the sandbox, the application's process creation and destruction, file read and write operations, network connection requests, and system resource calls are recorded in real time. The monitored behavioral data is analyzed in detail and compared with known malicious behavior patterns and characteristics. Based on the analysis results, it is determined whether the application has malicious tendencies. If so, the specific manifestations and impact range of its malicious behavior are further studied. After the detection is completed, the relevant data in the sandbox is cleaned up, and the sandbox environment is reset to prepare for the next detection. The code deobfuscation processing module receives the code to be deobfuscated, performs a preliminary scan on the code, determines the type and characteristics of the obfuscation, selects the corresponding deobfuscation algorithm according to the obfuscation type, executes the deobfuscation algorithm, gradually restores the structure and logic of the code, verifies and repairs the restored code to ensure its functional integrity and accuracy, and outputs the deobfuscated code for use by subsequent malicious behavior analysis modules.

[0070] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for batch detecting malicious behaviors of Android applications, comprising a malicious behavior detection module, Features: The malicious behavior detection module includes a data collection and monitoring module, a malicious behavior analysis module, a system security protection module, an application permission and data processing review module, a user behavior analysis and response module, a model update and optimization module, a simulation operation and verification module and a code deobfuscation processing module; The data collection and monitoring module is responsible for comprehensively collecting various behavior data of Android applications and monitoring these behaviors in real time; The malicious behavior analysis module is responsible for conducting in-depth analysis of the collected data and identifying possible complex malicious behavior patterns; The system security protection module is responsible for building a multi-level security protection system; The application permission and data processing review module is responsible for the application to implement malicious behavior through permission abuse; The user behavior analysis and response module is responsible for recording and analyzing the user's normal usage patterns; The model update and optimization module is responsible for ensuring that the system can continuously and effectively detect new malicious behaviors; The simulation operation and verification module is responsible for simulating the operation of the Android application in an isolated environment; The code deobfuscation processing module is responsible for handling code obfuscation in Android applications.

2. A method for batch detecting malicious behaviors of Android applications according to claim 1, Features: The data collection and monitoring module includes a real-time behavior monitoring submodule and a dynamic behavior monitoring submodule. The real-time behavior monitoring submodule is responsible for real-time monitoring of the behavior of the application, including network requests, file operations and database access, timely discovering and analyzing suspicious activities, using dynamic taint analysis technology to track the flow path of sensitive data, and identify potential privacy leaks and unauthorized access. The dynamic behavior monitoring submodule is responsible for real-time monitoring of the dynamic behavior of the application at runtime, including process creation, file reading and writing, and network communication activities, and quickly detecting any abnormal conditions.

3. A method for batch detecting malicious behavior of Android applications according to claim 1, Features: The malicious behavior analysis module includes a deep learning malicious behavior identification submodule, a feature matching submodule and a malicious code detection submodule. The deep learning malicious behavior identification submodule uses a recurrent neural network (RNN) to perform in-depth pattern analysis on the collected Android application behavior data, thereby identifying complex and difficult-to-detect malicious behavior patterns. At the same time, it combines natural language processing (NLP) technology to parse the semantics of application code, further enhancing the ability to identify malicious behaviors hidden by complex technologies such as code obfuscation. The feature matching submodule is responsible for establishing a comprehensive malicious behavior feature library and quickly identifying known malicious behavior patterns through feature matching. The malicious code detection submodule uses code static analysis and dynamic analysis technology to comprehensively detect whether there are malicious code fragments in Android applications.

4. A method for batch detecting malicious behaviors of Android applications according to claim 1, Features: The system security protection module includes a multi-layer protection sub-module and a vulnerability scanning sub-module. The multi-layer protection sub-module is responsible for building a multi-level security protection system from the application layer to the system layer, realizing deep defense against malicious software, adding behavioral analysis at the application layer, and integrating an abnormal behavior blocking mechanism at the system layer. Once malicious or abnormal behavior is detected, its further execution is immediately blocked, thereby providing double security protection for the device. The vulnerability scanning sub-module is responsible for scanning and detecting common system vulnerabilities, finding common operating system vulnerabilities and application framework vulnerabilities, and discovering vulnerabilities that may be exploited by malicious applications in advance.

5. A method for batch detecting malicious behaviors of Android applications according to claim 1, Features: The application permission and data processing review module includes an application permission analysis submodule and a data encryption detection submodule. The application permission analysis submodule is responsible for conducting an in-depth and detailed review of the permissions applied for by the Android application, comparing the permission range usually required by normal applications, and determining whether the permissions applied for by the detected application are abnormal or exceed a reasonable range, so as to discover possible signs of malicious behavior. The data encryption detection submodule is responsible for checking the encryption processing method and process of the Android application on the data, determining whether it complies with relevant security specifications and compliance requirements, and preventing malicious applications from hiding malicious behavior or sensitive information through encryption means.

6. A method for batch detecting malicious behaviors of Android applications according to claim 1, Features: The user behavior analysis and response module includes a user behavior analysis and anomaly detection submodule and a feedback and response submodule. The user behavior analysis and anomaly detection submodule is responsible for recording and analyzing the user's normal usage patterns, and using machine learning algorithms to build accurate user behavior models to detect and prevent abnormal operating behaviors. At the same time, with the help of complex event processing (CEP) technology, the user's behavior sequence is analyzed in real time, so as to efficiently distinguish between normal and abnormal behavior performance. The feedback and response submodule is responsible for centrally collecting feedback information from various monitoring modules, implementing automated response actions for detected malicious behaviors, isolating related applications and sending notifications to users, and introducing adaptive response strategies to intelligently select the most appropriate response measures based on the scope and severity of the malicious behavior.

7. A method for batch detecting malicious behaviors of Android applications according to claim 1, Features: The model update and optimization module is responsible for automatically updating the detection model and rule base based on newly discovered malicious behavior characteristics, ensuring that the system always maintains a high degree of sensitivity and accurate identification capabilities to new threats.

8. A method for batch detecting malicious behaviors of Android applications according to claim 1, Features: The simulation operation and verification module is responsible for simulating the operation process of the Android application in a completely isolated environment, observing its various behavioral performances in an all-round way, so as to accurately determine whether the application has malicious tendencies.

9. A method for batch detecting malicious behaviors of Android applications according to claim 1, Features: The code deobfuscation processing module is responsible for solving the problem of code obfuscation in Android applications, restoring the obfuscated code, and providing a clear, accurate and easy-to-understand code structure for subsequent code analysis.

10. A method for batch detecting malicious behaviors of Android applications according to any one of claims 1 to 9, The following steps are involved: Step 1: The data collection and monitoring module is responsible for comprehensively collecting various behavior data of Android applications and monitoring these behaviors in real time; Step 2: The malicious behavior analysis module is responsible for in-depth analysis of the collected data to identify possible complex malicious behavior patterns; Step 3: The system security protection module is responsible for building a multi-level security protection system, which provides protection from the application layer to the system layer to prevent the intrusion and damage of malicious software; Step 4: The application permission and data processing review module is responsible for checking whether the permissions applied by the application are reasonable, and preventing the application from abusing permissions to carry out malicious behavior; Step 5: The user behavior analysis and response module is responsible for recording and analyzing the user's normal usage patterns, establishing a user behavior model, and providing corresponding feedback and processing for detected abnormal behaviors; Step 6: The model update and optimization module is responsible for automatically updating and optimizing the detection model and rule base according to the newly discovered malicious behavior characteristics and changes, ensuring that the system can continuously and effectively detect new malicious behaviors; Step 7: The simulation operation and verification module is responsible for simulating the operation of Android applications in an isolated environment, observing whether their behavior has malicious tendencies, and verifying and supplementing the detection results; Step 8: The code deobfuscation processing module is responsible for handling code obfuscation in Android applications and restoring the obfuscated code to a clear and readable form for more accurate malicious behavior analysis.

Images