Detection method for mobile phone worms

Abstract

The invention provides a detection method for mobile phone worms which have the characteristic of being disseminated through a URL (Uniform Resource Locator)-contained short message. The detection method comprises the following steps of: extracting related information of the URL-contained message of a mobile phone; putting the related information in a queue for analyzing; and if an addresser sends the short message to a plurality of users and the short message is automatically forwarded, marking that a corresponding URL link comprises suspicious worm samples. The detection method is operated on a short message gateway and can effectively prevent the dissemination of the worms by URL-contained messages.

Description

technical field [0001] The invention belongs to the field of mobile Internet security, in particular to a method for detecting worms in mobile terminals and smart phones. Background technique [0002] With the development of mobile Internet technology, the number and performance of smart phones have increased, and more mobile phone applications have come along with it. At the same time, mobile phone manufacturers have provided mobile phone platform development interfaces. This provided the basis for the development of mobile phone worms. Mobile phone worms are more and more harmful to users. For example, the "Mobile Phone Skeleton" outbreak in February 2010 infected more than 100,000 smart phones, causing direct economic losses of more than 20 million yuan. Another example is that in June 2010, millions of users became the "broilers" of the "botnet" of mobile phone worms. Mobile phone worms have expanded from the initial system damage and malicious deduction to privacy the...

AI Technical Summary

Problems solved by technology

[0005] Most of the existing technologies for detecting mobile phone worms are aimed at worms that exploit mobile phone vulnerabilities to attack mobile phones. The signature library is built by extracting the signature codes of mobile phone worms. Although these technologies can successfully detect known attacks, the attackers slightly change the signatures. , it can bypass the matching detection of the feature code, and the detection effect on unknown mobile phone worms is not obvious

And generally these mobile phone anti-virus software run on the mobile phone to consume resources, and the mobile phone generally has the disadvantage of limited battery, so the actual effect is not obvious

Ordinary users are not likely to use these anti-virus software at the cost of wasting battery to ensure the security of mobile phones, and they cannot solve the security problems caused by the above-mentioned worms transmitted by short messages containing URLs.

Images