Malware detection method and malware detection system of mobile operating system

Abstract

The invention provides a malware detection method of a mobile android operating system. The method includes the sensitive calling sequence generation step and the detection step, wherein in the sensitive calling sequence generation step, code analysis is performed on software for at least one entry function in software, and a sensitive system calling sequence is generated; in the detection step, the sensitive system calling sequence is matched according to a predefined malware feature library, and a malware detection result is obtained. According to the characteristic that current malware is achieved mainly depending on system calling, system calling used by the malware is effectively detected, thus, the problem existing in the detection technology in the prior art can be effectively solved, the essential behavior of the malware can be detected, and the detection efficiency of the malware is improved.

Description

technical field [0001] The invention relates to the field of mobile Internet security, in particular to a malware detection method and system for a mobile operating system. Background technique [0002] In recent years, the open source smart mobile operating system represented by Android (Android) has been widely used. At the same time, various malicious software attacks have appeared along with powerful smart mobile terminals. At present, there are thousands of malicious software targeting Android mobile terminals on the Internet, which mainly involve spam text messages, malicious chargebacks, stealing users' personal information, and many other aspects. Although in terms of the degree of harm and the scope of influence, the malware targeting Android mobile terminals cannot compare with the security risks of personal computers, but from the perspective of development, the promotion and popularization of mobile terminals in the social field will further deepen and expand. T...

AI Technical Summary

Problems solved by technology

This technology essentially belongs to the static detection of software. Its shortcoming is that when the malware is deformed or mixed with other components, the matching of feature values ​​will be greatly affected; in addition, feature scanning requires a real-time malicious code feature library support, mobile terminals need to consume a large amount of communication traffic to download the latest feature database data

This technology has a high detection rate for malware, and is especially suitable for polymorphic and deformed malware. However, due to the multi-branch characteristics in the software execution process, the virtual machine technology can only check the existence of malicious code in a part of the software process. No, it is not possible to detect malicious codes in the entire process of the software

Images