Android malicious code detection device and method based on dynamic activation and behavior monitoring

Abstract

Disclosed is an android malicious code detection device and method based on dynamic activation and behavior monitoring. According to the device, behaviors of a cellphone terminal automatically installing and starting an application to be detected and automatically activating the application are controlled; meanwhile, during the whole running process of the application, information of the cellphone terminal, such as file access, short message sending, network connection, traffic, system resource usage and hardware resource access, is monitored in real time, malicious behaviors of malicious codes are detected, a detection report is generated and provided for a user, and behaviors of the application under detection are dynamically detected. The device comprises an application behavior dynamic activation module, an application behavior real-time monitoring module and a detection result analysis module. The device and the method have the innovative advantages that all control and interface operations are achieved for the application by a software interaction technology, all application behaviors are dynamically activated, all-function automatic monitoring and detection is achieved for the application on the premise of finishing self-functions, and detection can be comprehensive and complete.

Description

technical field [0001] The present invention relates to a detection technology of malicious behaviors of Android applications. Specifically, it relates to an Android malicious code detection device and method based on dynamic activation and behavior monitoring, and belongs to the technical field of application security in information security. Background technique [0002] At present, the detection and analysis technology for Android malicious applications has been studied for many years at home and abroad. Common detection tools include: DroidRange, TaintDroid and AppInspector, etc. The following are brief introductions to these tools: [0003] DroidRanger summarizes the behavior characteristics of ten known Android malware and two heuristic rules to detect unknown applications. This method can quickly detect known malicious behaviors, but it mostly uses manual analysis for new applications, so there is a certain lag in the detection results. [0004] TaintDroid is a syste...

AI Technical Summary

Problems solved by technology

There are also many possible security threats in Android applications (including automatic networking in the background, automatic sending and receiving of text messages, and access to user privacy files, etc.), which seriously damage the interests of users

Images