Malicious code detection method, system and mobile terminal under Android system

Abstract

The invention discloses a method and system for malicious code detection based on a virtual technology in an Android system. The method comprises the steps that at first, executable files in the Android system are recognized and analyzed; machine instructions of each executable file are split; the virtual technology is used to simulate execution of the machine instructions and simulate a physical environment required during running of the instructions; possible system calling and API calling are also simulated; sensitive information generated during the simulated execution and the simulated calling is monitored and recorded; and finally the sensitive information is matched with matched characteristics in a rule base, and whether an executable file containing a malicious code exists is determined. The method and the system disclosed by the invention make up deficiencies in existing technologies aiming at malicious code static detection in the Android system and conduct deep detection of the malicious codes in the Android system.

Description

[0001] Cross References to Related Applications [0002] This application requires the Chinese patent application number "201510889821.X" submitted by Wuhan Antiy Information Technology Co., Ltd. on December 08, 2015, the title of the invention is "Virtual Technology-Based Malicious Code Detection Method and System under Android System" priority. technical field [0003] The present invention relates to the technical field of malicious code monitoring, in particular to a method and system for detecting malicious codes under the Android system. Background technique [0004] Malicious codes under the current Android system show a more complex development trend. It uses more complex obfuscation and encryption methods, and the encryption algorithm usually uses a custom algorithm, which brings great challenges to the static detection of malicious codes. Malicious codes will Sensitive character strings, execution codes, and execution module files are encrypted, so that existing s...

AI Technical Summary

Problems solved by technology

[0004] Malicious codes under the current Android system show a more complex development trend. It uses more complex obfuscation and encryption methods, and the encryption algorithm usually uses a custom algorithm, which brings great challenges to the static detection of malicious codes. Malicious codes will Sensitive strings, execution codes, and execution module files are encrypted, so that the existing static detection schemes cannot effectively detect them intelligently

Images