基于动态检测的Android平台应用程序行为分析研究与实现

发布时间：2018-07-21 17:29

【摘要】：随着这几年移动互联网的快速发展,智能手机的快速普及,尤其是Android平台的智能手机市场占有率逐年递增。由于Android平台自身特性和市场特性,也使得目前在Android平台上软件的恶意行为给用户带来巨大损失。因此,Android平台软件行为研究是大势所趋。针对PC和WEB的软件行为研究已经日益成熟,而Android平台较PC端在软件、硬件方面都存在差异,因此,Android平台软件行为相关研究有必要进行专门研究。目前,针对软件行为相关研究,国内外已进行了大量工作。有基于特征代码的检测、基于行为检测的方法。基于行为检测的方法根据是否运行应用程序又可分为静态检测和动态检测。静态检测方式原理简单,识别方式较为简单,有很多弊端。因此,主要研究动态检测,在动态检测的研究中,可以分为应用级检测和系统级检测。传统应用级检测没有考虑到系统环境因素,也会面临一部分特征代码检测遇到的问题。而传统系统级检测多数情况下会对系统内核进行更改,使系统不稳定,并且大部分研究都是分析既定规则没有对评判规则进行机器学习、参数优化的过程。因此,本文要做的是从动态检测着手,对系统运行时的环境数据进行挖掘,在不破坏Android系统内核层的稳定性前提下,找出系统环境数据背后隐藏的应用程序行为,并使得监测模型随着不断检测可以实现自我修正,逐渐提高识别准确率。论文主要进行了以下工作:1)定义不同软件行为,对其采样大量的系统环境数据,进行聚类量化,生成单一属性数据的特征序列集合。2)对多个维度属性特征数据进行编码,生成系统环境数据特征综合起来的时间序列。3)对不同软件行为下的编码序列的码元出现的频率进行统计,以此作为隐马尔科夫模型建模的初始发射矩阵来进行隐马尔科夫模型建模。4)对系统环境数据的特征序列,使用建立好的隐马尔可夫模型对后续行为产生的系统环境数据进行隐马尔科夫估值计算,从而实现对后续行为的识别,同时在后续识别过程中不断优化模型。5)通过实验对比的方式验证该方法具有一定有效性。通过对系统环境数据的综合分析建立隐马尔科夫模型进行软件行为识别的方式比传统方式有一定优越性,也为Android平台软件安全性研究提供基础研究。
[Abstract]:With the rapid development of mobile Internet in recent years, the rapid popularity of smart phones, especially the Android platform's smartphone market share has increased year by year. Because of its own characteristics and market characteristics of the Android platform, the malicious behavior of the software on the Android platform has brought huge losses to the users. Therefore, the Android platform software line The research is the trend of the situation. The research of software behavior for PC and WEB has become more mature, and the Android platform is different from the software and hardware. Therefore, the research on the behavior related to the Android platform software is necessary. At present, a lot of work has been carried out at home and abroad for the research on software behavior. The method of behavior detection based on behavior detection. The method based on behavior detection can be divided into static detection and dynamic detection based on whether the application program is running or not. The principle of static detection is simple, the recognition method is simple and there are many disadvantages. Therefore, the main research of dynamic detection can be divided into application level in the research of dynamic detection. Detection and system level detection. The traditional application level detection does not take into account the system environment factors, but also faces some characteristic code detection problems. While the traditional system level detection will change the system kernel in most cases, make the system unstable, and most of the research is the analysis of the established rules that do not carry out the evaluation rules. The process of learning and parameter optimization, therefore, this article is to start from dynamic detection, mining the environment data of the system running, without destroying the stability of the Android kernel layer, to find out the hidden application behavior behind the system environment data, and make the monitoring model self repair with constant detection. In this paper, the recognition accuracy is gradually improved. The main work of this paper is as follows: 1) defining different software behavior, sampling a large number of system environment data, clustering and quantifying, generating the feature sequence set.2 of single attribute data. Sequence.3) the frequency of encoding sequence in different software behavior is counted, as the initial emission matrix of the hidden Markoff model to model the implicit Markoff model to model.4) the characteristic sequence of the system environmental data, and the system environment number produced by the established hidden Markov model for the subsequent behavior is used. According to the calculation of hidden Markov estimation, the recognition of follow-up behavior is realized, and the model.5 is continuously optimized in the follow-up identification process. The method is proved to be effective through experimental comparison. By the comprehensive analysis of the system environmental data, the hidden Marco model is established to carry out the way of software behavior recognition. The unified method has some advantages, and also provides a basic research for the software security research of Android platform.
【学位授予单位】：昆明理工大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP316;TP311.5

【参考文献】