基于逆向工程的Android特征库提取研究

发布时间：2018-12-13 12:15

【摘要】：随着智能手机的快速普及,智能手机恶意APP的数量与日俱增。恶意行为代码的二次复用开发、恶意APP的自动生成技术使得具有恶意行为的APP开发效率大大提高,恶意程序的数量急剧上升,现有的恶意行为特征库分类繁杂、良莠不齐,不利于对恶意APP进行恶意行为分析。一个全面、稳定、可扩展的恶意行为特征库,能有效地提高对恶意行为软件的检测精度,有利于分析恶意行为的不断演化的特征。文中基于APP逆向工程研究提出了一个基于文本挖掘以及信息检索的恶意特征库构建方法,并通过构建恶意行为演化关系树对恶意行为簇之间的演化关系进行了分析,经过实验验证本文提出的构建恶意行为特征库方法对静态分析恶意应用提供了可靠的基础,提高了恶意行为检测精度。
[Abstract]:With the rapid spread of smartphones, the number of malicious APP is increasing. The secondary reuse of malicious code and the automatic generation of malicious APP greatly improve the efficiency of APP development with malicious behavior, and the number of malicious programs increases sharply. It is not conducive to malicious behavior analysis of malicious APP. A comprehensive, stable and extensible signature library of malicious acts can effectively improve the detection accuracy of malicious acts software and help to analyze the evolving characteristics of malicious acts. In this paper, a method of constructing malicious signature library based on text mining and information retrieval is proposed based on APP reverse engineering. Experimental results show that the proposed method provides a reliable basis for static analysis of malicious applications and improves the accuracy of malicious behavior detection.
【作者单位】：天津市公安局网监总队;哈尔滨工程大学计算机科学与技术学院;黑龙江省电子信息产品监督检验院;
【分类号】：TP393

【相似文献】