基于静态分析的安卓重新打包程序检测方法研究

发布时间：2018-11-10 18:28

【摘要】：由于目前Android市场的火爆和缺乏有效监管,通过Dalvik虚拟机使Dalvik字节码完成逆向工程十分容易,Android应用程序重新打包已经成为一个非常严重的问题。通过应用程序的重新打包,可以轻易的盗取别人的代码,在应用程序中插入信息和广告,以此攫取高额的利润；更为严重的是一些流行的应用程序已经成为恶意应用程序的载体广泛流传,它严重威胁着用户的个人切身利益和整个移动互联平台的信息安全。因此,重新打包程序检测研究变得日益迫切。本文以Android重新打包程序检测方法为研究方向,探究基于静态分析的方法。以AAndroid应用程序逆向工程为基础,结合Android应用程序所包含的特征值为检测切入点,建立一个评估重新打包程序的评价体系。本文的主要贡献包括：综合考虑并选取Android应用程序的数字签名、运行权限、Dalvik可执行文件作为静态分析对比检测的依据,设计静态分析方法；实现Android平台重新打包程序检测系统；在检测系统的实现过程中解决了应用开发阶段不同编译器可能导致的静态分析过程出现误报率的问题,探究性的应用了模糊哈希相似性检验算法。据本文所设计的检测方法,检测那些根据重打包应用程序行为特征制作未加代码混淆的样本,检测出现误报率在5%以下,对来自于互联网应用程序的检测结果也有很好的效果。本文工作的重点是研究了基于静态分析的Android重新打包程序检测方法,为重新打包程序分析和对具有恶意功能的重新打包程序分析奠定了基础。
[Abstract]:Due to the popularity of the Android market and the lack of effective supervision, it is very easy to make Dalvik bytecode complete reverse engineering through the Dalvik virtual machine. Repackaging of Android applications has become a very serious problem. Through the repackaging of the application, you can easily steal other people's code, insert information and advertising in the application, so as to capture the high profits; More serious is that some popular applications have become the carrier of malicious applications, which seriously threaten the personal interests of users and the information security of the entire mobile platform. Therefore, the research of repackage detection becomes more and more urgent. In this paper, the Android repackage testing method is used as the research direction, and the static analysis based method is explored. Based on reverse engineering of AAndroid application and the characteristic value of Android application, an evaluation system of repackaging program is established. The main contributions of this paper include: synthetically considering and selecting the digital signature of Android application, running permission, Dalvik executable file as the basis of static analysis contrast detection, designing static analysis method; Implementation of Android platform repackage program detection system; In the implementation of the detection system, the problem of false alarm rate in the static analysis process caused by different compilers in the application development stage is solved, and the fuzzy hash similarity checking algorithm is applied inquiringly. According to the detection method designed in this paper, those samples that are not confused by code are detected according to the behavior characteristics of repackaged application, and the false positive rate is less than 5%. Detection results from Internet applications also have good results. The emphasis of this paper is to study the detection method of Android repackaging program based on static analysis, which lays a foundation for the analysis of repackage program and the analysis of repackage program with malicious function.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP311.53;TP309

【相似文献】