关键词: Android恶意应用, 远程内联挂钩, 动态检测, 支持向量机, 特征值序列

Abstract: Aiming at the problem that the existing methods can not detect obfuscated, hidden, and encrypted Android malicious code effectively, a dynamic detection method based on a malicious application behavior feature value sequence is proposed. Firstly, the dynamic detection module is injected into the Zygote process of the Android system through the remote injection technology, and then an inline hooking technology is executed to monitor important functions in the application. The important behavior of the detected Android application is obtained through the function. Further, the behavior is quantized into characteristic values according to the characteristic, and then the behavior characteristic values are arrayed as the sequence of behavior characteristic values in chronological order. Using support vector machines to train 5, 560 malicious samples, a sequence of behavioral eigenvalues of a malicious application family is obtained. Finally, this sequence is compared with the sequence of the detected application to determine whether the application is a malicious application. The rate of correct detection in malicious applications can reach 95.1%, and only 21.9 kilobytes of memory can be used for detected applications. Experimental results show that the proposed method can detect the obfuscated, encrypted and hidden malicious code, improve the accuracy of malicious application detection, reduce the memory space, and effectively improve the detection results.

Key words: Android malware, remote inline hook, dynamic detection, support vector machine, feature sequence