WO2014048195A1

WO2014048195A1 - Android software malicious behavior detection method, system and device

Info

Publication number: WO2014048195A1
Application number: PCT/CN2013/082163
Authority: WO
Inventors: 巫妍; 程绍银; 蒋凡
Original assignee: 中兴通讯股份有限公司; 中国科学技术大学
Priority date: 2012-09-29
Filing date: 2013-08-23
Publication date: 2014-04-03
Also published as: CN102945347A; CN102945347B

Abstract

Disclosed in an embodiment of the present invention are an Android software malicious behavior detection method, system and device, the method comprising: simulating the execution of to-be-detected software; matching the sensitive characteristic information and malicious characteristic information of a function invoked by the to-be-detected software with pre-stored sensitive characteristic information and malicious characteristic information; if the matching succeeds, then determining the function invoking as a malicious behavior. The technical solution in the embodiment of the present invention avoids the problem of being unable to determine whether the to-be-detected software is malicious software due to the detection lag phase and the complicated conditions for triggering malicious behaviors of malicious software in the relevant art.

Description

Method, system and device for detecting malicious behavior of Android software

The present invention relates to communication technologies, and in particular, to a method, system and device for detecting malicious behavior of Android software. Background technique

At present, mobile terminals generally adopt Android system, but the software distribution channels of Android system are diverse and lack effective supervision. Users are easy to install malware, resulting in malicious consumption of user fees and malicious deletion of personal information, which affects user experience.

The detection methods of malware in the related art include: detecting by means of virus killing; dynamic real-time monitoring software running and interacting with an external environment to determine whether the software is malware.

The above method for detecting malware by means of virus detection and killing depends on the virus signature, and the newly released software needs to manually analyze the virus signature, so the detection result has a certain lag period; and the dynamic real-time detection method depends on For a specific trigger condition, if the malicious behavior hidden in the software triggers a complicated condition, it may not be detected for a long time whether the software is malware. Summary of the invention

In view of this, the embodiments of the present invention provide a method, a system, and a device for detecting malicious behavior of an Android software, which can determine whether a malicious behavior is hidden in the software to be detected without a virus signature, and is not subject to software malicious behavior. limits.

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows:

An embodiment of the present invention provides a method for detecting malicious behavior of an Android software, where the method includes: Simulating execution of the software to be detected, and identifying, as a sensitive behavior, a behavior of a function that matches the sensitive feature information of the software to be detected and the pre-stored sensitive feature information;

The sensitive behavior of the malicious feature information of the called function in the sensitive behavior and the pre-saved malicious feature information is identified as a malicious behavior.

Preferably, the sensitive feature information includes: a function name, a function class name, a function parameter type, and a function parameter number;

The malicious feature information includes: a function name, a function parameter constant value.

Preferably, before the performing the software to be detected, the method further includes:

The bytecode file in the installation package of the detection software is disassembled, and the program structure is constructed and the program execution path is solved according to the disassembled program code.

Preferably, the method further includes:

The instructions in the program execution path are analyzed, and when the instruction introduces an instruction into a constant value, the introduced constant value is recorded and the constant value is propagated downward in the program execution path.

Preferably, the method further includes:

The risk level of the malicious behavior is determined according to the function name and the function parameter constant value of the called function in the malicious behavior, and the mapping relationship between the pre-stored function name, the function parameter constant value and the danger level.

Preferably, after the simulation execution of the software to be detected is completed, the method further includes:

The detection result is generated according to the dangerous level of the malicious behavior, and the detection result is reported to the user through a user interface (UI, User Interface).

The embodiment of the present invention further provides a server, where the server includes an analog execution unit, a detection rule storage unit, an identification unit, and a matching unit;

The simulation execution unit is configured to simulate execution of software to be detected;

The detection rule storage unit is configured to store sensitive feature information and malicious feature information; and the matching unit is configured to: when the analog execution unit calls a function, the called The sensitive feature information of the function is matched with the sensitive feature information in the detecting rule storage unit; the malicious feature information of the called function is matched with the malicious feature information in the detecting rule storage unit, and the called function is the identity unit identifier The called function is configured to: when the matching unit matches the sensitive feature information, the behavior of the function that successfully matches the sensitive feature information is identified as a sensitive behavior; When the malicious feature information is successful, the sensitive behavior that matches the successful matching of the malicious feature information is identified as a malicious behavior.

Preferably, the server further includes:

The program structure construction unit is configured to construct a program structure according to the program code after the preprocessing unit disassembles the program code according to the bytecode file;

The program execution path solving unit is configured to solve a program execution path according to the program structure after the program structure building unit constructs a program structure.

Preferably, the simulation execution unit is further configured to execute a program execution path solved by the path solving unit according to the program, and sequentially analyze an instruction in the program execution path;

The server further includes: a constant value analyzing unit configured to: when the analog execution unit analyzes that the instruction in the program execution path is a constant value import instruction, record the introduced constant value and lower the constant value in the program execution path propagation.

Preferably, the server further includes:

a hazard rating unit configured to calculate a function name and a function parameter constant value according to the called function in the malicious behavior, and a pre-saved function name, a function parameter constant value, and a danger level The mapping relationship determines the risk level of the malicious behavior.

Preferably, the server further includes: a detection result saving unit and a malicious behavior reporting unit; wherein

The risk rating unit is further configured to generate a detection result according to a malicious behavior risk level;

The detection result saving unit is configured to save the detection result generated by the risk rating unit;

The malicious behavior reporting unit is configured to report the detection result saved by the detection result saving unit to the user through the client UI after the simulation execution unit simulates executing the software to be detected.

The embodiment of the present invention further provides an Android software malicious behavior detecting system, where the system includes: a client and a server;

The client is configured to enable the user to upload an installation package of the software to be tested to the server through the UI running on the client; receive the detection result sent by the server, and report the user through the UI;

The server is configured to identify, as a sensitive behavior, a behavior of a function that matches the sensitive feature information to be detected and the pre-stored sensitive feature information; and the malicious feature information of the called function in the sensitive behavior is The sensitive behavior of the saved malicious feature information is identified as malicious behavior.

Preferably, the server includes a simulation execution unit, a detection rule storage unit, an identification unit, and a matching unit; the server further includes: a preprocessing unit, a program structure construction unit, a program execution path solving unit, and a constant value analysis unit; The server further includes: a hazard rating unit, a detection result saving unit, and a malicious behavior reporting unit; each unit function is the same as described above.

In the technical solution provided by the embodiment of the present invention, the sensitive feature information of the software calling function to be detected and the sensitive feature stored by the server are simulated by executing all the instructions in the software to be detected. The information is matched. When the function call is determined to be a sensitive behavior, the malicious feature information of the called function in the sensitive behavior is further matched with the malicious feature information stored by the server. If the matching is successful, the software to be detected is determined to be malware. In this way, when detecting the software to be tested, there is no need to use the virus signature, and there is no problem that the detection result has a lag period; no limitation of the condition of the malicious behavior of the software to be detected is complicated, and the malicious behavior detection of the software can be performed accurately and timely. . DRAWINGS

1 is a schematic flowchart of a method for detecting malicious behavior of an Android software according to an embodiment of the present invention; FIG. 2 is a schematic structural diagram of a malicious behavior detection system for an Android software according to an embodiment of the present invention; FIG. 3 is a schematic diagram of detecting malicious behavior of an Android software according to an embodiment of the present invention; Schematic diagram of the process. detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

FIG. 1 is a schematic flowchart of an implementation method for detecting malicious behavior of an Android software according to an embodiment of the present invention. As shown in FIG. 1 , the method includes the following steps:

Step 101: Simulate execution of the software to be detected, and identify the behavior of the function that matches the sensitive feature information of the software to be detected and the pre-stored sensitive feature information as a sensitive behavior.

The sensitive feature information includes: a function name, a function class name, a function parameter type, and a function parameter number, and a function can be uniquely determined by a function name, a function class name, a function parameter number, and a function parameter type.

The server locally stores the sensitive feature information of the dangerous function, and the dangerous function is a library function that is invoked when the malicious behavior in the software to be detected is implemented.

The malicious behavior in the software to be detected includes: sending a fixed content short message to a fixed number, and ordering a server provider (SP, Service Provider) service without consuming the user to consume the user fee; opening a fixed unified resource Locator (URL, Universal Resource Locator) to consume user fees; execute fixed system commands to modify or delete user files. The above malicious behavior needs to be implemented by calling a dangerous function and introducing a certain number of values of a type constant to the parameters of the dangerous function, the fixed content short message, fixed number, fixed URL and fixed system command in the software code to be detected. A parameter that introduces a dangerous function as a constant of a fixed string or an immediate value. In this way, in the process of simulating execution of the software to be detected, if the sensitive feature information of the software calling function to be detected matches the sensitive feature information of a dangerous function saved locally by the server, the function call is identified as a sensitive behavior for further detection. Determine if the function call is malicious.

In a preferred embodiment, the installation package of the software to be detected may be obtained by the user uploading the installation package of the software to be detected after the user uploads the file, and disassembling the bytecode file in the installation package. And build the program structure and solve the program execution path according to the disassembled program code.

The installation package format is an installation package based on the APK format of the Android system, and the unpacking tool is run on the server to operate the installation package, and a bytecode file in the dex format is obtained, and the byte in the dex format is obtained. The code file is an executable file on the Dalvik virtual machine, and the Dalvik virtual machine is an application environment for running software in the Android system.

In a preferred embodiment of constructing a program structure according to the disassembled program code in the embodiment of the present invention, the disassembly tool is run to disassemble the bytecode file, according to the disassembled The program code analyzes program structure information by using a script, and the program structure information includes: an instruction structure, a basic block structure, a function structure, a class structure, a function call graph, a control flow graph, and a fixed string table. The script structure is used to analyze the program structure information and is not related to the technical domain of the disassembly tool; the instruction structure includes the address, operation code and operand of the instruction; the basic block structure includes the basic block number and the first address. , a tail address, a function, an instruction in a block; the function structure includes a function first address, a function name, and all basic blocks within the function; the class structure includes a class name, a property list, and a function list; The table holds a fixed string that appears in the program information. The program execution path is an instruction execution sequence for running all the instructions in the disassembled program code. In a preferred embodiment of the solution execution path of the embodiment of the present invention, according to the control flow graph, the instruction structure, and the basic block Structure, function structure and class structure, starting from the entry function of the disassembled program code, analyzing the instruction execution sequence of the current function, the above analysis operation adopts the graph traversal algorithm, so that for the branch instruction in the function, each guarantee can be guaranteed The branch block is executed at least once; for the loop body in the function, the instruction of the loop body part is guaranteed to be executed at least once;

According to the function call graph, the instruction structure, the basic block structure, the function structure and the class structure, the function called by each function call point in the current function is analyzed, and the connection relationship between the current function and the called function is established to analyze the The instruction execution sequence of the calling function; when the function called by the function call point is a thread start function, a virtual function or an interface function, the following processing is also required:

(1) If the current function call point is a thread start function call, find the run function in the class as the actually called function according to the class name of the parameter at the time of thread initialization;

(2) If the current function call point is a virtual function or an interface function, the function of the same name in the class is searched for as the actual called function according to the class name of the this actual parameter in the current function.

In a preferred embodiment of the simulation execution software to be detected in the embodiment of the present invention, the instruction in the program execution path is analyzed, and when the instruction is a constant value introduction instruction, the introduced constant value is recorded and the constant value is executed in the program. Propagating down the path; the constants include immediate and fixed strings;

When the instruction in the program execution path is a constant value to introduce an instruction, if the constant value introduction instruction introduces a constant value in the form of an immediate value, the value of the immediate value directly introduced is recorded, and the corresponding variable in the program execution path is marked as a constant state. If the constant value import instruction introduces a constant value in the form of a fixed string, the fixed string table is searched for the fixed string table to obtain the value of the fixed string, the value of the introduced fixed string is recorded, and the program is executed. The corresponding variable in the path is marked as a constant state; When the instruction is an instruction for a constant value containing a operand for a variable, according to the semantic information of the current instruction, the corresponding variable is marked as a constant state in the program execution path, and the introduced constant value is recorded;

When the instruction introduces a constant value in the form of a function return instruction, and the function returns a constant value returned by the instruction to affect the actual parameter variable, the corresponding actual parameter variable is marked as a constant state in the program execution path, and the record is introduced into the real The constant value of the argument.

Step 102: Identify, as a malicious behavior, a sensitive behavior that matches the malicious feature information of the called function in the sensitive behavior with the pre-stored malicious feature information.

The malicious feature information includes: a function name, and a function parameter constant value.

In step 101, in the process of simulating execution of the software to be detected, if the sensitive feature information of the function called by the software to be detected matches the sensitive feature information of a dangerous function saved locally by the server, it is determined that the function call meets the preliminary behavior of the malicious behavior. Feature, ie: sending a fixed content SMS to a fixed number, opening a fixed URL or executing a fixed system command, and the fixed content SMS, fixed number, fixed URL and fixed system commands introduce dangerous function parameters in the form of constant values To implement sensitive behavior.

In a preferred embodiment, the malicious feature information of the function called in the sensitive behavior that has been identified in the software to be detected is matched with the malicious feature information of the pre-stored dangerous function to further determine the Whether the sensitive behavior is malicious, that is, sending a fixed content SMS to a fixed number, whether to order a service to the SP to consume the user fee; opening a fixed URL, whether to open the network IP (Internet Protocol, Internet Protocol) address To cause the consumption of user fees; execute a fixed system command, whether it causes loss to the user's files. If yes, the function call is identified as a malicious behavior, and the software to be detected is determined to be malware.

In a preferred embodiment, the risk level of the malicious behavior is also assessed, and the detection result is generated according to the risk level of the malicious behavior. After the simulation execution of the software to be detected is completed, the detection result is passed through the client UI (User Interface, user). Interface) report users to make users Understand the relevant information of the malware; the detection results include: the dangerous level of malicious behavior, the function name and class name of the dangerous function in the malicious behavior, the function name of the function of the malicious behavior, the malicious behavior type and the malicious behavior description.

In a preferred embodiment of the risk rating of the malicious behavior of the server according to the embodiment of the present invention, the function name and the function parameter constant value of the malicious behavior calling function are respectively matched with the locally pre-stored evaluation rule to determine the danger level, wherein The rating rule describes a hazard level corresponding to a different function and its function parameter constant value, the hazard level being determined according to the degree of loss to the user, for example, the hazard level of the malicious act of ordering multiple SP services to consume the user fee is more than The level of danger of malicious behavior that orders an SP service to consume user fees is high.

2 is a schematic structural diagram of a malicious software behavior detection system for an Android software according to an embodiment of the present invention. As shown in FIG. 2, the system includes: a server 21 and a client 22:

The server 21 is configured to identify, as a sensitive behavior, a behavior of a function that matches the to-be-detected software call sensitive feature information and the pre-stored sensitive feature information; and the malicious feature information of the called function in the sensitive behavior is pre-saved The sensitive behavior of the malicious feature information matching, identified as malicious behavior;

The client 22 is configured to enable the user to upload an installation package of the software to be detected to the server 21 through the UI running on the client 22; receive the detection report sent by the server 21, and report the user through the UI.

Preferably, the server 21 includes: an emulation execution unit 2101, a detection rule storage unit 2102, a matching unit 2103, and an identification unit 2104;

The simulation execution unit 2101 is configured to simulate executing the software to be detected;

The detection rule storage unit 2102 is configured to store the sensitive feature information and the malicious feature information. The matching unit 2103 is configured to simulate the sensitive function information of the called function and the sensitivity in the detection rule storage unit 2102 when the simulation execution unit 2101 calls the function. The feature information is matched; the malicious feature information of the called function is matched with the malicious feature information in the detection rule storage unit, and the called function is adjusted in the sensitive behavior identified by the identity unit 2104 Use a function;

The identifier unit 2104 is configured to identify, when the matching unit 2103 matches the sensitive feature information, the behavior of the function that successfully matches the sensitive feature information is a sensitive behavior; when the matching unit 2103 matches the malicious feature information successfully, the malicious feature information is matched. Successful sensitive behavior is identified as malicious.

Preferably, the server 21 further includes: a preprocessing unit 2105, a program structure building unit 2106, a program execution path solving unit 2107, and a constant value analyzing unit 2108;

The pre-processing unit 2105 is configured to receive an installation package of the software to be detected uploaded by the user through the client 22, and disassemble the bytecode file in the installation package;

The program structure construction unit 2106 is configured to construct a program structure according to the program code after the pre-processing unit 2105 disassembles the program code according to the bytecode file;

The program execution path solving unit 2107 is configured to solve the program execution path according to the program structure after the program structure building unit 2106 constructs the program structure.

Preferably, the simulation execution unit 2101 is further configured to execute the program execution path solved by the path execution unit 2107 according to the program, and sequentially analyze the instructions in the program execution path;

The server 21 also includes a constant value analysis unit 2108 configured to record the introduced constant value and propagate the constant value down in the program execution path when the analog execution unit 2101 analyzes that the instruction in the program execution path is a constant value introduction instruction.

Preferably, the server 21 further includes: a risk rating unit 2109 configured to calculate a function name and a function parameter constant value of the called function according to the malicious behavior, and a mapping relationship between the pre-saved function name, the function parameter constant value, and the danger level. , determining the level of danger of the malicious act. Preferably, the server 21 further includes: a detection result holding unit 2110 and a malicious behavior reporting unit 2111; wherein

The hazard rating unit 2109 is further configured to generate a detection result according to the risk level of the malicious behavior;

The detection result saving unit 2110 is configured to save the detection result generated by the risk rating unit 2109;

The malicious behavior reporting unit 2111 is configured to report the detection result saved by the detection result holding unit 2110 to the user through the client 22 UI after the simulation execution unit 2101 simulates execution of the software to be detected.

In practical applications, the simulation execution unit 2101, the matching unit 2103, the identification unit 2104, the pre-processing unit 2105, the program structure construction unit 2106, the program execution path solving unit 2107, the constant value analysis unit 2108, the risk rating unit 2109, and the malicious The behavior reporting unit 2111 can be implemented by a central processing unit (CPU) in a server 21, a digital signal processor (DSP), or a Field Programmable Gate Array (FPGA).

The detection rule storage unit 2102 and the detection result holding unit 2110 may each be implemented by a memory in the server 21, and the detection rule storage unit 2102 and the detection result holding unit 2110 may be implemented by the same memory in the server 21 or by a server. Different memory implementations in 21.

FIG. 3 is a schematic diagram of an implementation process for detecting malicious behavior of an Android software according to an embodiment of the present invention. The following is an example of the hippoSMS to be detected, as shown in FIG. 3, including the following steps:

Step 301: The server receives the software to be detected uploaded by the client, and performs preprocessing.

In this step, the user uploads the installation package hippoSMS.apk corresponding to the to-be-detected software hippoSMS to the server through the client UI, and the server decompresses the installation package by using the decompression software, and extracts the bytecode file in the installation package, and the suffix is dex. And run the disassembly tool on the bytecode file Disassemble and output the program code.

The decompression software may adopt WINRAR or APKTOOL, and the disassembly tool may adopt IDA pro (Interactive Disassembler Professional).

Step 302: The server builds the program structure and solves the program execution path according to the disassembled program code.

In this step, the server constructs a program structure according to the disassembled program code, and the program structure includes: an instruction structure, a basic block structure, a function structure, a class structure, a function call graph, a control flow graph, and a string table; and according to the above program Structure, solver execution path.

In this step, if the program execution path is solved for the following code segment 1,

Code segment 1

1 : new-instance v0, < t: Thread >

2: new-instance vl, < t: Download$myThread >

3 : invoke-direct { vl, this } , < void Downloads myThread. < init > ( ref ) >

4: invoke-direct { vO, vl }, <void Thread. < init > ( ref ) > 5: invoke-virtual < vO > , <void Thread, start ( ) >

Then the server performs the following processing:

Analysis of the instruction in the first line of the code segment defines a thread class, at this time the class name of the vO is marked as Thread;

It is analyzed that the instruction in the second line defines a user-defined class, and the class name of vl is marked as Download$myThread;

Analyze that the instruction in the third line is a function call instruction, and the called function is not a thread start function, a virtual function or an interface function, and directly finds the called function according to the function call graph to establish a connection relationship between the current function and the function. , and enter the called function to execute the program Path solving operation;

Analyze that the instruction in the fourth line is a system function call instruction, and the function is a thread initialization function. The class name of the initialization parameter is Download$myThread, and the vl object is bound to the νθ object, and the class name of the νθ object is marked as The class name of the vl object is Download$myThread, and continue to look down the run function in Downloads myThread;

The instruction in the fifth line of code is the thread start function call instruction, and the class name of the νθ parameter is Downloads myThread. At this point, the run function in Downloads myThread will continue to be searched, and the name of the called function will be changed from Thread.start to Download$myThread. .run, and solve the program execution path for the function Do wnload$myThread.run.

Step 303: The server analyzes the instructions in the execution path, and when the instruction introduces an instruction into a constant value, records the introduced constant value and propagates the constant value downward in the program execution path.

If the instruction in the program execution path is the following code segment 2,

Code segment 2

1 : const-string v7, a8

2: const-string v6, al 066156686

3: const-string v5, aData O

4: const-string v4, empty str

5: invoke—virtual { this, v6, v7, this }, < void MessageService.send sms<ref, ref, ref, ref>

Then the server performs the following processing:

It is analyzed that the first line instruction is a constant value introduction instruction, and v7 is defined as a string constant a8, a8 is a fixed string, then the instruction introduces a constant value in the form of a string, and queries in a fixed string table by using a8 as an index. Fixed the value of the string a8, the value of 8, then mark the v7 variable as a constant state, and record the value of V7 as 8;

Analyze that the second line to the fourth line of instructions are constant value introduction instructions, and are in the form of strings Introduce a constant value, query the value of the corresponding string in the fixed string table with v6, v5, and v4 as indexes, mark v6, v5, and v4 as constant states, and record the value of the corresponding string, where v6 The value is 1066156686, the value of v5 is data, and the value of v4 is an empty string. If the instruction of the 5th line is a function call instruction, the values of the argument variables this, v6, v7, v4, and this are passed to the Call the function MessageService.sendsms, and initialize the corresponding parameters of the function Messa geService.sendsms to the values of this, p0, pl, p2 and p3 to the value of the argument passed to the called function, further to the function MessageService.sendsms The instructions are analyzed.

If the command in the function MessageService.sendsms is shown in the following code segment 3, code segment 3

1 : const/4 v2, 0

2: move_ object vl, ρθ

3: move_ object v3, pi

4: invoke-virtual/range { v0..v5 } , < void SmsManager. sendTextMes sage ( ref, ref, ref, ref, ref ) >

Then the server performs the following processing:

Analyze that the first line instruction introduces the instruction as a constant value, and introduces the constant value in the form of an immediate value. The instruction introduces the immediate value 0 into the variable v2, marks the v2 variable as a constant state, and records the value of v2 as immediate. Number 0;

The second line instruction is analyzed to introduce an instruction for the constant value of the variable v1 containing the operand, which introduces the value of the parameter ρθ into vl. In the code segment 2, the argument corresponding to the parameter ρθ is the string v6, and V6 is assigned the value of 1066156686, then the value of ρθ is the value of the string v6 1066156686; according to the semantic information of the instruction, the variable vl is marked as a constant state, and the value of vl is recorded as a constant value of 1066156686;

The third line instruction is analyzed to introduce a constant value containing the operand for the variable V3, which The instruction introduces the value of the formal parameter pl into v3. In the code segment 2, the actual parameter corresponding to the formal parameter pi is the string v7, and v7 is assigned the value 8, and the value of pl is the value 8 of the string v7; Semantic information, mark v3 as a constant state, and record the value of v3 as a constant value of 8;

The fourth line instruction is analyzed as the system function call instruction. Since the called function SmsManager.sendTextMessage is a library function, the called function analysis cannot be entered, and the process proceeds to step 304.

Step 304: The server matches the sensitive feature information of the function called by the software to be detected with the locally stored sensitive feature information.

In this embodiment, the server locally maintains detection rules to store sensitive feature information and malicious feature information, and uses the same detection rule for XML (Extensible Markup Language, Extensible Markup Language) for sensitive feature information and malicious feature information of the same risk function. Description, the detection rules for the function SmsManager. sendTextMessage can be described as follows:

Code segment 4

< FunName > sendTextMessage < /FunName >

< ClassName > SmsManager < /ClassName >

< ParamSize > 6 < /ParamSize >

< KeyParamList>

< KeyParam >

< ParamPos > 1 < /ParamPos >

< ParamValue > ^Λ 10[0 - 9] { 3, 18 } $ </ParamValue>

< SinkType > SEND — SMS < /SinkType >

< /KeyParam >

< KeyParamList >

<Function> The meanings of the above fields are:

<FunName>: Matches the function named sendTextMessage;

<ClassName>: The function class that matches is named SmsManager;

<ParaTypeList>: list of parameter types, the parameter type of the function whose function class name is SmsManager, where the first three function parameters are of type String (string), and the latter two function parameters are of type system-defined type. The list matches the first three functions whose function type is a string;

<ParamSize>: A function that matches the number of arguments of the function to 6. For non-static functions, the first argument of each function is the this pointer, and the number of arguments here is the number containing the this pointer;

<KeyParamList>: Matches the parameter information of one or more functions, and the matching rule of each parameter is represented by <KeyParam>;

<KeyParam>: contains a matching rule for a parameter;

<ParamPos>: The position of the parameter to be matched, counting from 0;

<ParamValue>: The value of the parameter to be matched, the characteristics of the value are described by a regular expression;

<SinkType>: The behavior type of the function.

In this step, when the server analyzes that the fourth line of the code segment 3 is a function call instruction, and the called function is a library function, the sensitive feature of the called function is matched with the sensitive feature information in the detection rule of the code segment 4, wherein The sensitive feature information includes a function name, a function parameter class name, a function parameter type, and a function parameter number, and the processing is as follows:

After the above analysis of the code segment 3, it can be concluded that the function name, function parameter class name, function parameter type and function parameter number of the called function are: sendTextMessage, SmsManager, String and 6, respectively, because the called function is Non-static function, so the number of function arguments 6 is the number including the this pointer. Consistent with the description of the sensitive feature information of the called function in the code segment 4 detection rule, the function call is identified as a sensitive behavior. Step 305: The server matches the malicious feature information of the function called by the software to be detected with the locally saved malicious feature information.

In step 304, after the call of the function SmsManager.sendTextMessage is identified as a sensitive behavior, in this step, the server performs the following processing:

Analyze the object described by the regular expression in the malicious feature information <ParamValue> field in the code segment 4 detection rule, which is a string of length 5 to 20 starting with the character 10, and the function SmsManager. sendTextMessage except the this pointer The value of the first parameter is 1066156686. If the description of the regular expression is met, the function call is marked as malicious. Combine the description of <8^11^> 6> in the code segment to determine that the software to be detected is automatically sending SMS. Malware.

Step 306: The server evaluates the risk level of the malicious behavior, generates the detection result, and reports the user through the client.

In this step, for the matching result of the malicious feature information in step 305, the generated detection result is: Hazard level: high;

Dangerous function name: sendTextMessage;

Dangerous function class name: SmsManager;

The function name of the function where the malicious behavior is located: SmsManager;

The class name of the function where the malicious behavior is located: MessageService;

Type of malicious behavior: malicious deduction;

Description of malicious behavior: Send SMS subscription service to sp number 1066156686.

The detection result server is sent to the client, and is displayed by the client through the UI to report to the user.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Industrial applicability

In the embodiment of the present invention, the software to be detected is simulated, and the sensitive feature information and the malicious feature information of the function to be detected by the software to be detected are matched with the pre-stored sensitive feature information and the malicious feature information, and if the matching is successful, the method is determined. Function calls are malicious. By applying the technical solution of the embodiment of the present invention, the problem that the related Android malware detection technology has a detection lag period is avoided, and the problem that the software to be detected is malware cannot be determined due to the complicated trigger condition of the malicious behavior.

Claims

claims

1. A method for detecting malicious behavior of Android software. The method includes:

Simulate the execution of the software to be detected, and mark the behavior of the software to be detected as sensitive behavior by calling a function that matches the sensitive feature information with the pre-saved sensitive feature information;

The sensitive behavior that matches the malicious characteristic information of the called function in the sensitive behavior with the pre-saved malicious characteristic information is identified as a malicious behavior.

2. The method according to claim 1, wherein,

The sensitive feature information includes: function name, function class name, function parameter type and number of function parameters;

The malicious characteristic information includes: function name, function parameter constant value.

3. The method according to claim 1, wherein before the simulation executes the software to be detected, the method further includes:

Disassemble the bytecode files in the installation package of the software to be detected, build the program structure and solve the program execution path based on the disassembled program code.

4. The method according to claim 3, wherein the method further includes:

Analyze instructions in the program execution path, and when the instruction is a constant value introduction instruction, record the introduced constant value and propagate the constant value downward in the program execution path.

5. The method according to claim 1, 2, 3 or 4, wherein the method further includes: based on the function name and function parameter constant value of the function called in the malicious behavior, as well as the pre-saved function name and function The mapping relationship between parameter constant values and risk levels determines the risk level of the malicious behavior.

6. The method according to claim 5, wherein after the simulation execution of the software to be tested is completed, the method further includes:

A detection result is generated according to the risk level of the malicious behavior, and the detection result is reported to the user through the client user interface UI.

7. A server, the server includes a simulation execution unit, a detection rule storage unit, an identification unit and a matching unit; wherein,

The simulation execution unit is configured to simulate execution of the software to be tested;

The detection rule storage unit is configured to store sensitive feature information and malicious feature information; the matching unit is configured to, when the simulation execution unit calls a function, compare the sensitive feature information of the called function with the value in the detection rule storage unit Match the sensitive feature information; Match the malicious feature information of the called function with the malicious feature information in the detection rule storage unit, where the called function is the called function in the sensitive behavior identified by the identification unit; the identification unit, configured to identify the behavior of calling a function that successfully matches the sensitive feature information as a sensitive behavior when the matching unit successfully matches the sensitive feature information; when the matching unit successfully matches the malicious feature information, calls the malicious feature information to match Successful sensitive actions are identified as malicious actions.

8. The server according to claim 7, wherein,

9. The server according to claim 7, wherein the server further includes: editor;

A program structure construction unit configured to construct a program structure based on the program code after the preprocessing unit disassembles the program code according to the bytecode file;

The program execution path solving unit is configured to solve the program execution path according to the program structure after the program structure construction unit constructs the program structure.

10. The server according to claim 9, wherein,

The simulation execution unit is also configured to solve the problem according to the program execution path solving unit. The program execution path, sequentially analyzes the instructions in the program execution path;

The server also includes: a constant value analysis unit configured to, when the simulation execution unit analyzes that an instruction in the program execution path is a constant value introduction instruction, record the introduced constant value and move the constant value downward in the program execution path. spread.

11. The server according to claim 7, 8, 9 or 10, wherein the server further includes:

The risk level assessment unit is configured to determine the risk level of the malicious behavior based on the function name and function parameter constant value of the called function in the malicious behavior, as well as the mapping relationship between the pre-saved function name, function parameter constant value and risk level. .

12. The server according to claim 11, the server further comprising: a detection result storage unit and a malicious behavior reporting unit; wherein,

The risk level assessment unit is also configured to generate detection results according to the risk level of the malicious behavior;

The detection result storage unit is configured to save the detection results generated by the risk level assessment unit;

The malicious behavior reporting unit is configured to report the detection results saved by the detection result saving unit to the user through the client UI after the simulation execution unit completes the simulation execution of the software to be detected.

13. An Android software malicious behavior detection system, the system includes: a client and a server; wherein,

The client is configured to enable the user to upload the installation package of the software to be detected to the server through the UI running on the client; receive the detection results sent by the server, and report to the user through the UI;

The server is configured to identify the behavior of the software to be detected calling a function that matches the sensitive feature information with the pre-saved sensitive feature information as a sensitive behavior; and compare the malicious feature information of the called function in the sensitive behavior with the pre-saved sensitive feature information. The saved malicious signature information matches the sensitive behavior, Identified as malicious behavior.

14. The system according to claim 13, wherein the server is the server according to any one of claims 7 to 12.