CN106874761A - A kind of Android system malicious application detection method and system - Google Patents

Abstract

The invention discloses a method and a system for detecting malicious applications in an Android system, comprising: obtaining authority characteristics through reverse engineering and decompiling application programs; and obtaining behavior characteristics through dynamic behavior collection and defined behavior chain model matching. Combine a large number of permission features and behavioral features to generate a feature data sample set; machine learning algorithms use the feature data sample set to generate a classifier; input the features of an unknown application into the classifier to draw a conclusion whether the unknown application is a malicious application. The present invention proposes a behavior chain model based on reverse engineering and dynamic behavior collection, and then detects unknown applications through machine learning algorithms, thereby realizing effective identification of malicious applications with high accuracy. It can be seen that the detection method and system efficiency provided by the present invention High availability and no need to modify the system source code.

Description

Method and system for detecting malicious applications in Android system

technical field

The invention relates to the field of mobile Internet information security, in particular to a method and system for detecting malicious applications in an Android system.

Background technique

With the rapid popularization of smart phones, people have entered the era of mobile Internet. The publishing model based on the application store has become an important model of mobile applications, and the mobile application industry has grown rapidly. Because mobile applications can obtain a large amount of sensitive information from mobile terminals, and they can generate high profits through the mobile market and advertisers, mobile applications are frequently attacked by hackers, and mobile application security incidents occur frequently. The mixed third-party application market and the lack of centralized and effective security review for a large number of mobile applications have led to a large number of malicious mobile applications being released in the mobile application market. How to accurately identify malicious applications that may bring security risks to mobile terminals from a large number of mobile applications has become one of the important issues in mobile application security research.

At present, the main methods of malicious application detection can be divided into static detection and dynamic detection. Static detection method: FlowDroid can implement static taint analysis and generate a function call graph by analyzing the target program bytecode file and the life cycle of components. TaintDroid proposes a system-level dynamic taint analysis tool, which realizes real-time monitoring of information flow of private data by marking sensitive information; however, static detection methods need to continuously update the signature database of malicious applications, and can only identify known malicious applications .

Dynamic detection method: Based on TaintDroid, Kynoid can realize dynamic detection of information flow between applications and data, provide real-time monitoring, and prevent privacy leakage; based on TaintDroid dynamic detection method, it is necessary to modify the source code of the Android operating system, resulting in This method is difficult to popularize and apply.

Contents of the invention

In view of this, the object of the present invention is to propose a method and system for detecting malicious applications in the Android system with high efficiency, low overhead and no need to modify the source code of the Android system.

Based on the above purpose, the Android system malicious application detection method provided by the present invention includes:

Decompile the installation file of the application through reverse engineering to obtain the permission characteristics;

Obtaining the behavior record of the application program through the dynamic behavior capture technology, and matching the behavior record with the defined behavior chain model to obtain the behavior feature;

Combining the behavioral signature with said authority signature into a final signature;

The final features of multiple known applications are used to generate a feature data sample set, and a machine learning algorithm uses the feature data sample set to generate a classifier;

The final features of the unknown application are input into the generated classifier to draw a conclusion whether the unknown application is a malicious application.

Further, the method of generating a feature data sample set from the final features of multiple known application programs, and using the feature data sample set by a machine learning algorithm to generate a classifier includes:

Generate feature data sample sets from the final features of multiple known normal applications and malicious applications;

Dividing the feature data sample set into a feature training sample set and a feature test sample set;

The machine learning algorithm uses the feature training sample set to generate a classifier, and the feature test sample set tests and evaluates the generated classifier.

Further, the method for decompiling the installation file of the application program through reverse engineering to obtain the permission feature includes:

Using a decompiler tool to decompile the installation file of the application program to obtain the permission feature;

Define permission feature vector P=(μ ₁ , μ2...μ _i ...μ _k ), where k represents the total number of system permissions in the Android operating system, μ _i represents whether the application has applied for the i-th permission, i<1 , μ _i ∈ {0,1}, 0 means no application permission, 1 means application permission.

Further, the method for matching the behavior record with the defined behavior chain model to obtain the behavior characteristics includes:

Match the obtained behavior record with the defined behavior chain model to obtain the trigger times of each behavior chain;

By normalizing the triggering times of all behavior chains, the behavior feature vector S=(σ ₁ ,σ ₂ ...σ _i ...σ _m ), where m represents the total number of behavior chain models, and σ _i represents the The number of triggers per thousand behavior records of i behavior chain models,

Combining the behavioral features with the rights features shown into the final features includes:

Combining the permission feature vector P and the behavior feature vector S into a final feature vector F:

F=(μ ₁ , μ ₂ ... μ _i ... μ _k , σ ₁ , σ ₂ ... σ _i ... σ _m ).

Further, the method for obtaining the behavior record of the application program through the dynamic behavior capture technology includes:

Inject the local dynamic library file into the process space of the target application;

Load the local dynamic library;

Modify the corresponding Method structure of the Java layer API (Application Programming Interface, application programming interface) in the Dalvik virtual machine instance;

Through dynamic binding, API (Application Programming Interface application programming interface) calls are intercepted, that is, behavior records of the application program are obtained.

On the other hand, the present invention also provides an Android system malicious application detection system, including:

Obtaining the permission feature unit, which is used to decompile the installation file of the application program through reverse engineering to obtain the permission feature;

Obtaining a behavior feature unit, used to obtain the behavior record of the application program through dynamic behavior capture technology, and match the behavior record with the defined behavior chain model to obtain the behavior feature;

generating a final feature unit for combining the matching behavior feature and the authority feature into a final feature;

A classifier unit is generated, which is used to generate a feature data sample set from the final features of multiple known normal applications and malicious applications, and divide the feature data sample set into a feature training sample set and a feature test sample set, machine learning The algorithm utilizes the feature training sample data set to generate a classifier, and the feature test sample set is used to test and evaluate the generated classifier;

The detection unit is configured to input the final features of the unknown application into the generated classifier to detect whether the unknown application is a malicious application.

Further, the generating classifier unit includes:

Generate a feature data sample set module, which is used to generate a feature data sample set from the final features of multiple known normal applications and malicious applications;

A sample set division module, configured to divide the feature data sample set into a feature training sample set and a feature test sample set;

The training classifier module is used for the machine learning algorithm to use the feature training sample set to generate a classifier, and the feature test sample set is used to test and evaluate the generated classifier.

The feature unit for obtaining permission is further used to decompile the installation file of the application program using a decompilation tool;

And after obtaining the permission feature, define the permission feature vector P=(μ ₁ , μ ₂ ... μ _i ... μ _k ), where k represents the total number of system permissions in the Android operating system, and μ _i represents the application Whether to apply for the i-th permission, i<1, μ _i ∈ {0,1}, 0 means no permission is applied, 1 means permission is applied.

Further, the acquiring behavior feature unit is further used to match the obtained behavior record with the defined behavior chain model, so as to obtain the trigger times of each behavior chain;

And used to normalize the trigger times of all behavior chains, the behavior feature vector S=(σ ₁ ,σ ₂ ...σ _i ...σ _m ), where m represents the total number of behavior chain models, σ _i represents the number of triggers per thousand behavior records of the i-th behavior chain model,

The generating final feature unit is further used to combine the permission feature vector P and the behavior feature vector S into a final feature vector F:

F=(μ ₁ , μ ₂ ... μ _i ... μ _k , σ ₁ , σ ₂ ... σ _i ... σ _m ).

Further, the acquisition behavior feature unit includes: an acquisition behavior recording module, which is used to inject the local dynamic library file into the process space of the target application; further used to load the local dynamic library; modify the Java layer API in the Dalvik virtual The corresponding Method structure in the machine instance; and used for intercepting the API call through dynamic binding, that is, obtaining the behavior record of the application program.

It can be seen from the above that the Android system malicious application detection method provided by the present invention obtains data from mobile applications by proposing a behavior chain model based on reverse engineering and dynamic behavior collection; and detects unknown applications through machine learning algorithms, thereby realizing the detection of unknown applications. The effective identification of malicious applications has a high accuracy rate, which makes up for the shortcomings of traditional static detection methods that are difficult to detect unknown applications; and the Android system malicious application detection method provided by the present invention does not need to modify the source code of the Android system, which overcomes the need to modify the dynamic detection method. The source code defect of the Android operating system has good usability, and the method effectively reduces the performance overhead of the mobile terminal through cloud detection.

Description of drawings

Fig. 1 is a flowchart of an embodiment of the Android system malicious application detection method provided by the present invention;

Fig. 2 is the flow chart of another embodiment of the Android system malicious application detection method provided by the present invention;

Fig. 3 is a schematic diagram of an embodiment of a system for detecting malicious applications in the Android system provided by the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be described in further detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

As shown in Figure 1, it is a flow chart of an embodiment of the Android system malicious application detection method provided by the present invention, and the detection method includes:

Step 101, decompile the installation file of the application program through reverse engineering to obtain the permission feature;

Step 102, obtain the behavior record of the application program through the dynamic behavior capture technology, and match the behavior record with the defined behavior chain model to obtain the behavior feature;

Step 103, combining the behavior feature and the authority feature into a final feature;

Step 104, generating a feature data sample set from the final features of multiple known applications, and a machine learning algorithm uses the feature data sample set to generate a classifier;

Step 105 , inputting the final features of the unknown application into the generated classifier to draw a conclusion on whether the unknown application is a malicious application.

It can be seen from the above that the Android system malicious application detection method provided by the present invention obtains data from mobile applications by proposing a behavior chain model based on reverse engineering and dynamic behavior collection, and detects unknown applications through machine learning algorithms, thereby realizing the detection of unknown applications. Effective identification of malicious applications has a high accuracy rate; the method for detecting malicious applications in the Android system does not need to modify the source code of the Android system, has good usability, and the method effectively reduces the performance overhead of the mobile terminal through cloud detection.

Further, as shown in Figure 2, another embodiment flow chart of the Android system malicious application detection method provided by the present invention:

Wherein, in step 101, the method of decompiling the installation file of the application program through reverse engineering to obtain the permission feature further includes:

Step 101a, using a decompilation tool to decompile the installation file of the application program;

Step 101b, obtain the permission feature, and define the permission feature vector P=(μ ₁ , μ ₂ ... μ _i ... μ _k ), where k represents the total number of system permissions in the Android operating system, and μ _i represents whether the application applies for i<1, μ _i ∈ {0,1}, 0 means no permission application, 1 means permission application.

When an application needs to perform potentially risky operations, it must first apply to the operating system for corresponding permissions. For example, reading the address book requires the android.permission.READ_CONTACTS permission, and sending SMS requires the android.permission.SEND_SMS permission. Therefore, the permissions applied for by an application when it is installed can reflect the behavior and motivation of the application to a certain extent.

Reverse engineering is to process the program file through lexical analysis, syntax analysis, control flow analysis, data flow analysis and other methods without running the program code, so as to generate the disassembly code of the program, and then understand it by reading the disassembly code program function. The source code of the program and the permission application information of the application can be obtained by reverse processing the installation file of the Android application.

The installation file of the Android application program is an APK (Android Package), and each APK file includes an AndroidManifest.xml file, which records the permissions that the application program needs to apply to the operating system when it is installed.

Step 101a, using a decompilation tool to decompile the installation file of the application specifically includes:

Use the apktool tool to decompile the APK file, and obtain the contents of the folder after decompilation;

Use the Smali2JavaUI tool to convert the smali file of the obtained folder content into a java file, and the java file contains permission features.

Further, in step 102, obtain the behavior record of the application program through the dynamic behavior capture technology, and match the behavior record with the defined behavior chain model to obtain the behavior characteristics, which specifically include:

Step 102a, based on the process injection behavior record collection: the local dynamic library file is injected into the process space of the target application program; the local dynamic library is loaded; the Java layer API (Application Programming Interface, application programming interface) is modified in the Dalvik virtual machine instance The corresponding Method structure in ; through dynamic binding, API calls are intercepted, that is, the behavior records of the application are obtained.

Process injection is to load the packaged third-party dynamic link library into the memory map of the specified process, and call the entry function in it to execute the preset logic. After the process injection is successful, you can see the dynamic link library file packaged by yourself by looking at the memory mapping table of the process.

Through dynamic behavior capture technology, Android applications will generate behavior information records when calling Android APIs, such as call time, API class name, API method name, thread number, parameters, context and other information. Behavior collection information can be packaged using JSON, which facilitates rapid transmission between processes and the network.

At the same time step 102b is executed, the defined behavior chain model is:

L=(B ₁ ,B ₂ ,…,B _n )

L represents a behavior chain, B represents a behavior, and n represents the number of behaviors in the behavior chain.

Behavior means that the application program executes a certain command when it is running. Obtaining the GPS location of the mobile phone is an action, and initiating an HTTP request is also an action. However, an action itself is not malicious. It may be helping the user to navigate, or it may be leaking the user's location information. Therefore, multiple behaviors are combined into a behavior chain in a specific order. By analyzing the behavior chain, the behavior intention of the application can be obtained more effectively.

Step 102c matches the behavior record with the defined behavior chain model to obtain behavior characteristics, specifically including:

Match the obtained large amount of behavior records including call time, API class name, API method name, thread number, parameters, context and other information with the defined behavior chain model, and the number of triggers of each behavior chain L can be obtained;

By normalizing the triggering times of all behavior chains, the behavior feature vector S=(σ ₁ ,σ ₂ ...σ _i ...σ _m ), where m represents the total number of behavior chain models, and σ _i represents the The number of triggers per thousand behavior records of i behavior chain models,

Step 103, combining the behavior feature and the permission feature into a final feature, specifically including: combining the permission feature vector P and the behavior feature vector S into a final feature vector F:

F=(μ ₁ , μ ₂ ... μ _i ... μ _k , σ ₁ , σ ₂ ... σ _i ... σ _m ).

Step 104, generating a feature data sample set from the final features of multiple known application programs, and using the feature data sample set by a machine learning algorithm to generate a classifier specifically includes:

Step 104a generates a feature data sample set from the final features of multiple known normal applications and malicious applications;

Step 104b, dividing the feature data sample set into a feature training sample set and a feature test sample set;

Step 104c, the machine learning algorithm uses the feature training sample set to generate a classifier, and the feature test sample set is used to test and evaluate the generated classifier;

The classifier discovers classification rules by analyzing the training set of known categories, so as to predict the category of new data. The present invention can adopt Bayesian classifier, and classification principle is to use the priori probability of certain object, utilize Bayesian formula to calculate its posteriori probability, namely the probability that this object belongs to a certain class, select the one with maximum posteriori probability class as the class to which this object belongs.

In step 103, all corresponding feature vectors F of any application program can be obtained, and these operations can be repeated on a large number of different known application programs to obtain a feature vector data sample set. The feature data sample set can be divided into a feature training sample set and a feature test sample set at a ratio of 9:1. The Bayesian classifier is trained with the feature training sample set to obtain a classifier for detecting malicious programs.

Step 105, inputting the final features of the unknown application into the generated classifier to draw a conclusion on whether the unknown application is a malicious application specifically includes:

When detecting an unknown application, the final feature vector of the application to be tested is obtained, and then the final feature vector of the application to be tested is input into the trained Bayesian classifier to draw a conclusion whether the unknown application is a malicious application.

The detection method provided by the present invention is further described by a specific embodiment, for example:

30 potentially high-risk permissions were selected from the Android system permissions. Then decompile the installation file of the application program, obtain the permission applied by the application by analyzing the AndroidManifest.xml file, and generate the permission feature vector P.

P=(0,1,1,1,0,0,0,0,0,1,1,0,0,0,1,1,0,0,1,0,1,0,0,0 ,1,1,0,0,1,1)

Through dynamic behavior capture, a large number of behavior records of Android applications can be obtained. Each record contains context information such as API method name, call time, method parameters, method return value, process number, and thread number.

Taking the initiation of HTTP (HyperText Transfer Protocol hypertext transfer protocol) request as an example to establish a behavior chain model, the application can complete the initiation of HTTP request through a series of method calls: (1) Construct URL (UniformResoure Locator Uniform Resource Locator) object (2 ) Call the openConnection method of the URL object to obtain the HttpURLConnection object (3) Call the getInputStream method of the HttpURLConnection object to obtain the input byte stream (4) Call the read method of the InputStream object. Thus, the behavior chain model L=(B ₁ , B ₂ , B ₃ , B ₄ ) of the HTTP request can be obtained.

According to the same method, multiple potentially risky behavior chain models can be defined, for example, 10 behavior chain models can be defined.

Match the obtained behavior chain model with a large number of behavior records to get the trigger times of each behavior chain L and generate behavior feature vector S: S=(142,49,82,73,17,251,109,207,29,41)

The final feature vector F can be obtained from the permission feature vector P and the behavior feature vector S: F=(0,1,1,1,0,0,0,0,0,1,1,0,0,0,1 ,1,0,0,1,0,1,0,0,0,1,1,0,0,1,1,142,49,82,73,17,251,109,207,29,41).

The feature vectors of any Android application can be obtained through the above steps. For example, 200 malicious applications and 200 normal applications can be selected as sample sets, and the 400 applications are analyzed separately, and the obtained 400 feature vectors are used as feature vector data sample sets , the feature data sample set can be divided into a feature training sample set and a feature test sample set in a ratio of 9:1, and the Bayesian classifier is trained with the feature training sample set to obtain a trained Bayesian classifier for detecting malicious programs .

When detecting an unknown application, the feature vector of the application to be tested is obtained, and then the feature vector of the application to be tested is input into the trained Bayesian classifier to draw a conclusion whether the unknown application is a malicious application.

It can be seen that the Android system malicious application detection method provided by the present invention obtains data from mobile applications by proposing a behavior chain model based on reverse engineering and dynamic behavior collection; detects unknown applications through machine learning algorithms, thereby realizing effective detection of malicious applications. Recognition has a high accuracy rate, which makes up for the shortcomings of traditional static detection methods that are difficult to detect unknown applications; the Android system malicious application detection method provided by the present invention does not need to modify the source code of the Android system, and overcomes the need to modify the source code of the Android operating system in the dynamic detection method and the detection method provided by the present invention uses a combination of dynamic analysis and static analysis to complement each other's advantages. Through cloud detection, the performance overhead of the mobile terminal is reduced. It can be seen that the present invention provides a high-efficiency, low-cost and does not need to modify the source of the Android system. Code-based Android system malicious application detection method.

On the other hand, the present invention also provides a malicious application detection system for the Android system, as shown in FIG. 3 , a schematic diagram of an embodiment of the malicious application detection system for the Android system provided by the present invention. The system includes:

Obtaining the permission feature unit 301, used to decompile the installation file of the application program through reverse engineering to obtain the permission feature;

Obtaining a behavior feature unit 302, configured to obtain a behavior record of the application program through a dynamic behavior capture technology, and match the behavior record with a defined behavior chain model to obtain a behavior feature;

Generate a final feature unit 303, which is used to combine the matching behavior feature and the authority feature into a final feature;

Generate a classifier unit 304, which is used to generate a feature data sample set from the final features of multiple known application programs, and the machine learning algorithm utilizes the feature data sample set;

The detection unit 305 is configured to input the final features of the unknown application into the generated classifier to detect whether the unknown application is a malicious application.

Wherein, the obtaining permission feature unit 301 is further used to decompile the installation file of the application program using a decompilation tool; and after obtaining the permission feature, define the permission feature vector P=(μ ₁ , μ ₂ … μ _i … μ _k ), where k represents the total number of system permissions in the Android operating system, μ _i represents whether the application has applied for the i-th permission, i<1, μ _i ∈ {0,1}, 0 represents No application permission, 1 means application permission.

The defined behavior chain model is:

L=(B ₁ ,B ₂ ,…,B _n )

L represents a behavior chain, B represents a behavior, and n represents the number of behaviors in the behavior chain.

Obtaining the behavior feature unit 302, further used to match the obtained behavior record with the defined behavior chain model, so as to obtain the trigger times of each behavior chain L;

And used to normalize the trigger times of all behavior chains, the behavior feature vector S=(σ ₁ ,σ ₂ ...σ _i ...σ _m ), where m represents the total number of behavior chain models, σ _i represents the number of triggers per thousand behavior records of the i-th behavior chain model,

Generate the final feature unit 303, which is further used to combine the permission feature vector P and the behavior feature vector S into a final feature vector F:

F=(μ ₁ , μ ₂ ... μ _i ... μ _k , σ ₁ , σ ₂ ... σ _i ... σ _m ).

Further, the acquisition permission feature unit 301 includes: an acquisition behavior recording module, which is used to inject the local dynamic library file into the process space of the target application; further used to load the local dynamic library; modify the Java layer API in the Dalvik virtual machine The corresponding Method structure in the instance; and used for intercepting API calls through dynamic binding, that is, obtaining behavior records of the application program.

Further, generating classifier unit 304 includes:

Generate a feature data sample set module, which is used to generate a feature data sample set from the final features of multiple known normal applications and malicious applications;

A sample set division module, configured to divide the feature data sample set into a feature training sample set and a feature test sample set;

The training classifier module is used for the machine learning algorithm to use the feature training sample set to generate a classifier, and the feature test sample set is used to test and evaluate the generated classifier.

It can be seen that the Android system malicious application detection method and system provided by the present invention obtain data from mobile applications by proposing a behavior chain model based on reverse engineering and dynamic behavior collection; detect unknown applications through machine learning algorithms, thereby realizing detection of malicious applications. The effective identification of the system has a high accuracy rate, which makes up for the shortcomings of the traditional static detection method that is difficult to detect unknown applications; the Android system malicious application detection method provided by the present invention does not need to modify the source code of the Android system, and overcomes the need to modify the Android operating system in the dynamic detection method source code defects; and the detection method provided by the present invention combines dynamic analysis and static analysis, complementary advantages, through cloud detection, reduces mobile terminal performance overhead, it can be seen that the present invention provides high efficiency, low overhead and does not need to modify the Android system The source code Android system malicious application detection method and system.

Those of ordinary skill in the art should understand that: the discussion of any of the above embodiments is exemplary only, and is not intended to imply that the scope of the present disclosure (including claims) is limited to these examples; under the idea of the present invention, the above embodiments or Combinations between technical features in different embodiments are also possible, steps may be carried out in any order, and there are many other variations of the different aspects of the invention as described above, which are not presented in detail for the sake of brevity.

The Android system malicious application detection method and system provided by the present invention obtain data from mobile applications by proposing a behavior chain model based on reverse engineering and dynamic behavior collection; detect unknown applications through machine learning algorithms, thereby realizing detection of malicious applications Effective identification, high accuracy, making up for the shortcomings of traditional static detection methods that are difficult to detect unknown applications; the Android system malicious application detection method provided by the present invention does not need to modify the source code of the Android system, and overcomes the need to modify the source code of the Android operating system in the dynamic detection method code defects; and the detection method provided by the present invention combines dynamic analysis and static analysis, complementary advantages, through cloud detection, reduces mobile terminal performance overhead, it can be seen that the present invention provides high efficiency, low overhead and does not need to modify the Android system source Code and Android system malicious application detection method and system.

In addition, well-known power/ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures, for simplicity of illustration and discussion, and so as not to obscure the present invention. . Furthermore, devices may be shown in block diagram form in order to avoid obscuring the invention, and this also takes into account the fact that details regarding the implementation of these block diagram devices are highly dependent on the platform on which the invention is to be implemented (i.e. , these details should be well within the understanding of those skilled in the art). Where specific details (eg, circuits) have been set forth to describe example embodiments of the invention, it will be apparent to those skilled in the art that other embodiments may be implemented without or with variations from these specific details. Implement the present invention down. Accordingly, these descriptions should be regarded as illustrative rather than restrictive.

Although the invention has been described in conjunction with specific embodiments of the invention, many alternatives, modifications and variations of those embodiments will be apparent to those of ordinary skill in the art from the foregoing description. For example, other memory architectures such as dynamic RAM (DRAM) may use the discussed embodiments.

Embodiments of the present invention are intended to embrace all such alterations, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent replacements, improvements, etc. within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. a kind of Android system malicious application detection method, it is characterised in that including：

By the installation file of reverse-engineering decompiling application program, authority feature is obtained；

The behavior record of the application program is obtained by dynamic behaviour capture technique, by the behavior record and the behavior for defining Chain model match obtaining behavioural characteristic；

By behavioural characteristic and the authority combinations of features into final feature；

The final feature of multiple known applications is generated into characteristic sample set, machine learning algorithm utilizes the characteristic Grader is generated according to sample set；

The grader of the final feature input generation of Unknown Applications will be obtained, obtains whether the unknown applications are that malice should Conclusion.

2. Android system malicious application detection method according to claim 1, it is characterised in that it is described will should known to multiple Characteristic sample set is generated with the final feature of program, machine learning algorithm generates classification using the characteristic sample set The method of device includes：

The final feature of normal application known to multiple and malicious application is generated into characteristic sample set；

The characteristic sample set is divided into features training sample set and characteristic test sample set；

The machine learning algorithm generates grader using the features training sample set, and the characteristic test sample set is used to survey The grader of examination assessment generation.

3. Android system malicious application detection method according to claim 2, it is characterised in that described by reverse-engineering The installation file of decompiling application program, the method for obtaining authority feature includes：

Decompiling is carried out to the installation file of the application program using decompiling instrument；

The authority feature is obtained, authority characteristic vector P=(μ are defined₁,μ₂…μ_i…μ_k), wherein, k represents Android operation system The total number of middle System Privileges, μ_iRepresent whether the application has applied for i-th authority, i ＜ 1, μ_i∈ { 0,1 }, 0 represents no Shen Please authority, 1 represent applied for authority.

4. Android system malicious application detection method according to claim 3, it is characterised in that described by behavior note Record carries out matching the method for obtaining behavioural characteristic with the behavior chain model for defining to be included：

The behavior record that will be obtained is matched with the behavior chain model of definition, can obtain touching for each behavioral chain Hair number of times；

The triggering times of all behavioral chains are done into normalized, behavioural characteristic vector S=(σ can be obtained₁,σ₂…σ_i…σ_m), Wherein, m represents the total number of behavior chain model, σ_iRepresent the triggering time in i-th every thousand of behavior chain model behavior record Number,

It is shown to include behavioural characteristic into final feature with the authority combinations of features：

Authority characteristic vector P and behavioural characteristic vector S are combined into a final characteristic vector F：

F=(μ₁,μ₂…μ_i…μ_k, σ₁,σ₂…σ_i…σ_m)。

5. the Android system malicious application detection method according to claim 1-4 any one, it is characterised in that described logical The method for crossing the behavior record that dynamic behaviour capture technique obtains the application program includes：

Local dynamic library file is injected into the process space of destination application；

Load the local dynamic base；

Corresponding Method structures of the Java layers of API of modification in Dalvik virtual machine example；

By dynamic binding, API Calls are intercepted, that is, obtain the behavior record of the application program.

6. a kind of Android system malicious application detecting system, it is characterised in that including：

Authority feature unit is obtained, for the installation file by reverse-engineering decompiling application program, authority feature is obtained；

Obtain behavioural characteristic unit, the behavior record for obtaining the application program by dynamic behaviour capture technique, by institute State behavior record match obtaining behavioural characteristic with the behavior chain model of definition；

Final feature unit is generated, for the behavioural characteristic and the authority combinations of features into final feature that will match；

Generation grader unit, for the final feature of multiple known applications to be generated into characteristic sample set, engineering Practise algorithm and generate grader using the characteristic sample set；

Detection unit, for by the grader of the final feature input generation of Unknown Applications, detecting that the unknown applications are No is malicious application.

7. Android system malicious application detecting system according to claim 6, it is characterised in that the generation grader list Unit includes：

Generation characteristic sample set module, for by the final feature of normal application known to multiple and malicious application Generation characteristic sample set；

Sample set module is divided, for the characteristic sample set to be divided into features training sample set and characteristic test sample Collection；

Training classifier modules, grader is generated for the machine learning algorithm using the features training sample set, described The grader of characteristic test sample set test assessment generation.

8. Android system malicious application detecting system according to claim 7, it is characterised in that the acquisition authority feature Unit, is further used for carrying out decompiling to the installation file of the application program using decompiling instrument, obtains the authority Feature；

And for defining authority characteristic vector P=(μ₁,μ₂…μ_i…μ_k), wherein, k represents System Privileges in Android operation system Total number, μ_iRepresent whether the application has applied for i-th authority, i ＜ 1, μ_i∈ { 0,1 }, 0 represents without application authority, 1 table Show and applied for authority.

9. Android system malicious application detecting system according to claim 8, it is characterised in that the acquisition behavioural characteristic Unit, the behavior record for being further used for obtaining is matched with the behavior chain model of definition, can be obtained each The triggering times of individual behavioral chain；

And for the triggering times of all behavioral chains to be done into normalized, behavioural characteristic vector S=(σ can be obtained₁,σ₂… σ_i…σ_m), wherein, m represents the total number of behavior chain model, σ_iIn representing i-th every thousand of behavior chain model behavior record Triggering times,

The final feature unit of generation, is further used for for authority characteristic vector P and behavioural characteristic vector S being combined into one most Whole characteristic vector F：

F=(μ₁,μ₂…μ_i…μ_k, σ₁,σ₂…σ_i…σ_m)。

10. the Android system malicious application detecting system according to claim 6-9 any one, it is characterised in that described Obtaining behavioural characteristic unit includes：Behavior record module is obtained, for local dynamic library file to be injected into destination application The process space in；It is further used for the loading local dynamic base, Java layers of API is in Dalvik virtual machine example for modification Corresponding Method structures；And for by dynamic binding, intercepting API Calls, that is, obtain the behavior of the application program Record.