KR20120090160A - The smart phone comprising anti-virus ability and anti-virus method thereof - Google Patents

Abstract

PURPOSE: A smart phone and a security method thereof having a security function are provided to increase detection efficiency of malicious application by inspecting a digital signature for the distribution of an application. CONSTITUTION: A storing unit(250) stores malicious application detection data including decision basis data and electronic signature information for the detection of a malicious application. A behavior analyzing unit(110) analyzes a function performed by the application based on the decision basis data. A signature detecting unit(140) compares an electronic signature of a developer who develops the application.

Description

Smartphone with security function and its security method {The smart phone comprising anti-virus ability and anti-virus method

The present invention relates to a smart phone having a security function and a security method thereof, in particular, the act of actually performing the malicious app in addition to the method of comparing the specific information of the malicious app with the malicious app database, and determines the permissions of the app by a specified rule Smart phone and its security function that can prevent and treat viruses and phishing attacks with similar information while improving the efficiency of detection and treatment of malicious apps by inspecting digital signs recorded for distribution of apps. It relates to a security method.

In recent years, the development and use of smart phones, which enable a computer-like function to be implemented in a mobile phone, has become active. These smartphones are operated by the operating system (OS) like a computer, and can be installed on a smartphone by selecting an application (hereinafter referred to as an 'app') that a user needs, thus providing a distinctive feature from a conventional mobile phone. do. Because of these features, many users install their own apps and use them for various purposes such as Internet banking, financial services such as stock investment, social networking services (SNS), Internet access, and multimedia services.

These smartphones come with Windows Mobile, the iPhone operating system, Android, and some other operating systems. In the case of the Android operating system, the market share of the operating system is rapidly increasing because the information of the operating system is disclosed to the developers to provide an environment in which various apps can be developed and distributed. In addition, the number of cases of exploiting the advantages of such a smartphone, especially the operating system is increasing exponentially.

A typical example is the confidence of malicious programs such as viruses and phishing, as in conventional computers. However, malicious programs in smart phones have somewhat different characteristics from malicious programs found in existing computer environments. Specifically, in comparison with the conventional computer environment, the main feature is that the virus increases the load of the computer system by increasing the write operation in order to destroy or use the system. On the other hand, in the smartphone, the virus of the same type as in a conventional computer system is disguised as a normal app due to a structure that is difficult to survive and reproduce, and is being made to perform malicious functions without the user's recognition. In the case of a smart phone, a lot of personal information such as financial information and personal information is stored, and the smart phone itself can often use a service that is charged without a complicated authentication process. Therefore, in the case of a virus made for a smartphone, it has been developed to have a read-oriented function for the purpose of personal information leakage and charging without the user's permission.

Recently, due to the emergence of smartphone viruses, antivirus for smartphones has been developed and provided by antivirus developers / vendors or developers for computer systems. However, since the vaccine was developed in the form of following the vaccine for the computer system without considering the difference between the smartphone and the computer system, the security of the smartphone is still not stable and vulnerable. For example, the previously developed antivirus for smartphones can detect viruses by comparing specific information of malicious apps with existing malicious app databases, or use sensitive behaviors such as external memory format, billing service, and external transmission of personal information on smartphones. Only the permissions of the app, such as judges according to the specified rule, and the level of recognition and dealing with the virus according to the determination result. Therefore, in the case of a virus developed to avoid this, there is a problem in that detection and treatment by a vaccine are impossible. That is, the development of a security providing method that can be developed according to the characteristics of the smart phone to improve the security of the smart phone is urgently needed.

Accordingly, an object of the present invention is to compare specific information of a malicious app with a malicious app database, analyze the actions actually performed by the malicious app in addition to the method of judging the permission of the app by a specified rule, and record the distribution of the app. In addition to improving the efficiency of detection and treatment of malicious apps by inspecting digital signatures, a smartphone and a security method having security functions capable of preventing and treating viruses and phishing attacks with similar information are provided.

In order to achieve the above object, a smartphone having a security function according to the present invention includes an operating system and an app installed by adding an application to the operating system, wherein the smartphone detects a malicious app among the plurality of apps. And a storage unit for storing malicious app detection data including determination basis data and electronic signature information for detecting the malicious app. Behavior analysis unit for determining whether the app is a malicious app by analyzing the function performed by the app when the app is executed using the determination evidence data to detect the malicious app and the electronics of the developer who developed the app And a control unit including a sign detection unit that determines whether the app is a malicious app by comparing the sign with the electronic sign information.

The malicious app detection data further includes permission information including malicious app information in which basic information about the malicious app was previously recorded and information for determining a malicious app according to the permission of the app, wherein the controller includes: An app inspecting unit comparing the malicious app information with basic information of the app to determine whether the app is a malicious app; And a permission analyzer for comparing the permission declared in the app according to the permission information to determine whether the app is a malicious app.

The smart phone wireless communication unit for forming a communication channel with the network or other devices; An input unit for inputting any one or more of a user's command, voice, and video; A sensing unit for sensing any one or more of the state, position, orientation, acceleration / deceleration, and proximity of the smart phone; An output unit for outputting a result according to the execution of the app; And a power supply for supplying power for the operation of the smartphone; It further comprises a terminal capability unit having any one or more of them.

The control unit outputs the malicious app detection result provided from any one or more of the app inspecting unit, the sign detection unit, the behavior analysis unit, and the authority analysis unit through the output unit, and the detection result is the detected malicious app. It includes an option that allows the user to determine the processing of.

The security method of a smart phone according to the present invention includes an operating system and a plurality of apps installed by adding an application to the operating system, and in the security method of a smart phone detecting a malicious app among the apps, detecting the malicious app. Creating malicious app detection data including judgment basis data for the electronic signature and the electronic signature information of the developer who produced the app and stored in the storage unit of the smart phone; Checking, by the controller of the smartphone, the app that is installed or waiting to be installed on the smartphone; A test execution step of executing a test for checking whether the app is a malicious app by the controller; A detection or not determining step of determining whether the malicious app is detected according to the test execution by the controller; And a malicious app processing step of treating the malicious app detected by the controller; wherein the execution of the test is performed by the behavior analysis unit of the controller to analyze a function performed by the app installed and executed on the smart phone. A behavior analysis step of comparing the analysis result with the determination basis data, or a signature detection unit of the control unit compares the electronic signature included in the app with the electronic signature information and the developer of the app makes the malicious app production history; It consists of a sign verification step of analyzing if there is any.

The malicious app detection data further includes the malicious app information in which basic information about the malicious app is recorded and the permission information having information for determining the malicious app according to the permission of the app, wherein the execution of the scan is performed. An app analysis step of determining whether the app is malicious by comparing the malicious app information with basic information of the app; Or a permission analysis step of determining whether the app is a malicious app by comparing a permission declared by the control unit with the permission information of the app with the permission information.

The detecting whether the detection step or the malicious app processing step is the step of outputting the malicious app detection result provided from any one or more of the app inspection unit, the sign detection unit, the behavior analysis unit and the permission analysis unit through the output unit; The detection result may further include outputting a selection item for allowing a user to determine the processing of the detected malicious app.

Smartphones and security methods having a security function according to the present invention compares the specific information of the malicious app with the malicious app database, and analyzes the actual behavior of the malicious app in addition to the method of judging the permissions of the app by a specified rule. In addition, the digital signatures recorded for distribution of the app can be inspected to improve the efficiency of detecting and treating malicious apps, and to prevent and treat viruses and phishing attacks with similar information.

1 is an illustration showing the configuration of a smart phone having a security function according to the present invention.
Figure 2 is a flow chart illustrating a malicious app detection method according to the present invention.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. In the accompanying drawings, it should be noted that the same reference numerals are used in the drawings to designate the same configuration in other drawings as much as possible. In addition, in describing the present invention, when it is determined that a detailed description of a related known function or known configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. And certain features shown in the drawings are enlarged or reduced or simplified for ease of description, the drawings and their components are not necessarily drawn to scale. In addition, in the direction of the device or element, front and rear, right and left, up and down, vertical and horizontal do not mean that the associated device or element should have a specific direction to facilitate the description of the present invention. In addition, terms such as “first” and “second” are used for convenience of description and do not mean a relative majority or spirit or order in the detailed description and the claims. Such matters will be readily understood by those skilled in the art.

Meanwhile, the smart phone according to the present invention may be implemented in various forms, and includes a notebook computer, an e-book reader, a digital broadcasting terminal, a portable multimedia player, and an equivalent device thereof. In particular, the smart phone referred to in the present invention is installed with an operating system for the operation of the smart phone, based on the user's convenience by installing an application (hereinafter referred to as "app") that the user needs based on the operating system Refers to a portable terminal having a usable function.

In addition, in the present invention, a malicious app or a virus is collectively referred to as a malicious app, and destroys data on a smartphone, or induces an overload of a smartphone that is not desired by a user, resulting in loss of function or damage to the smartphone, or information desired by the user. Means a program or code that causes an external leak of a user and unauthorized use of a billing service that the user does not want.

1 is an exemplary view showing the configuration of a smart phone having a security function according to the present invention.

Referring to FIG. 1, a smart phone having a security function according to the present invention includes a control unit 100, a terminal function unit 200, and a storage unit 250. Meanwhile, in the detailed description of the present invention, FIG. 1 is a configuration as an example of various types of smart phones, and the illustrated components do not show essential components.

The controller 100 controls the terminal function unit 200 to control each function so that a user can use the function provided by the smart phone. In addition, in this process, the control unit 100 detects a malicious app that may be infected when an externally installed app or a communication network accesses the Internet or an external device, and notifies the user of information about the detected malicious app or a predetermined procedure. Serves to remove by. To this end, the control unit 100 receives data on the malicious app from the storage unit 250 in which the judgment information of the malicious app is stored, compares basic information, execution status, and permissions of the newly installed app, and compares the malicious app according to the comparison result. It will be judged. The controller 100 includes a behavior analyzer 110, a permission analyzer 120, an app inspector 130, and a sign detector 140 that detect malicious apps and perform processing on the detected malicious apps. do. The behavior analysis unit 110, the authority analysis unit 120, the app inspection unit 130 and the sign detection unit 140 may be installed and used in a smartphone in the form of a packaged app.

The behavior analysis unit 110 monitors the actual process that is performed while the installed app is running, and determines whether to perform a sensitive action such as accessing user information and accessing a billing service in the monitoring state. To this end, the storage unit 250 stores the data representing the risk according to the behavior of the app and the determination basis for determining whether the malicious app is malicious by calculating the risk, and the behavior analyzer 110 determines the behavior of the app according to the determination basis. It will determine whether the malicious app. And, if the behavior analysis unit 110 is determined to be a malicious app, there is an app that is determined to be a malicious app through the output unit 260 of the terminal function unit 200, and outputs the reason for determining the app as a malicious app. Done. In addition, the behavior analysis unit 110 may provide a selection item for the user to select a corresponding response, so that the user may select to maintain or delete the app.

The authority analyzing unit 120 checks whether the target app is declaring a right to cause personal information leakage, unauthorized billing service use, or a function loss of the smart phone, and responds according to the determination result. Android, among the operating systems of smartphones, allows app developers to declare permission to use smartphone features to install and run apps. Therefore, the permission analysis unit 120 checks the permission information of the basic information of the app, and compares it with the permission judgment information stored in the storage unit 250 in advance, and if it meets the conditions for dangerous behavior, this behavior analysis Like the unit 110, the user is notified. For example, the permission analysis unit 120 provides the user with such permission information when the newly installed app has a right to freely perform private acts such as reading / modifying personal information and accessing a billing service, and whether the app is a normal app. You can check whether it is a malicious app. In addition, according to the judgment of the user, the permission analysis unit 120 may proceed with the installation of the corresponding app or continue to use the installed app, or may be removed by deleting.

The app inspecting unit 130 determines whether the app is recorded in the malicious app information by comparing basic information, such as the package name of the app, with previously prepared malicious information stored in the storage unit 250. In addition, if it is determined that the malicious app based on the determination result, the app inspecting unit 130 provides the user with information regarding the discovery of the malicious app according to a predetermined process of processing the malicious app, and accordingly confirms the malicious app by the user. Will be removed.

The sign detection unit 130 compares the developer's electronic signature recorded in the app with malicious app information to determine whether the app is a malicious app, and performs the processing accordingly. The sign detection unit 130 detects malicious apps that are not detected through permission analysis and basic information comparison by developing and distributing variant apps determined by the developer as malicious apps in the past. That is, the sign detection unit 130 extracts the digital sign information that the app developer performs to distribute the app, and compares the information with the past malicious app developer information, thereby pre-notifying the risk of the app developed by the same developer. This prevents the installation and use of the app. To this end, the sign detection unit 130 compares the malicious app information with the electronic sign information of the app and if the electronic sign information recorded in the malicious app information matches the electronic sign information of the app according to the comparison result to the user and the Post-processing such as removal is performed. In particular, the sign detection unit 130 provides the user with the developer information of the electronic sign that has a history of malicious app development and the information of the malicious app in advance to predict the degree of damage caused by the user's use of the malicious app and accordingly use the malicious app. It is possible to make a decision.

The terminal function unit 200 performs various functions of the smartphone, and includes various configurations for this. For example, the terminal function unit 200 may include the wireless communication unit 210, the input unit 220, the sensing unit 230, the interface unit 240, the output unit 260, and the power supply unit 270 as shown in FIG. 1. It is configured to include. The configuration of the terminal function unit 200 is illustrated as an example and various configurations may be added or omitted.

The wireless communication unit 210 is configured to include a configuration for wireless communication between a smartphone and a wireless communication system or device. For example, the wireless communication unit 210 may include a configuration such as a broadcast receiving unit, a mobile communication unit, a wireless communication unit, a short range data communication unit, and a location information receiving unit. The broadcast receiver receives a broadcast frequency, and may receive satellite broadcast, terrestrial broadcast, and radio according to the type of the broadcast receiver. The mobile communication unit is connected to a mobile communication system (or a network) to perform voice call or data communication through the mobile communication system. Unlike the data communication through the mobile communication system, the wireless communication unit is connected to a line such as a wireless LAN and WiBro to perform data communication. In addition, the short-range data communication unit communicates with a nearby device or system using Bluetooth or near-infrared communication, and receives external data or transmits data of the smart phone to the outside. The location information receiver receives location information transmitted from an indicator device such as a base station of a satellite or mobile communication system and creates information on the current location of the smartphone. The wireless communication unit is responsible for data transmission or reception between the outside and the smart phone so that the smart phone is connected to the external system, and by using a variety of services by the connection.

The input unit 220 may include a user input unit for generating input data for controlling the operation of the terminal, a camera and a microphone for collecting various images and sounds. The user input unit may include a keypad, a dome switch, a touch pad, a jog wheel, a jog switch, a track ball, an optical track ball, and various buttons. In addition, the user input unit may be implemented on the screen of the output unit 260.

The detection unit 230 detects various states of the smartphone to perform the designated function according to the detection result, or to create the detection information to deliver the detection information to the app. The sensing unit 230 detects the current status such as the position of the smartphone, the presence or absence of the user's contact, the orientation, the acceleration / deceleration, and creates the sensing information accordingly. To this end, the detector 230 may include a proximity sensor, an acceleration sensor, a gyro sensor, an optical sensor, and an equivalent device thereof. Some of the roles of the detector 230 may be performed in synchronization with the configuration of the wireless communication unit 210.

The output unit 260 outputs the result processed by the smartphone. The output unit 260 is configured to include an image output unit and a sound output unit. In particular, the image output unit 260 may be implemented by a touch screen or a touch pad that also functions as a part of the input unit 220.

The power supply unit 270 provides power for the operation of the smartphone.

The storage unit 250 stores various data, and provides the stored data at the request of the controller 100 and the terminal function unit 200. The storage unit 250 stores and maintains data for detecting malicious apps in the controller 250 in addition to the app, the app data, and the user data, which are execution programs. In particular, the storage unit 250 stores judgment basis data, authority information, malicious app information, and electronic signature information for analyzing and determining the behavior of the malicious app, and is selectively updated by the terminal function unit. The malicious app detection data is provided at the request of the app inspecting unit 130, the sign detecting unit 140, the behavior analyzing unit 110, and the permission analyzing unit 120 of the controller 250 and used to detect the malicious app.

2 is a flow chart illustrating a malicious app detection method according to the present invention.

Referring to Figure 2, the malicious app detection method according to the present invention is a malicious app detection data collection step (S100), smart phone app confirmation step (S200), scan execution step (S300), determining whether or not malicious app discovery step (S500), It comprises a malicious app information output step (S600) and malicious app processing step (S700).

Malicious app detection data collection step (S100) is a step of creating or collecting malicious app detection data for malicious app detection. In the malicious app detection data collection step (S100), judgment basis data, permission information, malicious app information, and signature information for detecting malicious apps are stored in the storage unit 250 of the smartphone, or the stored data is updated. In addition, if the app inspection unit 130, the signature detection unit 140, the behavior analysis unit 110, the permission analysis unit 120 is provided in the form of a packaged inspection app of the function of the control unit 100, It further comprises an installation step.

 Smartphone app confirmation step (S200) is a step of checking the type, the number of apps that are installed on the smartphone by the control unit 100, or waiting to run. This smartphone app confirmation step (S200) is updated while the status of the app being added or terminated while the malicious app scan function is running.

Scan execution step (S300) is a step that checks whether the app that is installed on the smartphone or the app that is being installed or running on the smartphone is running malicious apps. To this end, the inspection execution step (S300) is configured to include a behavior analysis step (S410), autograph confirmation step (S420), authority analysis step (S430) and app analysis step (S440). Such behavior analysis step (S410) to app analysis step (S440) may be performed at the same time or may be selectively performed according to the situation.

Behavior analysis step (S410) is a step of analyzing the function or data of the smart phone that the app uses or accesses when the installed app is running. In the behavior analysis step (S410), the behavior analysis unit 110 is running the app, access the billing service, read personal information, delete data of the storage unit, data leakage or concentration of data such as excessive concentration of the specific terminal function unit 200 of the smart phone This step is to determine whether you are performing an action that may cause burnout. To this end, in the behavior analysis step (S410), the behavior analysis unit 110 performs an evaluation of the behavior of the app through the determination evidence data stored in the storage unit 250 and targets the malicious app when the conditions described in the determination evidence data are met. Will be judged.

Sign confirmation step (S420) is a step of detecting the electronic sign of the developer from the information contained in the pre-installed app or the app to be installed and compare it with the sign information stored in the storage unit 250. As described above, the electronic signature information of a developer having a history of developing and distributing a malicious app in the past is described as described above. In the signature checking step (S420), the electronic signature information is matched by comparing the electronic signature information of the app. It is a step to check if a sign exists.

The permission analysis step (S430) is a step of detecting a matter regarding the permission of the app from information included in the app installed in the smartphone or the app to be installed in advance, and comparing it with the permission information stored in the storage unit 250. In this permission analysis step (S420), the permission analysis unit 120 determines the permission of the app declared by the developer who developed the app according to the judgment basis recorded in the permission information, and if excessive permission is declared, it is targeted to the malicious app. You will be judged.

App analysis step (S440) is a step of comparing the information, such as the basic information of the app, for example, the package name from the information contained in the app installed on the smartphone or the app to be installed to the malicious app information stored in the storage unit 250 . In the app analysis step (S440), the app inspection unit 130 compares the basic information of the app and malicious app information, and checks whether the items described in the basic information match the malicious app.

Determining whether or not malicious app discovery step (S500), if any one or more of the behavior analysis step (S410) to app analysis step (S450) is executed, to determine whether there is an app that can be determined to be a malicious app according to the result. do. This determination is performed by the controller 100 and is performed for all apps that are to be installed or installed on the smartphone. In this process, the control unit 100 sequentially executes the inspection for each app existing in the smartphone, and repeats the inspection process until the inspection of all the apps is made, or repeats the inspection process by a predetermined condition. Done. In addition, behavior analysis step (S410)

In the malicious app information output step (S600), if a malicious app is found in the malicious app discovery step (S500), the control unit 110 detects the malicious app, the app checker 130, the sign detector 140, and the behavior analyzer Received from any one or more of the 110 and the authority analysis unit 120 is output through the output unit 260. At this time, the control unit 100 provides a selection item so that the user can select whether to delete or treat the malicious app or maintain the same as the malicious app information. The malicious app information output step (S600) may be omitted when the malicious app is to be processed without user consent, and may be replaced by providing information about the malicious app processed in the malicious app processing step (S700).

Malicious app processing step (S700) is a step in which the user selects the deletion of the malicious app, or automatically delete or clean the malicious app according to a predetermined condition. In addition, the malicious app processing step (S700) comprises the step of outputting the processing result of the malicious app through the output unit 260, and further comprising the step of delivering the malicious app information to the server or other smart phone through an external communication network Can be.

As described above, a smart phone having a security function and a security method thereof according to the present invention scan a smart phone virus or a malicious app that operates in a different manner from a conventional computer virus according to the characteristics of a malicious app, and detect and process it through the smart phone. It is possible to significantly improve the security of the conventional. In particular, the smart phone and security method having a security function according to the present invention, in addition to the basic information of the permissions or the app actually analyzes the operation of the app and determines whether it is a malicious app through this, as well as the possibility of malicious apps using the developer information By preventing the high use of the app itself, it is possible to prevent malicious app installations due to deliberate deception, and thereby improve the security of the smartphone.

Although illustrated and described in the specific embodiments to illustrate the technical spirit of the present invention, the present invention is not limited to the same configuration and operation as the specific embodiment as described above, various modifications do not depart from the scope of the present invention It may be practiced within limits. Accordingly, such modifications are deemed to be within the scope of the present invention, and the scope of the present invention should be determined by the following claims.

100: control unit 110: behavior analysis unit
120: authority analysis unit 130: app inspection unit
140: sign detection unit 200: terminal capabilities
210: wireless communication unit 220: input unit
230: detection unit 250: storage unit
260: output unit 270: power unit

Claims (7)

In the smart phone including an operating system, an app installed by adding an application to the operating system and detects a malicious app of the app,
A storage unit for storing malicious app detection data including determination basis data and electronic signature information for detecting a plurality of the app and the malicious app;
Behavior analysis unit for determining whether the app is a malicious app by analyzing the function performed by the app when the app is executed using the determination evidence data to detect the malicious app and the electronics of the developer who developed the app And a control unit including a sign detecting unit to determine whether the app is a malicious app by comparing the sign with the electronic sign information. The method of claim 1,
The malicious app detection data
Malicious app information recorded basic information about the previous malicious app and
It is configured to further include permission information including information for determining the malicious app according to the permissions of the app,
The control unit,
An app inspecting unit comparing the malicious app information with basic information of the app to determine whether the app is a malicious app;
Comprising a security function, characterized in that it further comprises; a permission analysis unit for determining whether the app is a malicious app by comparing the permissions declared in the app according to the permission information. The method of claim 2,
The smart phone is
A wireless communication unit for establishing a communication channel with a network or another device;
An input unit for inputting any one or more of a user's command, voice, and video;
A sensing unit for sensing any one or more of the state, position, orientation, acceleration / deceleration, and proximity of the smart phone;
An output unit for outputting a result according to the execution of the app; And
A power supply unit supplying power for the operation of the smartphone; Smart phone having a security function characterized in that it further comprises a terminal function unit having any one or more of. The method of claim 3, wherein
The control unit,
Outputting the malicious app detection result provided from any one or more of the app checking unit, the sign detecting unit, the behavior analyzing unit, and the authority analyzing unit through the output unit,
The detection result is a smart phone having a security function, characterized in that it comprises a selection item for the user to determine the processing of the detected malicious app. In the security method of the smart phone comprising an operating system and a plurality of apps installed by adding an application to the operating system, and detects a malicious app of the app,
Creating malicious app detection data including determination basis data for detecting the malicious app and electronic signature information of the developer who produced the app and storing the malicious app detection data;
Checking, by the controller of the smartphone, the app that is installed or waiting to be installed on the smartphone;
A test execution step of executing a test for checking whether the app is a malicious app by the controller;
A detection or not determining step of determining whether the malicious app is detected according to the test execution by the controller; And
And a malicious app processing step of treating the malicious app detected by the controller.
The test execution step
Behavior analysis step of the behavior analysis unit of the control unit analyzes the function performed by the app installed and executed on the smart phone, and compares the analysis result with the determination basis data, or
Security function characterized in that it comprises a sign confirmation step of comparing the sign auto electronic sign information contained in the app and the electronic sign information of the control unit for analyzing whether the developer of the malicious app production history Security method of having a smartphone. The method of claim 5, wherein
The malicious app detection data
Malicious app information recorded basic information about the previous malicious app and
It further comprises permission information having information for determining the malicious app according to the permissions of the app,
The test execution step
An app analysis step of determining whether the app is malicious by comparing the malicious app information with basic information of the app; or
The authority analysis unit of the control unit compares the authority declared in the app with the authority information and the authority analysis step for determining whether the app is a malicious app; security of the smart phone having a security function, characterized in that further comprises a Way. The method of claim 5, wherein
The detecting or determining step or the malicious app processing step
Outputting the malicious app detection result provided from any one or more of the app inspecting unit, the sign detecting unit, the behavior analyzing unit, and the authority analyzing unit through the output unit;
The detection result further comprises the step of outputting a selection item for the user to determine the processing of the detected malicious app security method of a smart phone having a security function.

Images