WO2014048194A1

WO2014048194A1 - Android malicious application program detection method, system and device

Info

Publication number: WO2014048194A1
Application number: PCT/CN2013/082152
Authority: WO
Inventors: 巫妍; 程绍银; 蒋凡
Original assignee: 中兴通讯股份有限公司; 中国科学技术大学
Priority date: 2012-09-29
Filing date: 2013-08-23
Publication date: 2014-04-03
Also published as: CN102938040A

Abstract

Disclosed in an embodiment of the present invention are an Android malicious application program detection method, system and device, the detection method comprising: a server simulates the execution of an Android application program, matches the sensitive characteristic information of a system function invoked by the Android application program with the sensitive characteristic information stored in a sensitive data introduction rule base, and marks the variable of the successfully matched system function as sensitive data; the server matches the function containing the sensitive data with the malicious behavior characteristic information stored in a malicious behavior detection rule base, and marks the successfully matched function parameter as a malicious behavior. The technical solution in the embodiment of the present invention can detect an Android malicious application program without relying on human analysis of characteristic code, thus reducing the workload of technical personnel.

Description

Android malicious application detection method, system and device

The invention relates to a malicious application detection technology, and in particular to an Android (Android) malicious application detection method, system and device. Background technique

As an open source smartphone operating system, Android has attracted a large number of application developers. Since there are a large amount of user privacy information stored in the smartphone, a large number of malicious applications are attracted to the application market to steal the user's private information. In addition, the supervision and management systems and detection methods of the various application markets are still not perfect. The maliciousness of the application is screened, so that the user's private information is leaked a lot, and the user of the application suffers a great loss.

An Android malicious application is software that installs and runs on a user's computer or other terminal without explicitly prompting the user or without the user's permission, infringing the legitimate rights and interests of the user. The main malicious behaviors include: malicious deduction, privacy theft, remote control, malicious transmission, tariff consumption, system damage, deception fraud, rogue behavior, etc.

At present, there are two main detection methods for malicious applications: dynamic detection methods and static detection methods. The dynamic detection method mainly performs real-time detection on the installed application by modifying the Android emulator kernel or uses the symbol execution method to make the application run according to the specified path, thereby obtaining the malicious behavior of the application. The static analysis method mainly analyzes related files in the Android installation package (AndroidPackage, APK), such as AndroidManifest.xml, Dalvik bytecode file, etc., and extracts some information as key features, and uses feature matching to complete the detection.

The dynamic detection method relies on specific trigger conditions and cannot detect all execution paths in a short time. The feature matching based method relies on the signature database and the acquisition of signatures. Basically, it relies on manual analysis and the workload is huge. Summary of the invention

In view of this, the main purpose of the embodiments of the present invention is to provide an Android malicious application detection method, system, and device, which can implement the detection of the Android malicious application without relying on the manual analysis of the feature code, thereby greatly reducing the technical staff. The amount of work.

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows: The embodiment of the present invention provides a method for detecting an Android malicious application, and the method includes:

The server simulates executing the Android application, and matches the sensitive feature information of the system function called by the application with the sensitive feature information stored in the rule base, and marks the variable of the successfully matched system function as sensitive data;

The function containing the sensitive data is matched with the malicious behavior characteristic information stored in the malicious behavior detection rule base, and the function parameters matching the success are marked as malicious behavior.

Preferably, the method further includes:

After the execution of the simulated Android application is completed, the server generates a detailed description of the dangerous behavior based on the result of matching with the malicious behavior detection rule base, outputs a detection report, and reports the detection result to the client.

Preferably, before the server simulates execution of the Android application, the method further includes:

The client sends the APK file of the Android application to be tested to the server, and the server decompresses the APK file, and extracts the Dalvik bytecode file and the AndroidManifest.xml in the APK file.

Preferably, the method further includes:

The server disassembles the Dalvik bytecode file, and constructs a program structure according to the Dalvik bytecode file information, including: an instruction structure, a basic structure, a function structure, a class structure, a function Number call graph, control flow graph;

The server parses the AndroidManifest.xml configuration file to obtain the entry function name, and finds the corresponding function structure from the constructed program structure as an entry function for the simulation execution.

Preferably, the server emulating execution of the Android application comprises:

The server starts from the entry function, simulates the call sequence of the function and the execution order of the instructions in the function according to the constructed program structure, and simulates the execution of each instruction in order according to the execution order of the instructions.

Preferably, the method further includes:

During the execution of the simulation instruction, the server collects the program state information of the function variable, and uses the program state information of the collected variable to determine the actual calling object of the dynamic mechanism function, and finds the relevant response function according to the current object.

The embodiment of the present invention further provides a server, where the server includes: a communication module, a flow sensitivity analysis module, a sensitive data introduction rule base, and a malicious behavior detection rule base; wherein:

The communication module is configured to receive an APK file sent by the client, and send the APK file to the flow sensitive analysis module;

The flow sensitivity analysis module is configured to simulate execution of the Android application according to the received APK file, and match the sensitive feature information of the system function invoked by the Android application with the sensitive feature information stored in the rule base, and The variable matching the successful system function is marked as sensitive data; it is also configured to match the function parameter containing the sensitive data with the detection rule of the malicious behavior stored in the malicious behavior detection rule base, and mark the successfully matched function parameter as a malicious behavior;

The sensitive data is introduced into a rule base and configured to store sensitive feature information;

The malicious behavior detection rule base is configured to store malicious behavior feature information.

Preferably, the server further comprises: a dangerous behavior reporting module, configured to simulate the execution of the Android application, and generate a risk according to a result matching the malicious behavior detection rule base A detailed description of the behavior, output a test report, and send the test report to the client via the communication module.

Preferably, the server further includes: a decompression module, a program structure construction module, and an entry function parsing module;

The decompression module is configured to decompress the APK file sent by the client, and extract the

a Dalvik bytecode file in the APK file and an AndroidManifest.xml configuration file, the Dalvik bytecode file is sent to the program structure building module, and the AndroidManifest.xml configuration file is sent to the entry function parsing module;

The program structure construction module is configured to disassemble the Dalvik bytecode file, and construct a program structure according to the information of the Dalvik bytecode file, and send the constructed program structure to the flow sensitivity analysis module;

The entry function parsing module is configured to parse the AndroidManifest.xml configuration file to obtain an entry function name, and find a corresponding function structure from the constructed program structure as an entry function for starting analysis, and send the obtained entry function to The flow sensitive analysis module.

Preferably, the flow sensitivity analysis module comprises: a matching module and a malicious behavior detecting module; wherein:

The matching module is configured to send sensitive feature information and sensitive data of a system function called by an Android application? The sensitive feature information in the I-input rule base is matched, the variable of the successfully matched system function is marked as sensitive data, and the matched data is sent to the malicious behavior detecting module to perform malicious behavior detection;

The malicious behavior detecting module is configured to match the function parameter containing the sensitive data with the malicious behavior characteristic information stored in the malicious behavior detection rule base, mark the successfully matched function parameter as a malicious behavior, and send the matching result to the Dangerous Behavior Reporting Module.

Preferably, the flow sensitivity analysis module further includes an instruction simulation module configured to construct a program structure according to the program structure, a call sequence of the simulation function, and a command execution of the function. The order of the lines begins with the entry function obtained by the entry function parsing module, simulating the execution of each instruction in sequence.

Preferably, the flow sensitivity analysis module further includes: a program state collection module and a dynamic mechanism connection module; wherein:

The program state collection module is configured to collect program state information of the function variable during the simulation execution of the instruction, and send the program state information of the collected function variable to the dynamic mechanism connection module;

The dynamic mechanism connection module is configured to collect program state information of the function variable collected by the module according to the program state, determine the actual call object of the dynamic mechanism function, and find the relevant response function according to the current object.

The embodiment of the present invention further provides an Android malicious application detection system, where the system includes: a client and a server according to an embodiment of the present invention;

The client is configured to send the APK file of the Android application to be tested to the server; and is configured to receive the detection report sent by the server, and report the detection result to the user.

The technical solution provided by the embodiment of the present invention matches the sensitive feature information of the system function invoked by the application with the sensitive feature information stored in the rule base by simulating the execution application, and tags the variable of the successfully matched system function. For sensitive data; match the function containing sensitive data with the malicious behavior feature information stored in the malicious behavior detection rule base, and mark the successfully matched function parameters as malicious behavior. The technical solution of the embodiment of the present invention does not depend on the signature database obtained by manual analysis, which greatly reduces the workload of the technician; and does not depend on a specific trigger condition, and can complete all execution paths in a short time, which can be accurate Promptly detect malicious behavior of the application. DRAWINGS

1 is a schematic flowchart of a method for detecting a malicious application of an Android according to a first embodiment of the present invention; FIG. 2 is a schematic diagram of a composition of an Android malicious application detection system according to Embodiment 1 of the present invention; FIG. 3 is a schematic flowchart of a method for detecting an Android malicious application according to Embodiment 2 of the present invention. detailed description

The basic idea of the embodiment of the present invention is: The server simulates executing the Android application, and matches the sensitive feature information of the system function called by the application with the sensitive feature information stored in the rule base, and the variable of the system function that matches the success is matched. Marked as sensitive data; Match the function containing sensitive data with the malicious behavior feature information stored in the malicious behavior detection rule base, and mark the function parameters that match successfully as malicious behavior.

The invention will now be described in greater detail with reference to the drawings and specific embodiments.

FIG. 1 is a schematic flowchart of a method for detecting a malicious application of an Android according to Embodiment 1 of the present invention. As shown in FIG. 1, the method includes the following steps:

Step 11: The server simulates the execution of the Android application based on the APK file of the Android application sent from the client.

Here, the client sends the APK file of the Android application to be tested to the server. After receiving the APK file, the server can extract the APK file through software such as WinRAR, APKTOOL.jar, etc., and extract the Dalvik bytecode file inside the file and AndroidManifest.xml configuration file.

Here, the server simulates the execution of the Android application according to the APK file of the Android application sent by the client, including:

The server disassembles the Dalvik bytecode file and constructs the program structure based on the Dalvik bytecode file information, including: instruction structure, basic structure, function structure, class structure, function call graph, control flow graph, and so on.

The server parses the AndroidManifest.xml configuration file to get the entry function name, such as extracting the value of the "android: name" field in the activity, service, receiver, provider, etc. as the entry function name, and finding the corresponding function from the built program structure. Structure, as an entry function for simulation execution. The server starts from the entry function, simulates the call sequence of the function and the execution order of the instructions within the function according to the constructed program structure, and simulates the execution of each instruction in turn according to the execution order of the instructions.

Wherein, for the in-process analysis phase, the execution order of the instructions in the function is generated according to the control flow graph, and the traversal algorithm of the graph is used to ensure that each basic block is executed at least once; for the branch, each branch is guaranteed to be executed; The loop ensures that the instruction of the loop body part is executed at least once; for the inter-process analysis stage, the call sequence of the function is generated according to the function call graph, and the function that should actually be called is calculated according to the parameter type of the function call point.

The calling sequence of the function may be specifically analyzed by using the semantic information of the function parameter, such as according to the function calling instruction, according to the frequency of use of the function from high to low, first determining whether the function is a virtual function or an interface calling function, when judging If the result is YES, the function actually called is searched according to the type of the this parameter; when the result of the judgment is no, it is continued to judge whether the function is a function implemented by the user; when the function is determined to be a user implementation If the judgment result of the function is YES, it is executed internally by the called function, and the instruction execution sequence of the called function is calculated; when the judgment result of whether the function is a user-implemented function is negative, the judgment is continued. Whether the function is a dynamic mechanism function; when the judgment result of determining whether the function is a dynamic mechanism function is YES, then the function corresponding to the search is entered, and the execution is sequentially performed, otherwise the analysis ends.

Here, the program state information of the collection function variable includes collecting type information and value information of each variable; for some dynamic mechanism related functions, such as an interface calling function, a virtual function, etc., using program state information of the collected variable , to determine the actual call object, to find the relevant response function according to the actual call object. Step 12: During the simulation execution of the Android application, the server matches the sensitive feature information of the system function called by the Android application with the sensitive feature information stored in the rule base, and matches the variable of the successfully matched system function. For sensitive data.

Here, the sensitive data introduction rule base mainly records matching rules of sensitive data, where the sensitive data refers to some data related to user privacy or system security, such as a user's address book, geographic location, mobile device number, etc.; The data import rule library records the library function information that introduces sensitive data into the program, including the function name, the class name of the function, the number of parameters of the function, the type of sensitive data introduced, whether the function is a static function, or a list of parameters. Information such as the pollution status of each parameter.

The malicious behavior in the application to be detected includes: sending a short message of a fixed content to a fixed number, and ordering a service provider (SP) service without unknowingly consuming the user fee; opening a fixed unified resource Locator (Universal Resource Locator, URL) to consume user fees; execute fixed system commands to modify or delete user files. The short message, the fixed number, the fixed URL, and the fixed system command of the fixed content introduce the parameters of the dangerous function in the form of sensitive data of the fixed string in the application code to be detected. In this manner, when the application to be detected is simulated, if the sensitive feature information of the application calling function to be detected matches the sensitive feature information of a dangerous function stored in the sensitive data import rule library, the function call is identified as sensitive data. For further testing, determine if the function call is malicious.

Step 13: The server matches the function containing the sensitive data with the malicious behavior characteristic information stored in the malicious behavior detection rule base, and marks the successfully matched function parameter as a malicious behavior.

Here, the malicious behavior detection rule base mainly records detection rules for malicious behaviors. The triggering of malicious behavior is generally caused by some system functions that communicate with external sources, such as connecting to the network, sending text messages, and so on. If the call point of these functions is found to contain sensitive data, it means that malicious behavior is found; the malicious behavior detection rule base mainly includes malicious behavior names, Information such as malicious behavior types, sensitive data type lists, and dangerous function type lists.

In step 12, if the sensitive feature information of the system function to be detected by the application to be detected matches the sensitive feature information stored in the sensitive data import rule base, determining that the system function call meets the preliminary feature of the malicious behavior, namely: sending the fixed content The SMS sends a fixed number, opens a fixed URL, or executes a fixed system command, and the fixed content SMS, fixed number, fixed URL, and fixed system commands introduce dangerous function parameters in the form of sensitive data to implement sensitive behavior.

In this step, the server matches the malicious feature information of the called system function in the sensitive behavior of the application to be detected with the malicious behavior feature information stored in the malicious behavior detection rule base to further determine whether the sensitive behavior is malicious behavior. , that is: whether to send a fixed content SMS to a fixed number, whether to order a service to the SP, to consume user fees; whether to open a fixed URL, whether to open the Internet Protocol (IP) address, to cause users Consumption of tariffs; whether to perform a fixed system command, causing loss to the user's files. If so, the function call is identified as a malicious act, and the application to be detected is determined to be a malicious application.

Here, after the server simulates the execution of the Android application, a malicious behavior detection report is generated, which details the triggering process of the current malicious behavior, the sensitive data of the operation, and the harm caused, and classifies according to the dangerous behavior according to the detected dangerous behavior. And calculating the degree of danger and the possible harm, outputting the program information such as the calling path of the dangerous behavior, and sending the detection report to the client; wherein the report can be graphically and extensible markup language (Extensible Markup Language) , XML) and other forms of representation.

FIG. 2 is a schematic diagram of the composition of the Android malicious application detection system according to the first embodiment of the present invention. As shown in FIG. 2, the system includes: a client 11 and a server 12; wherein: the client 11 is configured as Sending the APK file of the Android application to be tested to the server 12; The server 12 is configured to simulate the execution of the Android application according to the APK file sent by the client 11, and match the sensitive feature information of the system function invoked by the Android application with the sensitive feature information stored in the rule base. The variables matching the successful system functions are marked as sensitive data; the function parameters containing the sensitive data are matched with the malicious behavior characteristic information stored in the malicious behavior detection rule base, and the successfully matched function parameters are marked as malicious behaviors.

The server 12 is further configured to send a detection report to the client after the simulation is completed.

11 ;

The client 11 is further configured to receive a detection report sent by the server 12 and report the detection result to the user.

Based on the above system, the first embodiment of the present invention further provides a server. As shown in FIG. 2, the server 12 includes: a communication module 121, a flow sensitivity analysis module 123, a sensitive data import rule base 124, and a malicious behavior detection rule base. 125; where:

The communication module 121 is configured to receive the APK file sent by the client 11 and send the APK file to the flow sensitive analysis module 123;

The flow sensitivity analysis module 123 is configured to simulate execution of the Android application according to the received APK file, and match the sensitive feature information of the system function invoked by the Android application with the sensitive feature information stored in the rule base 124. Also configured to match the function parameters containing the sensitive data with the detection rules of the malicious behavior stored in the malicious behavior detection rule base 125, and mark the successfully matched function parameters as malicious behavior;

The sensitive data introduction rule base 124 is configured to store sensitive feature information;

The malicious behavior detection rule base 125 is configured to store malicious behavior feature information.

Preferably, the server 12 further includes a risk behavior reporting module 122 configured to generate a detailed description of the dangerous behavior according to the result of matching with the malicious behavior detection rule base 125 after the execution of the Android application is simulated by the flow sensitivity analysis module 123. Output test report, and will The detection is sent to the client 11 via the communication module 121.

Preferably, the server 12 further includes: a decompression module 128, a program structure building module 126, and an entry function parsing module 127; wherein:

The decompression module 128 is configured to decompress an APK file sent by the client, extract a Dalvik bytecode file in the APK file, and an AndroidManifest.xml configuration file, and send the Dalvik bytecode file to the The program structure building module 126, the AndroidManifest.xml configuration file is sent to the entry function parsing module 127;

The program structure construction module 126 is configured to disassemble the Dalvik bytecode file, and construct a program structure according to the information of the Dalvik bytecode file, and send the constructed program structure to the flow sensitivity analysis module. 123;

The entry function parsing module 127 is configured to parse the AndroidManifest.xml configuration file to obtain an entry function name, and find a corresponding function structure from the constructed program structure as an entry function for starting analysis, and send the obtained entry function. The flow sensitive analysis module 123 is provided.

Preferably, the flow sensitivity analysis module 123 includes: a matching module 1231 and a malicious behavior detecting module 1232; wherein:

The matching module 1231 is configured to match the sensitive feature information of the system function invoked by the Android application with the sensitive feature information in the sensitive data import rule base 124, and mark the variable of the successfully matched system function as sensitive data, which will match The subsequent data is sent to the malicious behavior detecting module 1232 for malicious behavior detection;

The malicious behavior detecting module 1232 is configured to match the function parameter containing the sensitive data with the malicious behavior characteristic information stored in the malicious behavior detecting rule base 125, mark the successfully matched function parameter as a malicious behavior, and send the matching result to the The risk behavior reporting module 122.

Preferably, the flow sensitivity analysis module 123 further includes an instruction simulation module 1235 configured to According to the program structure constructed by the program structure construction module 126, the calling sequence of the simulation function and the execution order of the instructions within the function start from the entry function obtained by the entry function parsing module 127, and the execution of each instruction is simulated in order.

Preferably, the flow sensitivity analysis module 123 further includes: a program state collection module 1234 and a dynamic mechanism connection module 1233; wherein:

The program state collection module 1234 is configured to collect program state information of the function variable during the simulation execution of the instruction, and send the program state information of the collected function variable to the dynamic mechanism connection module 1233;

The dynamic mechanism connection module 1233 is configured to determine the actual call object of the dynamic mechanism function according to the program state information of the variable collected by the program state collection module 1234, and search for the relevant function according to the current object.

The dangerous behavior reporting module 122, the decompression module 128, the program structure building module 126, the entry function parsing module 127, and the flow sensitivity analyzing module 123 and the submodules thereof in the server 12 include: a matching module 1231, a malicious behavior detecting module 1232. The program state collection module 1234, the dynamic mechanism connection module 1233, and the command simulation module 1235 may be implemented by a central processing unit (CPU) in the server, or a digital signal processor (DSP). , or a Field-Programmable Gate Array (FPGA) implementation; the communication module 121 in the server can be implemented by a transceiver or a transceiver antenna in practical applications; the sensitive data in the server 12 is introduced The rule base 124 and the malicious behavior detection rule base 125 can be implemented by a memory or a storage database in practical applications.

The embodiment of the present invention will be described in detail below by taking the com. aijiaoyou. android, sipphone application as an example.

FIG. 3 is a schematic flowchart of a method for detecting an Android malicious application according to Embodiment 2 of the present invention. As shown in FIG. 3, the method includes the following steps: Step 301: The client sends the APK file of the Android application to be tested to the server, and the server extracts the APK file, and extracts the Dalvik bytecode file and the AndroidManifest.xml configuration file.

Here, the server decompresses the APK file by using decompression software such as WinRAR, and the APKTOOL.jar tool; the AndroidManifest.xml configuration file is an encrypted file, and can be decrypted by using AXMLPrinter2.jar, APKTOOL.jar, and the like.

Step 302: The server disassembles the Dalvik bytecode file and constructs a program structure according to the disassembled Dalvik bytecode file information.

Here, the extracted Dalvik bytecode file may be disassembled by using a disassembly tool such as smali, IDA pro, etc.; the structure of the Dalvik bytecode file according to the disassembled constructor includes an instruction structure, a basic structure, and a function structure. , class structure, function call graphs, control flow graphs, and more.

Step 303: The server parses the AndroidManifest.xml configuration file to obtain the entry function name, and finds the corresponding function structure from the constructed program structure, as an entry function of the simulation execution.

Here, the AndroidManifest.xml configuration file records detailed information related to the application running, and parses the AndroidManifest.xml configuration file to extract the value of the "android: name" field in the activity, service, receiver, provider, etc. as an entry. The function name, find the corresponding function structure from the constructed program structure, as the entry function of the simulation execution, taking InitOnlineActivity as an example, the corresponding entry function is:

InitOnline Activity. onCreate @VL;

InitOnlineActivity.onStart@V;

InitOnlineActivity. onKeyD o wn@ZIL and so on.

Step 304: The server starts from the entry function, according to the constructed program structure, simulates the calling sequence of the function and the execution order of the instructions in the function, and simulates the execution of each instruction in order according to the execution order of the instruction; Here, for the in-process analysis phase, the execution order of the instructions in the function is generated according to the control flow graph, and the traversal algorithm of the graph is used to ensure that each basic block is executed at least once; for the branch, each branch is guaranteed to be executed; , the instruction of the loop body part is guaranteed to be executed at least once; for the inter-process analysis stage, the call sequence of the function is generated according to the function call graph, and the function that should be called is calculated according to the parameter type of the function call point;

The calling sequence of the function may be specifically analyzed by using the semantic information of the function parameter, for example, according to the function calling instruction, first determining whether the function is a virtual function or an interface calling function, and when the result of the judgment is yes, according to the this parameter The type finds the function actually called; when the result of the judgment is no, it continues to determine whether the function is a user-implemented function; when the judgment determines whether the function is a user-implemented function, the result of the determination is yes, then The called function is internally executed, and the instruction execution module is used to calculate the instruction execution sequence of the called function; when it is determined whether the function is a user-implemented function, the determination result is no, then it is continued to determine whether the function is a dynamic mechanism. The function; when the judgment of whether the function is a dynamic mechanism function is YES, the dynamic mechanism connection module is entered to find a corresponding function, and the execution is sequentially performed, otherwise the analysis ends.

Step 305: During the execution of the simulation instruction, the server collects the program state information of the function variable, and uses the program state information of the collected variable to determine the actual call object of the dynamic mechanism function, and finds the relevant response function according to the actual call object.

Here, in the execution of the simulation instruction, the program status information of the server collecting the function variable includes collecting type information and value information of each variable; for some functions related to the dynamic mechanism, such as an interface calling function, a virtual function, etc. Using the program state information of the collected variables, the actual calling object is judged, and the relevant response function is searched according to the actual calling object.

Step 306: The server matches the sensitive feature information of the system function called by the Android application with the sensitive feature information stored in the rule base during the execution of the simulated Android application, and marks the variable of the successfully matched system function as Sensitive data. Some of the code snippets that match the sensitive data import rule base information are as follows:

1: invoke -virtual {this,vl } ,<ref InitOnlineActivity. getSystemService(ref)> 2: move-result-object vO

3: check-cast v0,<t: TelephonyManager>

4: invoke -virtual {vO} , <ref TelephonyManager .getDeviceId()>

5: move -result-object vl

Here, in the simulation execution process, when executing to the above code segment, wherein one to three lines of code are executed to obtain a system object of a TelephonyManager, the obtained system object of the TelephonyManager is saved in the vO variable; when executing to the fourth line of code When the TelephonyManager. getDeviceId() function reads the device number information of the user equipment, all the library function information related to reading the user's privacy is recorded in the sensitive data import rule base, and the getDeviceld rule in the sensitive data introduction rule base is as follows Shown as follows:

<FunName> getD e viceId</FunName>

<ClassName> TelephonyManager</ClassName>

< eyParamList>

</KeyParamList >

<ReturnTypeName>Default</ReturnTypeName>

</Function>

In the getDeviceld rule in the above-mentioned sensitive data I entry rule library, the function name is named getDeviceld, and the function class name is TelephonyManager. Therefore, when executing the fourth line of code, it is found that the current function satisfies a certain item in the rule base of sensitive data. Rule, according to the description of the rule, the return value of the current function needs to be marked as sensitive data, so when executing the code to the fifth line, The variable vl contains sensitive data and is marked as sensitive.

Step 307: The server matches the function containing the sensitive data with the malicious behavior characteristic information stored in the malicious behavior detection rule base, and marks the successfully matched function parameter as a malicious behavior.

Here, the malicious behavior detection rule base stores a detection rule of malicious behavior, and if one of the rules is satisfied, the detected function parameter is marked as a malicious behavior. The partial code segment of the transmitted user privacy data that matches the malicious behavior detection rule base is as follows:

1 : new-instance v9, <t: URL>

2: invoke-direct {v9,vl5},<void URL.<init>(ref)>

3: invoke -virtual {v9},<ref URL.openConnection()>

4: move -result-object v6

In the process of simulating the execution of the application, when executing the above code segment, after executing the first line, the URL system object is generated and stored in the v9 variable, and the object can communicate with the network server; when executing to the second line The vl5 variable is found to contain sensitive data, and then the information contained in the vl5 variable is stored in v9, which is the device number information in the above example; when the third line is executed, the current function is detected to satisfy the malicious behavior detection rule. A rule in the library, the openConnection rule in the malicious behavior detection rule base is as follows:

<FunName>openConnection</FunName>

< eyParamList>

<DefaultType> K/DefaultType>

</KeyParam>

<ParamValue>(http | https ftp file)://.* </ParamValue> <SinkType> 1 </SinkType>

</KeyParam>

</KeyParamList >

</Function>

In the code segment of openConnection* in the above malicious behavior detection rule base, the function name is openConnection, and the function class name is URL. According to the description of the rule, if the first parameter of the current function contains sensitive data, A malicious act that steals user privacy. Because v9 contains sensitive data, it triggers malicious behavior. The malicious behavior is to send the device number information to the remote server through the network. The return value of the current function needs to be marked as malicious. Therefore, When the fourth line of the partial code segment of the transmitted user privacy data matching the malicious behavior detection rule base is executed, the variable v6 contains a malicious behavior, which is marked as a malicious behavior.

Step 308: After the server simulates execution of the Android application, the detection report is output according to the matching result, and the detection report is sent to the client.

Here, for the detected malicious behavior, generate a malicious behavior detection report, describe in detail the triggering process of the current malicious behavior, the sensitive data of the operation and the harm caused, classify according to the detected dangerous behavior according to the dangerous behavior category, and calculate The degree of danger and its possible hazards, the program information such as the calling path of the dangerous behavior is output; after the detection is completed, the time spent detecting, the number of detected instructions, the number of functions detected, the command coverage, and the function are also output. Statistics such as coverage. The above information is finally represented in various forms such as graphical, XML, etc. The resulting generated detection report is sent by the server to the client.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Range of protection. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the invention are included in the scope of the invention. Industrial applicability

The embodiment of the present invention simulates an execution application program, and the sensitive feature information of the system function called by the application program is matched with the sensitive feature information stored in the rule base, and the variable of the successfully matched system function is marked as sensitive data; The function of the sensitive data matches the malicious behavior characteristic information stored in the malicious behavior detection rule base, and the function parameters matching the success are marked as malicious behavior. The technical solution of the embodiment of the present invention does not depend on the signature database obtained by manual analysis, which greatly reduces the workload of the technician; and does not depend on a specific trigger condition, and can complete all execution paths in a short time, which can be accurate Promptly detect malicious behavior of the application.

Claims

claims

1. An Android (Android) malicious application detection method, the method includes: The server simulates the execution of the Android application, and introduces the sensitive feature information and sensitive data of the system functions called by the application into the sensitive feature information stored in the rule base. Match, mark the variables of the successfully matched system function as sensitive data;

Match the functions containing sensitive data with the malicious behavior characteristic information stored in the malicious behavior detection rule base, and mark the successfully matched function parameters as malicious behaviors.

2. The method according to claim 1, wherein the method further includes:

After the execution of the simulated Android application is completed, the server generates a detailed description of the dangerous behavior based on the results that match the malicious behavior detection rule library, outputs a detection report, and reports the detection results to the client.

3. The method according to claim 1, wherein before the server simulates the execution of the Android application, the method further includes:

The client sends the Android installation package APK file of the Android application to be tested to the server, and the server decompresses the APK file and extracts the Dalvik bytecode file and the AndroidManifest.xml S configuration file in the APK file.

4. The method according to claim 3, wherein the method further includes:

The server disassembles the Dalvik bytecode file and constructs a program structure based on the Dalvik bytecode file information, including: instruction structure, basic structure, function structure, class structure, function call graph, and control flow graph;

The server parses the AndroidManifest.xml configuration file to obtain the entry function name, and finds the corresponding function structure from the constructed program structure as the entry function for simulation execution.

5. The method according to claim 1 or 4, wherein the server simulates executing an Android application program including:

The server starts from the entry function and simulates the calling sequence of the function based on the constructed program structure. The execution sequence of the instructions within the column and function, and simulates the execution of each instruction in sequence according to the execution order of the instructions.

6. The method according to claim 5, wherein the method further includes:

During the execution of the simulation instruction, the server collects the program status information of the function variables, and uses the collected program status information of the variables to determine the actual calling object of the dynamic mechanism function, and find the relevant response function based on the current object.

7. A server, the server includes: a communication module, a flow sensitivity analysis module, a sensitive data introduction rule base and a malicious behavior detection rule base;

The communication module is configured to receive the APK file sent by the client, and send the APK file to the flow sensitive analysis module;

The flow sensitive analysis module is configured to simulate the execution of the Android application based on the received APK file, match the sensitive feature information of the system function called by the Android application with the sensitive feature information stored in the sensitive data introduction rule base, and The variables of the successfully matched system functions are marked as sensitive data; it is also configured to match the function parameters containing sensitive data with the malicious behavior detection rules stored in the malicious behavior detection rule library, and mark the successfully matched function parameters as malicious behaviors. ;

The sensitive data is introduced into a rule base configured to store sensitive feature information;

The malicious behavior detection rule base is configured to store malicious behavior characteristic information.

8. The server according to claim 7, wherein the server further includes: a dangerous behavior reporting module configured to generate details of dangerous behaviors based on results matching the malicious behavior detection rule base after the execution of the simulated Android application is completed. Description: Output the detection report and send the detection report to the client via the communication module.

9. The server according to claim 7, wherein the server further includes: a decompression module, a program structure building module and an entry function parsing module;

The decompression module is configured to decompress the APK file sent by the client and extract the Dalvik bytecode file and AndroidManifest.xml configuration file in the APK file, send the Dalvik bytecode file to the program structure building module, and send the AndroidManifest.xml configuration file to the entry function parsing module;

The program structure building module is configured to disassemble the Dalvik bytecode file, construct a program structure based on the information of the Dalvik bytecode file, and send the constructed program structure to the flow-sensitive analysis module;

The entry function parsing module is configured to parse the AndroidManifest.xml configuration file to obtain the entry function name, find the corresponding function structure from the built program structure as the entry function to start analysis, and send the obtained entry function to The flow-sensitive analysis module.

10. The server according to any one of claims 7 to 9, wherein the flow sensitivity analysis module includes: a matching module and a malicious behavior detection module;

Is the matching module configured to combine sensitive feature information and sensitive data of system functions called by Android applications? The sensitive feature information in the rule base is matched, the variables of successfully matched system functions are marked as sensitive data, and the matched data are sent to the malicious behavior detection module for malicious behavior detection;

The malicious behavior detection module is configured to match function parameters containing sensitive data with malicious behavior characteristic information stored in the malicious behavior detection rule library, mark successfully matched function parameters as malicious behavior, and send the matching results to the Risky Behavior Reporting Module.

11. The server according to claim 7, wherein the flow-sensitive analysis module further includes an instruction simulation module configured to simulate the calling sequence of functions and the execution sequence of instructions within the function according to the program structure constructed by the program structure building module. , starting from the entry function obtained by the entry function parsing module, simulate the execution of each instruction in sequence.

12. The server according to claim Ί, wherein the flow-sensitive analysis module further includes: a program status collection module and a dynamic mechanism connection module; wherein:

The program status collection module is configured to collect functions during the simulated execution of instructions. Program status information of variables, and send the collected program status information of function variables to the dynamic mechanism connection module;

The dynamic mechanism connection module is configured to determine the actual calling object of the dynamic mechanism function based on the program status information of the function variables collected by the program status collection module, and find the relevant response function based on the current object.

13. An Android malicious application detection system, the system includes: a client and the server described in any one of claims 7 to 12;

The client is configured to send the APK file of the Android application to be tested to the server; it is also configured to receive the detection report sent by the server and report the detection results to the user.