WO2015056885A1

WO2015056885A1 - Detection device and detection method for malicious android application

Info

Publication number: WO2015056885A1
Application number: PCT/KR2014/008560
Authority: WO
Inventors: 김준섭; 황명국; 김동원
Original assignee: (주)이스트소프트; 주식회사 이스트시큐리티
Priority date: 2013-10-16
Filing date: 2014-09-15
Publication date: 2015-04-23
Also published as: KR20150044490A

Abstract

The present invention relates to a detection device and a detection method for a malicious Android application and, more specifically, to a detection device and a detection method for a malicious Android application, which are capable of detecting a malicious application by extracting some of the elements of a Manifest file and a Dex file inside an application package file to calculate a degree of similarity with a malicious application pattern. According to the present invention, a malicious application can be detected by analyzing the structure of data related to the execution of an application even when a part of data in an application package file is changed or a malicious code is repackaged into a normal application package.

Description

Android Malicious Application Detection Device and Detection Method

The present invention relates to a detection device and a detection method of an Android malicious application, and more particularly, by extracting a part of the components of the AndroidManifest file and the Classes file in the application package file to calculate the degree of identity and the degree of identity of the malicious application pattern The present invention relates to a detection device and a detection method of an Android malicious application.

Operating systems (OSs) that control the behavior of smartphones include Apple's iOS, Google's Android, Nokia's Symbian, RIM's BlackBerry, and Microsoft's Windows Mobile. have. Unlike iOS, which distributes applications only through the App Store operated by Apple, smartphones using Android OS can download applications through various paths.

Android-based applications, which are spread through various types of application markets, also include malicious code created for malicious purposes, which may lead to the leakage of information that users did not intend while using the application.

1 is a block diagram illustrating a structure of a smartphone malicious application detection system based on signature information according to the related art, and FIG. 2 is a flowchart illustrating a process of detecting and removing a malicious application using the detection system of FIG. 1.

Referring to FIG. 1, the malicious application detection system of the related art includes an analysis server 100 and a test smartphone 200, and the user smartphone 400 and an application market 500 through a communication network 300. Connect and exchange information and data.

The malicious application detection system obtains application information including signature information about an application newly installed in the user smartphone 400 from the malicious application detection program installed in the user smartphone 400. In addition, the malicious application detection system obtains an installation file for the corresponding application from the application market 500 or the like based on the application information transmitted from the user's smartphone 400, performs static analysis and dynamic analysis, and the result of the user smart. Provide back to phone 400.

The malicious application detection program provides a result of analyzing the malicious status of the newly installed application to the user, and when a delete command is input for the file, the malicious application detection program deletes and repairs the file.

The test smartphone 200 and the user smartphone 400 may be installed and used by the user. The test smartphone 200 is a smartphone used by a malicious application detection system administrator connected to the analysis server 100 to detect a malicious application, and the user smartphone 400 is installed with a malicious application detection program in an application form. The detection result of the application is notified to the user, and the treatment is performed according to the user's selection.

The communication network 300 includes both the Internet, mobile communication networks such as 3G and 4G, Wi-Fi, WIBRO, and the like.

The analysis server 100 includes a static analysis module 110 for malicious application detection, a database 120 storing various information for supporting malicious application detection, and an application collection module 130 for collecting the analysis target application. .

The app collection module 130 obtains an app installation file from the app market 500 using the app package name transmitted from the malicious app detection program, or based on the app download location information included in the app information and transmitted, the app installation file. Acquire.

The DB 120 stores signature information (MD5 hash value, SHA1, application package name, etc.) for an application already registered as malicious. In addition, the database 120 stores in advance the information on the API available for malicious behavior among API (Application Program Interface) used in the smartphone operating system.

Referring to FIG. 2, first, the user smartphone 400 receives and installs a malicious application detection program from a download server operated in an application market or a malicious application detection system (S210).

And if there is an installation attempt for a new application in the user smartphone 400 (S215), the malicious application detection program extracts the signature information for the corresponding application from the application installation file and transmits it to the analysis server 100 (S220).

Then, the analysis server 100 determines whether the malicious application by comparing the application signature information transmitted from the user smartphone 400 with the signature information of the malicious application registered in the database 120 (S230). If it is determined that the malicious application in the previous step (S230) (S230-Y), it can immediately provide a malicious application detection result to the user smartphone 400 (S270).

On the other hand, if it is not determined to be a malicious application (S230-N), the analysis server 100 collects the installation file of the analysis target application from the app market 600, etc. through the app collection module 130 (S240).

Next, the analysis server 100 performs a static analysis operation for the application installation file through the static analysis module 110 (S250).

The static analysis module 110 extracts an executable file (for example, a DEX file for Android) from the app installation file by extracting an application installation file (for example, an APK file for Android). And it generates static analysis result including contents of malicious behavior related to malicious behavior available API. For example, a static analysis result is generated that includes information on whether the extracted API is related to personal information leakage, inducing abnormal charging, or abnormally operating the smartphone.

If it is determined that the malicious application, the analysis server 100 is requested to remove the malicious application from the user smartphone 400, the detection and removal of the malicious application is completed.

However, the existing methods of detecting malicious Android applications such as the prior art include data such as a package name existing in the AndroidManifest.xml file, a CRC value in a classes.dex file, a SHA-1 value, a class name, a string, and an MD5 value of an APK file. After combining hash values or enumerated values, hash values are taken and used as detection patterns. In other words, it uses signature-based detection method that uses specific unique value.

Conventional signature-based detection techniques are not detected when some of the data in the malicious application file changes or when the malware is repackaged into a normal application. That is, when a variant of a malicious application occurs, there is a problem in that even if the code of the malicious application is not changed, it is not detected.

The present invention to solve the above-mentioned problems is extracted the component and permission information from the AndroidManifest.xml file included in the Android-based application package file, the string. After comparison, the object of the present invention is to provide a detection device and detection method for Android malicious applications that can be classified into malicious or normal applications according to similarity.

In addition, the present invention is divided into parts of the pattern of the data contained in the malicious application stored in the database in advance, and the detection of the android malicious application to give a similarity according to how much the pattern of the malicious application is included in the extracted data pattern An object of the present invention is to provide an apparatus and a detection method.

The present invention devised to solve the above-mentioned problem is a system for detecting malicious applications by analyzing an Android application package (APK), AndroidManifest.xml file (hereinafter referred to as "Manifest file") and the inside of the Android application package; A detection data extracting unit 111 for extracting detection data necessary for detecting malicious code from a Classes.dex file (hereinafter referred to as a 'Dex file'); A detection data DB 112 for storing the detection data extracted from the manifest file and the dex file by the detection data extraction unit 111; A detection engine that determines whether malicious code is included by using the detection data, and classifies an application package to be diagnosed as a malicious application when a pattern matching a pattern of a malicious application package is included in the detection data. 113; And a malicious pattern DB 114 for storing a pattern included in an application determined to be malicious, wherein the detection data includes a component included in the manifest file, permission information, and a string included in the Dex file. ) Data and class data.

The component is a code that becomes a basic unit of a user interface (UI) of the application, and includes activity information that functions to provide an interface for interacting with a user; Service information which is code for a task executed in the background of the application; It is a code that is called by an operating system (OS) as a broadcast receiver, and includes receiver information for receiving and processing a message generated by an intent.

According to another exemplary embodiment of the present invention, a method of detecting a malicious application by analyzing an Android application package is provided. The detection data extracting unit 111 detects data necessary for detecting malicious codes in Manifest files and Dex files inside the Android application package. Extracting the first step; A second step of classifying the application package to be diagnosed as a malicious application when the detection engine 113 includes a pattern that matches a pattern of a malicious application package stored in the malicious pattern DB 114 in the detection data. The detection data may include component and permission information included in the manifest file, string data and class data included in the Dex file.

The component is a code that is a basic unit of the UI of the application, the activity information to function to provide an interface for interaction with the user; Service information which is code for a task executed in the background of the application; It is a code called by the OS as a broadcast receiver, and includes receiver information for receiving and processing a message generated by an intent.

According to the present invention, even when a part of data in an application package file is changed or malware is repackaged in a normal application package, a malicious application can be detected by analyzing a structure of data related to execution of the application.

In addition, the pattern of malicious code stored in the database can be used for analysis of a plurality of application package files, thereby detecting a large number of modified malicious application packages.

1 is a block diagram showing the structure of a smartphone malicious application detection system based on the signature information according to the prior art.

Figure 2 is a flow chart illustrating a process of detecting and removing malicious applications using the detection system of FIG.

Figure 3 is a block diagram showing a connection state of the detection apparatus according to an embodiment of the present invention.

Figure 4 is a block diagram showing the internal structure of the malicious app detection device.

5 is a block diagram showing the structure of a manifest file;

Fig. 6 is a diagram showing an example of actual creation of the manifest file of Fig. 5;

7 is a block diagram showing the structure of a Dex file.

FIG. 8 is a diagram showing an example of actual creation of a Dex file of FIG.

9 is a flow chart showing the operation of the detection method of the present invention.

Hereinafter, with reference to the drawings will be described "detection apparatus and detection method of an android malicious application" according to an embodiment of the present invention.

Figure 3 is a block diagram showing the connection state of the detection device according to an embodiment of the present invention, Figure 4 is a block diagram showing the internal structure of the malicious app detection device, Figure 5 is a block diagram showing the structure of the AndroidManifest file, Figure 6 Is a diagram showing an example of actual creation of AndroidManifest of FIG. 5, FIG. 7 is a block diagram showing the structure of a Classes file, and FIG. 8 is a diagram showing an example of actual creation of a Classes file of FIG.

The "detecting device of an android malicious application" (hereinafter referred to as "detecting device") of the present invention is installed in any one of the user terminal 100, the application providing system 300, the detection server 400.

The user terminal 100 of the present invention refers to a smartphone or tablet PC installed with the Android-based OS. The detection device 110 installed in the user terminal 100 monitors whether the malicious application is included in the Android application installed or used by the user, and stops or deletes the execution of the application including the malicious code. When the detection device 110 is installed in the user terminal 100, the detection device 110 operates when the application is installed or executed to detect malicious code.

The application providing system 300 is a system for providing an application program to the user terminal 100 through online, and operates an operating system such as 'Play Store' operated by Google (Google) or 'Samsung Apps' operated by Samsung Electronics. Include. The detection device 110 installed in the application providing system 300 checks whether the malicious code is included before distributing the application provided by the system, thereby preventing the malicious code from being distributed.

Detection server 400 is a surveillance system that exists separately from the user terminal 100 or the application providing system 300, it is generally a system of a company that provides a malicious code vaccine program. The detection server 400 collects new applications in real time or periodically to investigate whether malicious code is included.

The detection apparatus 110 of the present invention is installed in software, and it is most preferable to operate the user terminal 100 in which the installation and execution of the application are performed.

The user terminal 100 is connected to the application providing system 300 or the detection server 400 through a communication network 200, such as 3G or 4G mobile communication network or wired or wireless Internet.

The detection device 110 extracts data used for malware detection from an application and analyzes an execution pattern of a program included in the extracted data to analyze whether the operation is the same as that of the malicious code. As a result of the analysis, it finds an application that behaves like the malicious code pattern and classifies it as a malicious application, and classifies an application as a normal application.

The detection device 110 includes a detection data extracting unit 111, a detection data DB 112, a detection engine 113, and a malicious pattern DB 114.

Detection data extracting unit 111 detects malicious code in AndroidManifest.xml file (hereinafter referred to as 'Manifest file') and Classes.dex file (hereinafter referred to as 'Dex file') inside the Android application package (APK). Extract detection data to help The detection data is a part which does not change even when the application package is modified or repackaged, and details thereof will be described later.

The detection data DB 112 stores the detection data extracted from the manifest file and the Dex file by the detection data extracting unit 111 and delivers the detection data to the detection engine 113 to use for analyzing the malicious code.

The detection engine 113 determines whether the malicious code is included by using the extracted detection data, and calculates the matching degree by calling a pattern of the malicious APK stored in the malicious pattern DB 114. If it is found to have the same pattern as the malicious APK above a certain level, it is classified as a malicious application. In order to analyze the detection engine 113, the malicious pattern DB 114 stores data on execution patterns of malicious codes that are already classified as malicious application packages by other detection systems.

Detection data necessary for analysis of the detection device 110 is extracted from the manifest file and the Dex file.

To extract the detection data, first load the application package to be analyzed and extract the manifest and dex files by decompressing (decompiling) the application package. Extraction of the manifest file and the dex file may be performed by the detection apparatus 110 or may be executed by a separate system. The extracted manifest file and the dex file are delivered to the detection device 110 to analyze the application.

Manifest file is a file that contains information about what kind of activity the application is doing and what permissions it needs. It includes application information such as project version, name, and execution permission. As shown in FIG. 5, the manifest file includes a package name, a component, and permission information.

The package name is a part of recording the unique name of the application package, and in the Android app market, only one application having a specific package name may exist (1 in FIG. 6).

Components include activity information, service information, and receiver information.

Activity information is a code that is a basic unit of an application user interface (UI), and serves to provide an interface for interacting with a user (2 in FIG. 6).

The service information is code for a task executed in the background of the application and is not exposed to the user (3 in FIG. 6).

The receiver information is a code called by the OS as a broadcast receiver, and is a code for receiving and processing a message generated by an intent. Receiver information is responsive to certain events, such as SMS reception (④ in FIG. 6).

The permission information defines an authority for an operation performed when the application is executed. (⑤ of FIG. 6) In order to perform an action such as receiving an SMS while the application is executed, the permission information must be requested to the OS. Write this to the manifest file.

Among them, the detection data extraction unit 111 extracts the component and permission information and delivers the detected information to the detection engine 113. The component extracts the action field and property values defined in each field.

On the other hand, Dex file is an executable file created by compiled Java class, which converts Java class file into byte code for recognition by Dalvik Virtual Machine of Android terminal. . The Dalvik virtual machine loads specific Java classes from a Dex file to execute the application's intended behavior. As shown in FIG. 7, the Dex file includes a header, string data, and class data.

The string data is a string used by the application and exists inside the Dex file (3 in FIG. 8).

The class data is a class list used by the application and includes a method list for each class (④ in FIG. 8).

Such manifest files are decompiled into text documents by the decompiler, and the dex files are decompiled into cut files (* .jar) or Java files (* .java).

The detection data extracting unit 111 extracts data to be used for detecting malicious applications (hereinafter, referred to as 'detection data') from the decompiled manifest file and the dex file. In the manifest file, component and permission information is extracted. Extract string data and class data.

The extracted detection data (component, permission information, string data, class data) is stored in the detection data DB 112 and provided to the detection engine 113. When the extraction and analysis is performed in real time, it may be directly transmitted from the detection data extraction unit 111 to the detection engine 113.

The detection engine 113 analyzes the transmitted detection data to determine whether a malicious application pattern exists. The malicious application pattern that the detection engine 113 uses as a comparison target is stored in the malicious pattern DB 114.

[Reference Figure 1]

1 is an example of a pattern stored in the malicious pattern DB 114, and is composed of components that are contrasted with components included in a manifest file and a dex file. Although the present invention illustrates one of the representative patterns, there are various values in the actual application package.

[Reference Figure 2]

2 is a diagram illustrating a package in a state using unique values for each component of an application. The detection device 110 classifies a malicious application when the same data or character string is included in the detection data extracted from the application package to be detected. If the degree of identity is below a certain level or if there is no identical data at all, it is classified as a normal application.

9 is a flowchart illustrating an operation process of a detection method of the present invention.

9, a detailed operation process of the detection apparatus 110 of the present invention will be described in order.

First, a search for an application package to be determined whether the malicious application package is included (S202) The subject of the search may vary depending on the installation location of the detection device 110, generally in the user terminal 100 The installed detection device 110 diagnoses an application package installed or being installed in the user terminal 100.

A separate control unit (not shown) decompresses the application package to be diagnosed (S204). The application package is a compressed file in a ZIP format, and includes a manifest file, a dex file, metadata, an image, and other files. . Among them, Manifest file and Dex file are the target of detection.

The detection data extraction unit 111 extracts detection data from the decompressed manifest file and the Dex file (S206). The detection data extraction unit 111 extracts the component and permission information from the manifest file and the string data from the Dex file. Extract class data.

The extracted detection data is stored in a file or memory, and information about the stored location is transmitted to the detection engine 113 (S208).

The detection engine 113 analyzes the patterns included in the extracted detection data and checks whether a malicious application pattern exists. (S210) The malicious application pattern to be compared is called by the malicious pattern DB 114.

The detection engine 113 classifies the malicious application when the malicious application pattern is included in the pattern included in the detection data. The detection data includes component data, permission information, string data, and class data, and each data may include a plurality of patterns. The detection engine 113 may be classified as a malicious application when not only the entire method list matches but also the same pattern as a result of partial matching of the method list.

In some cases, if a pattern that is exactly the same as a malicious application pattern is found, it may be classified as a malicious application, and may be classified as a suspicious application when a partially identical but partially identical string is found. If none of the same patterns are found, they can be classified as normal applications.

Although the preferred embodiments of the present invention have been described above with reference to the accompanying drawings, the above-described technical configuration of the present invention may be embodied by those skilled in the art to which the present invention pertains without changing its technical spirit or essential features of the present invention. It will be appreciated that the present invention may be practiced as. Therefore, the above-described embodiments are to be understood as illustrative and not restrictive in all respects, and the scope of the present invention is indicated by the appended claims rather than the detailed description, and the meaning and scope of the claims and All changes or modifications derived from the equivalent concept should be interpreted as being included in the scope of the present invention.

Claims

A system that detects malicious applications by analyzing Android Application Packages (APKs).

Detection data extraction for extracting detection data necessary for detecting malicious code from AndroidManifest.xml file (hereinafter referred to as 'Manifest file') and Classes.dex file (hereinafter referred to as 'Dex file') inside the Android application package Section 111;

A detection data DB 112 for storing the detection data extracted from the manifest file and the dex file by the detection data extraction unit 111;

A detection engine that determines whether malicious code is included by using the detection data, and classifies an application package to be diagnosed as a malicious application when a pattern matching a pattern of a malicious application package is included in the detection data. 113;

It includes; malicious pattern DB 114 for storing a pattern included in the application determined to be malicious,

The detection data comprises a component and permission information contained in the manifest file, string data and class data contained in the Dex file, characterized in that the detection device of the android malicious application.
The method of claim 1,

The component is

Activity information that serves as a basic unit of a user interface (UI) of the application, and serves to provide an interface for interacting with a user;

Service information which is code for a task executed in the background of the application;

A code that is called by an operating system (OS) as a broadcast receiver and includes receiver information for receiving and processing a message generated by an intent.
A method of detecting malicious applications by analyzing Android application packages.

A first step of extracting, by the detection data extracting unit, detection data necessary for detecting malicious code from a manifest file and a Dex file in the Android application package;

A second step of classifying the application package to be diagnosed as a malicious application when the detection engine 113 includes a pattern that matches a pattern of a malicious application package stored in the malicious pattern DB 114 in the detection data. ,

The detection data comprises a component and permission information included in the manifest file, string data and class data included in the Dex file, Android malicious application detection method.
The method of claim 3,

The component is

Activity information serving as a basic unit of the UI of the application, the function providing a interface for interacting with a user;

Service information which is code for a task executed in the background of the application;

The code is called by the OS as a broadcast receiver, the receiver information for receiving and processing a message generated by the Intent; including, Android malicious application detection method.