WO2015196982A1

WO2015196982A1 - Android malicious program detecting and processing methods and apparatuses, and device

Info

Publication number: WO2015196982A1
Application number: PCT/CN2015/082123
Authority: WO
Inventors: 沈江波; 陈章群; 张楠; 陈勇
Original assignee: 北京金山安全软件有限公司
Priority date: 2014-06-27
Filing date: 2015-06-23
Publication date: 2015-12-30
Also published as: CN105335654A; CN105335654B

Abstract

An Android malicious program detecting method. The method comprises: monitoring whether the call of an ACTIVITY by an application program meets a preset rule (S100); monitoring whether a specific type of file corresponding to the application program exits in a system (S101); and determining whether the application program is a malicious program according to a monitoring result (S102). An Android malicious program detecting apparatus, an Android malicious program processing method and apparatus, and a smart terminal device. The methods can accurately detect and process a malicious application that is installed in an operating system of a mobile device of a user and aims to blackmail the user by controlling a user desktop, preventing uninstallation performed by the user and encrypting a file of the user, and therefore the security of the system is improved.

Description

Android malicious program detection and processing method, device and device

This application claims priority to Chinese Patent Application No. 201410302960.3, entitled "An Android Malicious Program Detection and Processing Method, Apparatus and Apparatus", which is filed on June 27, 2014, the entire contents of which are hereby incorporated by reference. Combined in this application.

Technical field

The present invention relates to the field of mobile Internet information security technologies, and in particular, to a malicious virus detection and processing method, device and device.

Background technique

With the development of the Android system, there are more and more applications in the Android system. Generally, in the Android terminal-based mobile terminal device, all installed applications can be managed in the system settings, including the application. Stop, uninstall, etc. of the program.

Since the source of the Android system application is relatively wide, the user usually does not have the ability to distinguish whether the installed application is a malicious program, and once the malicious application is installed, it will bring a lot of inconvenience to the user. A typical example is a malicious application such as Cryptolocker, which controls the user's device desktop and constantly asks the user to pay a fine to unlock it; it also encrypts the data files in the user's device using an encryption algorithm. Common encrypted data objects include the user's audio and video files, making it impossible for users to access and use these data files. The user must complete the payment before unlocking, decrypting the audio and video files, and restoring the device to normal use. If the user attempts to perform other clicks or actions to uninstall the malicious application, the malicious application will automatically cancel the user behavior and request the user to pay again. Usually, once the user device operating system is infected with such a malicious application virus, the user will not be able to remove the malicious application, and the user device will become completely unavailable. The only solution can only be sent back to the factory for reset, and reset. The behavior will completely destroy the data stored by the user, causing irreparable damage to the user. Further, even if the user uninstalls the malicious program, the file encrypted by the malicious program cannot be used normally, and the user data can only be processed as a useless file, which also brings a lot of trouble to the user.

Summary of the invention

The present application provides an Android malicious application detection and processing method, which can accurately detect whether the mobile device operating system has such a way to control the user desktop, prevent the user from uninstalling, and encrypt the user file to achieve blackmail fraudulent users. The malicious application of the purpose.

An embodiment of the present application provides a method for detecting an Android malicious program, including:

Whether the monitoring application's call to ACTIVITY conforms to a preset rule, and whether there is a specific type of file corresponding to the application in the system;

Whether the application is a malicious program is determined based on the result of the monitoring.

The embodiment of the present application further provides an Android malicious program processing method, where the method is applicable to the malicious program, and the method includes:

Monitoring the first call cycle T1 of the malicious program for ACTIVITY;

Setting a second calling period T2, wherein T2 is less than T1;

Initiating a malicious program to delete the boot program, causing the malicious program to delete the boot program to call ACTIVITY in the second call cycle T2;

The preset decryption algorithm function is called, and the file encrypted by the malicious program is decrypted using a preset key string.

Correspondingly, the embodiment of the present application further provides an Android malicious program device, including:

a first monitoring module, configured to monitor whether an application invokes an ACTIVITY conforms to a preset rule, and whether a specific type of file corresponding to the application exists in the system;

And a determining module, configured to determine, according to the result of the monitoring, whether the application is a malicious program.

Correspondingly, the embodiment of the present application further provides an Android malicious program processing device, where the device is adapted to process the malicious program, and the device includes:

a second monitoring module, configured to monitor the first calling period T1 of the malicious program for ACTIVITY;

Setting a module, configured to set a second calling period T2, wherein T2 is less than T1;

The startup module is configured to start the malicious program to delete the boot program, so that the malicious program deletes the boot program to call ACTIVITY in the second calling period T2;

The decryption module is configured to invoke a preset decryption algorithm function, and decrypt the file encrypted by the malicious program by using a preset key string.

Correspondingly, the embodiment of the present application further provides a storage medium, where the storage medium is used for An application is stored for executing an Android malicious program detection method described herein at runtime.

In order to achieve the above object, an embodiment of the present application further provides an application, where the application is used to execute an Android malicious program detection method described in the present application at runtime.

In order to achieve the above object, an embodiment of the present application further provides a storage medium, where the storage medium is used to store an application, and the application is configured to execute an Android malicious program processing method described in the present application at runtime. .

In order to achieve the above object, an embodiment of the present application further provides an application, where the application is used to execute an Android malicious program processing method described in the present application at runtime.

In order to achieve the above object, the embodiment of the present application further provides a terminal device, including:

a processor, a memory, a communication interface, and a bus;

The processor, the memory, and the communication interface are connected by the bus and complete communication with each other;

The memory stores executable program code;

The processor runs a program corresponding to the executable program code by reading executable program code stored in the memory for:

In order to achieve the above object, the embodiment of the present application further provides a terminal device, which is suitable for processing the malicious program, and includes:

a processor, a memory, a communication interface, and a bus;

The memory stores executable program code;

Monitoring the first call cycle T1 of the malicious program for ACTIVITY;

Setting a second calling period T2, wherein T2 is less than T1;

The implementation of the embodiment of the present application has the following beneficial effects:

By monitoring the application's call to ACTIVITY, it is possible to locate a specific application. When the application's call to ACTIVITY conforms to a preset rule, and the system in the monitoring exists in a specific type of file corresponding to the application, The application is determined to be a malicious program that occupies the user's desktop, prevents the user from uninstalling, and encrypts the user's files. Through the embodiments of the present application, such Android malicious applications can be accurately detected and processed to protect user equipment security.

DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings to be used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present application, and other drawings can be obtained according to the drawings without any creative work for those skilled in the art.

1 is a schematic flowchart of a method for detecting a malicious application of Android according to an embodiment of the present application;

2 is a schematic flowchart of another method for detecting a malicious application of Android according to an embodiment of the present application;

3 is a schematic flowchart of a method for processing a malicious program of an Android provided by an embodiment of the present application;

4 is a schematic structural diagram of an Android malicious program detecting apparatus according to an embodiment of the present application;

FIG. 5 is another schematic structural diagram of an Android malicious program detecting apparatus according to an embodiment of the present application;

FIG. 6 is a schematic structural diagram of an Android malicious program processing apparatus according to an embodiment of the present application.

detailed description

The technical solution in the embodiment of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application. It is clear that the described embodiments are only a part of the embodiments of the present application, and not all of them. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

Activity is one of the most basic and most commonly used components of the Android component (Activity, Service Service, Content Provider Content Provider, BroadcastReceiver Broadcast Receiver).

All operations in the Activity are closely related to the user. It is a component responsible for interacting with the user. In an android application, an Activity is usually a separate screen, which can display some controls, and can also listen to and process user events. Out of response.

In android, Activity has four basic states:

After a new Activity is launched onto the stack, it is displayed at the front end of the screen. The processing is at the top of the stack (the top of the Activity stack). At this time, it is in an active state that is visible and can interact with the user. It is called active or running (active). OR running).

When the Activity loses focus, it is placed on the top of the stack by a new non-full-screen Activity or a transparent Activity. The state at this time is called Paused. At this point it remains connected to the window manager, the activity remains viable (maintaining all state, member information, and the window manager remain connected), but will be forcibly terminated when the system memory is extremely low. So it's still visible, but it has lost its focus and can't interact with the user.

If an Activity is completely covered by another Activity, it is called Stopped. It still maintains all state and member information, but it is no longer visible, so its window is hidden. When the system memory needs to be used elsewhere, the Stopped Activity will be forcibly terminated.

If an Activity is Paused or Stopped, the system can delete the Activity from memory. The Android system deletes it in two ways, either requiring the Activity to end or directly terminating its process. When the Activity is displayed to the user again, it must restart and reset the previous state.

Android manages the Activity through an Activity stack. The state of an Activity instance determines its position on the stack. The activity in the foreground is always in At the top of the stack, when the current Activity of the station is destroyed due to an exception or other reasons, the Activity at the second level of the stack will be activated and floated to the top of the stack. When the new Activity is launched onto the stack, the original Activity will be pushed to the second layer of the stack. The change in the position of an Activity on the stack reflects its transition between states.

Cryptolocker and similar malicious applications take advantage of this feature of Activity, by constantly calling a new Activity, to generate a new screen, when the user clicks on other operations, the application will call the new Activity to override the Activity of other applications clicked by the user, so This type of application occupies the user's desktop, the user will not be able to remove the malicious application, and the user device will become completely unavailable.

In addition, the upgraded version of Cryptolocker also uses the public encryption algorithm AES algorithm to encrypt the personal files commonly used by users. For example, after the user's video and audio files are encrypted, the user cannot open and use them normally, only when the user pays Virus writers can decrypt these files.

For the malicious application described above, the present application provides a method for detecting a malicious application of the Android. Referring to FIG. 1 , FIG. 1 is a schematic flowchart of a method for detecting a malicious application of the Android provided by the embodiment of the present application. The method includes:

S100. The monitoring application calls the ACTIVITY;

This type of malicious application mainly utilizes the characteristics of the ACTIVITY stack to periodically call the ACTIVITY. This application mainly monitors the calling behavior of ACTIVITY to determine whether it maliciously occupies the user's desktop.

Further, the preset rule includes: the application periodically calls the ACTIVITY; the preset rule is obtained by a local or server

S101. Is there a specific type of file corresponding to the application in the monitoring system;

For the behavior of such a malicious virus, mainly monitoring whether there is a file encrypted by the malicious program in the user equipment system, including monitoring whether there is a specific folder corresponding to the application in the system, such as a specific file for a specific application. The folder further includes monitoring a specific extension file corresponding to the application in the system, and the virus program encrypts the user file and then changes the user file suffix extension, for example, modifying the original video or audio file to be an enc file.

S102. Determine, according to the result of the monitoring, whether the application is a malicious program.

By monitoring the application, it is true that the ACTIVITY is called periodically and frequently, so that the user has no The normal use of other applications, and the application cannot be uninstalled in the normal way; then the application can be initially determined to be a malicious program;

Optionally, when it is further monitored whether there is a file encrypted by the malicious program in the user equipment system, such as a specific folder corresponding to the application, or a specific extension file corresponding to the application, The application can be determined to be a malicious program.

FIG. 2 is another schematic flowchart of an Android malicious application detection method according to an embodiment of the present application. In the embodiment of the present application, the method includes:

S200. The monitoring application calls the ACTIVITY;

S201. Is there a specific type of file corresponding to the application in the monitoring system;

S202. Upload feature information corresponding to the application to the server, so that the server determines, according to the feature information, whether the application is a malicious program.

In order to confirm the maliciousness of the application, the feature information of the application may be uploaded to the server for determination. The specific feature information includes a package name and/or an MD5 value of the application, and further optionally, Includes behavioral characteristics information for the application.

S203. Receive a malicious program determination result sent by the server, and perform a preset operation according to the determination result.

Specifically, the malicious program judgment result sent by the server is received, and when the determination result indicates that the application program is a malicious program, the application program is deleted.

Further optionally, the malicious program processing information sent by the server is received, and when the processing information indicates that the file is a file encrypted by a malicious program, the file is decrypted according to the malicious program processing information.

Optionally, in other embodiments of the present application, the method may further include: after the application is deleted successfully, uploading the processing result of the malicious program to the server. And uploading device information of the device where the malicious program is located to the server.

By performing monitoring, the application does periodically and periodically call ACTIVITY and whether there is a specific type of file corresponding to the application in the system for preliminary determination; and then uploading the feature information of the application to the server for further confirmation, combining The preliminary determination result can accurately determine whether the application is a malicious program; or

By monitoring that the application does call ACTIVITY periodically and frequently, and whether there is a specific type of file corresponding to the application in the system, uploading the feature information of the application to the server, it may be determined whether the application is Malicious program.

FIG. 3 is a schematic flowchart of a method for processing an Android malicious program according to an embodiment of the present disclosure. The method in this embodiment is applicable to the malicious program in the method shown in FIG. 1 and FIG. 2, and the method in this embodiment includes:

S300, monitoring the first call period T1 of the malicious program for ACTIVITY;

The malicious application mainly utilizes the characteristics of the ACTIVITY stack, and periodically calls ACTIVITY to occupy the user's desktop, so the malicious application can be monitored to obtain the ACTIVITY calling period T1;

S301, setting a second calling period T2, wherein T2 is less than T1;

S302. Start a malicious program to delete the booting program, so that the malicious program deletes the booting program to call ACTIVITY in the second calling period T2.

Setting the calling period T2 smaller than T1, the purpose is to preempt the ACTIVITY instance of the uninstaller before the malicious program, and create conditions for the user to uninstall the malicious application.

Further, the malicious program deletion boot program receives a malicious program deletion instruction of the user, and deletes the malicious program.

Specifically, the malicious program deletion boot program completes deletion of the malicious program by calling a deletion program of the Android system.

When the boot program is started, the boot program calls the ACTIVITY instance of the uninstaller. At this time, the ACTIVITY instance of the uninstaller is placed on the top of the ACTIVITY stack, and the user is visible. Therefore, the user can click the uninstaller to uninstall the malicious program. If the uninstall program is not clicked in time during the T1 period, the malicious program will call its own ACTIVITY instance in the next cycle. At this time, the malicious program is deleted because the calling period T2 of the malicious program deletion boot program is smaller than the calling period T1 of the malicious program. The bootloader is started again, and the ACTIVITY instance of the uninstaller is called with the second call cycle T2. Therefore, it can be ensured that the malicious program removal boot program can always call the deletion program before the malicious program to help the user uninstall the malicious application.

S303. Call a preset decryption algorithm function, and add the malicious program by using a preset key string. The encrypted file is decrypted.

The preset decryption algorithm function and the preset key string are obtained by a local or server. Specifically, by unpacking and decompiling the apk file of the malicious program, the function of the encryption algorithm used by the malicious program, such as the AES encryption function, is analyzed; and the function of the encryption algorithm is analyzed, and the encryption function can be obtained. Key information. Therefore, the decryption function corresponding to the encryption function can be called, and the obtained user information can be used to decrypt the user file encrypted by the malicious program.

4 is a schematic structural diagram of an Android malicious program detecting apparatus according to an embodiment of the present application. In the embodiment of the present application, the apparatus includes:

The first monitoring module 100 is configured to monitor whether the application invokes the ACTIVITY according to a preset rule, and whether a specific type file corresponding to the application exists in the system;

The determining module 101 is configured to determine, according to the result of the monitoring, whether the application is a malicious program;

Specifically, the preset rule includes: the application periodically calling the ACTIVITY.

Further, the preset rule is obtained by a local or server.

By monitoring the application, the ACTIVITY is called periodically and frequently, so that the user cannot use other applications normally and cannot uninstall the application in a normal manner. If the user data file is further monitored to be encrypted, the application can be initially determined. For malicious programs.

FIG. 5 is another schematic structural diagram of an Android malicious program detecting apparatus according to an embodiment of the present application. In the embodiment of the present application, the apparatus includes:

The first monitoring module 200 is configured to monitor whether the application invokes the ACTIVITY according to a preset rule, and whether a specific type file corresponding to the application exists in the system;

The determining module 201 is configured to determine, according to the result of the monitoring, whether the application is a malicious program;

Further, the preset rule is obtained by a local or server.

The first uploading module 202 is configured to upload feature information corresponding to the application to the server, so that the server determines whether the application is a malicious program based on the feature information.

In order to further confirm the maliciousness of the application, the feature information of the application may be uploaded to the server for determination, and the specific feature information includes a package name and/or an MD5 value of the application.

Further optionally, the device may further include:

The first receiving module 203 is configured to receive a malicious program determination result sent by the server;

The deleting module 204 is configured to delete the application when the determining result indicates that the application is a malicious program.

By monitoring whether the application program periodically calls ACTIVITY, whether a specific type of file corresponding to the application exists in the system, and uploading feature information of the application to the server for judgment, the combination of the determination result may be accurate. Determining whether the application is a malicious program, and then further deleting the malicious application.

Further optionally, the device may further include:

a second receiving module 205, configured to receive malicious program processing information sent by the server;

The decryption module 206 is configured to decrypt the file according to the malicious program processing information when the processing information indicates that the file is a file encrypted by a malicious program.

Further optionally, the device may further include:

The second uploading module 207 is configured to upload a processing result of the malicious program to a server.

FIG. 6 is a schematic structural diagram of an Android malicious program processing apparatus according to an embodiment of the present application. In the embodiment of the present application, the apparatus includes:

a second monitoring module 300, configured to monitor a first calling period T1 of the malicious program for ACTIVITY;

The setting module 301 is configured to set a second calling period T2, where T2 is less than T1;

The startup module 302 is configured to start the malicious program deletion booting program, so that the malicious program deletes the boot program to call ACTIVITY in the second calling period T2;

The decryption module 303 is configured to invoke a preset decryption algorithm function, and decrypt the file encrypted by the malicious program by using a preset key string.

Specifically, the preset decryption algorithm function and the preset key string are obtained by a local or server end.

Correspondingly, the embodiment of the present application further provides a storage medium, where the storage medium is used to store an application, and the application is used to execute an Android malicious program detection method described in the present application at runtime. The Android malicious program detection method described in the present application includes:

In order to achieve the above object, an embodiment of the present application further provides an application, where the application is used to execute an Android malicious program detection method described in the present application at runtime. The Android malicious program detection method described in the present application includes:

In order to achieve the above object, an embodiment of the present application further provides a storage medium, where the storage medium is used to store an application, and the application is configured to execute an Android malicious program processing method described in the present application at runtime. . The Android malicious program processing method described in the present application is applicable to processing the malicious program, including:

Monitoring the first call cycle T1 of the malicious program for ACTIVITY;

Setting a second calling period T2, wherein T2 is less than T1;

In order to achieve the above object, an embodiment of the present application further provides an application, where the application is used to execute an Android malicious program processing method described in the present application at runtime. The Android malicious program processing method described in the present application is applicable to processing the malicious program, including:

Monitoring the first call cycle T1 of the malicious program for ACTIVITY;

Setting a second calling period T2, wherein T2 is less than T1;

a processor, a memory, a communication interface, and a bus;

The memory stores executable program code;

a processor, a memory, a communication interface, and a bus;

The memory stores executable program code;

Monitoring the first call cycle T1 of the malicious program for ACTIVITY;

Setting a second calling period T2, wherein T2 is less than T1;

It should be noted that the various embodiments in this specification focus on descriptions that are different from other embodiments. Wherein, the same and similar parts between the various embodiments can be referred to each other. Especially for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiment.

One of ordinary skill in the art can understand that all or part of the process of implementing the foregoing embodiments can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium. When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

The above disclosure is only a preferred embodiment of the present application, and of course, the scope of the application should not be limited thereto, and those skilled in the art can understand all or part of the process of implementing the above embodiments, and the rights of the present application are The equivalent change required is still within the scope of the application.

Claims

An Android malicious program detection method, which is characterized in that:

Whether the monitoring application's call to ACTIVITY conforms to a preset rule, and whether there is a specific type of file corresponding to the application in the system;

Whether the application is a malicious program is determined based on the result of the monitoring.
The method of claim 1 wherein said predetermined rules comprise:

The application periodically invokes the ACTIVITY.
The method of claim 1, wherein the monitoring system has a specific type of file corresponding to the application, including:

A specific folder corresponding to the application is monitored in the system.
The method of claim 1, wherein the monitoring system has a specific type of file corresponding to the application, including:

A specific extension file corresponding to the application is monitored in the system.
The method of claim 1, wherein before determining whether the application is a malicious program based on the result of the monitoring, the method further comprises:

Uploading the feature information corresponding to the application to the server, to determine, on the server side, whether the application is a malicious program based on the feature information.
The method of claim 5, wherein the method further comprises:

Receiving a malicious program judgment result sent by the server, and deleting the application program when the determination result indicates that the application program is a malicious program.
The method of claim 5, wherein the method further comprises:

Receiving malicious program processing information sent by the server, and when the processing information indicates that the file is a file encrypted by a malicious program, decrypting the file according to the malicious program processing information.
The method according to claim 6 or 7, wherein the method further comprises: uploading the processing result of the malicious program to the server.
An Android malicious program processing method, characterized in that the method is suitable for processing the malicious program according to any one of claims 1 to 8, the method comprising:

Monitoring the first call cycle T1 of the malicious program for ACTIVITY;

Setting a second calling period T2, wherein T2 is less than T1;

Initiating a malicious program to delete the boot program, causing the malicious program to delete the boot program to call ACTIVITY in the second call cycle T2;

The preset decryption algorithm function is called, and the file encrypted by the malicious program is decrypted using a preset key string.
The method of claim 9, wherein the predetermined decryption algorithm function and the preset key string are obtained by a local or server.
An Android malicious program detecting device, comprising:

a first monitoring module, configured to monitor whether an application invokes an ACTIVITY conforms to a preset rule, and whether a specific type of file corresponding to the application exists in the system;

And a determining module, configured to determine, according to the result of the monitoring, whether the application is a malicious program.
The apparatus according to claim 11, wherein the preset rule comprises: the application periodically calling the ACTIVITY.
The device according to claim 11, wherein the first monitoring module is specifically configured to monitor whether a specific folder corresponding to the application exists in the system.
The device according to claim 11, wherein the first monitoring module is further configured to monitor whether a specific extension file corresponding to the application exists in the system.
The device of claim 11 wherein said device further comprises:

The first uploading module is configured to upload the feature information corresponding to the application to the server, to determine, on the server side, whether the application is a malicious program based on the feature information.
The device of claim 11 wherein said device further comprises:

a first receiving module, configured to receive a malicious program determination result sent by the server;

And deleting the module, when the judgment result indicates that the application is a malicious program, deleting the application.
The device of claim 11 wherein said device further comprises:

a second receiving module, configured to receive malicious program processing information sent by the server;

a decryption module, configured to: when the processing information indicates that the file is a file encrypted by a malicious program At the time, the file is decrypted according to the malicious program processing information.
The device according to claim 16 or 17, wherein the device further comprises:

The second uploading module is configured to upload a processing result of the malicious program to the server.
An Android malicious program processing apparatus, wherein the apparatus is adapted to process the malicious program according to any one of claims 1 to 8, the apparatus comprising:

a second monitoring module, configured to monitor the first calling period T1 of the malicious program for ACTIVITY;

Setting a module, configured to set a second calling period T2, wherein T2 is less than T1;

The startup module is configured to start the malicious program to delete the boot program, so that the malicious program deletes the boot program to call ACTIVITY in the second calling period T2;

The decryption module is configured to invoke a preset decryption algorithm function, and decrypt the file encrypted by the malicious program by using a preset key string.
The apparatus according to claim 19, wherein said predetermined decryption algorithm function and a preset key string are obtained by a local or server.
A terminal device, comprising the device according to any one of claims 11-20.