WO2022126616A1 - Procédé et appareil de détection d'application malveillante et support de stockage - Google Patents

Procédé et appareil de détection d'application malveillante et support de stockage Download PDF

Info

Publication number
WO2022126616A1
WO2022126616A1 PCT/CN2020/137660 CN2020137660W WO2022126616A1 WO 2022126616 A1 WO2022126616 A1 WO 2022126616A1 CN 2020137660 W CN2020137660 W CN 2020137660W WO 2022126616 A1 WO2022126616 A1 WO 2022126616A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
configuration information
information
operating system
malicious
Prior art date
Application number
PCT/CN2020/137660
Other languages
English (en)
Chinese (zh)
Inventor
那键
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202080004482.1A priority Critical patent/CN112689835A/zh
Priority to PCT/CN2020/137660 priority patent/WO2022126616A1/fr
Publication of WO2022126616A1 publication Critical patent/WO2022126616A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements

Definitions

  • the present application relates to the field of computer technologies, and in particular, to a method, device and storage medium for detecting malicious applications.
  • Application is a computer program for completing one or more specific tasks.
  • An operating system based on a Linux kernel such as an Android (Android) system, is mainly used in mobile terminal devices. Due to the open source and rich extensibility of the operating system code based on the Linux kernel, the functions of the apps developed by the operating system based on the Linux kernel are more and more diverse, which greatly meets the various needs of people's daily life.
  • the black industry that conducts fraud, deduction, and mining through malicious apps is also developing rapidly.
  • the black industry has a major impact on the data security of users.
  • the car-machine equipped with the Android system and the mobile terminal device that communicates with the car-machine are attacked by malicious apps, resulting in the leakage of the car owner's private data, and even a serious threat to the driving safety of the vehicle. Therefore, the detection of the application security of the operating system based on the Linux kernel has always been the focus of the research of information security personnel.
  • the currently used application detection method is to detect the source code of the App, but it requires a lot of computing and storage resources, and the detection efficiency is low; and when the malicious App code changes or uses techniques such as code obfuscation and packing, it can be easily bypass detection. Therefore, the current detection methods for malicious apps consume a lot of resources, and the accuracy of detection results is low.
  • the embodiments of the present application provide a malicious application detection method, device, and storage medium.
  • text comparison technology the configuration information of the operating system in the initial state and the configuration information in the running state are compared, and the operating system is compared.
  • the legitimate application information and the application information to be detected are compared, so as to detect the security of the application to be detected, and evaluate the malicious level of the application to be detected, which can save a lot of computing and storage resources, improve the detection efficiency, and prevent the code occurrence.
  • Malicious application detection that changes or adopts technologies such as code obfuscation and packing is still effective, which improves the accuracy of detection results.
  • an embodiment of the present application provides a detection method for a malicious application, the detection method includes:
  • initial information of the operating system wherein the initial information includes legal application information of the operating system or configuration information of the operating system in an initial state, and the initial state is the state before the operating system runs for the first time;
  • the configuration information of the operating system and the application information of the application are regarded as two comparison contents, and a detection method for malicious applications is provided, which is different from the many currently used "detection applications”.
  • the detection method in this embodiment combined with the system content detection and application content detection under the operating mechanism of the operating system, can save a lot of computing and storage resources, improve the detection efficiency, and change the code. Or the detection of malicious applications by techniques such as code obfuscation and packing is still effective, which improves the accuracy of detection results.
  • the comparing the configuration information in the initial state with the configuration information in the running state specifically includes:
  • the hash value of the configuration information of the operating system in the initial state is compared with the hash value of the configuration information of the operating system in the running state.
  • a method of comparing hash values is used to compare whether the configuration information in the initial state and the configuration information in the running state are the same. Compare the hash value of the configuration information of the operating system in the initial state with the hash value of the configuration information of the operating system in the running state. The hash value of the configuration information and the configuration information are obtained together. The hash value of the two configuration information can enable the receiver of the configuration information to confirm the authenticity of the content of the configuration information, thereby confirming whether the content of the above two configuration information is the same, and the comparison method effectively improves the efficiency of configuration information comparison. .
  • the comparing the configuration information in the initial state with the configuration information in the running state specifically includes:
  • the first configuration information is the configuration information of the system startup process of the operating system in the initial state
  • the second configuration information is the Configuration information of the system startup process of the operating system in the running state
  • the third configuration information is the configuration information of the user logging in to the operating system process in the initial state of the operating system
  • the fourth configuration information The information is configuration information of a user logging in to the operating system process when the operating system is in the running state.
  • the configuration information of the system startup process of the operating system in the initial state and in the running state is compared, or the user of the operating system in the initial state and in the running state is logged into the operating system process configuration information for comparison.
  • the configuration information under the operating mechanism of the operating system can be detected from the perspective of the operating system level, and the detection of high-threat malicious applications processed by the hidden camouflage technology is still effective, and the improvement is improved. Detection efficiency and accuracy of detection results.
  • the comparing the legal application information with the application information to be detected specifically includes:
  • the fifth configuration information includes configuration information of an application startup process of the application to be detected in an initial state
  • the sixth configuration information includes the application startup process of the application to be detected. Detects the configuration information of the application startup process when the application is running.
  • the application name in the legal application information and the application name in the application information to be detected are compared, or the configuration information of the application startup process of the application to be detected in the initial state and the running state is compared. Comparison.
  • the configuration information of the application startup process in the initial state and the configuration information of the application startup process in the running state from the perspective of the application level and the operating mechanism of the operating system.
  • the configuration information is still effective for the detection of high-threat malicious applications processed by the hidden camouflage technology, and a lot of computing and storage resources are saved, and the detection efficiency and the accuracy of the detection results are improved.
  • the detection method further includes:
  • the malicious level of the application to be detected is determined.
  • the initial information and the running information are different, and it is determined that the application to be detected is a malicious application.
  • the malicious level of the application to be detected is further determined according to the specific difference between the initial information and the running information. .
  • the malicious level of the application to be detected can be determined, and the degree of threat of the application to be detected to the terminal device can be evaluated, thereby providing a theory for the subsequent reduction or resolution of possible threats to the malicious application in different degrees. Based on this, the security and overall stability of the application operating environment are improved.
  • the determining the malicious level of the application to be detected according to the initial information and the running information specifically includes:
  • the application to be detected is a first-level malicious application
  • the application to be detected is a second-level malicious application, wherein, The malicious level of the second-level malicious application is lower than the malicious level of the first-level malicious application.
  • an implementation manner of determining the malicious level of the application to be detected under different information at the operating system level is provided.
  • the first configuration information and the second configuration information are different, it is determined that the application to be detected is a first-level malicious application, and the first-level malicious application represents the application to be detected with the highest degree of maliciousness; the first configuration information and the second configuration information are the same , and when the third configuration information and the fourth configuration information are different, it is determined that the application to be detected is a second-level malicious application, because the configuration information of the system startup process of the operating system in the initial state and the system startup process in the running state
  • the configuration information of the second-level malicious application is the same, so the malicious level expressed by the second-level malicious application is lower than the malicious level expressed by the first-level malicious application.
  • the determining the malicious level of the application to be detected according to the initial information and the running information specifically includes:
  • the first configuration information is the same as the second configuration information
  • the third configuration information is the same as the fourth configuration information
  • the application name in the legal application information is the same as the application name in the application information to be detected.
  • it is determined that the application to be detected is a third-level malicious application, wherein the malicious level of the third-level malicious application is lower than the malicious level of the second-level malicious application.
  • an implementation manner of determining the malicious level of the application to be detected when the information at the application level is different is provided.
  • the third-level malicious application is because the configuration information of the system startup process in the initial state of the operating system is the same as the configuration information of the system startup process in the running state, and the configuration information of the user logging in to the operating system process in the initial state of the operating system.
  • the configuration information of the user logging in to the operating system process when the operating system is running is the same, so the malicious level represented by the third-level malicious application is lower than the malicious level represented by the second-level malicious application and the first-level malicious application.
  • the determining the malicious level of the application to be detected according to the initial information and the running information specifically includes:
  • the third configuration information is the same as the fourth configuration information, the application name in the legal application information and the application to be detected information In the case where the names are the same and the fifth configuration information and the sixth configuration information are different, determine that the application to be detected is a fourth-level malicious application, where the malicious level of the fourth-level malicious application is lower than the The malicious level of the third-level malicious application.
  • the above-mentioned first configuration information is the same as the second configuration information
  • the above-mentioned third configuration information is the same as the fourth configuration information
  • the application name in the legal application information is the same as the application name in the application information to be detected
  • the above-mentioned fifth configuration information and the third configuration information are the same.
  • the configuration information of the user logging in to the operating system process in the state is the same as the configuration information of the user logging in to the operating system process in the running state of the operating system, and the application name in the legal application information and the application name in the application information to be detected are the same.
  • the malicious level represented by the fourth-level malicious application is lower than the malicious level represented by the third-level malicious application, the second-level malicious application, and the first-level malicious application.
  • the operating system includes a system using the Linux kernel.
  • the operating system includes a system using the Linux kernel.
  • the first process started by the system using the Linux kernel is generally the init process, and the configuration information of the process is usually stored in the init.rc file. Therefore, using Linux
  • the kernel systems are all applicable to the malicious application detection method described in the embodiments of this application.
  • the detection method further includes:
  • the storage path of the application to be detected is determined.
  • the initial information and the running information are different, and it is determined that the application to be detected is a malicious application.
  • the storage path of the application to be detected is further determined according to the specific difference between the initial information and the running information. .
  • the label of the first configuration information and the label of the second configuration information are parsed to obtain the label content of the first configuration information and the label content of the second configuration information, and the The content of the tag of the first configuration information is compared with the content of the tag of the second configuration information, and the storage path of the application to be detected is determined according to the difference in content between the two.
  • the label of the third configuration information and the label of the fourth configuration information are parsed to obtain the content of the label of the third configuration information and the label of the fourth configuration information.
  • the content of the tag of the third configuration information is compared with the content of the tag of the fourth configuration information, and the storage path of the application to be detected is determined according to the difference in the content of the two.
  • the label of the fifth configuration information and the label of the sixth configuration information are analyzed to obtain the label content of the fifth configuration information and the label content of the sixth configuration information, and the The content of the tag of the fifth configuration information is compared with the content of the tag of the sixth configuration information, and the storage path of the application to be detected is determined according to the difference in content between the two.
  • the storage path of the malicious application can be quickly determined, and the malicious application can be processed accordingly according to the storage path, such as uninstalling the malicious application according to the storage path, restricting the acquisition of corresponding permissions, etc. processing to improve the security of the operating system operating environment.
  • an embodiment of the present application provides a detection device for malicious applications, the detection device includes:
  • an acquisition unit configured to acquire initial information of the operating system, wherein the initial information includes legal application information of the operating system or configuration information of the operating system in an initial state, where the initial state is the first time the operating system state before operation;
  • the obtaining unit is further configured to obtain operation information of the operating system, where the operation information includes application information to be detected of the operating system or configuration information of the operating system in a running state;
  • a comparison unit configured to compare the legal application information with the application information to be detected, or compare the configuration information in the initial state with the configuration information in the running state to obtain a comparison result ;
  • a determining unit configured to determine that the application to be detected on the operating system is a malicious application if the comparison results are different.
  • the comparison unit is specifically configured to compare the hash value of the configuration information of the operating system in the initial state with the configuration information of the operating system in the running state Hash values are compared.
  • the comparison unit is further configured to compare the first configuration information with the second configuration information, wherein the first configuration information is the operating system in the initial state configuration information of the system startup process under the operating system, the second configuration information is the configuration information of the system startup process of the operating system in the running state;
  • the comparison unit is further configured to compare the third configuration information with the fourth configuration information, wherein the third configuration information is that the user of the operating system in the initial state logs in to the operating system configuration information of a process, and the fourth configuration information is configuration information of a user logging in to the operating system process when the operating system is in the running state.
  • the comparison unit is further configured to compare the application name in the legal application information with the application name in the application information to be detected;
  • the comparison unit is further configured to compare the fifth configuration information with the sixth configuration information, wherein the fifth configuration information includes the configuration information of the application startup process of the application to be detected in the initial state,
  • the sixth configuration information includes configuration information of an application startup process of the application to be detected in a running state.
  • the determining unit is further configured to determine the malicious level of the application to be detected according to the initial information and the running information.
  • the determining unit is specifically configured to determine that the application to be detected is a first-level malicious application when the first configuration information and the second configuration information are different;
  • the determining unit is further configured to determine the application to be detected when the first configuration information and the second configuration information are the same and the third configuration information and the fourth configuration information are different is a second-level malicious application, wherein the malicious level of the second-level malicious application is lower than the malicious level of the first-level malicious application.
  • the determining unit is specifically further configured to: when the first configuration information and the second configuration information are the same, the third configuration information and the fourth configuration information are the same, and all the In the case where the application name in the legal application information and the application name in the application information to be detected are different, determine that the application to be detected is a third-level malicious application, wherein the malicious level of the third-level malicious application is low the malicious level of the second-level malicious application.
  • the determining unit is specifically further configured to: when the first configuration information and the second configuration information are the same, the third configuration information and the fourth configuration information are the same, the In the case where the application name in the legitimate application information and the application name in the application information to be detected are the same, and the fifth configuration information and the sixth configuration information are different, it is determined that the application to be detected is the fourth-level malicious application, wherein the malicious level of the fourth-level malicious application is lower than the malicious level of the third-level malicious application.
  • the operating system includes a system using the Linux kernel.
  • the determining unit is further configured to determine the storage path of the application to be detected according to the initial information and the running information.
  • an embodiment of the present application provides an apparatus for detecting malicious applications, where the detection apparatus includes a processor and a memory; the memory is used for storing computer execution instructions; the processor is used for executing a computer stored in the memory The instructions are executed to cause the detection apparatus to execute the method according to the above-mentioned first aspect and any possible implementation manner.
  • the detection apparatus further includes a transceiver, where the transceiver is used to receive a signal or send a signal.
  • embodiments of the present application provide a computer-readable storage medium, where the computer-readable storage medium is used to store instructions or computer programs; when the instructions or the computer programs are executed, the first aspect is The described method is implemented.
  • an embodiment of the present application provides a computer program product, where the computer program product includes an instruction or a computer program; when the instruction or the computer program is executed, the method described in the first aspect is implemented.
  • the configuration information of the operating system in the initial state is compared with the configuration information in the running state, and the legal application information of the operating system and the application information to be detected are compared. , so as to detect the security of the application to be detected, and evaluate the malicious level of the application to be detected, which can save a lot of computing and storage resources, improve the detection efficiency, and prevent malicious applications with code changes or code obfuscation, packing and other technologies.
  • the detection is still valid, improving the accuracy of the detection results.
  • FIG. 1 is a schematic diagram of a scenario of malicious application detection provided by an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a malicious application detection provided by an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a method for detecting a malicious application provided by an embodiment of the present application
  • FIG. 4 is a schematic flowchart of another malicious application detection method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of another malicious application detection method provided by an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another malicious application detection method provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an apparatus for detecting malicious applications provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a terminal device according to an embodiment of the present application.
  • At least one (item) refers to one or more
  • multiple refers to two or more
  • at least two (item) refers to two or three And three or more
  • "and/or” is used to describe the association relationship of related objects, indicating that three kinds of relationships can exist, for example, “A and/or B” can mean: only A exists, only B exists, and A exists at the same time and B three cases, where A, B can be singular or plural.
  • the character “/” generally indicates that the associated objects are an "or” relationship.
  • At least one item(s) below” or similar expressions thereof refer to any combination of these items, including any combination of single item(s) or plural items(s).
  • At least one (a) of a, b or c can mean: a, b, c, "a and b", “a and c", “b and c", or "a and b and c" ", where a, b, c can be single or multiple.
  • the present application provides a method for detecting malicious applications.
  • some knowledge related to application detection is introduced below.
  • APKTool is an Android application package (Android application package, APK) compilation tool, which can decompile and recompile apk, install the framework-res framework required by the decompilation system apk, and clean up the last decompiled folder and other functions . If the apk code wants to run on an Android device, it must be compiled first, and then packaged into a file recognized by the Android system before it can be run, and the file format that can be recognized and run by the Android system is " apk”.
  • An apk file contains compiled code files (.dex files), file resources (resources), native resource files (assets), certificates (certificates), and manifest files (manifest file).
  • Sandbox A virtual execution environment for network programming, a virtual system program that allows testers to run browsers or other programs in a sandbox environment, so changes resulting from running can be deleted later. It creates an independent operating environment similar to a sandbox, and the programs running inside it cannot have a permanent impact on the hard disk.
  • a sandbox refers to a tool used to test the behavior of untrusted files or applications in an isolated environment.
  • Hook technology also known as hook function.
  • the hook program Before the system does not call the function, the hook program first captures the message, and the hook function first obtains control. At this time, the hook function can process (change) the execution behavior of the function, and can also Forcibly end the delivery of the message. To put it simply, it is to pull out the program of the system and turn it into a snippet of our own execution code.
  • FIG. 1 is a schematic diagram of a malicious application detection scenario provided by an embodiment of the present application.
  • the 101 installed in the center console of the car is a car machine equipped with an Android system.
  • the car machine is the abbreviation of the in-vehicle infotainment products installed in the car.
  • it also has a telematics function, which can realize information communication between people and vehicles, vehicles and the outside world (vehicle-to-vehicle).
  • the "I-Call" and "E-Call" functions are the most typical representatives of Telematics functions.
  • the "I-Call” function is to connect the background call center through the built-in communication module of the car, providing one-key navigation and corresponding location and remote services;
  • the "E-Call” function is that when a serious accident occurs in the car, the The local area network (controller area network, CAN) bus reads the information of the airbag and automatically dials the emergency call.
  • the Telematics function also has a positioning function and anti-theft monitoring function. When the vehicle is stolen, the call center will cooperate with the law enforcement department to locate and track the vehicle. In this scenario, if the vehicle is attacked by malicious apps, it will affect the realization of some functions of the vehicle.
  • 102 is a mobile phone equipped with an Android system, and the mobile phone 102 can communicate with the vehicle machine 101 through a Bluetooth connection or a data cable connection or other means.
  • 102 (mobile phone) and 101 (car machine) are connected via Bluetooth, and the user can control the behavior of the car machine by operating the mobile phone: open the music player application on the mobile phone, and communicate with the car machine to make the car audio connected to the car machine play.
  • Songs in the mobile phone when answering a call from the mobile phone, you can make a call without holding the mobile phone, but use the audio and microphone connected with the car machine to make a call.
  • the mobile phone that communicates with the car and the machine is attacked by malicious apps, which leads to the leakage of the car owner's privacy, and even the incidents that affect the safety of vehicle driving are increasing day by day.
  • malicious apps For example, a certain map app on the mobile phone has been maliciously tampered with due to the cyber attack code, and the driver will go astray under the navigation of the app, and even seriously threaten the driving safety.
  • FIG. 2 is a schematic structural diagram of a malicious application detection according to an embodiment of the present application. As shown in Figure 2, this architecture mainly includes three modules: the original information database module, the file analysis module, and the application detection result module.
  • the original information database module is used to establish the original information database, and the original information database mainly includes two contents: the configuration information of the operating system in the initial state, and the legal application information of the operating system.
  • the above initial state refers to the state before the operating system runs for the first time, including the state that has not been used after leaving the factory, the state before the first run, or the state that has not been used after the official subsequent release of the updated version of the operating system, The state before the first run.
  • the configuration information of the operating system in the initial state mainly includes the configuration information of the system startup process of the operating system and the configuration information of the user logging in to the operating system process.
  • the legal application information of the above operating system mainly includes relevant information of some legal applications, such as application name of the legal application, configuration information of the legal application, and the configuration information of the legal application may specifically be the configuration information of the application startup process.
  • the information contained in the original information database can be obtained without accessing the operating system.
  • the original information database module can obtain the configuration information of the operating system in the initial state by downloading it from the official website of the operating system.
  • the original information database module can also obtain the legal application information of the operating system through different channels, and adopt different channels to obtain the application information for different types of legal applications.
  • the legal applications contained in the legal application information of the operating system mainly fall into two categories. One is the applications that are pre-installed by the operating system in the initial state.
  • the original information database module can be downloaded from platforms such as the official website that publishes such applications.
  • the application-related information such as the application name and configuration information of this type of application
  • another type of legitimate application is the application developed based on the above-mentioned operating system published by the third-party application platform, and the original information database module can be downloaded from the corresponding third-party platform.
  • Related content of the application such as the application name and configuration information of the class application. Therefore, the information obtained from the original information database does not need to depend on the operation of the operating system, and the information can be determined after the operating system leaves the factory or is updated.
  • the above configuration information of the system startup process is the information of the first process started by the operating system. After the system startup process works, other important system processes will be derived to perform corresponding functions.
  • the above-mentioned operating systems include systems using the Linux kernel, such as Android, Ubuntu, and the like.
  • the first process started by the system is generally the init process, which is used to instruct the operating system to perform a series of corresponding processes at startup, such as starting user login, implementing run levels, and processing Orphaned processes, etc. Therefore, the configuration information of the above system startup process is usually stored in the init.rc file and the rc.local file. Both the init.rc file and the rc.local file are scripts that are started with the system startup.
  • the init.rc file precedes rc. local file starts.
  • the init.rc file is a configuration file that specifies the behavior and actions of the init process.
  • the rc.local file is used to record the execution commands for system startup, which are executed after the system is started and before the user logs in.
  • the configuration information of the above-mentioned user login operating system process is usually stored in a profile file.
  • the profile file is a script that is started when the user logs in to the operating system.
  • the profile file is used to record some user logins.
  • the execution command when the system is started.
  • the above command is executed when the user logs in to the system after the system is started.
  • the path of the init.rc file in the system is "/system/core/rootdir/init.rc”
  • the path of the rc.local file in the system is "/etc/init.rc”
  • the path of the profile file in the system is " /etc/profile”.
  • the configuration information of the above application startup process is usually stored in the AndroidManifest.xml file.
  • the AndroidManifest.xml file is an application manifest file located in the root directory of the application, and contains the configuration information of the application. The operating system needs to run the application according to the content in it. code, display the interface, and execute the corresponding function.
  • the file analysis module is used to compare and analyze the operation information of the operating system with the information in the original information database.
  • the operating information of the operating system is different from the information in the original information database. It needs to be obtained by the operating system in the operating state.
  • the operating state is the state in which the operating system is in use after the operating system leaves the factory or is updated. Therefore, the file analysis module needs to be connected to the operation. system, obtain the relevant permissions of the operating system, and then obtain the operating information of the operating system.
  • the operating information of the operating system mainly includes two aspects: configuration information of the operating system in a running state, and application information of the operating system to be detected.
  • the configuration information of the operating system in the running state mainly includes the configuration information of the system startup process of the operating system and the configuration information of the user logging in to the operating system process.
  • the application information to be detected of the operating system mainly includes application-related information such as the application name of the application to be detected, configuration information of the application to be detected, etc.
  • the configuration information of the application to be detected may specifically be configuration information of the application startup process.
  • the configuration information of the system startup process when the operating system is running is usually stored in the init.rc file and the rc.local file.
  • the configuration information of the user logging in to the operating system process in the running state is usually stored in the profile file, and the configuration information of the application startup process of the application to be detected is usually stored in the AndroidManifest.xml file of the application to be detected.
  • the file analysis module compares and analyzes the operating information of the operating system with the information in the original information database. Because the configuration information of the above two is usually stored in the corresponding configuration file, it can be achieved by comparing the hash value of the configuration file. For the purpose of comparing configuration information, the specific comparison content can be compared from the following aspects:
  • the file analysis module compares the configuration information of the system startup process in the initial state of the operating system with the configuration information of the system startup process in the running state;
  • the file analysis module compares the configuration information of the user logging in to the operating system process in the initial state of the operating system with the configuration information of the user logging in the operating system process in the running state;
  • the file analysis module compares the application name in the legal application information of the operating system with the application name in the application information to be detected;
  • the file analysis module compares the configuration information of the application startup process in the initial state of the application to be detected of the operating system with the configuration information of the application startup process in the running state.
  • the above four comparison contents can be the comparison contents of the four parallel comparison schemes, or the comparison contents of the progressive comparison schemes in order.
  • the file analysis module can be used according to different application scenarios. It is required to select at least one of the above aspects for comparative analysis.
  • the application detection result module is used to obtain the application detection result according to the comparative analysis result of the above-mentioned document analysis module. That is, as long as the comparison result of any one of the four aspects of the file analysis module is different, the application detection result module will determine the application to be detected as a malicious application.
  • the application detection result module can further distinguish the malicious degree of the application to be detected according to the comparison content in different aspects, so as to provide a theoretical basis for the subsequent reduction or resolution of possible threats to the malicious application in different degrees. , to improve the security and overall stability of the application operating environment.
  • the application detection result module determines the application to be detected in this case as the malicious application with the greatest degree of maliciousness (may be referred to as the first-level malicious application); If the comparison content of the first aspect is the same and the comparison content of the second aspect above is different, the application detection result module will determine that the application to be detected in this case is the second-level malicious application, and the second-level malicious application The degree of maliciousness expressed by the application is lower than the degree of maliciousness expressed by the above-mentioned first-level malicious application; similarly, the comparison content in the first aspect above is the same, the comparison content in the second aspect above is the same, and the content in the third aspect above is the same If the comparison contents are not the same, the application detection result module will determine that the application to be detected in this case is a third-level malicious application, and the maliciousness expressed by the third-level malicious application is lower than the maliciousness expressed by the above-mentioned second-level malicious application.
  • the application detection result module will determine that the application to be detected in this case is a fourth-level malicious application, and the malicious degree expressed by the fourth-level malicious application is lower than the malicious degree expressed by the third-level malicious application.
  • the detection technology combines the content detection under the operating system operating mechanism. Even if the application code to be detected changes or uses technologies such as code obfuscation and packing, the above detection technology is still effective. The accuracy of the detection result is greatly improved, and the detection process does not require a large amount of feature storage or occupies a large amount of computing resources, which can save a large amount of computing and storage resources and improve the detection efficiency.
  • FIG. 3 is a schematic flowchart of a method for detecting a malicious application according to an embodiment of the present application.
  • the detection method includes but is not limited to the following steps:
  • Step 301 The terminal device obtains initial information of the operating system, and obtains operating information of the operating system.
  • the terminal device in the embodiment of the present application is an electronic device equipped with an operating system of the Linux kernel, such as a mobile phone, a computer, a car machine, and a smart wearable device equipped with an Android system.
  • an operating system of the Linux kernel such as a mobile phone, a computer, a car machine, and a smart wearable device equipped with an Android system.
  • the terminal device obtains the initial information and running information of the operating system.
  • the initial information mainly includes legal application information of the operating system and configuration information of the operating system in an initial state
  • the running information mainly includes application information of the operating system to be detected and configuration information of the operating system in a running state.
  • the initial state refers to the state before the operating system runs for the first time, including the state that has not been used after leaving the factory and before the first run, or the state that has not been used after the official subsequent release of the updated version of the operating system, and the first time
  • the state before running, the running state is the state in use after the operating system leaves the factory or is updated.
  • the legal application information of the operating system mainly includes relevant information of some legal applications, such as the application name of the legal application and the configuration information of the legal application.
  • the configuration information of the legal application may specifically be the configuration information of the application startup process in the initial state.
  • the configuration information of the operating system in the initial state may include configuration information (first configuration information) of the system startup process of the operating system in the initial state, and configuration information (third configuration information) of a user logging into the operating system process.
  • the above initial information can be obtained without accessing the operating system.
  • the terminal device can obtain the configuration information of the operating system in its initial state by downloading it from the official website where the operating system is released, and obtain the configuration information on the official website where the legal application is released. App-related information for legitimate apps.
  • the terminal device will take different ways to obtain its application information for different types of legitimate applications.
  • the terminal device can download the application name and configuration information and other related information of the application on the platform that publishes the application, such as the official website.
  • application the terminal device can download the relevant content of the application, such as the application name and configuration information of this type of application, from the corresponding third-party platform.
  • the terminal device does not need to rely on the operation of the operating system to obtain the initial information of the operating system, nor does it need to obtain the relevant permissions of the operating system in advance, and the initial information is information that can be determined after the operating system leaves the factory or is updated.
  • the application information to be detected of the operating system mainly includes some relevant information of the application to be detected, such as the application name of the application to be detected, and the configuration information of the application to be detected. configuration information.
  • the configuration information of the operating system in the running state may include the configuration information (second configuration information) of the system startup process of the operating system in the running state, and the configuration information (fourth configuration information) of the user logging into the operating system process.
  • the operating information of the operating system is different from the initial information of the above-mentioned operating system, and needs to be obtained by relying on the operating system in the running state. Therefore, the terminal device needs to access the operating system, obtain the root authority of the operating system, and then obtain the operating system's root authority. Running information.
  • the configuration information (first configuration information) of the system startup process in the above-mentioned initial state and the configuration information (second configuration information) of the system startup process in the running state are both information of the first process started by the operating system.
  • the information indicates the information that the first process is not started
  • the second configuration information indicates the information after the first process is started
  • other important system processes will be derived after the system startup process works to perform corresponding functions.
  • the first process started by the system is generally the init process, which is used to instruct the operating system to perform a series of corresponding processes at startup, such as starting user login, implementing run levels, and processing
  • the process information of the init process is usually stored in the init.rc file and the rc.local file.
  • Both the init.rc file and the rc.local file are scripts that are started with the system startup.
  • the init.rc file first Start in the rc.local file.
  • the init.rc file is a configuration file that specifies the behavior and actions of the init process.
  • the rc.local file is used to record the execution commands for system startup, which are executed after the system is started and before the user logs in. Therefore, the above-mentioned first configuration information and second configuration information are usually also stored in the init.rc file and the rc.local file of the operating system.
  • the above-mentioned third configuration information and fourth configuration information indicating that the user logs in to the operating system process in different states are usually stored in the profile file of the operating system.
  • the script is started by the operating system, and the profile file is used to record the execution commands of some users when they log in to the system. After the system is started, the above commands are executed when the user logs in to the system.
  • the path of the init.rc file in the system is "/system/core/rootdir/init.rc”
  • the path of the rc.local file in the system is "/etc/init.rc”
  • the path of the profile file in the system is " /etc/profile”.
  • the configuration information (fifth configuration information) of the application startup process of the above-mentioned legal application in the initial state is usually stored in the AndroidManifest.xml file corresponding to the legal application, and the above-mentioned application to be detected is running
  • the configuration information (the sixth configuration information) of the application startup process in the state is usually stored in the AndroidManifest.xml file corresponding to the application to be detected, and the AndroidManifest.xml file is an application manifest file located in the root directory of the application, which contains the application configuration information, the operating system needs to run the code of the application according to the content inside, display the interface, and perform the corresponding functions.
  • Step 302 Compare the legal application information with the application information to be detected, or compare the configuration information in the initial state with the configuration information in the running state.
  • the terminal device After the terminal device obtains the initial information and running information of the operating system, it will use the text comparison technology to compare and analyze the initial information and running information, specifically, compare the legal application information of the operating system with the application information to be detected. , and compare the configuration information of the operating system in the initial state with the configuration information in the running state.
  • the hash value is usually represented by a short string of random letters and numbers.
  • the hash value of the configuration file is calculated by a hashing algorithm, which is a method of creating a small digital "fingerprint" from any kind of data. " method is used to compress the message or data into a digest, so that the amount of data becomes smaller and the format of the data is fixed.
  • the hash value of the configuration file and the configuration information stored in the configuration file are obtained together.
  • the application name in the above-mentioned legal application information and the application name in the application information to be detected can be used as the unique identifiers of the legal application and the application to be detected, respectively. Therefore, the application names of the two applications can be used to distinguish. Whether the two applications are the same application. Further, the name of the application can be named by a computer programming language (such as a Java package), and its function can describe the program components of the application, publish corresponding component functions, declare the necessary permissions of the application, and the like.
  • a computer programming language such as a Java package
  • the above four comparison contents can be the comparison contents of the four parallel comparison schemes, or the comparison contents of the progressive comparison schemes in sequence, and the terminal device can meet the needs of different application scenarios.
  • the terminal device may perform comparison and analysis according to any one of the above-mentioned four comparison methods to obtain the detection result.
  • the terminal device can also perform a comparison and analysis according to the first comparison method above. If the application to be detected can be confirmed as a malicious application through the first comparison method, the detection result of the application to be detected as a malicious application is obtained.
  • the second comparison method above can confirm that the application to be detected is a malicious application, then the detection result that the application to be detected is a malicious application is obtained, and the remaining two comparison methods are not executed; If it is still impossible to confirm that the application to be detected is a malicious application, continue to carry out the comparison and analysis according to the third comparison method above. If the detection result of the detected application is a malicious application, the remaining fourth comparison method is not performed; if the application to be detected cannot be confirmed as a malicious application through the third comparison method above, continue to follow the fourth comparison method above. A comparative analysis was carried out to obtain the final test results.
  • Step 303 In the case that the above comparison results are not the same, determine that the application to be detected on the operating system is a malicious application.
  • a corresponding comparison result can be obtained, and according to the comparison result, it can be determined whether the application to be detected on the operating system is a malicious application.
  • the comparison result of any one of the above four comparison methods is different, it can be determined that the application to be detected on the operating system is a malicious application. That is, if the initial information and running information of the above operating system are different, it can be determined that the application to be detected is a malicious application.
  • the terminal device can also determine the malicious level of the application to be detected according to the specific difference between the initial information and the running information. make further determinations.
  • the application to be detected is a first-level malicious application
  • the first-level malicious application represents an application to be detected with the highest degree of maliciousness.
  • the malicious application in this case is an application that starts automatically when the system startup process is started, which will pose a great threat to the privacy information and security of the device.
  • the application to be detected is a second-level malicious application, because the first configuration information and the second configuration information are different.
  • the information is the same, that is, the configuration information of the system startup process of the operating system in the initial state is the same as the configuration information of the system startup process in the running state, so the malicious level represented by the second-level malicious application is lower than the first-level malicious application. Indicates the level of maliciousness.
  • the malicious application in this case is an application that starts automatically when the user logs into the operating system process, which will pose a great threat to the privacy information and security of the device.
  • the third configuration information and the fourth configuration information are the same, and the application name in the legal application information and the application name in the application information to be detected are different, determine the application to be detected It is a third-level malicious application, because the first configuration information is the same as the second configuration information, and the third configuration information is the same as the fourth configuration information, that is, the configuration information of the system startup process of the operating system in the initial state is the same as that in the running state.
  • the configuration information of the system startup process is the same, and the configuration information of the user logging in to the operating system process in the initial state of the operating system is the same as the configuration information of the user logging in to the operating system process in the running state of the operating system, so the third-level malicious application
  • the malicious level indicated is lower than the malicious level indicated by the second-level malicious application and the first-level malicious application.
  • the malicious application in this case is not a legitimate application, neither an application pre-installed by the operating system in the initial state, nor an application developed based on the above-mentioned operating system disclosed by a third-party application platform.
  • the security of downloaded applications released on unofficial platforms (informal application markets) cannot be guaranteed accordingly, and they are likely to be malicious applications packaged with technologies such as code obfuscation and packing.
  • the first configuration information is the same as the second configuration information
  • the third configuration information is the same as the fourth configuration information
  • the application name in the legal application information is the same as the application name in the application information to be detected
  • the fifth configuration information If it is different from the sixth configuration information, it is determined that the application to be detected is a fourth-level malicious application, because the first configuration information is the same as the second configuration information, and the third configuration information is the same as the fourth configuration information, that is, the operating system is initially
  • the configuration information of the system startup process in the state is the same as the configuration information of the system startup process in the running state.
  • the configuration information of the user logging in to the operating system process in the initial state of the operating system is the same as that of the user logging in to the operating system in the operating state.
  • the configuration information of the process is the same, and the application name in the legitimate application information and the application name in the application information to be detected are the same, so the malicious level of the fourth-level malicious application is lower than that of the third-level malicious application and the second-level malicious application. , the malicious level represented by the first-level malicious application. It should be noted that, in the case of this comparison result, the application name in the application information to be detected is the same as the application name in the legal application information, which means that the source of the application to be detected is legal.
  • the pre-installed application in the state may also be the application developed by the user on the third-party application platform based on the above operating system, but this does not mean that the detection application is not malicious, because the configuration of the application startup process of the application to be detected
  • the information may not be the same.
  • the application to be detected is also malicious, and its malicious behavior is manifested as automatically acquiring illegal permissions when the application startup process is started. For example, when a user downloads a "weather" app, when the user clicks to start, the app's application startup process starts and enters the running state. According to the configuration information of the application startup process, the geographical location permission, calendar permission, and photo album of the terminal device are obtained in turn.
  • the application behavior recorded by the configuration information of the application startup process of the "Weather” App in the initial state is to sequentially obtain the geographical location permission and calendar permission of the terminal device. Automatically obtained illegal permissions, the configuration information of the application startup process in the initial state of the "Weather” App is different from the configuration information of the application startup process in the running state, and it can be determined that the "Weather” App is a fourth-level malicious application.
  • the application name in the above-mentioned legal application information and the application information to be detected are the same. If the names of the applications are the same and the fifth configuration information and the sixth configuration information are different), the malicious level of the application to be detected may be further refined.
  • the first configuration information is the same as the second configuration information
  • the third configuration information is the same as the fourth configuration information
  • the application name in the legal application information is the same as the application name in the application information to be detected
  • the fifth configuration If the information is different from the sixth configuration information, if the application to be detected is an application preinstalled by the operating system in the initial state, it is determined that the application to be detected is a fourth-level malicious application; if the application to be detected is published by a third-party application platform Based on the application developed by the above operating system, it is determined that the application to be detected is a fifth-level malicious application.
  • the malicious level expressed by the fifth-level malicious application is lower.
  • the malicious level represented by the fourth-level malicious application is lower.
  • the application to be detected on the operating system is a malicious application and the malicious level of the application to be detected is determined
  • the label of the first configuration information and the label of the second configuration information are parsed to obtain the content of the label of the first configuration information and the content of the label of the second configuration information , compare the label content of the first configuration information with the label content of the second configuration information, and determine the storage path of the application to be detected according to the difference in content between the two.
  • the label of the third configuration information and the label of the fourth configuration information are parsed to obtain the content of the label of the third configuration information and the label of the fourth configuration information.
  • the content of the tag of the third configuration information is compared with the content of the tag of the fourth configuration information, and the storage path of the application to be detected is determined according to the difference in the content of the two.
  • the label of the fifth configuration information and the label of the sixth configuration information are analyzed to obtain the label content of the fifth configuration information and the label content of the sixth configuration information, and the The content of the tag of the fifth configuration information is compared with the content of the tag of the sixth configuration information, and the storage path of the application to be detected is determined according to the difference in content between the two.
  • the configuration information of the operating system in the initial state is compared with the configuration information in the running state, and the legal application information of the operating system and the application information to be detected are compared, so as to ensure the security of the application to be detected. It can save a lot of computing and storage resources, improve the detection efficiency, and it is still effective for the detection of malicious applications with code changes or code obfuscation, packing and other technologies, improving the detection results. accuracy.
  • FIG. 4 is a schematic flowchart of another malicious application detection method provided by an embodiment of the present application, which can also be understood as a supplement to the flowchart of the malicious application detection method in FIG. 3 .
  • the terminal device first establishes an initial database, which mainly includes legal application information of the operating system and configuration information of the operating system in an initial state (see step 401 ).
  • the terminal device is an electronic device equipped with a Linux kernel operating system, such as a mobile phone, a computer, a car machine, and a smart wearable device equipped with an Android system.
  • the initial state refers to the state before the operating system runs for the first time, including the state that has not been used after leaving the factory, before the first run, or the state that has not been used after the official subsequent release of the updated version of the operating system, before the first run.
  • the configuration information of the operating system in the initial state mainly includes the configuration information of the system startup process of the operating system in the initial state (the above-mentioned first configuration information), the configuration information of the user logging into the operating system process (the above-mentioned third configuration information) ), the first configuration information is usually stored in the init.rc and rc.local files of the operating system, and the third configuration information is usually stored in the profile file of the operating system.
  • the legal application information of the operating system mainly includes the relevant information of some legal applications, such as the application name of the legal application and the configuration information of the legal application.
  • the configuration information of the legal application may specifically be the configuration information of the application startup process in the initial state (the fifth configuration information).
  • the information in the above-mentioned initial database can be obtained without accessing the operating system, and the terminal device can obtain the configuration information of the operating system in its initial state by downloading it from the official website where the operating system is released, and on the official website where legal applications are released. Download the application-related information of the legitimate application.
  • the terminal device will access the Android system to obtain application information of the operating system to be detected and configuration information of the operating system in a running state (see step 402).
  • the operating state is the state in which the operating system is in use after leaving the factory or after being updated, and the configuration information of the operating system in the operating state mainly includes the configuration information of the system startup process of the operating system in the operating state (the above-mentioned second configuration information),
  • the configuration information (the above-mentioned fourth configuration information) that the user logs into the operating system process, the above-mentioned second configuration information is usually stored in the init.rc and rc.local files of the operating system, and the above-mentioned fourth configuration information is usually stored in the profile of the operating system in the file.
  • the path of the init.rc file in the operating system is "/system/core/rootdir/init.rc”
  • the path of the rc.local file in the operating system is "/etc/init.rc”
  • the profile file in the operating system is "/etc/profile”.
  • the application information to be detected of the operating system mainly includes some relevant information of the application to be detected, such as the application name of the application to be detected, and the configuration information of the application to be detected. Configuration information (sixth configuration information).
  • the terminal device compares the configuration information of the operating system in the initial state with the configuration information of the operating system in the running state, and determines whether the configuration information of the operating system in the above two states is the same (see step 403).
  • the configuration information of the system startup process of the operating system in the initial state is compared with the configuration information of the system startup process of the operating system in the running state, or the user of the operating system in the initial state logs in to the operating system process.
  • the configuration information of the operating system is compared with the configuration information of the user logging in to the operating system process in the running state of the operating system, and it is judged whether the configuration information of the two is the same.
  • step 403 If the comparison result in the above step 403 is not the same, it can be determined that the application to be detected is a malicious application, and the init.rc and rc.local files, or the profile file, are parsed to determine the malicious application path (see step 404). Specifically, if the comparison result between the first configuration information and the second configuration information is different, the application to be detected is determined to be a first-level malicious application, and the label and running state of the init.rc file in the initial state are analyzed.
  • the label of the init.rc file in the following state is analyzed, the label of the rc.local file in the initial state and the label of the rc.local file in the running state are parsed, and the path of the malicious application is determined according to the difference in the content of the labels in the two states; if If the comparison result between the third configuration information and the fourth configuration information is not the same, it is determined that the application to be detected is a second-level malicious application, and the second-level malicious application represents a lower degree of maliciousness than the first-level malicious application. Indicates the degree of maliciousness, and parses the label of the profile file in the initial state and the label of the profile file in the running state, and determines the path of the malicious application according to the difference in the content of the label in the two states.
  • the terminal device will compare the legal application information in the initial database with the application information to be detected in the running state of the operating system (see step 405). Specifically, the application name in the legal application information of the operating system is compared with the application name in the application information to be detected, or the configuration information of the application startup process of the application to be detected in the running state is compared with the application startup of the legal application of the same name. The configuration information of the process is compared, and whether the information of the two is the same.
  • step 406 If the comparison result in the above step 406 is not the same, it is determined that the application to be detected is a third-level malicious application, and the malicious level represented by the third-level malicious application is lower than the above-mentioned first-level malicious application and second-level malicious application. Malicious level (see step 407).
  • step 406 the configuration information of the application startup process of the application to be detected in the running state is compared with the configuration information of the application startup process of the legal application with the same name (see step 408), and Determine whether the configuration information of the two is the same.
  • step 408 it is determined that the application to be detected is a fourth-level malicious application, and the configuration information in the two states is parsed to determine possible malicious behaviors (see step 409).
  • the malicious level of the application to be detected may be further refined, that is, if the first configuration information and the second configuration information are the same, the third configuration information and the fourth configuration information are the same, and the application to be detected is the same.
  • the application name is the same as the application name of the legitimate application, and the fifth configuration information and the sixth configuration information above are different
  • the application to be detected is an application preinstalled by the operating system in the initial state, it is determined that the application to be detected is the fourth
  • the application to be detected is an application developed based on the above operating system and disclosed by a third-party application platform, it is determined that the application to be detected is a fifth-level malicious application.
  • the malicious level expressed by the fifth-level malicious application is lower.
  • the malicious level represented by the fourth-level malicious application is lower.
  • the application to be detected may be scored by formulating a scoring rule to distinguish the malicious grades of the malicious application in different degrees.
  • the scoring rules for malicious apps are as follows:
  • the determined application to be detected is a first-level malicious application, and the first-level malicious application starts automatically when the system startup process is started, and is rated as 5 points;
  • the determined application to be detected is the second-level malicious application, and the second-level malicious application starts automatically when the user logs into the operating system process, and is rated as 4 points;
  • the application to be detected is determined as a third-level malicious application, and the source of the third-level malicious application is illegal, and is rated as 3 points;
  • the application to be detected is determined when the fifth configuration information and the sixth configuration information are different, if the application to be detected is an application preinstalled by the operating system in the initial state, it is determined that the application to be detected is a fourth-level malicious application , rated as 2 points;
  • the application to be detected is determined under the condition that the fifth configuration information and the sixth configuration information are different, if the application to be detected is an application developed based on the above operating system disclosed by a third-party application platform, the application to be detected is determined to be the fifth application to be detected. level malicious application, rated 1 point.
  • the above scoring adopts the principle of “highest”, that is, when the application to be detected satisfies many of the above five scoring rules, it will be scored according to the highest score. From this, it can also be concluded that the malicious degree of the first-level malicious application is the largest, and the subsequent malicious degrees are in order. decrease.
  • the above scoring can also adopt the accumulation principle, that is, when the application to be detected satisfies more than one of the above five scoring rules, the scores of the rules that satisfy the conditions are accumulated to obtain the final scoring result of the application to be detected.
  • FIG. 5 is a schematic flowchart of another malicious application detection method provided by an embodiment of the present application, which can also be understood as a supplement to the flowcharts of the malicious application detection method in FIGS.
  • This embodiment provides a specific process for the comparison of the configuration information of the system startup process of the operating system. As shown in FIG. 5 , first obtain the latest updated init.rc/rc.local file (refer to step 501), the init.rc/rc.local file is obtained.
  • the rc/rc.local file contains the configuration information of the system startup process in the initial state of the operating system, which can be downloaded from the official website where the operating system is released; secondly, access the target Android system with root privileges and obtain the target Android system
  • the init.rc/rc.local file in the running state (see step 502)
  • the init.rc/rc.local file contains the configuration information of the system startup process in the running state of the operating system
  • the init.rc file is in the operating system
  • the path of the rc.local file is "/system/core/rootdir/init.rc", and the path of the rc.local file in the operating system is "/etc/init.rc"; then, compare the above two init.rc/rc.local files Yes, parse the file tags (refer to step 503), and specifically compare the init.rc/rc.local files in the initial state and the running state according to the tag content, and compare the text content corresponding to
  • the tags of the file include actions (Actions), commands (Commands), services (Services), options (Options), etc.; finally, determine the malicious level and path of the application to be detected (see step 504), in the above initial state and If the init.rc/rc.local files in the running state are not the same, it can be rated as 5 points according to the scoring rule in Figure 4 above to determine that the application to be detected is the first-level malicious application, and parse the content according to the text level by level. Trace, determine the path of malicious applications.
  • a corresponding specific process can also be provided for the comparison of the configuration information of the operating system user login operating system process.
  • obtain the latest updated profile file which contains the user login in the initial state of the operating system.
  • the configuration information of the operating system process can be downloaded from the official website of the operating system and other platforms; secondly, access the target Android system with root privileges, and obtain the profile file under the running state of the target Android system.
  • the labels of the file include Actions, Commands, Services, and Options.
  • the application is a second-level malicious application, and is tracked step by step according to the text parsing content to determine the path of the malicious application.
  • FIG. 6 is a schematic flowchart of another malicious application detection method provided by an embodiment of the present application, which can also be understood as a supplement to the flowcharts of the malicious application detection method in FIGS. 3 and 4.
  • This embodiment provides a specific process for the comparison of the configuration information of the application to be detected in the operating system.
  • the Androidmanifest.xml file of the application preinstalled by the operating system see step 601
  • the Androidmanifest.xml file contains the configuration information of the application startup process of the application pre-installed by the operating system in the initial state, which can be downloaded from the official website where the application is released.
  • the Androidmanifest.xml file of the application to be detected in the state (refer to step 602), the Androidmanifest.xml file contains the configuration information of the application startup process of the application to be detected in the running state; then, compare the above two Androidmanifest.xml files.
  • Step 603 parsing the file tags (see step 603), specifically comparing the Androidmanifest.xml files in the initial state and the running state according to the tag content, and parsing the text content corresponding to the tags with different tag content, Labels include actions (Actions), commands (Commands), services (Services), options (Options), etc.; finally, determine the malicious level and path of the application to be detected (see step 604), in the above initial state and running state If the Androidmanifest.xml files are not the same, it can be rated as 2 points according to the scoring rule in Figure 4 above, and the application to be detected is determined to be the fourth-level malicious application, the user has no uninstall permission, and the content is parsed according to the text. Path to malicious application.
  • the xml file contains the configuration information of the application startup process in the initial state of the application developed based on the above operating system disclosed by the third-party application platform, which can be downloaded from the corresponding third-party application platform; secondly, access the target Android system with root privileges , and obtain the Androidmanifest.xml file of the application to be detected in the running state of the target Android system, the Androidmanifest.xml file contains the configuration information of the application startup process of the application to be detected in the running state; then, the above two Androidmanifest.xml File comparison, parsing file tags, specifically comparing the Androidmanifest.xml files in the initial state and the running state according to the tag content, parsing the text content corresponding to the tags with different tag content, and the tags of the file have behaviors (Actions), Commands (Commands), Services (Services), Options (Options), etc.; finally, determine the malicious level and path of the application to be detected, in the case that the Androidmanifest.xml file in
  • FIG. 7 is a schematic structural diagram of an apparatus for detecting malicious applications according to an embodiment of the present application.
  • the apparatus for detecting malicious applications 70 may include an acquiring unit 701 , a comparing unit 702 and a determining unit 703 , wherein each The description of the unit is as follows:
  • Obtaining unit 701 configured to obtain initial information of an operating system, wherein the initial information includes legal application information of the operating system or configuration information of the operating system in an initial state, where the initial state is the operating system the state before the first run;
  • the obtaining unit 701 is further configured to obtain the operation information of the operating system, the operation information including the application information to be detected of the operating system or the configuration information of the operating system in the running state;
  • a comparison unit 702 configured to compare the legal application information with the application information to be detected, or compare the configuration information in the initial state with the configuration information in the running state to obtain a comparison result;
  • the determining unit 703 is configured to determine that the application to be detected on the operating system is a malicious application if the comparison results are different.
  • the configuration information of the operating system and the application information of the application are regarded as two comparison contents, and a method for detecting malicious applications is provided.
  • the malicious application detection method provided by the embodiments of the present application can save a large amount of computing and storage resources, improve the detection efficiency, and has no effect on code changes or Malicious application detection using techniques such as code obfuscation and packing is still effective, improving the accuracy of detection results.
  • the comparison unit 702 is specifically configured to compare the hash value of the configuration information of the operating system in the initial state with the configuration of the operating system in the running state The hash value of the information is compared.
  • a method of comparing hash values is used to compare whether the configuration information in the initial state and the configuration information in the running state are the same. Compare the hash value of the configuration information of the operating system in the initial state with the hash value of the configuration information of the operating system in the running state. The hash value of the configuration information and the configuration information are obtained together. The hash value of the two configuration information can enable the receiver of the configuration information to confirm the authenticity of the content of the configuration information, thereby confirming whether the content of the above two configuration information is the same, and the comparison method effectively improves the efficiency of configuration information comparison. .
  • the comparing unit 702 is further configured to compare the first configuration information with the second configuration information, wherein the first configuration information is the operating system in the The configuration information of the system startup process in the initial state, and the second configuration information is the configuration information of the system startup process of the operating system in the running state;
  • the comparison unit 702 is further configured to compare the third configuration information with the fourth configuration information, wherein the third configuration information is the operation of logging in the user in the initial state of the operating system Configuration information of a system process, and the fourth configuration information is configuration information of a user logging in to the operating system process when the operating system is in the running state.
  • the configuration information of the system startup process of the operating system in the initial state and in the running state is compared, or the user of the operating system in the initial state and in the running state is logged into the operating system process configuration information for comparison.
  • the configuration information under the operating mechanism of the operating system can be detected from the perspective of the operating system level, and the detection of high-threat malicious applications processed by the hidden camouflage technology is still effective, and the improvement is improved. Detection efficiency and accuracy of detection results.
  • the comparing unit 702 is further configured to compare the application name in the legal application information with the application name in the application information to be detected;
  • the comparing unit 702 is further configured to compare the fifth configuration information with the sixth configuration information, wherein the fifth configuration information includes the configuration information of the application startup process of the application to be detected in the initial state , the sixth configuration information includes configuration information of an application startup process of the application to be detected in a running state.
  • the application name in the legal application information and the application name in the application information to be detected are compared, or the configuration information of the application startup process of the application to be detected in the initial state and the running state is compared. Comparison.
  • the configuration information of the application startup process in the initial state and the configuration information of the application startup process in the running state from the perspective of the application level and the operating mechanism of the operating system.
  • the configuration information is still effective for the detection of high-threat malicious applications processed by the hidden camouflage technology, and a lot of computing and storage resources are saved, and the detection efficiency and the accuracy of the detection results are improved.
  • the determining unit 703 is further configured to determine the malicious level of the application to be detected according to the initial information and the running information.
  • the initial information and the running information are different, and it is determined that the application to be detected is a malicious application.
  • the malicious level of the application to be detected is further determined according to the specific difference between the initial information and the running information.
  • the malicious level of the application to be detected can be determined, and the degree of threat of the application to be detected to the terminal device can be evaluated, thereby providing a theory for the subsequent reduction or resolution of possible threats to the malicious application in different degrees. Based on this, the security and overall stability of the application operating environment are improved.
  • the determining unit 703 is specifically configured to determine that the application to be detected is a first-level malicious application when the first configuration information and the second configuration information are different;
  • the determining unit 703 is specifically further configured to determine the to-be-detected when the first configuration information and the second configuration information are the same, and the third configuration information and the fourth configuration information are different
  • the application is a second-level malicious application, wherein the malicious level of the second-level malicious application is lower than the malicious level of the first-level malicious application.
  • an implementation manner of determining the malicious level of the application to be detected under the condition that the information at the operating system level is different is provided.
  • the first configuration information and the second configuration information are different, it is determined that the application to be detected is a first-level malicious application, and the first-level malicious application represents the application to be detected with the highest degree of maliciousness; the first configuration information and the second configuration information are the same , and when the third configuration information and the fourth configuration information are different, it is determined that the application to be detected is a second-level malicious application, because the configuration information of the system startup process of the operating system in the initial state and the system startup process in the running state
  • the configuration information of the second-level malicious application is the same, so the malicious level expressed by the second-level malicious application is lower than the malicious level expressed by the first-level malicious application.
  • the determining unit 703 is further configured to, specifically, when the first configuration information and the second configuration information are the same, the third configuration information and the fourth configuration information are the same, And when the application name in the legitimate application information and the application name in the application information to be detected are different, it is determined that the application to be detected is a third-level malicious application, wherein the malicious application of the third-level malicious application is The level is lower than the malicious level of the second-level malicious application.
  • an implementation manner of determining the malicious level of the application to be detected under the condition of different application-level information is provided.
  • the third configuration information and the fourth configuration information are the same, and the application name in the legal application information and the application name in the application information to be detected are different, it is determined that the application to be detected is
  • the third-level malicious application is because the configuration information of the system startup process in the initial state of the operating system is the same as the configuration information of the system startup process in the running state, and the configuration information of the user logging in to the operating system process in the initial state of the operating system
  • the configuration information of the user logging in to the operating system process when the operating system is running is the same, so the malicious level represented by the third-level malicious application is lower than the malicious level represented by the second-level malicious application and the first-level malicious application.
  • the determining unit 703 is further configured to, specifically, when the first configuration information and the second configuration information are the same, the third configuration information and the fourth configuration information are the same, In the case where the application name in the legal application information and the application name in the application information to be detected are the same, and the fifth configuration information and the sixth configuration information are different, it is determined that the application to be detected is the fourth configuration information. level malicious application, wherein the malicious level of the fourth level malicious application is lower than the malicious level of the third level malicious application.
  • the above-mentioned first configuration information is the same as the second configuration information
  • the above-mentioned third configuration information is the same as the fourth configuration information
  • the application name in the legal application information is the same as the application name in the application information to be detected
  • the above-mentioned fifth configuration information and the third configuration information are the same.
  • the configuration information of the user logging in to the operating system process in the state is the same as the configuration information of the user logging in to the operating system process in the running state of the operating system, and the application name in the legal application information and the application name in the application information to be detected are the same.
  • the malicious level represented by the fourth-level malicious application is lower than the malicious level represented by the third-level malicious application, the second-level malicious application, and the first-level malicious application.
  • the operating system includes a system using the Linux kernel.
  • the operating system includes a system using the Linux kernel
  • the first process started by the system using the Linux kernel is generally the init process
  • the configuration information of the process is usually stored in the init.rc file. Therefore, using The Linux kernel systems are all applicable to the malicious application detection methods described in the embodiments of this application.
  • the determining unit 703 is further configured to determine the storage path of the application to be detected according to the initial information and the running information.
  • the initial information and the running information are different, and it is determined that the application to be detected is a malicious application.
  • the storage path of the application to be detected is further analyzed.
  • the label of the first configuration information and the label of the second configuration information are parsed to obtain the label content of the first configuration information and the label content of the second configuration information, and the The content of the tag of the first configuration information is compared with the content of the tag of the second configuration information, and the storage path of the application to be detected is determined according to the difference in content between the two.
  • the label of the third configuration information and the label of the fourth configuration information are parsed to obtain the content of the label of the third configuration information and the label of the fourth configuration information.
  • the content of the tag of the third configuration information is compared with the content of the tag of the fourth configuration information, and the storage path of the application to be detected is determined according to the difference in the content of the two.
  • the label of the fifth configuration information and the label of the sixth configuration information are analyzed to obtain the label content of the fifth configuration information and the label content of the sixth configuration information, and the The content of the tag of the fifth configuration information is compared with the content of the tag of the sixth configuration information, and the storage path of the application to be detected is determined according to the difference in content between the two.
  • the storage path of the malicious application can be quickly determined, and the malicious application can be processed accordingly according to the storage path, such as uninstalling the malicious application according to the storage path, restricting the acquisition of corresponding permissions, etc. processing to improve the security of the operating system operating environment.
  • each unit in the apparatus shown in FIG. 7 may be combined into one or several other units, respectively or all, to form, or some unit(s) may be further split into functionally more
  • the same operation can be achieved without affecting the realization of the technical effects of the embodiments of the present application.
  • the above units are divided based on logical functions.
  • the function of one unit can also be implemented by multiple units, or the functions of multiple units can be implemented by one unit.
  • the network-based device may also include other units, and in practical applications, these functions may also be implemented with the assistance of other units, and may be implemented by cooperation of multiple units.
  • each unit may also correspond to the corresponding descriptions of the method embodiments shown in FIG. 3 , FIG. 4 , FIG. 5 , and FIG. 6 .
  • the configuration information of the operating system in the initial state and the configuration information in the running state are compared through the text comparison technology, and the legitimate application information of the operating system is compared. Compare with the information of the application to be detected, so as to detect the security of the application to be detected, and evaluate the malicious level of the application to be detected, which can save a lot of computing and storage resources, improve the detection efficiency, and change the code or use code obfuscation. , Packing and other malicious application detection techniques are still effective, improving the accuracy of detection results.
  • FIG. 8 is a schematic structural diagram of a terminal device 80 according to an embodiment of the present application.
  • the terminal device 80 may include a memory 801 and a processor 802 . Further optionally, a communication interface 803 and a bus 804 may also be included, wherein the memory 801 , the processor 802 and the communication interface 803 are communicated with each other through the bus 804 .
  • the communication interface 803 is used for data interaction with the above-mentioned malicious application detection device 70 .
  • the memory 801 is used to provide a storage space, and data such as an operating system and a computer program can be stored in the storage space.
  • the memory 801 includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read only memory (EPROM), or Portable read-only memory (compact disc read-only memory, CD-ROM).
  • the processor 802 is a module that performs arithmetic operations and logical operations, and can be a processing module such as a central processing unit (CPU), a graphics processing unit (GPU), or a microprocessor (microprocessor unit, MPU). of one or more combinations.
  • a processing module such as a central processing unit (CPU), a graphics processing unit (GPU), or a microprocessor (microprocessor unit, MPU). of one or more combinations.
  • a computer program is stored in the memory 801, and the processor 802 calls the computer program stored in the memory 801 to execute the malicious application detection method shown in the above-mentioned FIG. 3, FIG. 4, FIG. 5, and FIG. 6:
  • initial information of the operating system wherein the initial information includes legal application information of the operating system or configuration information of the operating system in an initial state, and the initial state is the state before the operating system runs for the first time;
  • FIG. 3 The specific content of the method executed by the processor 802 can be referred to FIG. 3 , FIG. 4 , FIG. 5 , and FIG. 6 , and details are not repeated here.
  • the processor 802 calls the computer program stored in the memory 801, and can also be used to execute the method executed by the obtaining unit 701, the comparing unit 702 and the determining unit 703 in the malicious application detection device 70 shown in FIG.
  • the specific content of the steps can be found in FIG. 7 , which will not be repeated here.
  • the configuration information of the operating system in the initial state and the configuration information in the running state are compared through the text comparison technology, and the legal application information of the operating system is compared with the information to be detected.
  • the application information is compared, so as to detect the security of the application to be detected, and evaluate the malicious level of the application to be detected, which can save a lot of computing and storage resources, improve the detection efficiency, and the code changes or code obfuscation, packing
  • the malicious application detection of other technologies is still effective, and the accuracy of the detection results is improved.
  • Embodiments of the present application further provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium.
  • a computer program is stored in the computer-readable storage medium.
  • An embodiment of the present application further provides a computer program product, which can implement the methods shown in FIG. 3 , FIG. 4 , FIG. 5 , and FIG. 6 when the computer program product is executed on the processor.
  • the configuration information of the operating system in the initial state is compared with the configuration information in the running state, and the legal application information of the operating system and the application information to be detected are compared, so as to Detecting the security of the application to be detected and evaluating the malicious level of the application to be detected can save a lot of computing and storage resources and improve the detection efficiency. Effective and improve the accuracy of detection results.
  • the aforementioned storage medium includes: read-only memory ROM or random-access storage memory RAM, magnetic disk or optical disk and other media that can store computer program codes.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Debugging And Monitoring (AREA)

Abstract

Procédé et appareil de détection d'application malveillante et support de stockage. Le procédé de détection d'application consiste : à acquérir des informations initiales d'un système d'exploitation, et à acquérir des informations d'exécution du système d'exploitation (301) ; à comparer des informations sur une application légitime avec des informations sur une application à détecter, ou à comparer des informations de configuration dans un état initial avec des informations de configuration dans un état d'exécution, pour obtenir un résultat de comparaison (302) ; et si le résultat de la comparaison indique que lesdites informations sont différentes, à déterminer que l'application à détecter sur le système d'exploitation est une application malveillante (303). Selon le procédé, des informations de configuration d'un système d'exploitation dans un état initial sont comparées à des informations de configuration du système d'exploitation dans un état d'exécution, ou des informations sur une application légitime du système d'exploitation sont comparées à des informations sur une application à détecter, de façon à détecter la sécurité de l'application à détecter et à évaluer le niveau de malveillance de l'application à détecter, de telle sorte qu'un grand nombre de ressources de calcul et de stockage peut être économisé, l'efficacité de détection est améliorée, la présente invention est toujours efficace pour la détection d'applications malveillantes ayant un code modifié ou utilisant des techniques telles qu'un tassement et un brouillage de code, et la précision du résultat de détection est améliorée.
PCT/CN2020/137660 2020-12-18 2020-12-18 Procédé et appareil de détection d'application malveillante et support de stockage WO2022126616A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080004482.1A CN112689835A (zh) 2020-12-18 2020-12-18 一种恶意应用的检测方法、装置及存储介质
PCT/CN2020/137660 WO2022126616A1 (fr) 2020-12-18 2020-12-18 Procédé et appareil de détection d'application malveillante et support de stockage

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/137660 WO2022126616A1 (fr) 2020-12-18 2020-12-18 Procédé et appareil de détection d'application malveillante et support de stockage

Publications (1)

Publication Number Publication Date
WO2022126616A1 true WO2022126616A1 (fr) 2022-06-23

Family

ID=75457656

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/137660 WO2022126616A1 (fr) 2020-12-18 2020-12-18 Procédé et appareil de détection d'application malveillante et support de stockage

Country Status (2)

Country Link
CN (1) CN112689835A (fr)
WO (1) WO2022126616A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080016339A1 (en) * 2006-06-29 2008-01-17 Jayant Shukla Application Sandbox to Detect, Remove, and Prevent Malware
WO2013166126A1 (fr) * 2012-05-01 2013-11-07 Taasera, Inc. Systèmes et procédés de sécurité mobile sur la base d'une attestation dynamique
US20150256552A1 (en) * 2014-03-04 2015-09-10 Electronics And Telecommunications Research Institute Imalicious code detection apparatus and method
CN110737887A (zh) * 2019-10-22 2020-01-31 厦门美图之家科技有限公司 恶意代码检测方法、装置、电子设备及存储介质
CN111027070A (zh) * 2019-12-02 2020-04-17 厦门大学 恶意应用检测方法、介质、设备及装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106503555A (zh) * 2016-10-21 2017-03-15 维沃移动通信有限公司 一种保障支付安全的方法和移动终端

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080016339A1 (en) * 2006-06-29 2008-01-17 Jayant Shukla Application Sandbox to Detect, Remove, and Prevent Malware
WO2013166126A1 (fr) * 2012-05-01 2013-11-07 Taasera, Inc. Systèmes et procédés de sécurité mobile sur la base d'une attestation dynamique
US20150256552A1 (en) * 2014-03-04 2015-09-10 Electronics And Telecommunications Research Institute Imalicious code detection apparatus and method
CN110737887A (zh) * 2019-10-22 2020-01-31 厦门美图之家科技有限公司 恶意代码检测方法、装置、电子设备及存储介质
CN111027070A (zh) * 2019-12-02 2020-04-17 厦门大学 恶意应用检测方法、介质、设备及装置

Also Published As

Publication number Publication date
CN112689835A (zh) 2021-04-20

Similar Documents

Publication Publication Date Title
US10235524B2 (en) Methods and apparatus for identifying and removing malicious applications
KR101238572B1 (ko) 신뢰 환경을 지원하기 위한 컴퓨터 판독가능 구성요소의자동 업데이트
US8191147B1 (en) Method for malware removal based on network signatures and file system artifacts
US20100306851A1 (en) Method and apparatus for preventing a vulnerability of a web browser from being exploited
WO2010053739A2 (fr) Procédé et système pour limiter un accès à un fichier dans un système d'ordinateur
CN104517054A (zh) 一种检测恶意apk的方法、装置、客户端和服务器
EP3583536B1 (fr) Définition sécurisée d'une composition de système d'exploitation sans création multiple
Mandal et al. Vulnerability analysis of android auto infotainment apps
US20140283044A1 (en) Method and Device For Preventing Application in an Operating System From Being Uninstalled
CN111177665B (zh) 一种新生成可执行文件的安全追溯方法
CN108028843B (zh) 保护计算机实现的功能的递送的方法、系统和计算设备
KR101558054B1 (ko) 안티 멀웨어 시스템 및 안티 멀웨어 시스템에서의 패킷 처리 방법
US10366213B2 (en) Protecting an application via an intra-application firewall
CN114282212A (zh) 流氓软件识别方法、装置、电子设备及存储介质
WO2022126616A1 (fr) Procédé et appareil de détection d'application malveillante et support de stockage
US9507621B1 (en) Signature-based detection of kernel data structure modification
CN116595523A (zh) 基于动态编排的多引擎文件检测方法、系统、设备及介质
CN113779576A (zh) 一种可执行文件感染病毒的识别方法、装置及电子设备
CN112528286A (zh) 终端设备安全检测方法、关联设备以及计算机程序产品
CN112905534B (zh) 一种基于沙箱环境的样本分析方法和装置
JP2010113566A (ja) 情報処理装置、アクセス制御方法、及びプログラム
CN107346389B (zh) 移动终端异常行为的检测方法与系统
CN113901483A (zh) 应用检测方法、装置、计算机存储介质和电子设备
CN115712876A (zh) 安装包拦截方法、装置、电子设备和计算机可读存储介质
Zhan et al. DroidExaminer: An Android Malware Hybrid Detection System Based on Ensemble Learning

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20965631

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20965631

Country of ref document: EP

Kind code of ref document: A1