一种Android恶意程序检测工具的实现

Implementation of a Malware Detect Tool on Android

目前,Android上恶意程序的识别主要通过静态检测,但普遍识别率不高。文章基于静态检测原理,使用了一种基于行为的检测方法,以变量跟踪以及函数等价匹配的方式来判断一个Android安装包中是否存在恶意行为,从而增大了静态检测的准确率。在文章中,以短信吸费程序为样本,实现了这种基于行为分析的恶意程序检测工具。并在测试中证明了它的有效性。

At present, malware is mainly detected through static-based approach, but the recognition rate is low. Based on the mechanism of static detection, this paper gave a behavior-based approach which analysis the behavior of sensitive function in the application. In this way, using the traces of variables and equivalent function matching to determine whether an Android package have malicious behavior. The behavior-based approach improves the accuracy of the static detection. This paper implement a detect tool aim at SMS Trojan and is proved its effectiveness in testing.