一种静态Android程序恶意性检测方法

Malicious Android Application Detection Method Based on Static Behavior Characteristics

分析Android恶意程序行为特征,研究基于静态行为特征的Android程序恶意性检测方法及其实现方案,根据程序的静态行为特征来判断程序是否具有恶意性。针对Kirin方案做了2个方面的改进,一方面增加了对API的检测,细化了检测粒度,另一方面量化了不同静态行为特征的恶意性指数,通过计算程序的恶意性指数来分析程序的安全等级。实验结果表明,该方法能够有效地检测Android程序的恶意性程度。

This paper analyzes the malicious Android application behavior characteristics. It researches the detection method of malicious Android application based on static behavior characteristics and its implementation. The method can determine whether an application is malicious according to its static behavior characteristics. It improves Kirin in two aspects. Firstly, it adds the detection of APls,refines the detection granularity.Secondly,it quantifies the malicious value of different static behavior characteristics and analyzes the security level by calculating the malicious value of the application. Experimental results show that this detection method can effectively detect the security level of an application.