基于多级签名匹配算法的Android恶意应用检测

Android malware detection based on multi-level signature matching

针对Android恶意应用泛滥的问题,提出了一种基于恶意应用样本库的多级签名匹配算法来进行Android恶意应用的检测。以MD5哈希算法与反编译生成的smali文件为基础,生成API签名、Method签名、Class签名、APK签名。利用生成的签名信息,从每一类恶意应用样本库中提取出这类恶意行为的共有签名,通过匹配待检测应用的Class签名与已知恶意应用样本库的签名,将待测应用中含有与恶意签名的列为可疑应用,并回溯定位其恶意代码,确定其是否含有恶意行为。在测试中成功地发现可疑应用并定位了恶意代码,证明了系统的有效性。

This paper proposed an Android malware analytic method based on improved multi-level signature. It combined decompiling techniques with MD5 hash function,generating API signature,method signature,class signature,and the application signature. After getting the signature,it extracted the same mal-signatures of one kind malware in the malware repository successfully. Then used the information of mal-signature to detect other applications. Finally it was necessary to locate and analyze the main mal code of those suspecte applications. And the experiments to real Android applications indicated that this system can find the suspected applications and locate the malicious code.