基于多层次交叉视图分析的Android系统恶意行为监控方法研究

Research on Method of Android System Malware Behavior Monitoring Based on Multi-level and Cross-view Analysis

现有的Android系统行为监控方法,或需重新编译系统,或需改动被监控软件,且大多数监控不全面,无法识别恶意代码隐藏行为。针对这些问题,文章提出了一种基于多层次交叉视图分析的Android系统恶意行为监控方法。该方法基于进程注入和可加载内核模块技术,在Java层、Native层和Kernel层对恶意行为进行监控,获取行为监控表,并通过交叉视图对比分析,识别恶意代码的隐藏行为。最后,文章在Android模拟器环境下,利用能够覆盖主要恶意行为的12种恶意代码进行实验,结果表明,该方法对恶意行为的监控准确率达到了91.43%,并能有效检测其隐藏行为,监控粒度细、实用性强。

The existing methods applying to behavior monitoring of Android system need to either recompile the system or alter the applications which is monitored. Most of them are not comprehensive enough and cannot identify the hidden behaviors of malicious codes. According to the problems raised before, this paper proposes a method of Android system malware behavior monitoring which bases on multi-level and cross-view analysis. The paper uses the technology of process injection and loadable kernel, which monitors malware behavior in Java level, Native level and Kernel level. Then this paper obtains the result of behavior monitoring and identiifes the hidden behaviors by cross-view analysis. Under Android simulator environment, the experiment uses 12 kinds of malware which can cover most of the malware behaviors. The results shows that the monitoring accuracy rate of malicious behavior reaches to 91.43%, and the method can detect the hidden behaviors effectively. So it has fine audit granularity and strong practicality.