Android恶意软件检测研究与进展  

Android Malware Detection Research and Development

作　　者：彭国军[1,2,3] 李晶雯[1] 孙润康[1] 肖云倡 

机构地区：[1]武汉大学计算机学院,湖北武汉430072 [2]空天信息安全与可信计算教育部重点实验室,湖北武汉430072 [3]中国人民大学法学院,北京100872

出　　处：《武汉大学学报（理学版）》2015年第1期21-33,共13页Journal of Wuhan University:Natural Science Edition

基　　金：国家自然科学基金(61202387;61202385;61373168;61103220);中国博士后科学基金(2012M510641);高等学校博士点专项科研基金(20120141110002);湖北省自然科学基金(2011CDB456)资助项目;武汉市晨光计划项目(2012710367)

摘　　要：针对持续恶化的Android安全形势,从恶意软件检测的角度,首先总结了Android恶意软件在安装、触发和恶意负载方面的特征和发展趋势;以此为基础,结合Android平台特性和移动智能终端环境限制,系统化论述了现有Android恶意软件分析与判定技术,指出了权限分析、动态分析和静态分析的实现方法及其优缺点;介绍了基于特征值和基于启发式的恶意软件判定方法.最后,根据已有Android恶意软件检测研究的不足,提出了未来的研究方向和发展趋势.In light of deteriorating security situation on the popular Android platform, there is a pressing need to develop effective solutions of Android malware detection. To address this issue, firstly Android malwares were systematically characterized from various aspects, including their installation methods, activation mechanisms as well as the nature of carried malicious payloads. Characterization and evolution of Android malware were the foundation of malware detection. Given the resource-constrained mobile phone environments and Android＇s special programming paradigm, several analysis techniques for detecting malware have been proposed： permission analysis, static analysis and dynamic analysis. The following malware detection solutions are primarily implemented using two methods： signature-based and heuristic-based. And then, a wide range of Android-based malware detection works were compared to evaluate the effectiveness of techniques for analyzing and identifying mobile malware. Finally, the direction of future studies in this field was presented on the basis of the assessment of the previous researches.

关 键 词：ANDROID 恶意软件特征 恶意软件分析 恶意软件检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]