基于Binder信息流的Android恶意行为检测系统  

A Detecting System for Android Malicious Behavior Based on Binder Information Flow

作　　者：李桂芝[1,2] 韩臻[1] 周启惠[2] 王雅哲[2] 

机构地区：[1]北京交通大学计算机与信息技术学院,北京100044 [2]中国科学院信息工程研究所信息安全国家重点实验室,北京100093

出　　处：《信息网络安全》2016年第2期54-59,共6页Netinfo Security

基　　金：国家自然科学基金[61202476]

摘　　要：目前基于Android系统的恶意软件泛滥,其恶意行为不仅给用户的财产安全带来巨大的威胁,也制约移动终端应用的发展。文章针对这种现象设计并实现了一种基于Binder信息流的Android恶意行为检测系统。根据收集到的应用间通信信息,以检测隐私数据泄露为具体安全需求,构建信息流矢量图展示应用通信路径,基于通信内容利用图的遍历进行恶意行为分析。文章对300个应用进行分析,发现有30.7%的应用存在非法访问隐私数据的恶意行为。性能测试结果表明,文章所提方案对Android系统仅带来6.9%的性能损耗。Currently, malwares based on the Android system are in flood. The malicious behavior not only brings a huge threat to users＇ property, but also limits the development of mobile terminal application. In order to solve this problem, this paper designs and realizes a system for malicious behavior detection based on Binder information flow. According to the collected universal information, this paper sets privacy data detection as the specific safety requirements to discover the malicious behavior of applications, and builds information-flow graph showing the communication path between applications. Malicious behavior analysis is based on communication content and graph traversal. This paper analyzes 300 applications and finds 30.7% of the applications have malicious behavior of illicit access to private data. The performance test shows that the proposed scheme in this paper only brings 6.9% performance loss to Android system.

关 键 词：ANDROID Binder信息流 隐私数据 恶意行为 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]