抗混淆的Android应用相似性检测方法  

Anti-obfuscation method for detecting similarity of Android application

作　　者：王兆国[1] 李城龙[2] 关毅[1] 薛一波[3] 

机构地区：[1]哈尔滨工业大学计算机科学技术学院,黑龙江哈尔滨150006 [2]国家计算机网络应急技术处理协调中心,北京100029 [3]清华大学清华信息科学与技术国家实验室,北京100084

出　　处：《华中科技大学学报（自然科学版）》2016年第3期60-64,76,共6页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家科技支撑计划资助项目(2012BAH46B04)

摘　　要：为了对抗混淆问题,更好地应对相似性检测需求,基于抗混淆的7种应用代码特征,以及抗混淆的音频和图片文件特征,提出一种新型的抗混淆相似性检测和评估方法.并基于该方法实现了可满足大数据分析环境的原型系统.通过该系统对1 259款恶意应用和12个应用商店的288款应用进行分析,结果表明:该方法可有效对抗混淆攻击,完成同源性分析,依据同源性分析结果可对零日恶意应用进行识别.实验证明该方法可有效对抗代码混淆给相似性检测带来的问题,特征选取具有全局性,效果优于同类方法.In order to confront the code obfuscation problem,and better respond to the needs of similarity detection,a new method based on anti-obfuscation characteristics was designed,which included7 kinds of anti-obfuscation code characteristics,audio characteristics and image characteristics.The method was proposed for detecting similarity and evaluating.Based on these characteristics and the methods,aprototype system was implemented and made suitable for large-scale scenario.The detections of 1259 malware and 288 APPs from 12 APP markets show that the proposed method has obvious advantages over the state-of-the-art methods against code obfuscation with high detection performance.

关 键 词：ANDROID应用 抗混淆特征 相似性检测 恶意软件分析 声纹特征 代码特征 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]