基于敏感权限及其函数调用图的Android恶意代码检测  

Detecting Android malware based on sensitive permissions and function-call graphs

作　　者：祝小兰 王俊峰[1] 杜垚[1] 白金荣[1] 

机构地区：[1]四川大学计算机学院,成都610065

出　　处：《四川大学学报（自然科学版）》2016年第3期526-533,共8页Journal of Sichuan University(Natural Science Edition)

基　　金：国家自然科学基金(91338107;91438119;91438120);教育部博士点基金(20130181110095);四川省软科学计划(2016ZR0087)

摘　　要：为了有效地检测Android平台上的恶意软件,提出了一种基于敏感权限及其函数调用流程图的静态综合检测方法.通过对恶意软件进行逆向工程分析,构建了包含恶意代码敏感权限与函数调用图的特征库.并采用Munkres匈牙利算法计算待测样本与特征库在相同敏感权限下两个函数调用图之间的编辑距离,得到两个函数调用图之间的相似性,进而得到两个应用程序之间的相似性,据此对恶意软件进行检测识别.实验结果表明,该检测方法具有较高的准确性与有效性,检测效果明显优于工具Androguard.In order to detect malwares on the Android platform more effectively,a static comprehensive detection method which combines sensitive permissions with function-call graphs was proposed.Firstly,after adopting reverse engineering technology,the authors constructed a malware graph database,including sensitive permissions and function-call graphs of numbers of malwares.Then,the Munkres algorithm was used to calculate the graph edit distance between the function-call graphs of the test sample and database at the same sensitive permissions to get the similarity of two function-call graphs,the similarity between two apps and detect malware further.The result shows that the method in this paper is highly effective in terms of a high accuracy and a low false positive rate,and it can detect more malwares when compared with the detection rate of the Androguard.

关 键 词：Android恶意代码检测 逆向工程 敏感权限 函数调用图 图编辑距离 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]