基于日志分析的Android系统恶意行为检测  

LOG ANALYSIS-BASED MALICIOUS BEHAVIOUR DETECTION FOR ANDROID SYSTEM

作　　者：谢丽霞[1] 赵彬彬[1] 

机构地区：[1]中国民航大学计算机科学与技术学院,天津300300

出　　处：《计算机应用与软件》2016年第5期289-292,共4页Computer Applications and Software

基　　金：国家自然科学基金项目(60776807;61179045);国家科技重大专项(2012ZX03002002);天津市科技计划重点项目(09JCZDJC16800)

摘　　要：针对Android平台恶意软件泛滥的问题,提出一种基于日志分析的Android系统的恶意行为检测模型。模型采用进程守护和广播监听的方式收集日志信息并通过Boyer-Moore算法匹配、识别恶意行为。以Android 4.0平台为测试环境进行软件行为检测,实验结果表明,该检测模型能够检测出90.0%的恶意行为,证明模型对Android系统恶意行为检测的有效性和可行性。This paper proposes a log analysis-based malicious behaviour detection model for Android system targeted at the rampant Android platform malware problem. The model uses the way of process guardianship and broadcast interception to collect log information,and matches and identifies malicious behaviours with Boyer-Moore algorithm. Android 4. 0 platform is used as the testing environment for software behaviours detection,experimental results shows that this detection model is able to detect 90. 0% malicious behaviours,and this proves the effectiveness and feasibility of the model on detecting malicious behaviours in Android system.

关 键 词：进程守护 恶意行为 日志信息 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]