基于静态分析的TVOS恶意应用检测方法研究  

Vetting TVOS Applications and Detecting Malicious Applications

作　　者：曹咪 王继刚[2] 王伟[1] 邵坤 何永忠[1] CAO Mi;WANG Jigang;WANG Wei;SHAO Kun;HE Yongzhong(Beijing Key Laboratory of Security and Privacy in Intelligent Transportation,Beijing Jiaotong University,Beijing 100044,China;Department of Technical Planning,ZTE Corporation,Nanjing 210012,China)

机构地区：[1]北京交通大学智能交通数据安全与隐私保护技术北京市重点实验室,北京100044 [2]中兴通讯股份有限公司技术规划部,江苏南京210012

出　　处：《郑州大学学报（理学版）》2018年第3期27-33,共7页Journal of Zhengzhou University:Natural Science Edition

基　　金：国家重点研发计划"网络空间安全"重点专项(2017YFB0802805);中兴通讯产学研合作项目(K17L00190);电子信息控制重点实验室基金项目(K16GY00040);国家科技重大专项(2014ZX01039101);中央高校基本科研业务费项目(K17JB00020);上海市信息安全综合管理技术研究重点实验室基金项目(AGK2015002)

摘　　要：TVOS是一种新型的智能电视操作系统,针对当前TVOS应用分析相关工作较少,并且缺乏相应TVOS恶意应用检测方法的问题,全面深入分析TVOS应用,并提出有效的TVOS恶意应用检测方法.由于TVOS兼容Android应用,但又具有面向广电行业及媒体融合的特点.首先,基于静态特征深入研究了TVOS应用与Android应用的区别.其次,以TVOS的典型应用市场欢视网为例,分析并检测了欢视网应用市场中3 425个应用.再次,量化分析应用的静态特征,并使用支持向量机、逻辑回归、决策树、随机森林等4种机器学习方法对应用进行检测.最后,深入分析检测结果,讨论了基于静态特征的TVOS恶意应用检测方法的可行性与局限性.实验结果表明,所提出的基于支持向量机的TVOS恶意应用检测方法在误报率为0.54%的条件下,能够有效检测出98.67%的潜在恶意应用.TVOS was a newly developed operating system of smart TV.This study aimed to vet TVOS applications and to detect malicious applications.Firstly,the differences between TVOS applications and Android applications were investigated based on static features.Secondly,the applications were all detected in a typical TVOS app market called“HuanShi”.Thirdly,features extracted from these applications were analyzed.With these features,malicious applications were detected based on four machine learning methods,namely,support vector machine(SVM),decision tree(DT),random forest(RF),and logistic regression(LR).Finally,the detection results were analyzed,and the feasibility and limitations were thoroughly discussed based on static features.The experimental results showed that the SVM based detection method had detectable rate 98.67%for malicious applications with a false positive rate of 0.54%.

关 键 词：TVOS 恶意应用检测 静态分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]