Android恶意软件检测研究与进展

Android恶意软件检测研究与进展 Android Malware Detection Research and Development 彭国军 PENG Guojun 1 2 3 first-author 李晶雯 LI Jingwen 1 孙润康 SUN Runkang 1 肖云倡 XIAO Yunchang 1 武汉大学计算机学院 武汉大学计算机学院 School of Computer,Wuhan University School of Computer,Wuhan University 空天信息安全与可信计算教育部重点实验室 空天信息安全与可信计算教育部重点实验室 Key Laboratory of Aerospace Information Security and Trusted Computing Ministry of Eduction,Wuhan University Key Laboratory of Aerospace Information Security and Trusted Computing Ministry of Eduction,Wuhan University 中国人民大学法学院 中国人民大学法学院 Law School,Remin University of China Law School,Remin University of China 针对持续恶化的Android安全形势,从恶意软件检测的角度,首先总结了Android恶意软件在安装、触发和恶意负载方面的特征和发展趋势;以此为基础,结合Android平台特性和移动智能终端环境限制,系统化论述了现有Android恶意软件分析与判定技术,指出了权限分析、动态分析和静态分析的实现方法及其优缺点;介绍了基于特征值和基于启发式的恶意软件判定方法.最后,根据已有Android恶意软件检测研究的不足,提出了未来的研究方向和发展趋势. In light of deteriorating security situation on the popular Android platform,there is a pressing need to develop effective solutions of Android malware detection.To address this issue,firstly Android malwares were systematically characterized from various aspects,including their installation methods,activation mechanisms as well as the nature of carried malicious payloads.Characterization and evolution of Android malware were the foundation of malware detection.Given the resource-constrained mobile phone environments and Android’s special programming paradigm,several analysis techniques for detecting malware have been proposed:permission analysis,static analysis and dynamic analysis.The following malware detection solutions are primarily implemented using two methods:signature-based and heuristic-based.And then,a wide range of Android-based malware detection works were compared to evaluate the effectiveness of techniques for analyzing and identifying mobile malware.Finally,the direction of future studies in this field was presented on the basis of the assessment of the previous researches. Android 恶意软件特征 恶意软件分析 恶意软件检测 Android malware characterization malware analysis malware detection 10.14188/j.1671-8836.2015.01.003 TP393.08 国家自然科学基金（61202387,61202385,61373168,61103220）;中国博士后科学基金（2012M510641）;高等学校博士点专项科研基金（20120141110002）;湖北省自然科学基金（2011CDB456）资助项目;武汉市晨光计划项目（2012710367） 2015-01-01 2021-03-31 1 61