【作者】 张京；

【导师】 邹仕洪；

【作者基本信息】 北京邮电大学 ， 计算机科学与技术， 2015， 硕士

【摘要】 随着Android手机的普及度越来越大,Android恶意软件的数量也在以惊人的速度增长着。因此,如何实现对这些恶意软件的检测,从而保护用户的隐私和财产安全,已经成为了一个关键问题。以行为分析为基础的Android恶意软件检测凭借其检测的准确性,吸引了越来越多人的关注,已经成为了一种非常有前途的检测方法。我们以此为背景,明确了课题任务,即设计和开发一个Android软件行为分析系统。本文首先介绍了课题的背景、任务以及目前Android软件行为分析方面的相关研究,并详细说明了系统所用技术的相关背景,包括共享库注入、Hook、Binder进程间通信机制以及机器学习。接着,我们从功能性需求和非功能性需求两个方面对需求分析进行了介绍。然后,我们将系统分为了两个模块,即行为拦截模块和行为分析模块,并针对这两个模块结合流程图分别进行了概要设计和详细设计。最后,我们介绍了对系统进行的实验；我们总共使用了1136个实验样本,并且引入了三种评估指标来对系统的实验结果进行评估。本文设计的系统实现了对Android恶意软件的有效检测,其创新点在于：在技术方面,我们有效的将共享库注入、Hook以及机器学习等技术结合起来；在理论方面,我们提出了一个特征加权方法,并将其应用于SVM分类器,最终取得了很好的效果。我们将技术创新与理论研究相结合,最终实现了一个有效的Android软件行为分析系统。更多还原

【Abstract】 With the increase of the popularity of Android mobile phone, the number of Android malware is growing at an alarming speed. In order to protect the privacy and property safety of Android users, it is a key issue to implement Android malware detection. Behavior-based Android malware detection has drawn a lot of people’s attention because of its accuracy, and becomes a promising approach. Based on this background, we decide to design and implement an Android software behavior analysis system.In the first place, we introduce the background and task of this thesis, present the related work of Android software behavior analysis, and describe the technical background of the system, including shared library injection, hooking, Binder mechanism and machine learning. Next, we introduce the requirements analysis from two aspects, namely functional requirements and non-functional requirements. Then, we divide the system into two parts, namely behavior interception module and behavior analysis module, and carry out summary design and particular design on both of them with flow charts. Finally, we introduce the experimental results; our experiments are conducted with1136real-world samples and three standard metrics are introduced to evaluate the experimental results.This system shows the effectiveness of Android malware detection, and the contributions of it are as follows:in the technical aspect, we effectively combine three techniques together, namely shared library injection, hooking and machine learning; in the theoretical aspect, we propose a feature weighting method to improve the classification effect of SVM. With the combination of engineering innovation and theoretical researches, we carry out an effective Android software behavior analysis system.更多还原