【作者】 魏娟；

【导师】 秦志光；

【作者基本信息】 电子科技大学 ， 信息安全， 2015， 硕士

【摘要】 随着智能手机的不断普及,以及Android的快速发展,针对Android的恶意软件、病毒等方面的安全事件也越来越频繁。越来越多的恶意软件、广告被伪装成为正规手机软件从第三方平台上被用户下载安装,随后远程控制用户手机,窃取用户的隐私甚至恶意扣费。然而,现有的Android应用恶意软件检测方法大多是基于行为的研究,在恶意软件暴露之前,很多程序已经对用户造成了损失,不能满足用户需要,因此,研究Android应用静态风险评估很有必要。论文工作主要研究通过静态分析技术实现Android应用的风险评估。论文结合Android应用程序的结构和安全机制有关知识,分析和对比了Android平台恶意软件检测相关技术,然后提出从源代码出发,利用Android静态分析方法,对Android应用程序反编译后的文件进行分析,从而提取权限特征,来有效地评估Android软件中可能存在的恶意行为。论文工作的重点如下:(1)提出了一种基于恶意软件分类的权限特征提取方法,并结合权限组合和机器学习分类方法去除冗余。基于恶意软件分类的方法,提取出能够有效区分恶意软件和正常软件的十种权限特征属性,根据它们彼此的相关性,对它们做了权限组合分类,从而达到去冗余的目的。此方法简单高效,有一定的实际应用价值。(2)采用加权相似算法,对未知Android应用做风险评估。在传统的Android应用安全检测基础之上,提出加权相似算法,通过静态特征库对比,针对有潜在风险的应用程序,给用户提供安全提示。此方法相比较其他检测方法而言,从源代码角度出发,无需实际运行Android应用程序,检测时间较短,占用系统资源较少,成本低,可实际应用于Android应用风险评估。论文在收集了大量真实的正常软件和恶意软件样本的基础上进行实验,实验结果表明所设计的系统能够对新上市的Android应用进行风险评估,系统稳定,功能完善,满足系统需求,达到了较好的效果。总的来说,本论文的研究结果对Android应用安全相关研究有着重要的参考价值。更多还原

【Abstract】 With the rapid development of the Android Operating System, security issues such as malware and virus are rising. Disguised as normal apps, malware installed from third party platforms continuously are causing issues including the leak of sensitive data, fee deduction and the loss of security control, which lead to great loss to users. Majority of existing malware detecting methods are based on the behaviors of applications, so damage may have already been made before malicious behaviors are detected. Thus the research on static risk assessment of Android applications is of vital and urgent importance.This thesis makes detailed comparison between malware detecting technologies on the Android platform, and proposes an approach using static analysis on decompiled source code with feature extraction, estimating probable malicious activities in Android applications.First of all, a feature extraction method based on malware classification is introduced in this thesis. By using feature combination and machine learning classification algorithms, it extracts ten features which are able to distinguish malware from normal apps effectively.Besides, a new risk assessment system for Android applications is shown in this thesis. This system extracts permission features of Android application and compares it against a static library of features to detect potential risk. Compared with other malware detecting systems, the system proposed by this thesis is based on static analysis, actually with no need to run the applications, and requires fairly less system resource.Last but not the least, the results of related experiments conducted are analyzed in this thesis as well. Based on a large number of real samples, the experiments prove that the system proposed is able to assess the risk of unknown Android applications.更多还原