【作者】 李彬；

【导师】 邹仕洪；

【作者基本信息】 北京邮电大学 ， 电子与通信工程（专业学位）， 2013， 硕士

【摘要】 随着Android手机操作系统的流行,该平台上的恶意软件的数量不断增多,技术也在不断发展。当前的一些软件行为分析技术已经不能满足新的需求。在此背景下,迫切需要一种新的行为分析手段。因此,需要实现一个基于Android沙箱的软件行为分析系统。论文首先通过介绍Android OS的发展、智能手机面临的安全问题、恶意软件的研究现状三个方面引出本课题。接着,介绍设计和实现系统所需的一些技术背景知识,包括Android系统架构、Dalvik虚拟机、Hook API技术、Android OS安全机制等。然后,在需求分析阶段,明确了系统需求,即通过Hook敏感API技术,实现对软件的行为分析。这些敏感API包括：联网、短信、操作数据库、窃取用户隐私、通话等。在概要设计阶段,将系统划分为代码注入模块、Hook模块、数据传递模块、行为日志生成及分析四个模块。在每个模块设计中,结合用例图、静态类图及一些系统框图给出了每个模块的设计思路。在系统的详细设计与实现阶段,对每个模块的实现进行介绍,并对一些核心类及其函数进行重点阐述。在系统测试阶段,根据给出的测试用例,对系统进行测试。在论文的结尾,分析了系统的不足之处,并对整篇论文进行了总结。本论文所设计的基于Android沙箱的软件行为分析系统已经实现,现己经投入使用。更多还原

【Abstract】 With the growing popularity of Android OS, malicious software on this platform is also developing in quantities and techniques. Currently, the software behavior analysis techniques are outdated and are not able to handle these malware. In the circumstances, there is an urgent need for a new behavior analysis technique. Therefore, we need to implement a software behavior analysis system based on the Android sandbox.First of all, this thesis gives a brief introduction to the development of Android OS, the security problem on mobile platform and the current mobile malware research technique. Secondly, it introduces the technical backgrounds of designing and implementing the system, such as Android System Architecture, Dalvik virtual machine, Hook API technology, Android security mechanism and so on. In the next phase, this thesis specifies the design requirements clearly, by Hooking sensitive API technology to analyze the behavior of the software.This thesis also specifies the sensitive behaviors requiring Hook, such as networking, SMS, operating the database, stealing user privacy, call behavior and so on. During the detailed design phase, the system is divided into four modules, including code injection module, the Hook module, data transfer module, the log and behavior analysis module. During the system design period, this thesis gives the design ideas of each module combined with case diagrams, static class diagrams and system block diagrams. During the phase of detailed design and implementation, this thesis elaborates on the method how to implement each model and focuses on some of the core classes and their functions. During the system testing phase, the system was tested according to the given test cases. In the end,this thesis analyses the inadequacies of the system and concludes with the full thesis.The behavior analysis system based on the Android sandbox has been achieved, and has been put into use.更多还原