meta_sploit_meta的博客

近几年来 .Android手机木马病毒发展迅速 ,Android手机安全问题成为大家关注 的焦点 ,基于 Android的 木 马检测引擎的研究 与实现变得 日益迫切 。为此 ,提出了一套特征码提取检测 算法 (FCPA),FCPA通过调用 Android系统库 函数获取恶意文件的源路径,利用源路径找到相应文件并对文件进行散列处理 ,获取文件特征信 息,生成一个唯一标识该木马病毒的特征值 ,然后构建特征码库。同时 ,设计并实现了木马检测引擎 ,其利用特征码提 取算法快速扫描并检测出手机应用程序中的恶意程序。实验结果表明 ,该木马检测 引擎能够有效检测恶意应用。

This article presents Andromaly—a framework for detecting malware on Android mobile devices. The proposed framework realizes a Host-based Malware Detection System that continuously monitors various features and events obtained from the mobile device and then applies Machine Learning anomaly detectors to classify the collected data as normal (benign) or abnormal (malicious). Since no malicious applications are yet available for Android, we developed four malicious applications, and evaluated Andromaly’s ability to detect new malware based on samples of known malware. We evaluated several combinations of anomaly detec- tion algorithms, feature selection method and the number of top features in order to find the combination that yields the best performance in detecting new malware on Android. Empirical results suggest that the proposed framework is effective in detecting malware on mobile devices in general and on Android in particular.

音信无痕安卓加密通信软件，用起来挺不错。

Android应用的恶意代码注入 张嘉宾 北京邮电

Basic Courses of Android Security 移动安全 北斗