Please wait a minute...
 首页  期刊介绍 期刊订阅 联系我们 横山亮次奖 百年刊庆
 
最新录用  |  预出版  |  当期目录  |  过刊浏览  |  阅读排行  |  下载排行  |  引用排行  |  横山亮次奖  |  百年刊庆
清华大学学报(自然科学版)  2016, Vol. 65 Issue (5): 453-460    DOI: 10.16511/j.cnki.qhdxxb.2016.25.001
  信息安全 本期目录 | 过刊浏览 | 高级检索 |
基于沙盒的Android应用风险行为分析与评估
李舟军1, 吴春明1, 王啸2
1. 北京航空航天大学 计算机学院, 北京 100191;
2. 国家计算机网络应急技术处理协调中心, 北京 100029
Assessment of Android application's risk behavior based on a sandbox system
LI Zhoujun1, WU Chunming1, WANG Xiao2
1. School of Computer Science and Engineering, Beihang University, Beijing 100191, China;
2. National Computer Network Emergency Response Technical Team/Coordination Center of China, Beijing 100029, China
全文: PDF(1508 KB)  
输出: BibTeX | EndNote (RIS)      
摘要 Android是移动领域市场占有率最高的操作系统, 其开源的系统、海量的应用使得Android的用户量与日俱增, 因此Android的安全问题受到业界的高度重视和广泛关注, 特别是Android设备上大量涌现的恶意应用, 已成为Android生态圈发展所面临的重大问题。该文基于Android 4.1.2设计并实现了一个沙盒, 能够对Android系统中应用的行为进行动态监视和记录; 提出了一种基于行为分析的应用风险评估方法, 以便用户对相关应用的风险有一个明确的预判, 从而提高和保障用户的安全; 通过对恶意应用和正常应用的样本分别进行实验和分析, 验证了该文所提出方法的有效性。
服务
把本文推荐给朋友
加入引用管理器
E-mail Alert
RSS
作者相关文章
李舟军
吴春明
王啸
关键词 Android应用沙盒行为分析风险评估    
Abstract:Android has become the most popular operating system on mobile devices. However, the Android is an open source system with billions of applications. More users are choosing Android, so Android security problems are receiving much attention in the industry. Android of malware is already a major problem and cannot be avoided in the Android ecosystem. This paper describes a sandbox system based on Android 4.1.2 which can dynamically monitor and record application behavior. A risk assessment approach based on behavior analysis is given so that users can get an explicit risk prognosis for an application to improve their safety. Tests on malware and normal application samples verify the effectiveness of this risk assessment approach.
Key wordsAndroid applications    sandbox    behavior analysis    risk assessment
收稿日期: 2016-01-21      出版日期: 2016-05-19
ZTFLH:  TP309.2  
引用本文:   
李舟军, 吴春明, 王啸. 基于沙盒的Android应用风险行为分析与评估[J]. 清华大学学报(自然科学版), 2016, 65(5): 453-460.
LI Zhoujun, WU Chunming, WANG Xiao. Assessment of Android application's risk behavior based on a sandbox system. Journal of Tsinghua University(Science and Technology), 2016, 65(5): 453-460.
链接本文:  
http://jst.tsinghuajournals.com/CN/10.16511/j.cnki.qhdxxb.2016.25.001  或          http://jst.tsinghuajournals.com/CN/Y2016/V65/I5/453
  图1 Android系统层次结构
  图2 Android沙盒结构示意
  图3 注入与拦截API的流程
  图4 log文件格式
  表1 API与行为对照表
  图5 CaffeineMark3.0 测试结果
  图6 恶意应用行为频度统计
  图7 GooglePlay正常应用行为频度统计
  图8 恶意应用的信息熵
  图9 正常应用的信息熵
  表2 识别率和误判率
[1] SCAP中文社区. Android漏洞信息库[Z/OL]. (2013-12-20). http://android.scap.org.cn. The SCAP Community of China. Android vulnerbilities database[Z/OL]. (2013-12-20). http://android.scap.org.cn. (in Chinese)
[2] 赛门铁克安全响应中心. 《互联网安全威胁报告》[Z/OL]. http://www.symantec.com/zh/cn/security_response/publications/threatreport.jsp. Symantec Security and Response Center. A survey of global security threat on the internet[Z/OL]. http://www.symantec.com/zh/cn/security_response/publications/threa-treport.jsp. (in Chinese)
[3] 张玉清, 王凯, 杨欢, 等. Android安全综述[J]. 计算机研究与发展, 2014,51(7):1385-1396. ZHANG Yuqing, WANG Kai, YANG Huan, et al. Survey of Android OS security[J].Journal of Computer Research and Development, 2014,51(7):1385-1396. (in Chinese)
[4] Enck W, Gilbert P, Chun B G, et al. TaintDroid:An information flow tracking system for real-time privacy monitoring on smartphones[J].Communications of the ACM, 2014,57(3):99-106.
[5] Reina A, Fattori A, Cavallaro L. A system call-centric analysis and stimulation technique to automatically reconstruct Android malware behaviors[C]//Proceedings of European Workshop on Systems Security. Prague, Czech Republic:EuroSec, 2013:135-141.
[6] Wei X, Gomez L, Neamtiu I, et al. ProfileDroid:Multi-layer profiling of Android applications[C]//Proceedings of the 18th Annual International Conference on Mobile Computing and Networking. Istanbul, Turkey:ACM, 2012:137-148.
[7] Yan L K, Yin H. DroidScope:Seamlessly reconstructing the OS and dalvik semantic views for dynamic Android malware analysis[C]//Proceedings of the 21st USENIX Conference on Security Symposium. Washington DC, USA:USENIX Security Symposium, 2012:569-584.
[8] Zhang Y, Yang M, Xu B, et al. Vetting undesirable behaviors in Android apps with permission use analysis[C]//Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security. Hangzhou, China:ACM, 2013:611-622.
[9] Chen K Z, Johnson N M, D'Silva V, et al. Contextual policy enforcement in Android applications with permission event graphs[C]//Proceedings of 20th Annual Network & Distributed System Security Symposium. San Diego, USA:NDSS, 2013.
[10] Wu D J, Mao C H, Wei T E, et al. Droidmat:Android malware detection through manifest and API calls tracing[C]//Information Security (Asia JCIS), 2012 Seventh Asia Joint Conference. Tokyo, Japan:IEEE, 2012:62-69.
[11] Bläsing T, Batyuk L, Schmidt A D, et al. An android application sandbox system for suspicious software detection[C]//Malicious and Unwanted Software (MALWARE), 20105th International Conference. Nancy, France:IEEE, 2010:55-62.
[12] Wikipedia. Java native interface[Z/OL]. http://en.wikipedia.org/wiki/Java_Native_Interface.
[13] HAN T S, Kobayashi K. Mathematics of Information and Coding[M]. Washington, DC:American Mathematical Society, 2002.
[14] CM3. CaffeineMark[Z/OL]. http://www.benchmarkhq.ru/cm30/info.html.
[1] 董国伟, 王眉林, 邵帅, 朱龙华. 基于特征匹配的Android应用漏洞分析框架[J]. 清华大学学报(自然科学版), 2016, 65(5): 461-467.
[2] 马刚, 杜宇鸽, 杨熙, 张博, 史忠植. 复杂系统风险评估专家系统[J]. 清华大学学报(自然科学版), 2016, 56(1): 66-76,82.
[3] 苏伯尼, 黄弘, 张楠. 基于情景模拟的城市内涝动态风险评估方法[J]. 清华大学学报(自然科学版), 2015, 55(6): 684-690.
[4] 陈元琳, 柴跃廷, 刘义, 徐扬. 基于群体偏好的交易评价可信度[J]. 清华大学学报(自然科学版), 2015, 55(5): 558-564,571.
[5] 赵金龙, 唐卿, 黄弘, 苏伯尼, 李云涛, 付明. 基于数值模拟的大型外浮顶储罐区定量风险评估[J]. 清华大学学报(自然科学版), 2015, 55(10): 1143-1149.
[6] 马刚, 杜宇鸽, 荣江, 甘家瑞, 史忠植, 安波. 基于威胁传播的复杂信息系统安全风险评估[J]. 清华大学学报(自然科学版), 2014, 54(1): 35-43.
[7] 王得金, 江常青, 彭勇. 工业控制系统上基于安全域的攻击图生成[J]. 清华大学学报(自然科学版), 2014, 54(1): 44-52.
Viewed
Full text


Abstract

Cited

  Shared   
  Discussed   
版权所有 © 《清华大学学报(自然科学版)》编辑部
本系统由北京玛格泰克科技发展有限公司设计开发 技术支持:support@magtech.com.cn