针对Android平台恶意软件泛滥的问题,提出一种基于日志分析的Android系统的恶意行为检测模型。模型采用进程守护和广播监听的方式收集日志信息并通过Boyer-Moore算法匹配、识别恶意行为。以Android 4.0平台为测试环境进行软件行为检测,实验结果表明,该检测模型能够检测出90.0%的恶意行为,证明模型对Android系统恶意行为检测的有效性和可行性。
This paper proposes a log analysis-based malicious behaviour detection model for Android system targeted at the rampant Android platform malware problem. The model uses the way of process guardianship and broadcast interception to collect log information,and matches and identifies malicious behaviours with Boyer-Moore algorithm. Android 4. 0 platform is used as the testing environment for software behaviours detection,experimental results shows that this detection model is able to detect 90. 0% malicious behaviours,and this proves the effectiveness and feasibility of the model on detecting malicious behaviours in Android system.