中文摘要：

针对最近愈发猖獗的勒索软件,本文在Android平台上设计了一种针对Android勒索软件的主动实时检测方法.该方法可以在用户失去对设备或文件的控制权之前,检测并消除勒索软件恶意行为的危害.该方法对勒索软件检测分为两个阶段,静态特征分析阶段和动态行为实时监控阶段,这两个阶段分别实现了对锁屏策略检测和加密行为检测.对针对Android勒索软件的主动实时方法进行实现,并使用收集到的675个勒索软件样本和9 238个正常应用对系统进行评估.结果显示,该系统在检测勒索软件方面有很高的准确率和很低的误报率.同时系统在移动设备上的资源消耗低,具有很高的实用性.

英文摘要：

In recent years, we witnessed a drastic increase of mobile ransomware. Therefore, it is imperative to have an initiative and real-time detection method of ransomware on Android to detect and stop ransomware＇s malicious behaviors before the victims lost the control of their phones and data. This system is divided into two stages： the static characteristic analysis and the real-time monitor about dynamic behaviors. The two stages are respectively used to detect locking screen and encryption behavior. This paper implemented the initiative and real-time detection method of android ransomware and evaluated the implemented system on the collected 675 ransomware samples and 9 238 benign applications crawled from Google Play. The results show that this system can effectively detect Android ransomware with high accuracy and few false alarms. In addition, this system also shows high performance on mobile devices and has a good practicability.