Android恶意应用数量的不断增加不仅严重危害Android市场安全,同时也为Android恶意应用检测工作带来挑战。设计了一种基于HTTP流量的Android恶意应用行为生成与特征自动提取方法。该方法首先使用自动方式执行恶意应用,采集所生成的网络流量。然后从所生成的网络流量中提取基于HrITrP的行为特征。最后将得到的网络行为特征用于恶意应用检测。实验结果表明,所设计的方法可以有效地提取Android恶意应用行为特征,并可以准确地识别Android恶意应用。
Growing of Android malware, not only seriously endangered the security of the Android market, but also brings challenges for detection. A generation and extraction approach of automatic Android malware behavioral signatures was proposed based on HTI'P traffic. Firstly, the behavioral signatures were extracted from the traffic traces generated by Android malware. Then, network behavioral characteristics were extracted from the generated network traffic. Finally, these behavioral signatures were used to detect Android malware. The experimental results show that the approach is able to extract Android malware network traffic behavioral signature with accuracy and efficiency.