基于语义的Android敏感行为静态分析方法

Semantic-Based Sensitive Behavior Analysis Method for Android

  • 摘要: 提出一种基于语义的Android敏感行为静态分析方法。该方法首先基于样本统计结果,利用精简Dalvik指令集作为本文分析的中间语言,实现对指令层的形式化语义描述;之后,基于中间语言发现检测样本中的敏感调用,并通过控制依赖关系追溯调用路径;最后,在控制流分析基础上,对存在敏感调用的路径约束求解路径条件。最终求解出具体后台行为及触发条件,揭示出样本后台行为的执行全过程。该方法缓解了符号执行中的路径爆炸问题,实验验证了该方法可以有效地对移动应用后台行为进行分析,并及时获取特征检测无法发现的未知移动恶意应用程序。

     

    Abstract: This paper proposes a semantic-based sensitive behavior analysis method for Android. With sample statistics results, the method firstly adopts a simple-Dalvik intermediate language (SDIL) as the intermediate language for text analysis, thus giving a symbolic semantics description for instructions. Then the method uses SDIL to detect sensitive calls from the samples and traces the call paths according to the control dependence. Then based on control-flow analysis, the method adopts constraint solving to obtain path conditions. At last, the method finds the background behaviors with trigger conditions, thus the whole process of background behavior execution will be showed as well. This method can release the path explosion problem in the process of symbolic execution. With experiment under our platform, it proves that the method can analyze the background behaviors of mobile application efficiently, and find the unknown mobile malicious applications which can not be found by traditional feature detection methods in time.

     

/

返回文章
返回