关键词: Java Method HOOK, Android恶意代码, 动态沙盒分析

Abstract: Recently, mobile terminals have been extended to business applications rapidly, and have been more closely related to user privacy and property. As static monitoring cannot guarantee software security, the analysis of dynamic monitoring sandbox can realize real-time monitoring in a faster, more accurate, safer, and high feasible manner. The problem of privacy leakage exists in Android platform malware, such as accessing user data and exposing them to networks, or intercepting and spying on phone calls and short text messages. Thus, this article proposes a solution system called AnDa, which records sensitive behavior of Android malwares using dynamic detection sandbox. The overall designs and key technologies of the system are described, including real-time monitoring of behaviors such as accessing to phone calls, text messages, location information, SIM card and so on. It has been tested on both virtual machine and physical machine. This work adopted analysis technique on dynamic detection sandbox, to realize the software dynamic monitoring and behavior analysis under Android platform. It can achieve effectively monitoring Java Method Hook for API from Android framework layers and common malware characteristics. The system support devices over Android 4.0. Depending on the information of malicious behavior, AnDa can determine the type of malware and detect new viruses, so that important phone calls and personal data will be protected, and the security will be greatly improved.

Key words: Java Method HOOK, Android malicious code, dynamic sand-box analysis