信息网络安全

信息网络安全 ›› 2016, Vol. 16 ›› Issue (8): 61-67.doi: 10.3969/j.issn.1671-1122.2016.08.010

• • 上一篇    下一篇

Android系统数据完整性检测方法研究

曲乐炜, 罗森林(), 孙志鹏, 朱帅   

  1. 北京理工大学信息系统及安全对抗实验中心,北京 100081
  • 收稿日期:2016-05-12 出版日期:2016-08-20 发布日期:2020-05-13
  • 作者简介:

    作者简介： 曲乐炜（1992—）,男,山东,硕士研究生,主要研究方向为信息安全;罗森林（1968—）,男,河北,教授,博士,主要研究方向为信息安全、数据挖掘、文本安全;孙志鹏（1993—）,男,河北,硕士研究生,主要研究方向为数据挖掘;朱帅（1993—）,男,湖北,硕士研究生,主要研究方向为信息安全。

  • 基金资助:
    国家242信息安全计划[2005C48]

Research on the Method of Data Integrity Detecting on Android System

Lewei QU, Senlin LUO(), Zhipeng SUN, Shuai ZHU   

  1. Information System and Security & Countermeasures Experimental Center, Beijing Institute of Technology, Beijing 100081, China
  • Received:2016-05-12 Online:2016-08-20 Published:2020-05-13

RichHTML

1

PDF (PC)

155

摘要：

恶意代码产生的危害巨大,不仅会窃取用户个人隐私、侵犯用户的权益,更会给用户造成严重的经济损失。典型的恶意代码采用高级技术实现文件、进程的隐藏和自启动等,但是,这些典型的攻击手段都会破坏系统的完整性。文章针对现有Android系统完整性检测方法存在的检测不全面、依赖硬件、系统消耗大、难以移植等缺点,提出了一种结合文件数据和内存数据的数据完整性检测方法。该方法基于可信的基线数据库,采用MD5哈希算法对文件数据完整性进行检测,在保证文件完整性的条件下,再进行内存数据完整性检测,最后获得数据完整性检测结果。文章最后在Android模拟器环境下,利用7种攻击数据完整性的恶意代码进行实验。实验结果表明,该方法针对几种典型恶意代码检测率为100%,CPU占用率小于5%,且不依赖硬件,准确率高,实用性强。

关键词: Android系统, 数据完整性, 文件数据, 内存数据

Abstract:

The malicious code causes huge damage. It not only steals users’ personal privacy, invades users’ rights, but also causes serious economic loss. Typical malicious code occupies with advanced technology such as hiding files, hiding progress and self-starting. However, all of these typical methods of attacking could destroy the integrity of system data. This paper proposes a method of data detecting integrity combined file data with memory data on Android system and solves the problems of not all-inclusive detection, relying on hardware, huge consumption of system and hard to transplant in existing methods. This method use the algorithm of MD5 Hash to detect the integrity of data based on credible baseline database. Firstly, the method ensures the integrity of file. Then the method detects the integrity of memory data. At last we obtain the result of detecting integrity of data. At the end of this paper, several experiments are done in the Android simulator environment. And the paper uses 7 malicious codes which attack detection of data in our experiments. The experiment shows that the rate of detecting is 100% and the CPU occupancy rate below 5%. This method has high accuracy, strong practicability, and does not rely on hardware.

Key words: Android system, data integrity, file data, memory data

中图分类号: