Abstract:

Android operating system occupies most of the smart devices and has the largest number of users. But smartphone’s huge market value has also attracted the attention of hackers while bringing convenience to users. The black chain which uses malware as the main attack method can put users’ privacy and their property safety in dangerous situation. Therefore, study of the technology on Android malware detection has a very important theoretical value and practical significance. This paper gives a brief introduction on knowledge of Android malware, and proposes an Android application software dynamic behavior monitoring method based on LKM. This method hijacks and replaces the system call in the Linux kernel layer, and later runs in the form of services. It can monitor sending text messages, making phone calls, getting the phone number, network connections, privilege escalation and et al. Experimental results show that the monitoring accuracy rate of malicious behavior reaches to 93% and its performance overhead is less than 5%. Finally, this paper design and implement the dynamic behavior monitoring system based on the method. So, it has a high practical value.

Key words: behavior monitoring, LKM, malware, Android