With the intelligent mobile terminal, mobile terminal store a large amount of personal privacy information. Due to the growing number of malicious applications on mobile terminals and for detecting malicious applications lack of effective mechanism, the existence of malicious applications will result in the leakage of personal privacy information, personal property, and reputation damage. In order to prevent the happening of this kind of harm, kernel is proposed in this paper, based on system call log information to identify the behavior of the application. Detection method is as follows, first download malicious application with benign application, run and collect their system kernel call log information, the statistics system call frequency information as the original data. Then normalized processing the raw data, generated for the analysis of the input data and generate the input vector. Finally use the K-Means clustering algorithm to cluster the input vector, the generated two clustering cluster, malicious and benign application of clustering cluster respectively, and then apply some unknown types of kernel call information as the validation data generated input vector, determine the application belongs to which cluster, can know the application of the presence of malicious behavior. This paper test the method using WEKA, test results show that the method is effective to distinguish the malicious applications and benign applications.
