摘要
随着微型电子设备计算能力和通信能力的不断提升,智能手机正在人们的生活中广泛的普及,并相应产生了很多新的应用领域,同时也产生了很多威胁。Android是谷歌研制的智能手机操作系统,基于定制的Linux内核设计。由于谷歌的限制和其本身的运行机制,Android具有独特的属性和特定的限制,这使得它难以用常规的方法检测并阻止恶意攻击。针对Android防范恶意攻击能力薄弱这一情况,提出了一个Android应用程序沙箱系统,它能够对应用程序执行静态和动态分析,自动检测出Android应用程序中恶意的部分。静态分析即在不安装应用的条件下扫描查找软件的恶意部分。动态分析在一个完全隔离环境,即沙箱,执行应用程序,记录应用与系统的底层交互,以用来做进一步分析判断。这个沙箱和检测算法都可以作为云服务部署在云中,可以为谷歌安卓市场等手机软件商店提供一个快速的和分布式检测可疑软件方案。此外,该沙箱系统的设计方案也可以引入Android操作系统传统杀毒软件当中,用于提高扫描修复系统的效率。实验测试结果表明,该沙箱系统能够按照需求检测出应用程序中的恶意攻击,较好的完成了设计目的。
With the development of computational power and communication capability of miniature elec- tronic devices, smartphones are widely gaining popularity in people＇ s life. Meanwhile, it creates new application area and also give an opportunity to new threats. Android is designed by Google based on a modified Linux kernel. For the limit from Google and the operational mechanism itself, Android has unique properties and specific limitations. This makes it harder to detect and prevent malware attacks through conventional techniques. Android system in view of the situation is weak against malicious attacks, this paper proposes an Android application sandbox for performing both static and dynamic analyses on Android programs to automatically detect suspicious applications. Static analysis scans the software for malicious patterns without installing. Dynamic analysis executes the application in a fully isolated environment, i. e. , sandbox, which logs low-level interactions with the system for further analysis. Both the sandbox and the detection algorithms can be deployed in the cloud, providing a fast and distributed detection of suspicious software in a mobile software store akin to Google＇s Android Market. Additionally, the design scheme can be imported into Android classical anti-virus applications to improve the efficient of scanning and restoring systems. Experimental results show that the sandbox system can detect malicious attacks in the application program according to the demand. Thus, it can achieve the design.
出处
《南京邮电大学学报（自然科学版）》
北大核心
2015年第4期104-109,共6页
Journal of Nanjing University of Posts and Telecommunications：Natural Science Edition
基金
连云港市科技支撑计划(SH1110)资助项目
关键词
沙箱
静态分析
动态分析
恶意攻击
隔离环境
sandbox
static analysis
dynamic analysis
malicious attack
isolation environment
