摘要
近年来,移动互联网的兴起使以诈骗、博彩和色情为主的网络黑产移动应用(APP)变得更加猖獗,亟待采取有效措施进行管控.目前,研究人员针对黑产应用的研究较少,其原因是由于执法部门持续对黑产应用的传统分发渠道进行打击,已有的通过基于搜索引擎和应用商店的采集方法效果不佳,缺乏大规模具有代表性的在野黑产应用数据集,已经成为开展深入研究的一大掣肘.为此,尝试解决在野黑产应用大规模采集的难题,为后续深入全面分析黑产应用及其生态提供数据支撑.提出了一种基于突变流量分析的黑产应用批量捕获方法,以黑产应用分发的关键途径为抓手,利用其具有的突变和伴随流量特点,批量快速发现正处于传播阶段的新兴在野黑产应用,为后续实时分析和追踪提供数据基础.在测试中,该方法成功获取了3439条应用下载链接和3303个不同的应用.捕获的移动应用中,不但有91.61%的样本被标记为恶意软件,更有98.14%的样本为首次采集发现的零天应用.上述结果证明了所提出的方法在黑产应用采集方面的有效性.
In recent years,with the rise of the mobile Internet,underground mobile applications primarily involved in scams,gambling,and pornography have become more rampant,requiring effective control measures.Currently,there is a lack of research on underground applications by researchers.Due to the continuous crackdown by law enforcement agencies on traditional distribution channels for these applications,the existing collection methods based on search engines and app stores have proven to be ineffective.The lack of large-scale and representative datasets of real-world underground applications has become a major constraint for in-depth research.Therefore,this study aims to address the challenge of collection of large-scale real-world underground applications,providing data support for a comprehensive in-depth analysis of these applications and their ecosystem.A method is proposed to capture underground applications based on traffic analysis.By focusing on the key distribution channels of underground applications and leveraging their characteristics of mutation and accompanying traffic,underground applications can be discovered in the propagation stage.In the test,the proposed method successfully obtained 3439 application download links and 3303 distinct applications.Among these apps,91.61%of the samples were labeled as malware by antivirus engine,while 98.14%of the samples were zero-days.The results demonstrate the effectiveness of the proposed method in the collection of underground applications.
作者
陈沛
洪赓
邬梦莹
陈晋松
段海新
杨珉
CHEN Pei;HONG Geng;WU Meng-Ying;CHEN Jin-Song;DUAN Hai-Xin;YANG Min(School of Computer Science,Fudan University,Shanghai 201203,China;Institute for Network Sciences and Cyberspace,Tsinghua University,Beijing 100084,China;Zhongguancun Laboratory,Beijing 100081,China)
出处
《软件学报》
EI
CSCD
北大核心
2024年第8期3684-3697,共14页
Journal of Software
基金
国家自然科学基金(62302101)。
关键词
网络黑产
网络犯罪
移动应用
流量分析
underground ecosystem
cybercrime
mobile app
traffic analysis
