关键词: 安卓, 恶意软件, 特征分析, 威胁评分, 等级评估

Abstract: Aiming at the problem of the increasing proliferation of malware on Android platform, this paper proposes a threat level assessment technology for Android applications, which includes two parts: feature construction and threat level evaluation rule design. In this paper, firstly, we use static analysis and dynamic analysis technology to extract the permission, behavior and vulnerability characteristics of Android application APK file, and then use information gain algorithm to filter and build a feature library. Then, we design functions based on Naive Bayesian model. By defining monotonous, typical and intuitive functions, we can finally score the permissions and behavior characteristics of APK files The assessment is to divide the threat level according to the grading guidelines, and then extract the source code by decompiling the APK file, then read the code line by line to search for the matching vulnerabilities, and then evaluate the threat level of the APK file according to the corresponding threat level of the vulnerability. The experimental results show that this paper can divide the application threat level according to the calculated score, which is more intuitive and clear, and can evaluate the Android application threat level more effectively.

Key words: Android, malware, feature analysis, threat score, grade assessment