Abstract: Aiming at the problem of the increasing proliferation of malware on Android platform, this paper proposes a threat level assessment technology for Android applications, which includes two parts: feature construction and threat level evaluation rule design. In this paper, firstly, we use static analysis and dynamic analysis technology to extract the permission, behavior and vulnerability characteristics of Android application APK file, and then use information gain algorithm to filter and build a feature library. Then, we design functions based on Naive Bayesian model. By defining monotonous, typical and intuitive functions, we can finally score the permissions and behavior characteristics of APK files The assessment is to divide the threat level according to the grading guidelines, and then extract the source code by decompiling the APK file, then read the code line by line to search for the matching vulnerabilities, and then evaluate the threat level of the APK file according to the corresponding threat level of the vulnerability. The experimental results show that this paper can divide the application threat level according to the calculated score, which is more intuitive and clear, and can evaluate the Android application threat level more effectively.

Key words: Android, malware, feature analysis, threat score, grade assessment

摘要： 针对Android平台恶意软件日益泛滥的问题，本文提出一种Android应用威胁等级评估技术，包括特征构建和威胁等级评估规则设计2部分．本文首先利用静态分析和动态分析技术，提取出Android应用APK文件的权限、行为、漏洞特征，利用信息增益算法筛选后构建特征库，再基于朴素贝叶斯模型设计函数，通过定义有单调性、典型性、直观性的函数，最终实现对APK文件权限和行为特征的打分；漏洞方面的评估则是先根据等级划分指南划分威胁等级，通过反编译APK文件获取源代码后，对代码进行逐行读取搜索匹配漏洞，再根据漏洞对应威胁等级来对APK文件进行威胁等级评估．实验结果表明，本文能根据计算所得分数划分应用的威胁等级，更为直观明了，也能更为有效地对Android应用进行威胁等级评估．

关键词: 安卓, 恶意软件, 特征分析, 威胁评分, 等级评估