Behavior-Based Detection Method for Android Malware

The behavior-based Android malware detection method is a method that detects the presence of malicious behavior by observing and analyzing the behavior of an app during operation. Behavior detection mainly refers to the detection method for specific malicious behavior. Typical malicious behaviors include privacy breaches, privilege escalation, and descriptions that are inconsistent with actual behavior, as described below. Privacy leakage: The reasons for privacy leakage can be mainly divided into two categories: one is caused by vulnerabilities in the Android system, and the other is caused by vulnerabilities in Android apps. Android system vulnerabilities are caused by defects in the framework of the Android system itself, with a wide range of impacts and can cause harm to all smartphones installed with the corresponding system. For example, the WebView vulnerability in the Android system is mainly caused by the system allowing JS scripts to make dangerous calls to APIs in Java and native code. Malicious software embeds scripts into WebView components, and when a user clicks to trigger the WebView component, the script triggers a vulnerability and calls related APIs to steal user privacy information. Privacy breaches caused by Android app vulnerabilities are more common than system vulnerabilities, which are caused by developers not paying attention to security when coding, specifically manifested as the lack of legitimacy verification of exposed components in the app. The attacker obtains the interface for stealing user privacy information by analyzing the Android app and hijacks user privacy information through disguise. Permission elevation: Permission elevation refers to software that does not have certain permission obtaining certain permission, mainly due to the existence of call relationships between Android apps. The Android system provides Android apps with the ability to call other apps, such as ordering takeout on takeout software and then calling payment software for payment, but this kind of behavior may bring certain security risks. If the software applies for permissions it does not need and provides an interface to the outside world, malicious apps can obtain sensitive resources by legally calling the public interface, so as to achieve permission enhancement. In the process of Android software development process, following the principle of least privilege (the software should only state the permissions used by the software, not the permissions irrelevant to the software functions) can ensure the data security of the Android system. Inconsistent behavior: Inconsistent behavior refers to the actual execution behavior of software that is inconsistent with its declared behavior. For example, if an app has applied for reading CONTACTS permission but there are no statements related to reading contact information in its description, it is said that the app has inconsistent behavior. There are two main reasons for this problem: firstly, a program is often developed by multiple people together, and the personnel who wrote the app description may not have participated in the complete program development process, so their understanding of the program’s functions is not clear enough. Secondly, most Android software embeds third-party packages during development, and these third-party packages do not contain source code, so developers cannot describe their specific behavior. Behavior-based Android malware detection methods usually use static analysis and dynamic analysis and other program technologies to find malicious behaviors in Android software. At the same time, machine learning technology can be used to enhance the analysis capability of Program analysis technology [1].