The Research Of Software Abnormal Behavior Detection Technology On Android

With the commercial use of3rd-generation in China,the convenient use of mobile Internet, and the smart phones being easy to carry, the smartphones have got rapid development in the recent ten years. Because of the outstanding performance, rich capabilities, easy to carry, etc., and more and more people use the smart phone instead of a personal computer with some daily affairs, such as office, instant messaging, online trading, online games, etc. The intelligent mobile phone market have been rising year by year, the future of the market will be full of smart phone, its subscriber base and industrial scale will be far more than the personal computer market. Intelligent cell phones’convenience and shortcut making it more contact with the user’s personal information, and the intelligent mobile phones began to attract more malicious software attack, in this kind of situation, the safety of the intelligent mobile phones become more and more important.Malwares mean that the software which have malicious behavior of the program,e.g. virus, worms and Trojan horses. Malwares have been threats to computer systems for many years and it was only a question of time when the first malicious software writers would get interested in increasingly popular mobile platforms, such as Symbian OS. In2004, the first articles about malware for smart phones appeared stating that the next generation of targets are mobile devices. Since then, the number of malwares increased every month and variants for various smart phone platforms appeared. In recent years, with Android operating system, such as the rapid development of mobile terminal malicious software also rapid spread, according to NQ and statistics, in2010, the total kind of mobile terminal virus was more than2500, the total infection cell phone8million department above.Based on the understanding of the Android platform smart phone characteristics and facing the basis of security threats, this paper puts forward a based on the Android platform software abnormal behavior detection method and the Android platform to realize. Based on behavior detection methods rely on monitoring the behavior of the file (e.g., through the static analysis or dynamic interception methods for obtaining program system call sequences), and combining with known malicious behavior patterns (such as malicious software system call sequences), to determine whether a target file malware trend. According to the testing time is different, the behavior of the detection method based on dynamic monitoring atmosphere and static testing two. The dynamic behavior of the detection in the procedure in the operation process of execution, static behavior testing is before the program is run execution. The dynamic behavior of the detection because the program runtime execution, the real time requirement is higher, must ensure that the malicious program on the system before damage detection of threat, so usually large energy consumption. And static behavior detection through the reverse work.