The Design And Implementation Of Software Behavior Analysis System Based On The Android Sandbox

With the growing popularity of Android OS, malicious software on this platform is also developing in quantities and techniques. Currently, the software behavior analysis techniques are outdated and are not able to handle these malware. In the circumstances, there is an urgent need for a new behavior analysis technique. Therefore, we need to implement a software behavior analysis system based on the Android sandbox.First of all, this thesis gives a brief introduction to the development of Android OS, the security problem on mobile platform and the current mobile malware research technique. Secondly, it introduces the technical backgrounds of designing and implementing the system, such as Android System Architecture, Dalvik virtual machine, Hook API technology, Android security mechanism and so on. In the next phase, this thesis specifies the design requirements clearly, by Hooking sensitive API technology to analyze the behavior of the software.This thesis also specifies the sensitive behaviors requiring Hook, such as networking, SMS, operating the database, stealing user privacy, call behavior and so on. During the detailed design phase, the system is divided into four modules, including code injection module, the Hook module, data transfer module, the log and behavior analysis module. During the system design period, this thesis gives the design ideas of each module combined with case diagrams, static class diagrams and system block diagrams. During the phase of detailed design and implementation, this thesis elaborates on the method how to implement each model and focuses on some of the core classes and their functions. During the system testing phase, the system was tested according to the given test cases. In the end,this thesis analyses the inadequacies of the system and concludes with the full thesis.The behavior analysis system based on the Android sandbox has been achieved, and has been put into use.