Detecting TVOS Malicious Applications With String Types Of Features Based On Static Analysis

Security of smart TV has become increasingly prominent with its rapid development in recent years.Smart TV gives users freedom to install applications easily.This mechanism provides users comfortable experiences and personalized choices.However,it also increases chances for the malware to enter application markets.Malicious software is the main threats to the security of smart TV.It is very important to investigate the malicious application detection techniques to asure a safe environment of smart TV.As a new generation of self-developed smart television operating system in China,TVOS is manageable and controllable,safe and efficient with independent intellectual property rights.TVOS has formulated a global security management framework that uses a variety of security technologies to achieve global protection and control of TVOS system security.The application store comes with TVOS is the only way to install TVOS applications,which safeguards the security of TVOS application to a large extent,as well as puting forward higher requirements for application detection.How to detect and identify malicious TVOS applications and effectively monitor them are of great importance to smart TV environment and benefits of users.On the task of TVOS application analysis and malicious application detection,we carried out the following work:(1)Firstly,the architecture,type of application and technical characteristic of TVOS system are introduced in detail.Secondly,the security mechanism of TVOS system is elaborated,including security management framework,hardware security,software security,network security,data seciruty and application security.(2)TVOS applications are collected from the actual application markets,and string-type features are extracted from the applications,which include 9 categories such as permission,API call,component and code related features.Based on features extracted,TVOS applications are analysed in depth.Combined with existing malware detection techniques,a kind of malicious application detection method based on single classifier is proposed.(3)According to different detection results of different classifiers on different features,based on the single classifier model,a kind of TVOS malicious application detection method based on combined classifier is proposed.By constructing the best classifier for every kind of feature in 9 features,this method uses a lifting algorithm based on the best classifier corresponding to every kind of feature to enhance the classification effect.Finally,the result of detected samples is given through a comprehensive decision function.(4)The two detection methods above are designed and implemented,and the algorithms are optimized according to the experiment results.The experiment results show that these two methods can effectively detect TVOS malicious applications,and have good performances.