Research And Implementation Of Abnormity Behavior Analysis Based On UI

With the development of network and mobile devices,mobile intelligent terminals are becoming more and more powerful.Mobile applications(App)are widely used.The security problems of mobile applications are also frequent.Android is so far the most popular intelligent terminal system,the data show that in 2016,the sales of Android reached 1.2 billion,accounting for more than 85%of the global share.At the same time,these smart devices are running a large number of mobile applications.Because of the open source nature of the Android system,and the lack of a consistent review mechanism in the Android application mall,Android malware is emerging in an endless stream.In order to deal with the threat of malicious software,researchers have proposed a variety of dynamic and static detection technology,based on these technologies has a very good evaluation effect on the application security.Most of the results of the evaluation is discussed application permissions from the developer's point of view,but also can go to the evaluation of the application security from the user's point of view.When the user chooses to install the application in the application mall,he can only deduce the application behaviour from the application description and application operation screenshot provided by the mall.The description given by application developers is not explicitly specified that all the application behavior,so has the uncertainty,and the user can deduce the application operation informationan and function by the screenshot of UI,to a certain extent reflect the actual behavior of the application,so the information which is provided by UI is very important.The UI interface of Android mobile application hosts almost all man-machine interaction tasks.Users can perform functions provided by application by sliding and clicking on UI,while text,pictures and other information on UI can help users deduce the application behavior.Taking into account the download mobile application in the mall,user does not care about permissions to the application,and abnormal condition of a single UI is easy to be accepted by users,and the malls lack of safety evaluation rules for single UI.So we introduce that using UI information to describe the functional category features of a single UI,and put forward an abnormal behavior of Android analysis method using the UI information.This method is based on the application of detection technology.We use machine learning means to classify applications from the store of the same category by function.Then according to the UI API in the same function,we generate multiple abnormal behavior decision model.Finally,through the possibility of different models to infer the unknown UI.The main research focus of this paper is:(1)The Android system foundation,the Android security foundation,the Android decompile technology and the machine learning method are studied.(2)Research UI text extraction technology,API extraction technology and so on;(3)A method of abnormal behavior analysis based on UI category is proposed to analyze the exception call of API from the Activity level of the Android application.Supported by a large number of applications,the experimental results show that the abnormal behavior discovery method proposed in this paper can detect some possible abnormal behaviors of Android applications to some extent.