Research And Implement Of Android Application Behavior Collection Technology Based On Process Injection

With the rapid development of mobile intelligent terminals,people have entered the era of mobile Internet,and the mobile Internet has penetrated into all aspects of people's lives,constantly changing people's way of life.Mobile intelligent terminal has become an integral part of people's lives,but at the same time,it also has a variety of security riks.Therefore,the research about the security of Android application has become the focus of the Android security field.In this thesis,through the full investigation of the current Android security field,the research found and pointed out that the shortcomings and problems of the existing Android application security research,and on the basis of in-depth study of the Android system security mechanisms,Dalvik operation mechanism,and the mechanism of Android system,this thesis proposes a collection Android application behavior technology,main contents and research results are as follows:(1)The design and implementation of Android application behavior acquisition technology.By analyzing the operation mechanism of Dalvik virtual machine,dynamic injection technology is used to realize the purpose of recording the behavior information of Android application.In Android application behavior collection technology,the dynamic modification of Java layer API is mainly responsible for capturing the Android running information,supporting multi-threaded behavior records module is mainly responsible for the behavior of Android applications information collection,storing in a multi-threaded transmit module is mainly responsible for storing and sending Android application behavior information collected.(2)Design and implementation of Android application behavior collection management module and control flow graph composition and self perfection technology.Android application behavior acquisition management module is a application program on the Android platform,written by java language,mainly to control the run and stop of Android applications,control injection of Android applications and display the current application which is being monitored at the same time,receive Android applications being monitored collection behavior sequences and send behavior sequence to the server.Control flow graph composition and self perfect technique is mainly applied to the server.By receiving and analysis of applications behavior sequence,draw the Android application control flow graph,and support multiple test and control flow graph self perfection.This thesis uses three graphs to fully describe the behavior of Android applications,the thread size of control flow graph,the overall control flow graph and Activity level control flow graph.This thesis designs and implemens the Android application behavior acquisition technology,and through functional testing and performance testing,find that this technology is in line with expectations.The Android application behavior acquisition technology has a certain reference value for the research of capturing the behavior of Android applications.And this thesis studies the control flow graph of Android application,which has an important reference for the safety evaluation of Android application.