Welcome to Journal of University of Chinese Academy of Sciences,Today is

›› 2015, Vol. 32 ›› Issue (5): 689-694.DOI: 10.7523/j.issn.2095-6134.2015.05.016

Previous Articles     Next Articles

An easy-to-deploy behavior monitoring scheme for Android applications

WANG Xueqiang1,2,3, LEI Lingguang1,2, WANG Yuewu1,2   

  1. 1. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China;
    2. Data Assurance and Communication Security Research Center, Chinese Academy of Sciences, Beijing 100093, China;
    3. University of Chinese Academy of Sciences, Beijing 100049, China
  • Received:2014-08-20 Revised:2014-11-27 Online:2015-09-15

Abstract:

Malicious applications pose tremendous threats to Android platform. More than 90% of malicious codes are introduced in the form of Android apps. Hence, behavior monitoring scheme for Android applications are required in order to resolve the problem. However, most of the schemes are based on system customization and hard to deploy on devices for Android's fragmentation problem. In this paper, an easy-to-deploy Android application monitoring method on the basis of process hijacking is proposed after analysis of Android process model and code execution details. The method depends on Dalvik interpreter entry point and system call interception. The authors created a fully usable prototype of the system, and the evaluation results show that the system is easy to deploy, provides a whole-scale behavior of Android applications, and incurs little performance overhead.

Key words: Android APP, behavior monitoring, Dalvik hijacking, dynamic instrumentation

CLC Number: