| With the popularity of personal computer and the development of network technology, Internet has become the major media and application gradually. Combining Internet with mobile communication which are both booming industries, mobile Internet opens up a new era of information and communication industry. From now on, Android operating system is the fastest growing mobile platform which has become one of the hottest smartphone development platforms. With the widespread of Android applications, we can surf on the Internet, send or receive email, socialize whenever and wherever possible. Android applications have brought so much convenient for people’s life, at the same time the malicious software industry also increases sharply, and brings enormous challenge for several security aspects in Android. Although Android system has provided permission mechanisms such as sandbox, file access control, and other security measures to protect Android system and applications, innumerable attackers launched all kinds of attack against to the system itself or applications in the pursuit of interests. During this process, various aspects of serious security problems in Android system like system vulnerabilities, application vulnerabilities, and permission vulnerabilities are exposed. It is very common that malicious behaviors happen in Android system.Aiming at the issues of the increasing number of malware in Android and the lack of the effective measurements to prevent damage from malwares to smartphones, a malware detection method based on system calls is studied on regard of a Linux-based mobile operating system, Android. We implement the project that designed, in which several experiments have been conducted by combining with some instances, and data results are then analyzed. Taking into account the situation of smartphones with limited resources, detection of unknown applications on the smartphone side is transferred from the mobile terminal to the server side. The server collects data transferred from the smartphone, analyses and detects suspicious or malicious applications. In this case, most of the safety tests are performed by the server side which helps greatly reducing the resource usage on smartphone. On the Android platform, Java programming language are used to make the smartphone to collect system calls’names and their corresponding frequency counts information automatically. Information about system calls’names and their corresponding frequency counts when operating the application, regarded as Android application characteristic properties, are stored to a file, which is subsequently sent to a remote server. A system call vector is generated after the file data is analyzed by server, normal behaviors and malicious ones are distinguished by using KNN classification algorithm. A warning information is pushed to the user whenever the user’s application has malicious behaviors in order to mitigate the damage of the malware and potential avoid the spreading of the detected malware. A case study of setup planning is presented to verify the feasibility and effectiveness of the malware detection based on system calls method that we proposed. |
