Android内核钩子的混合检测技术

针对Android平台上内核级钩子检测的研究,提出了一种结合基于特征模式的静态检测技术和基于行为分析的动态检测技术的Android内核钩子检测技术,这两种技术的结合能够检测基于修改系统调用表项的攻击和基于内联钩子的攻击。为所提技术构建了软件原型系统并进行了实验评测,实验结果表明,提出的技术能够针对Android内核钩作出精确检测,并且运行时间开销在7%以内,具有良好运行效率,能够适用于Android内核钩子的混合。

Hybrid detection technique for Android kernel hook

To address the challenge of Android kernel hook detection, a new approach was proposed to detect Android kernel hooks by combining static technique based on characteristic pattern and dynamic technique based on behavioural analysis. The attacks including modifying system call tables and inline hook could be detected by the proposed approach. Software prototypes and test experiments were given. The experimental results show that the proposed method is effective and efficient in detecting Android kernel hooks, for most of the test cases, the runtime overhead is below 7%; and it is suitable to detect Android kernel hooks.