一种基于Native层的Android恶意代码检测机制

Android现有的恶意代码检测机制主要是针对bytecode层代码，这意味着嵌入Native层的恶意代码不能被检测，最新研究表明86%的热门Android应用都包含Native层代码。为了解决该问题，本文提出一种基于Native层的Android恶意代码检测机制，将smali代码和so文件转换为汇编代码，生成控制流图并对其进行优化，通过子图同构方法与恶意软件库进行对比,计算相似度值，并且与给定阈值进行比较，以此来判断待测软件是否包含恶意代码。实验结果表明，跟其他方法相比，该方法可以检测出Native层恶意代码而且具有较高的正确率和检测率。

An Android Malicious Code Detection Mechanism Based on Native Layer

Android’s existing malicious code detection mechanism is mainly for the bytecode layer codes. This means that malicious code embedded in Native layer can’t be detected. The latest research shows that 86% of popular Android APPs contain Native layer code. In order to solve this problem, this paper proposes an Android malicious code detection mechanism based on Native layer, which converts smali code and so file into assembly code, generates control flow graph then optimizes it. Through comparing with malware library by subgraph isomorphism method, the similarity values are calculated and compared with the given thresholds to determine whether the software under test contains malicious code. The experimental results show that compared with the others the method can detect malicious code of Native layer and has higher accuracy and detection rate.