行動裝置上惡意軟體行為偵測之研究-以Android為例

A Behavior-Based Malware Detection Study on the Android Devices

孫建興(Chien-Hsing Sun)

指導教授 ： 陳志誠

大同大學/經營設計學院/資訊經營學系所/碩士(2012年)

摘要

近年由於行動寬頻技術的蓬勃發展，智慧型手機漸漸取代傳統手機，成為手機市場的主流。由於智慧型手機上儲存著豐富的個人隱私資訊，目前各家資安公司所發現的手機惡意軟體中，竊取個人隱私資料的木馬程式所占比率最高，伴隨而來的智慧型行動裝置資通訊安全議題，則是本文關注的重點。
本論文針對惡意軟體必須對外連線，將竊取資料傳送至特定主機的異常網路行為特徵，提出一套行動裝置惡意軟體行為檢測的作法，並實際架設一個無線網路監測環境，透過實驗方式，以Android手機為例，比對惡意軟體與正常軟體網路行為異常特徵，驗證其可偵測出手機感染惡意軟體之異常網路行為。並經實驗結果證明此檢測方法，不僅可偵測已知惡意軟體網路行為，對於未知惡意軟體網路行為亦可偵測。
目前相關手機惡意軟體行為偵測的研究，均需針對特定作業平台及已知樣本方能進行檢測，本研究提出之檢測方式最大之貢獻在於不限定行動裝置作業平台，即能初步確認該行動裝置是否有異常的網路行為。由於不需要建置複雜的檢測環境，故除能提供一般使用者自我檢測外，亦可提供相關企業做為加強智慧型手機或行動裝置資安檢測之參考。

關鍵字

木馬程式 ； 惡意軟體 ； 智慧型手機 ； 資安檢測

並列摘要

Thanks to the vigorous development on mobile broadband in recent years, smart phones have gradually replaced traditional cell phones and become the main stream in cell phone market. Due to abounding private information can be stored up inside smart phones and according to the cell phone malware reports from some information security companies, Trojan can stole private information and has become the most infamous malware among malicious software. This research will focus on information and communication issues from the smart mobile device.
This research will aim at the abnormal behavior traits that the malware has to link to the external network and transmit the stolen data to some specific servers, submit a method to detect the malware and actually put up an environment for wireless network monitoring. Through the experiment, this research will take the Android smart phone as an example to compare the unusual characteristic in network behavior between the malware and the normal software and to test and verify that this method can detect the abnormal network behavior from the infected cell phones. Moreover, this experiment will prove this examining method will not only detect the known malware network behavior, but also detect the unknown malware network behavior.
In the present day, the researches on detecting cell phone’s malware behavior still need to limit on some specific working platforms and also the known samples. The greatest contribution of this detecting method from the research is that it can initially affirm the abnormal behavior from the mobile device that has installed different working platforms. Because of free from setting up a complicated environment, this detecting method can be provided to the general users to do the self-detecting job. Also, this method can be a reference and provided to the related enterprises to strengthen information security detecting on smart phones or mobile device.

並列關鍵字

malware ； Trojan ； information security detecting ； smart phones

參考文獻

[12] 劉恩榜,“Android上的殭屍網路攻擊偵測,” 交通大學資訊科學與工程研究所碩士論文, 2011.

[3] 姜琇森,賴建源,楊智傑,宋光凱”行動平台上手機病毒的偵測技術評估之研究,”第十一屆電子化企業經營管理理論暨實務研討會, pp. 378-388, 2010

[4] 陳志遠,”手機病毒行為分析與偵測之研究,”大葉大學資訊管理學系碩士班碩士論文, 2009.

[14] Asaf Shabtai and Yuval Elovici,”Applying Behavioral Detection on Android-Based Devices,” Deutsche Telekom Laboratories at Ben-Gurion University , 2010.

[15] Adrienne Porter Felt, Matthew Finifter, Erika Chin, Steven Hanna, and David Wagner, "A Survey of Mobile Malware in the Wild ," ACM Workshop on Security and Privacy in Mobile Devices, 2011.