Hybrid detection technique for Android kernel hook

doi:10.11772/j.issn.1001-9081.2014.11.3336

Journal of Computer Applications ›› 2014, Vol. 34 ›› Issue (11): 3336-3339.DOI: 10.11772/j.issn.1001-9081.2014.11.3336

Previous Articles Next Articles

Hybrid detection technique for Android kernel hook

HUA Baojian¹,²,ZHOU Aiting¹,²,ZHU Hongjun¹,²

1. School of Software Engineering, University of Science and Technology of China, Suzhou Jiangsu 215123, China
2. Suzhou Institute for Advanced Study, University of Science and Technology of China, Suzhou Jiangsu 215123, China

Received:2014-04-30 Revised:2014-06-23 Online:2014-12-01 Published:2014-11-01
Contact: HUA Baojian

Android内核钩子的混合检测技术

华保健¹,²,周艾亭¹,²,朱洪军¹,²

1. 中国科学技术大学软件学院, 江苏苏州 215123;
2. 中国科学技术大学苏州研究院,江苏苏州 215123

通讯作者: 华保健
作者简介:
华保健(1979-),男,河北保定人,讲师,博士,主要研究方向:程序设计语言、软件安全;
周艾亭(1988-),男,江苏淮安人,硕士研究生,主要研究方向:软件测试、移动安全;
朱洪军(1983-),男,安徽阜阳人,讲师,硕士,主要研究方向:软件测试、移动安全。
基金资助:
中国计算机学会—腾讯科研基金资助项目;苏州市科技计划项目

Abstract

Abstract:

To address the challenge of Android kernel hook detection, a new approach was proposed to detect Android kernel hooks by combining static technique based on characteristic pattern and dynamic technique based on behavioural analysis. The attacks including modifying system call tables and inline hook could be detected by the proposed approach. Software prototypes and test experiments were given. The experimental results show that the proposed method is effective and efficient in detecting Android kernel hooks, for most of the test cases, the runtime overhead is below 7%; and it is suitable to detect Android kernel hooks.

摘要：

针对Android平台上内核级钩子检测的研究,提出了一种结合基于特征模式的静态检测技术和基于行为分析的动态检测技术的Android内核钩子检测技术,这两种技术的结合能够检测基于修改系统调用表项的攻击和基于内联钩子的攻击。为所提技术构建了软件原型系统并进行了实验评测,实验结果表明,提出的技术能够针对Android内核钩作出精确检测,并且运行时间开销在7%以内,具有良好运行效率,能够适用于Android内核钩子的混合。

CLC Number:

TP301

HUA Baojian ZHOU Aiting ZHU Hongjun. Hybrid detection technique for Android kernel hook[J]. Journal of Computer Applications, 2014, 34(11): 3336-3339.

华保健周艾亭朱洪军. Android内核钩子的混合检测技术[J]. 计算机应用, 2014, 34(11): 3336-3339.

References

[1]GU X. Android occupy 81% maket share in the global smart phone market, Apple's share fell [EB/OL]. [2013-11-14]. http://news.xinhuanet.com/tech/2013-11/14/c_125699425.htm.(古晓宇.全球智能手机市场安卓独占81% 苹果份额下滑[EB/OL].[2013-11-14].http://news.xinhuanet.com/tech/2013-11/14/c_125699425.htm.)
[2]Kaspersky. Unveiling "Careto" : The masked APT[EB/OL].[2014-02-18].http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf.
[3]LI B, WO T, HU C, et al. VMM-based operating system hidden objects off joint detection technology [J]. Journal of Software, 2013,24(2):405-420.(李博,沃天宇,胡春明,等.基于VMM的操作系统隐藏对象关联检测技术[J].Journal of Software,2013,24(2):405-420.)
[4]WANG B. Design and implementation of the Linux server's virus protection system API Layer [D]. Nanjing: Nanjing University, 2012.(王博.Linux服务器病毒防护系统API Layer的设计与实现[D].南京:南京大学,2012.)
[5]WANG Q, HU D, XU S, et al. Research and implementation of the 2.6 Linux kernel process based interception mechanism [J]. Microcomputer Information, 2012,28(9):13-15.(王全民,胡大海,许殊玮,等.基于Linux内核2.6的进程拦截机制的研究和实现[J].微计算机信息,2012,28(9):13-15.)
[6]JINAG H, YANG F, DUAN H, et al. Rootkit detection methods and research techniques to hide [J]. Journal of Chinese Computer Systems, 2012,33(5):1006-1011.(姜辉,杨峰,段海新.Rootkit隐藏技术与检测方法研究[J].小型微型计算机系统,2012,33(5):1006-1011.)
[7]LI X, HUANG H. Kernel integrity monitoring approach a hardware-based virtualization [J]. Computer Science, 2011,38(12):68-72.(李珣,黄皓.一个基于硬件虚拟化的内核完整性监控方法[J].计算机科学,2011,38(12):68-72.)
[8]JIANG S, WANG J, ZHANG T, et al. Summary of safety research Android [J]. Computer Applications and Software, 2012,29(10):205-210.(蒋绍林,王金双,张涛,等.Android安全研究综述[J].计算机应用与软件,2012,29(10):205-210.)
[9]CHEN W. Android kernel-level research Rootkit detection module based signature [D]. Nanjing: Nanjing University, 2012.(陈文.基于模块签名的Android内核级Rootkit检测方法研究[D].南京:南京大学,2012.)
[10]ZHU W. Kernel-level attacks and Rootkit detection technology Android platform [D]. Shanghai: Shanghai Jiao Tong University, 2013.(祝为.Android平台的内核级Rootkit攻击与检测技术[D].上海:上海交通大学,2013.)
[11]LIU Z. Kernel mode Rootkit research system based on Android [D]. Chengdu: University of Electronic Science and Technology of China, 2012.(刘自龙.基于Android系统的内核态Rootkit研究[D].成都:电子科技大学,2012.)
[12]LI S, YAN H. Linux user space encryption/decryption API design and implementation [J]. Computer Applications and Software, 2013,30(2):184-188.(李石磊,闫宏印.Linux用户空间加/解密API的设计与实现[J].计算机应用与软件,2013,30(2):184-188.)

[1]	. YOLOv5s-MRD: an efficient fire and smoke detection algorithm for complex scenarios based on YOLOv5s [J]. Journal of Computer Applications, 0, (): 0-0.
[2]	Yawei HUANG, Xuezhong QIAN, Wei SONG. Improved differential evolution algorithm based on dual-archive population size adaptive method [J]. Journal of Computer Applications, 2024, 44(12): 3844-3853.
[3]	Hongru JIANG, Wei FANG. Survey of application of deep learning in meteorological data correction [J]. Journal of Computer Applications, 2024, 44(12): 3930-3940.
[4]	Qiye ZHANG, Xinrui ZENG. Efficient active-set method for support vector data description problem with Gaussian kernel [J]. Journal of Computer Applications, 2024, 44(12): 3808-3814.
[5]	. Improvement method of heuristic vehicle routing algorithm based on constrained spectral clustering [J]. Journal of Computer Applications, 0, (): 0-0.
[6]	. Path planning of multi-UAV formation based on improved artificial potential field method [J]. Journal of Computer Applications, 0, (): 0-0.
[7]	. Dual-population dual-stage evolutionary algorithm for complex constrained multi-objective optimization problems [J]. Journal of Computer Applications, 0, (): 0-0.
[8]	Qin LENG, Zhengyuan MAO. Two echelon location-routing optimization considering facility sizing decision [J]. Journal of Computer Applications, 2024, 44(11): 3513-3520.
[9]	Qingyuan PENG, Xiaofeng WANG, Junxia WANG, Yingying HUA, Ao TANG, Fei HE. Review of phase transition in satisfiability problems [J]. Journal of Computer Applications, 2024, 44(11): 3503-3512.
[10]	Jie HUANG, Ruizi WU, Junli LI. Efficient adaptive robustness optimization algorithm for complex networks [J]. Journal of Computer Applications, 2024, 44(11): 3530-3539.
[11]	Renke SUN, Zhiyu HUANGFU, Hu CHEN, Zhongnian LI, Xinzheng XU. Survey of neural architecture search [J]. Journal of Computer Applications, 2024, 44(10): 2983-2994.
[12]	Antai SUN, Ye LIU, Dongmei XU. Dynamic surface asymptotic compensation algorithm for multi-agent systems [J]. Journal of Computer Applications, 2024, 44(10): 3151-3157.
[13]	Chaoying YAN, Ziyi ZHANG, Yingnan QU, Qiuyu LI, Dixiang ZHENG, Lijun SUN. Double auction carbon trading based on consortium blockchain [J]. Journal of Computer Applications, 2024, 44(10): 3240-3245.
[14]	. Dung beetle optimizer algorithm with restricted reverse learning and Cauchy-Gauss variation [J]. Journal of Computer Applications, 0, (): 0-0.
[15]	Guanglei YAO, Juxia XIONG, Guowu YANG. Flower pollination algorithm based on neural network optimization [J]. Journal of Computer Applications, 2024, 44(9): 2829-2837.

Hybrid detection technique for Android kernel hook

Android内核钩子的混合检测技术

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics