基于域名关联的恶意移动应用检测研究

为实现对恶意移动应用的准确检测以保障移动设备安全,提出一种基于域名关联的恶意移动应用检测方法。以DNS域名为检测分析对象识别网络流量中的恶意域名,利用DNS请求流量的时间特征寻找恶意域名的相关联域名,并将关联域名与文本分类样本库进行比对,确定恶意移动应用名称。实验结果表明,该方法可有效用于移动设备的安全防护,其在公开测试数据集中的检测率达到97.1%,在实际网络的部署运行中共检测出13款恶意移动应用,且误报数量为0。

Research on Malicious Mobile Application Detection Based on Domain Name Association

In order to realize the accurate detection of malicious mobile applications and ensure the security of mobile devices,a malicious mobile application detection method based on DNS is proposed.DNS domain name is used as the analysis object of detection to identify the malicious domain name in the network traffic,the time characteristics of DNS request traffic are used to find the associated domain name of the malicious domain name,and the associated domain name is compared with the text classification sample library to determine the name of the malicious mobile application.The experimental results show that this method can be effectively applied to the security protection of mobile devices.The detection rate of this method in the public test data set is 97.1%,and a total of thirteen malicious mobile applications are detected in the actual network deployment,and the number of false positives is 0.