Android malicious code detection system and method based on Opcode backtracking

TL;DR: In this paper, an android malicious code detection system and method based on Opcode backtracking is presented. But, the method is limited to Android, and it is not suitable for Java.

Abstract: The invention discloses an android malicious code detection system and method based on Opcode backtracking. The method includes the steps that firstly, a rule base is established, and detection strategies are customized by the rule base according to an object to be detected; an API called initially is placed in a queue as a name to be matched; the name to be matched is read from the queue, and names of functions called by all Opcode instructions are obtained by using a dex analysis and Opcode disassembling module; the names of the called functions are contrasted with the name to be matched, the name of the function where the successfully matched Opcode instruction belongs is placed in the queue as a name to be matched, the operations are repeated until the queue is empty, whether a called relational tree conforms to detection rules customized in the rule base or not is analyzed and judged on the basis of the rule base, and if yes, the relational tree is a malicious sample; otherwise the relational tree is safe. According to the Android malicious mode detection system and method based on Opcode backtracking, the problems of false alarm and alarm failure in an existing malicious code detection method can be well solved.