通信学报 ›› 2017, Vol. 38 ›› Issue (5): 84-95.doi: 10.11959/j.issn.1000-436x.2017103

• 学术论文 • 上一篇    下一篇

DroidBet:事件驱动的Android应用网络行为的自动检测系统

魏松杰,吴高翔,罗娜,时召伟,周紫阳   

  1. 南京理工大学计算机科学与工程学院,江苏 南京 210094
  • 修回日期:2017-03-27 出版日期:2017-05-01 发布日期:2017-05-28
  • 作者简介:魏松杰(1977-),男,江苏南京人,南京理工大学副教授,主要研究方向为信息安全、无线网络与移动计算、智能计算与云计算等。|吴高翔(1990-),男,江西高安人,南京理工大学硕士生,主要研究方向为信息安全、移动互联网安全。|罗娜(1992-),女,福建福州人,南京理工大学硕士生,主要研究方向为信息安全、移动互联网安全。|时召伟(1992-),男,江苏南通人,南京理工大学硕士生,主要研究方向为信息安全、移动互联网安全。|周紫阳(1986-),男,江苏南京人,南京理工大学硕士生,主要研究方向为信息安全、移动互联网安全。
  • 基金资助:
    国家自然科学基金资助项目(61472189)

DroidBet:event-driven automatic detection of network behaviors for Android applications

Song-jie WEI,Gao-xiang WU,Na LUO,Zhao-wei SHI,Zi-yang ZHOU   

  1. School of Computer Science and Engineering,Nanjing University of Science and Technology,Nanjing 210094,China
  • Revised:2017-03-27 Online:2017-05-01 Published:2017-05-28
  • Supported by:
    The National Natural Science Foundation of China(61472189)

摘要:

多数Android应用需要通过连入互联网与外界进行通信,所有与网络相关的活动都涉及网络流量,通过分析建模Android应用的网络流量,可以一定程度上掌握Android应用的网络行为。因此,设计了一个事件驱动的网络行为自动检测系统DroidBet,来对Android应用进行自动测试评估。首先,建立一个场景模拟事件库,用来模拟应用程序运行过程中可能执行的事件,从而尽可能地触发应用程序的网络行为;然后,自动生成基于状态转移分析方法的测试序列,同时对应用程序测试过程中的网络行为进行动态收集;最后,采用机器学习方法对收集到的网络行为进行学习、训练,生成基于BP神经网络的网络行为模型,实现对未知的Android应用的行为检测。实验结果表明,DroidBet能够有效地触发并提取应用程序的网络行为,并具有准确度高、系统资源开销低等优点。

关键词: Android, 场景模拟, 网络行为, 自动化检测

Abstract:

The most Android applications connect to Internet to communicate with the outside world.Applications’ network-related activities were reflected and described with network traffic.By analyzing and modeling network traffic of Android applications,network behaviors of Android applications could be subsequently characterized.Therefore,DroidBet:an event-driven network behavior automatic detection system was presented,to test and evaluate Android applications automatically.Firstly,a scenario simulation event library was built to simulate the events that applications may be executed in the process,so as to trigger the network behavior of the application as much as possible.Then,the test sequence based on the state transition analysis method was automatically generated,and the network behavior was dynamically collected during the application testing process.Finally,the machine learning method was used to learn and train the collected network behavior,and the network behavior model based on BP neural network was generated to detect the behavior of the unknown Android application.The experimental results show that DroidBet can effectively trigger and extract the network behavior of the application,which has the advantages of high accuracy and low resource cost.

Key words: Android, scenario simulation, network behavior, auto-detection

中图分类号: 

No Suggested Reading articles found!