Разработка алгоритма выявления вредоносных программ для платформы Android путем проведения анализа файла манифеста

Abstract

The available algorithms for detecting malicious software are often not enough to detect new types of viruses. In this regard, the issues related to the use of reverse engineering of malicious software codes intended for the Android operating system are considered. It is proposed to conduct a comprehensive analysis of the code and manifest of the mobile application in order to form the attributes of malicious software and create detection algorithms for a specific operating system. Research objective: to show the relevance of reverse engineering and to develop a heuristic analysis algorithm that allows detecting the presence of hidden malicious code in mobile applications by analyzing code metadata. Methods: the article uses the reverse engineering method on the example of actual Trojans to form attributes that characterize the possibility of hidden malicious code in a mobile application, according to the logical values of which the algorithm makes a cumulative decision about the possibility of hidden malicious load. Results: the proposed approach was tested using the VirusTotal database to evaluate errors of the first and second kind and showed 78% efficiency in detecting malicious software only from code metadata using the proposed attributes, does not require complex calculations and time-consuming costs and can be the basis for using artificial intelligence in combination with static and dynamic analysis to identify viruses of the Android operating system. Practical significance: the developed algorithm can be used as an additional element in the integrated antivirus protection system of a smartphone against malware infection.