Avpd: An Anti-virus Model with Remote Thread Injection for Android Based on ResNet50

Abstract

Most Android mobile anti-virus software in the industry is checked at the application level, and users familiar with the Android operating system are well aware that the use of virtual clicks, function execution, or shell commands can force the application to stop, which poses a threat to the real-time monitoring of anti-virus software. Moreover, the current mainstream anti-virus software in the industry can only let users manually uninstall or deactivate malicious apps when detected, which also makes the anti-virus software in Android mobile lose the ability of mobile anti-virus software to remove or delete viruses and Trojans automatically. To solve the problems above, in this paper, we train a mobile anti-virus model based on Resnet50 and proposes an Android mobile anti-virus method using remote thread injection - overriding the execution of malicious code by RTI means such as hook API, nulling related functions, rewriting related classes or functions to preserve the app as much as possible. In contrast, The model can identify malicious code with the highest accuracy. The model's recognition accuracy is up to 98.14%, and the malicious code blocking rate is up to 99.70% after recognition.