A detection method of Android application malicious behaviors based on Xposed framework

• 1、Software Security Center,Beijing University of Posts and Telecommunications,Beijing 100876
• 2、School of Applied Science,Beijing Information Science and Technology University,Beijing 100196

Abstract：With the increasingly prominent malicious attacks of Android terminal, this paper proposes a detection method of Android application malicious behaviors based on Xposed framework to optimize the existing method both in trigger and capture. In the trigger aspect, the method build a tree based on interface elements and traversal it to carry out an automation test that can make a full coverage of the elements. It can trigger malicious behaviors as much as possible. As for the capture aspect, this method develops a dynamic sensitive API monitor module based on Xposed framework, with which we can detect the malicious behaviors through the direct monitor of Android system sensitive API call. And it can get more information about the call and its parameters. The experimental results show that this method can effectively detect the malicious behaviors. Furthermore, it is much more convenient to monitor the behavoirs with a strong scalability.

Keywords： Android terminal malicious attacks sensitive API automation test hook hijacking