title: ÐÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ Android Ð¼ÐµÑÐ¾Ð´Ð°Ð¼Ð¸ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Detection of malicious software for Android using static analysis methods
Creators: name: ÐÐ°Ð»ÑÐ½ÑÐ¹, ÐÐ»ÐµÐºÑÐµÐ¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2020
Subjects: ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÐµ ÑÐ¸ÑÑÐµÐ¼Ñ
ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ
ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð· android Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ
Ð°Ð½Ð°Ð»Ð¸Ð· Ð´Ð¸Ð·Ð°ÑÑÐµÐ¼Ð±Ð»Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð°
static analysis of android applications
analysis of disassembled code

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ Android Ð¼ÐµÑÐ¾Ð´Ð°Ð¼Ð¸ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°Â». ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ñ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ Ð´Ð»Ñ Android Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð¼ÐµÑÐ¾Ð´Ð°Ð¼Ð¸ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. ÐÐ°Ð´Ð°ÑÐ¸, ÐºÐ¾ÑÐ¾ÑÑÐµ ÑÐµÑÐ°Ð»Ð¸ÑÑ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÑ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¼ÐµÑÐ¾Ð´Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Android Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹. 2. Ð¡ÑÐ¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð¿ÑÐ¾ÑÑÑÐ°Ð½ÑÑÐ²Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÑÐµÐ¼ÑÑ Ð¿ÑÐ¸Ð·Ð½Ð°ÐºÐ¾Ð². 3. Ð¡Ð¾Ð·Ð´Ð°ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ðµ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð´Ð»Ñ Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÐ¸ APK ÑÐ°Ð¹Ð»Ð¾Ð². 4. ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð¼ÐµÑÐ¾Ð´Ñ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Android Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹. 5. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÑ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¾ÑÐµÐ½ÐºÐ¸ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ¾Ð² ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. 6. ÐÑÐ¾Ð²ÐµÑÑÐ¸ ÑÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð· Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ ÐÐÐ. Ð Ð´Ð°Ð½Ð½Ð¾Ð¹ Ð´Ð¸Ð¿Ð»Ð¾Ð¼Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ Ð±ÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¼ÐµÑÐ¾Ð´Ñ ÑÑÐ°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. ÐÑÐ»Ð¸ ÑÐ°ÑÑÐ¼Ð¾ÑÑÐµÐ½Ñ Ð¸Ñ Ð½ÐµÐ´Ð¾ÑÑÐ°ÑÐºÐ¸. ÐÐ° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð½Ð¾Ð¹ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¸ Ð±ÑÐ»Ð¾ ÑÑÐ¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð¾ Ð¿ÑÐ¾ÑÑÑÐ°Ð½ÑÑÐ²Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÑÐµÐ¼ÑÑ Ð¿ÑÐ¸Ð·Ð½Ð°ÐºÐ¾Ð². ÐÑÐ»Ð¾ ÑÐ¾Ð·Ð´Ð°Ð½Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ðµ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð½Ð¾Ðµ Ð½Ð° ÑÑÐµÐ¹Ð¼Ð²Ð¾ÑÐºÐ°Ñ MobSF Ð¸ Androwarn. Ð¢Ð°ÐºÐ¶Ðµ Ð±ÑÐ» ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¼ÐµÑÐ¾Ð´ Ð²ÑÐ´ÐµÐ»ÐµÐ½Ð¸Ñ Ð¿ÑÐ¸Ð·Ð½Ð°ÐºÐ¾Ð² Ð¸Ð· Ð´Ð¸Ð·Ð°ÑÑÐµÐ¼Ð±Ð»Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Android Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ Ð¼ÐµÑÐ¾Ð´Ñ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Android, Ð° ÑÐ°ÐºÐ¶Ðµ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½ Ð¼ÐµÑÐ¾Ð´ Ð¾ÑÐµÐ½ÐºÐ¸ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ¾Ð² ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. Ð ÐµÐ·ÑÐ»ÑÑÐ°ÑÑ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½Ð¾Ð¹ Ð¾ÑÐµÐ½ÐºÐ¸ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿Ð° Ð² ÐºÐ¾Ð¼Ð±Ð¸Ð½Ð°ÑÐ¸Ð¸ Ñ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð¾Ð¼ ÑÐ»ÑÑÐ°Ð¹Ð½Ð¾Ð³Ð¾ Ð»ÐµÑÐ° Ð¸Ð»Ð¸ Ð¸ÑÐºÑÑÑÑÐ²ÐµÐ½Ð½Ð¾Ð¹ Ð½ÐµÐ¹ÑÐ¾Ð½Ð½Ð¾Ð¹ ÑÐµÑÑÑ Ð´ÐµÐ¼Ð¾Ð½ÑÑÑÐ¸ÑÑÑÑ Ð²ÑÑÐ¾ÐºÑÑ Ð²ÐµÑÐ¾ÑÑÐ½Ð¾ÑÑÑ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÑ Android Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹.
description: The subject of the graduate qualification work is âDetection of malicious software for Android using static analysis methodsâ. This work is devoted to increasing the detection efficiency of malware for Android applications using static analysis methods. Tasks that were solved during the study: 1. Explore existing methods of static analysis of Android applications. 2. To form the space of the analyzed features. 3. Create a software tool for processing APK files. 4. Analyze machine learning methods to classify Android applications. 5. Explore existing methods for evaluating classification results. 6. Conduct a comparative analysis of methods for identifying malware. In this thesis, the existing methods of static analysis were analyzed. Their disadvantages were considered. Based on the information received, a space of analyzed features was formed. A software tool based on the MobSF and Androwarn frameworks was created. Also, was developed a method for extracting attributes from disassembled files of an Android application. Machine learning methods for classifying Android software were analyzed, and a method for evaluating classification results was proposed. The results of an experimental evaluation of the effectiveness of the developed prototype in combination with a random forest algorithm or artificial neural network demonstrate a high probability of detecting malicious Android applications.