关键词: Android,恶意行为检测,动态分析,组合事件,自动触发

Abstract: For lack of effective means to identify Android malware application in transmission link at current time,this paper proposed an Android malicious behavior detection method based on automated testing techniques and dynamic analysis techniques. Android applications behavior is triggered by automated testing technology and monitored by a vir-tual sandbox.This paper presented a model of triggering malicious behavior named DroidRunner using combined operations on malware,which improves the Android application code coverage and the trigger rate of the malicious behavior.It benefits to improving the detection rate of malicious Android applications.After the actual deployment and testing,this method has a high detection rate to the unknown malicious applications.It can help users to find and analyze the unknown malicious applications.

Key words: Android,Malicious behavior detection,Dynamic analysis,Composite event,Automatic trigger