基于图像相似性的Android钓鱼恶意应用检测方法

摘要

在移动互联网日益兴盛的今天，攻击者已开始通过移动应用的形式来实施网络钓鱼，而现有的网络钓鱼检测方法主要针对网页钓鱼，无法应对这一新的安全威胁。钓鱼恶意应用的一个显著特点是通过构造与目标应用相似的界面来诱骗用户输入敏感信息。基于这种视觉相似性，提出了一种面向Android平台的钓鱼恶意应用检测方法。该方法通过动态技术截取被检测应用的人机交互界面，利用图像哈希感知算法计算其与目标应用界面的图像相似度。如果相似度超过阈值，则识别被检测应用程序为钓鱼恶意应用。实验表明，该方法可以有效检测Android平台上的恶意钓鱼应用程序。%As mobile payment has become increasingly popular recently, some phishing malwares on mobile devices try to steal users’ sensitive information through forging a user interface similar to the targeted application, which cannot be detected by existing anti-phishing techniques. We propose a new similarity-based anti-phishing approach to detect phishing malware on Android. With the perceptual image hash technology, it compares the similarity of captured screen images between the suspicious application and the targeted application. If the similarity exceeds a threshold, the suspicious application is determined to be malicious. The experiment proves that the approach is effective to detect phishing malware on Android.