【摘要】：進(jìn)入二十一世紀(jì)以來,移動終端作為一個新興設(shè)備發(fā)展非常迅速,尤其是智能終端的問世,極大的方便了人們的日常生活,3G與4G網(wǎng)絡(luò)的逐漸普及,網(wǎng)絡(luò)帶寬的增加,以iPhone的發(fā)布開始,Android系統(tǒng)的風(fēng)靡為標(biāo)識,智能手機(jī)中各式各樣的應(yīng)用宣布了移動互聯(lián)網(wǎng)時代的到來。然而隨著移動應(yīng)用尤其是移動支付的普及,針對Android平臺安全問題也逐漸凸顯出來。手機(jī)中大量存儲了人們?nèi)粘Ｉ钪械臄?shù)據(jù),例如通信錄,短信,應(yīng)用數(shù)據(jù),日常行為等。隨著手機(jī)應(yīng)用的不斷推廣,伴隨而來的數(shù)據(jù)安全問題也日漸突出。面對這些隱私數(shù)據(jù),針對Android平臺上社交與支付類應(yīng)用的釣魚攻擊也逐年增加,引發(fā)竊取用戶隱私數(shù)據(jù)尤其是金融相關(guān)數(shù)據(jù)的行為從而導(dǎo)致信息泄露或財產(chǎn)損失的后果非常嚴(yán)重。本文分析了針對Android平臺釣魚攻擊的基本原理,同時指出了Android平臺下安全軟件無法識別以及在應(yīng)用層無法攔截這種攻擊的內(nèi)在原因,根據(jù)釣魚攻擊的兩種方式,設(shè)計了反釣魚方案:針對重打包攻擊,設(shè)計了手機(jī)端APK檢測模塊,用來檢測應(yīng)用文件是否被重打包;針對后臺監(jiān)控釣魚方式,基于Android 4.4系統(tǒng),在框架層AMS(活動管理服務(wù))中添加釣魚攻擊監(jiān)控與攔截模塊。同時編寫釣魚應(yīng)用并在不同機(jī)型系統(tǒng)中做攻擊測試,測試數(shù)據(jù)表明添加監(jiān)控與攔截模塊的系統(tǒng)可以有效的攔截釣魚應(yīng)用的攻擊;利用各大安全論壇中提供學(xué)習(xí)研究的重打包應(yīng)用測試APK檢測模塊,結(jié)果表明APK檢測模塊可以有效的檢測出重打包應(yīng)用。
[Abstract]:Since 21 century, mobile terminal has developed very quickly as a new device, especially the advent of intelligent terminal, which greatly facilitates people's daily life, the gradual popularization of 3G and 4G network, and the increase of network bandwidth. With the release of iPhone and the popularity of Android system, various applications in smart phones have announced the arrival of the mobile Internet era. However, with the popularity of mobile applications, especially mobile payment, the security of Android platform becomes more and more important. The mobile phone stores a lot of data in people's daily life, such as communication record, SMS, application data, daily behavior and so on. With the continuous promotion of mobile phone applications, the accompanying data security issues are becoming increasingly prominent. In the face of these privacy data, phishing attacks on social and payment applications on Android platform are increasing year by year, which leads to the behavior of stealing users' privacy data, especially financial data, which results in information leakage or property loss. This paper analyzes the basic principle of phishing attack on Android platform, and points out the inherent reasons why the security software can not be recognized and the attack can not be intercepted in the application layer under the Android platform, according to the two ways of phishing attack. The anti-phishing scheme is designed: aiming at the repackaging attack, the APK detection module of mobile phone is designed to detect whether the application file is repackaged or not; Based on the Android 4.4 system, the phishing attack monitoring and intercepting module is added to the framework layer AMS (activity Management Service). At the same time, the phishing application is written and tested in different models. The test data show that the system with monitoring and intercepting module can effectively intercept the attack of phishing application. The APK detection module of repackaging application is used to test the repackaging application, which is provided in various security forums. The results show that the APK detection module can effectively detect the repackaging application.
【學(xué)位授予單位】：西安電子科技大學(xué)
【學(xué)位級別】：碩士
【學(xué)位授予年份】：2014
【分類號】：TP393.08

【參考文獻(xiàn)】

相關(guān)期刊論文 前1條

1 曾立濵;唐泉彬;牛斗;;Android系統(tǒng)應(yīng)用程序組件安全性分析[J];軟件;2014年03期

，

本文編號：2302774