摘要

Through the analysis of some mobile malwares, we found that malware is similar with its original application in semantics of the program, and the similarity is different with the similarity between other members of the family. Based on this fact, by means of hierarchical clustering technology for the function call graph, we propose a program based on family relationships to detect the malicious mobile applications and build a system named as "NeighborWatcher". Experimental results show that when each family contains four or more members, the detection rate of Piggybacked application can reach 92.86%.

全文