基于多特征分析的移动应用恶意热更新安全检测方法

doi:10.12267/j.issn.2096-5931.2026.09.012

信息通信技术与政策 ›› 2026, Vol. 52 ›› Issue (9): 88-96.doi: 10.12267/j.issn.2096-5931.2026.09.012

技术与标准上一篇

基于多特征分析的移动应用恶意热更新安全检测方法

A security detection method for malicious hot updates in mobile applications based on multi-feature analysis

王淞鹤¹^,², 王艳红¹^,², 李京典¹^,², 桑明臣¹^,²

¹ 中国信息通信研究院泰尔终端实验室, 北京 100191
² 移动应用创新与治理技术工业和信息化部重点实验室, 北京 100191

收稿日期:2026-01-12 出版日期:2026-09-25 发布日期:2026-09-30
作者简介:
王淞鹤,中国信息通信研究院泰尔终端实验室信息安全部、移动应用创新与治理技术工业和信息化部重点实验室工程师,主要从事移动应用软件安全、终端安全、个人信息保护等方面的研究工作；
王艳红,中国信息通信研究院泰尔终端实验室信息安全部副主任、移动应用创新与治理技术工业和信息化部重点实验室高级工程师,主要从事移动互联网领域信息安全、个人信息保护、数据管理等方面的研究工作；
李京典,中国信息通信研究院泰尔终端实验室信息安全部、移动应用创新与治理技术工业和信息化部重点实验室工程师,主要从事移动安全、个人信息保护等方面的研究工作；
桑明臣,中国信息通信研究院泰尔终端实验室信息安全部、移动应用创新与治理技术工业和信息化部重点实验室工程师,主要从事移动智能终端及应用软件安全和个人信息保护检测等方面的研究工作

WANG Songhe¹^,², WANG Yanhong¹^,², LI Jingdian¹^,², SANG Mingchen¹^,²

¹ CTTL Terminal Labs, China Academy of Information and Communications Technology, Beijing 100191, China
² Key Laboratory of Mobile Application Innovation and Governance Technology, Beijing 100191, China

Received:2026-01-12 Online:2026-09-25 Published:2026-09-30

摘要/Abstract

摘要：

热更新技术常用于移动应用程序(Application,App)快速修复、轻量级更新等场景中,然而恶意开发者滥用热更新绕过应用商店安全审核,引发潜在安全风险。针对恶意热更新行为监测成本高、检测难度大、技术对抗严重等问题,提出一种多特征分析检测方法,对热更新代码控制流特征、运行时行为特征以及应用指纹特征进行综合分析。收集12 982款App及300款恶意样本进行试验分析,发现11款新增恶意App,共标记29个恶意家族。试验结果表明,该检测方法能够有效识别恶意热更新行为。

关键词: 移动应用安全, 恶意热更新, 一致性分析, 特征识别

Abstract:

Hot update technology is widely utilized in mobile applications for scenarios such as rapid patching and lightweight updates. However, malicious developers abuse this mechanism to bypass App store security audits, posing potential security risks. To address the challenges of high monitoring costs, significant detection difficulties, and intense technical adversarial confrontanion associated with malicious hot updates, this paper proposes a detection method based on multi-feature analysis. This method performs a comprehensive analysis of the control flow features of hot update code, runtime behavioral features, and application fingerprint features. This paper collected a total of 12 982 Apps and 300 malicious samples for experimental analysis, and identified 11 newly detected malicious Apps and 29 malware familes. Experimental results demonstrate that the proposed method can effectively identify malicious hot update behaviors.

Key words: mobile application security, malicious hot update, consistency analysis, feature recognition

中图分类号:

王淞鹤, 王艳红, 李京典, 桑明臣. 基于多特征分析的移动应用恶意热更新安全检测方法[J]. 信息通信技术与政策, 2026, 52(9): 88-96.

WANG Songhe, WANG Yanhong, LI Jingdian, SANG Mingchen. A security detection method for malicious hot updates in mobile applications based on multi-feature analysis[J]. Information and Communications Technology and Policy, 2026, 52(9): 88-96.

导出引用管理器 EndNote|Ris|BibTeX

链接本文:

http://ictp.caict.ac.cn/CN/10.12267/j.issn.2096-5931.2026.09.012

http://ictp.caict.ac.cn/CN/Y2026/V52/I9/88

图/表 8

参考文献 32

[1]	宋恺, 王淞鹤, 武林娜, 等. 热更新技术分析与治理策略研究[J]. 信息通信技术与政策, 2023, 49 (8): 80. doi: 10.12267/j.issn.2096-5931.2023.08.011
[2]	腾讯手机管家. 恶意SDK无感刷百度广告, 数千款App植入影响千万用户[EB/OL]. (2019-04-24) [2026-01-10]. https://www.freebuf.com/sectool/201714.html.
[3]	姚立伟. 苹果App Store涉黄软件被下架多次曝出违规内容[EB/OL]. (2024-09-26) [2026-01-10]. https://news.sohu.com/a/811801403_114822.
[4]	Google. Google服务条款[EB/OL]. (2022-01-05) [2026-01-10]. https://policies.google.com/terms.
[5]	Apple Inc. App Store审核指南[EB/OL]. (2023-06-05) [2026-01-10]. https://developer.Apple.com/cn/App-store/review/guidelines/#software-requirements.
[6]	腾讯应用开放平台. 腾讯应用开放平台移动应用违规说明[EB/OL]. 2023 [2026-01-10]. https://wikinew.open.qq.com/index.html#/iwiki/4007776131.
[7]	百度移动应用平台. 百度移动应用平台应用分发资质说明及审核规范[EB/OL]. (2022-09-22) [2026-01-10]. https://app.baidu.com/newapp/docs/%E5%BA%94%E7%94%A8%E5%88%86%E5%8F%91/%E8%B5%84%E8%B4%A8%E8%AF%B4%E6%98%8E%E5%8F%8A%E5%AE%A1%E6%A0%B8%E8%A7%84%E8%8C%83/.
[8]	360移动开放平台. 360移动开放平台应用发布规则[EB/OL]. 2022 [2026-01-10]. https://dev.360.cn/wiki/index/id/18.
[9]	工业和信息化部. 工业和信息化部关于进一步提升移动互联网应用服务能力的通知[EB/OL]. (2023-02-06) [2026-01-10]. https://www.gov.cn/zhengce/zhengceku/2023-03/02/content_5744106.htm.
[10]	Aysan A I, Sakiz F, Sen S. Analysis of dynamic code updating in Android with security perspective[J]. IET Information Security, 2019, 13 (3): 269-277. doi: 10.1049/ise2.v13.3 URL
[11]	Github. Tinker[EB/OL]. (2024-12-09) [2026-01-10]. https://github.com/Tencent/tinker.
[12]	苗宇飞. 阿里热更新框架Sophix浅析[J]. 电脑迷, 2017 (20): 126-127.
[13]	Uni-App. Uni-App开发文档[EB/OL]. (2025-04-11) [2026-01-10]. https://zh.uniApp.dcloud.io/component/uniui/uni-forms.html.
[14]	Weex. Weex开发指南[EB/OL]. (2022-08-15) [2026-01-10]. https://weexApp.com/zh/guide/introduction.html#%E6%A6%82%E8%BF%B0.
[15]	Flutter. Flutter Docs[EB/OL]. [2026-01-10]. https://docs.flutter.dev/codelabs.
[16]	Poeplau S, Fratantonio Y, Bianchi A, et al. Execute this! Analyzing unsafe and malicious dynamic code loading in android applications[C]// In NDSS Symposium 2014. San Diego: NDSS, 2014: 16.
[17]	Ahmad M, Costamagna V, Crispo B, et al. StaDART:addressing the problem of dynamic code updates in the security analysis of android applications[J]. Journal of Systems and Software, 2020, 159: 110386. doi: 10.1016/j.jss.2019.07.088 URL
[18]	Zhauniarovich Y, Ahmad M, Gadyatskaya O, et al. Stadyna:addressing the problem of dynamic code updates in the security analysis of android Applications[C]// Proceedings of the 5th ACM Conference on Data and Application Security and Privacy. San Antonio: ACM Press, 2015: 37-48.
[19]	Li H, Wang Y, Zhang Y, et al. Pedroid: automatically extracting patches from android App updates[J]. Dagstuhl Artifacts Series (DARTS), 2022, 8 (2): 1-2.
[20]	Enck W, Gilbert P, Han S, et al. Taintdroid: an information-flow tracking system for realtime privacy monitoring on smartphones[J]. ACM Transactions on Computer Systems (TOCS), 2014, 32 (2): 1-29.
[21]	Sun M, Wei T, Lui J C S. Taintart:a practical multi-level information-flow tracking system for Android runtime[C]// Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. Vienna: ACM Press, 2016: 331-342.
[22]	Lee S, Dolby J, Ryu S. HybriDroid: static analysis framework for Android hybrid Applications[C]// Proceedings of the 31st IEEE/ACM international conference on automated software engineering. Singapore: ACM Press, 2016: 250-261.
[23]	Zhao Y, Yu L, Sun Y, et al. Nosource code? No problem! Demystifying and detecting mask Apps in iOS[C]// Proceedings of the 32nd IEEE/ACM International Conference on Program Comprehension. Lisbon: ACM Press, 2024: 358-369.
[24]	Lee Y, Wang X, Lee K, et al. Understanding {iOS-based} crowdturfing through hidden {UI} analysis[C]// 28th USENIX Security Symposium (USENIX Security 19). Santa Clara: USENIX, 2019: 765-781.
[25]	Lee Y, Wang X, Liao X, et al. Understanding illicit UI in iOS Apps through hidden UI analysis[J]. IEEE Transactions on Dependable and Secure Computing, 2019, 18 (5): 2390-2402.
[26]	Lam P, Bodden E, Lhoták O, et al. The soot framework for Java program analysis: a retrospective[C]// Cetus Users and Compiler Infrastructure Workshop (CETUS 2011). Galveston Island: CETUS, 2011, 15: 35.
[27]	Arzt S, Rasthofer S, Fritz C, et al. Flowdroid:precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android Apps[J]. ACM Sigplan Notices, 2014, 49 (6): 259-269.
[28]	Li Y, Yang Z, Guo Y, et al. Droidbot: a lightweight ui-guided test input generator for android[C]// 2017 IEEE/ACM 39th International Conference on Software Engineering Companion (ICSE-C). Buenos Aires: IEEE Press, 2017: 23-26.
[29]	Github. PaddleOCR[EB/OL]. (2024-03-07) [2026-01-10]. https://github.com/PaddlePaddle/PaddleOCR.
[30]	Github. 中文数据预处理材料[EB/OL]. [2026-01-10]. https://github.com/fighting41love/Chinese_from_dongxiexidian.
[31]	Ma Z, Wang H, Guo Y, et al. Libradar:fast and accurate detection of third-party libraries in android Apps[C]// Proceedings of the 38th International Conference on Software Engineering Companion. Austin: ACM Press, 2016: 653-656.
[32]	王淞鹤, 王艳红, 李京典, 等. 面向移动互联网关联分析的多实体知识图谱设计与实现[J]. 信息通信技术与政策, 2025, 51 (3): 89-96. doi: 10.12267/j.issn.2096-5931.2025.03.012

序号	条件判断描述	函数API接口
1	获取已运行时间	SystemClock. elapsedRealtime()
2	获取系统时间	System. currentTimeMillis()
3	获取地理位置	LocationManager. getLastKnownLocation()
4	获取手机型号	Build. MODEL
5	Root检测	检查/system/bin/su或Build.TAGS
6	调试模式检测	Debug. isDebuggerConnected()
7	SIM卡状态检测	TelephonyManager. getSimState()
8	后台运行检测	ActivityManager. getRunningAppProcesses()
9	模拟器检测	检查Build. PRODUCT或/dev/qemu_pipe
10	获取网络状态	ConnectivityManager. getNetworkCapabilities() NetworkCapabilities. hasTransport()

序号	条件判断描述	函数API接口
1	获取已运行时间	SystemClock. elapsedRealtime()
2	获取系统时间	System. currentTimeMillis()
3	获取地理位置	LocationManager. getLastKnownLocation()
4	获取手机型号	Build. MODEL
5	Root检测	检查/system/bin/su或Build.TAGS
6	调试模式检测	Debug. isDebuggerConnected()
7	SIM卡状态检测	TelephonyManager. getSimState()
8	后台运行检测	ActivityManager. getRunningAppProcesses()
9	模拟器检测	检查Build. PRODUCT或/dev/qemu_pipe
10	获取网络状态	ConnectivityManager. getNetworkCapabilities() NetworkCapabilities. hasTransport()

模块名称	精确率	召回率	F1值
控制流特征分析模块	30.70%	71.43%	0.429 4
行为一致性比对模块	94.30%	85.41%	0.896 4
应用指纹特征识别模块	100.00%	87.40%	0.932 8
多特征分析方法	100.00%	84.62%	0.916 7

模块名称	精确率	召回率	F1值
控制流特征分析模块	30.70%	71.43%	0.429 4
行为一致性比对模块	94.30%	85.41%	0.896 4
应用指纹特征识别模块	100.00%	87.40%	0.932 8
多特征分析方法	100.00%	84.62%	0.916 7

检测工具	原生应用	混合应用	静态分析	运行时检测	是否需要原工程文件	准确率
Stadart	√	×	√	√	×	88.28%
Pedroid	√	×	√	×	√	90.28%
Hybrid-Roid	×	√	√	×	×	88.62%
多特征分析方法	√	√	√	√	×	96.99%

基于多特征分析的移动应用恶意热更新安全检测方法

A security detection method for malicious hot updates in mobile applications based on multi-feature analysis

RichHTML

PDF

可视化

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献 32

相关文章 0

编辑推荐

Metrics

本文评价

包名	版本	应用商店分类	运行时分类	恶意族群
COM.JSYIYI.NEWFARM	4.0.3	购物比价	虚拟货币类	×
COM.GAME.KC258V7	7.8.8.16	汽车	体育资讯类	×
COM.JIEJIDARENBJ.MSH	1.0.42	实用工具	游戏类	×
COM.GAME.ANDROIDWXC	1.4.1	实用工具	游戏类	×
UNI.UNIE084971	1.1.0	影音娱乐	游戏类	√
COM.MMDUODUO.ARCADE	v1.0.0	便捷生活	游戏类	×
COM.QRMYMKT.HKAPP	1.0.2	实用工具	金融交易类	×
UNI.UNIC806C4F	1.2.4	实用工具	刷单类	√
COM.RES.MFESTPLACE	1934.234.43	实用工具	体育资讯类	×
COM.JIAXIN.TIANJI	1.1.9	实用工具	内容推送类	×
UNI.ZQXK.GXX	4.0	实用工具	金融交易类	×