Abstract:

Hot update technology is widely utilized in mobile applications for scenarios such as rapid patching and lightweight updates. However, malicious developers abuse this mechanism to bypass App store security audits, posing potential security risks. To address the challenges of high monitoring costs, significant detection difficulties, and intense technical adversarial confrontanion associated with malicious hot updates, this paper proposes a detection method based on multi-feature analysis. This method performs a comprehensive analysis of the control flow features of hot update code, runtime behavioral features, and application fingerprint features. This paper collected a total of 12 982 Apps and 300 malicious samples for experimental analysis, and identified 11 newly detected malicious Apps and 29 malware familes. Experimental results demonstrate that the proposed method can effectively identify malicious hot update behaviors.

Key words: mobile application security, malicious hot update, consistency analysis, feature recognition