Open AccessAvpd: An Anti-virus Model with Remote Thread Injection for Android Based on ResNet50
Author(s) -
Yuer Yang,
Zeguang Chen,
Shaobo Chen,
Zhuoyun Du,
Yan Luo,
Liangtian Zhao,
Lifeng Zhou,
Yujuan Quan
Publication year - 2022
Publication title -
journal of physics. conference series
Language(s) - English
Resource type - Journals
SCImago Journal Rank - 0.21
H-Index - 85
eISSN - 1742-6596
pISSN - 1742-6588
DOI - 10.1088/1742-6596/2203/1/012078
Subject(s) - android (operating system) , computer science , thread (computing) , software , operating system , rewriting , computer virus , embedded system , computer security , programming language
Most Android mobile anti-virus software in the industry is checked at the application level, and users familiar with the Android operating system are well aware that the use of virtual clicks, function execution, or shell commands can force the application to stop, which poses a threat to the real-time monitoring of anti-virus software. Moreover, the current mainstream anti-virus software in the industry can only let users manually uninstall or deactivate malicious apps when detected, which also makes the anti-virus software in Android mobile lose the ability of mobile anti-virus software to remove or delete viruses and Trojans automatically. To solve the problems above, in this paper, we train a mobile anti-virus model based on Resnet50 and proposes an Android mobile anti-virus method using remote thread injection - overriding the execution of malicious code by RTI means such as hook API, nulling related functions, rewriting related classes or functions to preserve the app as much as possible. In contrast, The model can identify malicious code with the highest accuracy. The model's recognition accuracy is up to 98.14%, and the malicious code blocking rate is up to 99.70% after recognition.