Design and Implementation of Android Container Monitoring Server and Agent

초록

Security companies have been struggling with malware analysis for many years as they become more and more intelligent. In order to yield better analysis result, the analysis environment must be well-equipped to cover wide range of applications. For instance, applications are analyzed dynamically in a period of time in various environments, including a virtual environment and a real device. Yet many intelligent Android malware still find a way to stop running when they inspect the environment. In order to solve this problem, Android container technology has been studied, but there is still a lack of research on monitoring server that can analyze operation information in malicious application. This paper proposes a server-agent model to monitor application behaviors in Android container. We design and implement agents that collect behavioral information from malicious applications running in the Android containers, and monitoring server that organizes these information for further analyses. © 2018, Springer International Publishing AG, part of Springer Nature.