CN105320886B - Detect the method and mobile terminal that whether there is Malware in mobile terminal - Google Patents

Abstract

The invention discloses a method for detecting whether malicious software exists in a mobile terminal and the mobile terminal. The method includes: detecting whether there is a file recording the time stamp of the last collected information in the cache of the mobile terminal; collecting information on installed software in the mobile terminal according to the detection result; and sending the collected information to a server for further processing. detection, wherein the server is preset with non-malicious software information for comparison with the collected information. According to this method, the information of all non-malicious software that has passed authentication or detection can be preset in the server, and by collecting the information of the software installed in the mobile terminal and sending it to the server for comparison, it can be determined whether the software installed in the mobile terminal is All are non-malware.

Description

Method for detecting whether malicious software exists in mobile terminal and mobile terminal

technical field

The invention relates to a mobile terminal, in particular to a method for detecting whether malicious software exists in a mobile terminal and the mobile terminal.

Background technique

In recent years, smart phones have become more and more popular, and smart phones have been able to achieve more and more functions, and have become an increasingly indispensable part of people's lives. In people's daily life, they not only use smart phones to make calls and send messages to realize the basic functions of mobile terminals, but also use smart phones to surf the Internet, shop, listen to music, play games and so on. These functions of the mobile terminal are realized by installing various applications therein.

However, some malware also emerges with the development of applications for mobile terminals. Some malicious software will continuously push various advertisements to users through mobile terminals. Other malware can mislead mobile terminal users to perform misoperations, thereby binding some services or functions inexplicably. Some malicious software may even steal passwords entered by users through mobile terminals, such as bank card passwords, thereby bringing great financial risks to users.

Because malicious software has brought great inconvenience and risk to the user of mobile terminal. How to detect whether there is malware in a mobile terminal has become an urgent problem to be solved.

Contents of the invention

In view of this, the present invention proposes a method and a mobile terminal for detecting whether malicious software exists in a mobile terminal.

According to one aspect of the present invention, there is provided a method for detecting whether malicious software exists in a mobile terminal, including: detecting whether there is a file recording the time stamp of the last collected information in the cache of the mobile terminal; information about installed software in the mobile terminal; and sending the collected information to a server for detection, wherein the server is preset with information about non-malicious software for comparison with the collected information.

According to one embodiment, if there is no file in the cache that records the time stamp of the last collected information, a full scan is performed on all installed software in the mobile terminal to collect information; and if there is a file that records the last collected information in the cache, For files with timestamps, the information of the installed software in the mobile terminal is collected according to the last full scan timestamp, the last incremental scan timestamp and the current timestamp of the file records in the cache.

According to one embodiment, collecting the information of the installed software in the mobile terminal according to the last full scan timestamp and the last incremental scan timestamp and the current timestamp of the file records in the cache includes: comparing the files in the cache The recorded last full scan time stamp and the current time stamp; and collecting information of installed software in the mobile terminal according to the comparison result.

According to one embodiment, collecting the information of the installed software in the mobile terminal according to the comparison result includes: if the current timestamp is later than the last full scan timestamp of the file records in the cache and exceeds a predetermined first threshold, then All installed software in the above mobile terminal is scanned to collect information; The time stamp of the last incremental scan and the current time stamp collect the information of the installed software in the mobile terminal.

According to one embodiment, collecting the installed software information in the mobile terminal according to the last incremental scan timestamp and the current timestamp of the file record in the cache includes: if the current timestamp is later than the file record in the cache If the time stamp of the last incremental scan exceeds the predetermined second threshold, an incremental scan is performed on the information of installed software in the mobile terminal to collect information.

According to one embodiment, performing an incremental scan on the information of installed software in the mobile terminal to collect information includes: comparing the time stamps of all installed software in the mobile terminal with the last increment of the file records in the cache comparing the scanning timestamps; and collecting information on installed software whose timestamps in the mobile terminal are later than the last incremental scan timestamps of the file records in the cache.

According to one embodiment, the information of each installed software includes 5-tuple information of the software.

According to one embodiment, the quintuple information of the software includes: app package name, app version number, app version name, the SHA1 value of META-INF/CERT.RSA in the app file, and the SHA1 value of AndroidManifest.xml in the app file .

According to one embodiment, collecting the information of the installed software in the mobile terminal according to the detection results includes: obtaining the app package name of the installed software in the mobile terminal; determining the installation file storage path of the installed software according to the app package name ;According to the installation file storage path of the installed software, obtain and decompress the installation file of the installed software; and obtain the app version number, app version name, SHA1 value of META-INF/CERT.RSA in the app file and The SHA1 value of AndroidManifest.xml in the app file.

According to another aspect of the present invention, a mobile terminal is provided, including: a detection unit, configured to detect whether there is a file recording the time stamp of the last collected information in the cache of the mobile terminal; a collection unit, configured to The detection result of the detection unit collects the information of the installed software in the mobile terminal; and the sending unit is used to send the collected information to the server for detection, wherein the server is preset with non-malicious software information for use for comparison with the information collected.

According to one embodiment, if the detection unit detects that there is no file recording the time stamp of the last collected information in the cache, the collection unit performs a full scan of all installed software in the mobile terminal to collect information and if the detection unit detects that there is a file recording the timestamp of the last collection of information in the cache, the collection unit records the last full scan timestamp and the last increment according to the file record in the cache. The information of the installed software in the mobile terminal is collected through the volume scan time stamp and the current time stamp.

According to one embodiment, the collection unit includes: a comparison subunit, configured to compare the last full scan timestamp of the file record in the cache with the current timestamp; and a collection subunit, configured to The comparison result of the unit collects the information of the installed software in the mobile terminal.

According to one embodiment, if the comparison subunit compares that the current timestamp is later than the last full scan timestamp of the file record in the cache and exceeds a predetermined first threshold, the collection subunit All installed software in the terminal scans to collect information; and if the comparison subunit compares that the current timestamp is later than the last full scan timestamp of the file record in the cache and does not exceed a predetermined first threshold, then The collection subunit collects the information of the software installed in the mobile terminal according to the last incremental scanning timestamp and the current timestamp of the file records in the cache.

According to one embodiment, if the comparison subunit compares that the current timestamp is later than the last incremental scan timestamp of the file record in the cache and exceeds a predetermined second threshold, the collection subunit The information of installed software in the mobile terminal is incrementally scanned to collect information.

According to one embodiment, the comparison subunit is further configured to compare the timestamps of all installed software in the mobile terminal with the last incremental scan timestamp of the file records in the cache, and the collection subunit It is also used to collect information of installed software in the mobile terminal whose time stamp is later than the last incremental scan time stamp of the file record in the cache.

According to an embodiment, the information of each installed software collected by the collecting unit includes 5-tuple information of the software.

According to one embodiment, the quintuple information of the software includes: app package name, app version number, app version name, the SHA1 value of META-INF/CERT.RSA in the app file, and the SHA1 value of AndroidManifest.xml in the app file .

According to one embodiment, the collection unit includes: an acquisition subunit, configured to acquire the app package name of the installed software in the mobile terminal; a determination subunit, configured to determine the installed software according to the app package name acquired by the acquisition subunit The installation file storage path of the installation software; and the decompression subunit, which is used to obtain and decompress the installation file of the installed software according to the installation file storage path of the installed software determined by the determination subunit, wherein the acquisition subunit is based on the determined subunit. The file decompressed by the decompression subunit obtains the app version number, the app version name, the SHA1 value of META-INF/CERT.RSA in the app file, and the SHA1 value of AndroidManifest.xml in the app file.

According to the technical solution provided by the present invention, the information of all non-malicious software that has passed the authentication or detection can be preset in the server, and by collecting the information of the software installed in the mobile terminal and sending it to the server for comparison, the mobile terminal can be determined Whether all the software installed in is non-malware. If the information of a certain software does not match all the information preset in the server, it means that the software installed in the mobile terminal is likely to be malicious software, which can remind the user to deal with the software accordingly, so as to ensure safe use mobile terminal.

Description of drawings

Other features and advantages of the present invention will be more easily understood by reading the various embodiments of the present invention with reference to the accompanying drawings. The accompanying drawings described here are only for the purpose of schematically illustrating the embodiments of the present invention, not all possible implementations , and are not intended to limit the scope of the invention. In the attached picture:

FIG. 1 shows a flowchart of a method for detecting whether malware exists in a mobile terminal according to an exemplary embodiment of the present invention;

FIG. 2 shows a flow chart of collecting information of installed software in a mobile terminal according to the last full scan timestamp and the last incremental scan timestamp and the current timestamp of the file records in the cache according to an exemplary embodiment of the present invention;

FIG. 3 shows a flow chart of incrementally scanning information on installed software in a mobile terminal according to an exemplary embodiment of the present invention;

FIG. 4 shows a flowchart of collecting information of installed software in a mobile terminal according to an exemplary embodiment of the present invention;

FIG. 5 shows a block diagram of a mobile terminal according to an exemplary embodiment of the present invention;

Figure 6 shows a block diagram of a collection unit according to an exemplary embodiment of the present invention; and

Fig. 7 shows a block diagram of a collection unit according to another exemplary embodiment of the present invention.

Detailed ways

Embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be noted that the following description is only exemplary and not intended to limit the present invention, and for the sake of brevity, specific descriptions of some components that are the same as those in the prior art are omitted in the following description. Also, in the following description, the same reference numerals will be used to designate the same or similar components in different drawings. Different features in different embodiments described below can be combined with each other to form other embodiments within the scope of the present invention.

FIG. 1 shows a flowchart of a method for detecting whether malware exists in a mobile terminal according to an exemplary embodiment of the present invention. As shown in FIG. 1 , the method 1000 may include steps S1100 to S1300. In step S1100, it is detected whether there is a file recording the time stamp of the last collected information in the cache of the mobile terminal. In step S1200, information on installed software in the mobile terminal is collected according to the detection result. Subsequently, in step S1300, the collected information is sent to the server for detection. Information about non-malicious software is preset in the server for comparison with the collected information.

According to this embodiment, the information of all non-malicious software that has passed the authentication or detection can be preset in the server, and by collecting the information of the software installed in the mobile terminal and sending it to the server for comparison, it is possible to determine the information of the software installed in the mobile terminal. Whether the software is all non-malware. If the information of a certain software does not match all the information preset in the server, it means that the software installed in the mobile terminal is likely to be malicious software, which can remind the user to deal with the software accordingly, so as to ensure safe use mobile terminal.

For example, according to this embodiment, four security levels can be enumerated: safe, dangerous, cautious and Trojan horse. Among them, the definitions of various security levels are as follows: safe: the application is a normal application, and there is no behavior that threatens the security of the user's mobile phone; dangerous: the application has security risks, and the application itself may be malware, or the application may It was originally a normal software released by a regular company, but due to security loopholes, the user's privacy and mobile phone security are threatened; Caution: This application is a normal application, but there are some problems, such as allowing users to be deducted accidentally, Or there are complaints about unfriendly advertisements, etc. When such an application is found, the user will be prompted to use it carefully and inform the possible behavior of the application, but it is up to the user to decide whether to clear the application; Trojan horse: the application is a virus, Trojan or Other malicious software, collectively referred to as Trojans here for simplicity, does not mean that the application is just a Trojan. For example, for an Android application detected as "Trojan horse level", if the malicious behavior=3, it is 11 when translated into binary, the first bit=1, the second bit=1, and the malicious behavior represented is: secretly downloading and downloading in the background at the same time The act of sending text messages privately. For another example, for an Android application detected as "cautious level", if the behavior description = 4, the binary translation is 100, the first bit = 0, the second bit = 0, the second bit = 1, and the indicated behavior is: Contains advertisements. Since this advertisement may or may not be allowed by the user, the user will be prompted to use it with caution, and it is up to the user to decide whether to clear it. Software description information: usually expressed as a character string, which is a description of the Android application, such as the publisher, release time and other information. Timestamp information: indicates when the feature information (such as normal feature, Trojan horse feature, etc.) of the Android application program was put into storage. In practical applications, when the client user interface displays the security detection results, the security level information can be popped up first. If the user clicks the "View Details" button, the behavior description information, software description information and time stamp information will be displayed for the user.

In addition, this application can also combine machine learning engine, cloud antivirus engine, local antivirus engine, etc. to simultaneously scan objects to be monitored, and can also operate in combination with active defense and other security detection modules.

In addition, according to this embodiment, each time the information of installed software in the mobile terminal is collected, the current time stamp is recorded in the cache. If it is detected in the sub-step S1100 that there is no file recording the time stamp of the last collected information in the cache, it means that the mobile terminal has not yet scanned the installed software after starting up, so it is necessary to scan all the installed software in the mobile terminal. Do a full scan (that is, scan all installed software) to gather information. On the contrary, if it is detected in the sub-step S1100 that there is a file recording the time stamp of the last collected information in the cache, it means that the installed software in the mobile terminal has been scanned, so the last full amount recorded according to the file in the cache can be The scan timestamp and the last incremental scan timestamp and the current timestamp determine how to collect information about installed software in the mobile terminal.

According to the above implementation manners, the mobile terminal can be processed differently according to whether the installed software is overscanned after the mobile terminal is turned on.

FIG. 2 shows a flow chart of collecting installed software information in a mobile terminal according to the last full scan time stamp, last incremental scan time stamp and current time stamp of file records in the cache according to an exemplary embodiment of the present invention. As shown in FIG. 2 , when it is detected in substep S1100 that there is a file recording the time stamp of last collected information in the cache, the above substep S1200 may include substeps S1210 and S1220. In sub-step S1210, the last full scan time stamp of the file records in the cache is compared with the current time stamp. Subsequently, in sub-step S1220, information of installed software in the mobile terminal may be collected according to the comparison result of sub-step S1210.

Specifically, if the comparison result in sub-step S1210 is that the current timestamp is later than the last full scan timestamp of the file record in the cache and exceeds the predetermined first threshold, it means that the mobile terminal has not performed a full scan for too long , so it is necessary to scan all installed software in the mobile terminal to collect information at this time. For example, the predetermined first threshold can be set to 1 month. If the current timestamp is more than 1 month later than the last full scan timestamp of the file record in the cache, it means that the mobile terminal has not been used for too long. Do a full scan.

Conversely, if the comparison result in sub-step S1210 is that the current timestamp is later than the last full scan timestamp of the file record in the cache and does not exceed the predetermined first threshold, then the timestamp of the last incremental scan of the file record in the cache can be used and the current timestamp to determine how to collect information about software installed in the mobile terminal. Specifically, if the current timestamp is later than the last incremental scan timestamp of the file record in the cache and exceeds the predetermined second threshold, it means that the software installed in the mobile terminal has not been incrementally scanned for a long time (that is, Scan the software installed or updated after the last scan), so it is necessary to perform incremental scans on the information of installed software in the mobile terminal to collect information. For example, the predetermined second threshold can be set to 1 day, and if the current timestamp is later than the last incremental scan timestamp of the file record in the cache for more than 1 day, it means that the mobile terminal has not been scanned for a long time. Incremental scanning.

According to the above embodiments, by presetting the first threshold and the second threshold, the software installed in the mobile terminal can be fully scanned or incrementally scanned according to the time stamp. This not only ensures the timeliness of scanning, but also does not occupy system resources too frequently.

Fig. 3 shows a flow chart of incrementally scanning information of installed software in a mobile terminal according to an exemplary embodiment of the present invention. As shown in FIG. 3 , the incremental scan for the information of installed software in the mobile terminal may include sub-steps S1221 and S1222. In sub-step S1221, compare the time stamps of all installed software in the mobile terminal with the last incremental scan time stamp of the file records in the cache. Subsequently, in sub-step S1222, information of installed software in the mobile terminal whose time stamp is later than the last incremental scan time stamp of the file records in the cache is collected.

It can be understood that the time stamp is later than the time stamp of the last incremental scan recorded in the cache, which means that the software is installed or updated after the last incremental scan. Therefore, according to the procedure, information can be collected on software installed or updated since the last incremental scan. It is also understandable that when a certain software is installed or updated in the mobile terminal, the time stamp will be recorded.

According to an embodiment of the present invention, the information of each installed software includes 5-tuple information of the software. The five-tuple information may include: app package name, app version number, app version name, SHA1 value of META-INF/CERT.RSA in the app file, and SHA1 value of AndroidManifest.xml in the app file. Based on the above five-tuple information, it is enough to determine whether a certain software installed in the mobile terminal is malicious software.

For example, feature one: packageName=com.wbs; feature two: none; feature three: MD5(signature[0])=294f08ae04307a649322524713318543; feature one + feature three: the security level is "Trojan horse"; feature 1, feature 3 Trojan horse?", find the record, and return the result as "Trojan horse".

For another example, it can be determined whether there is abnormal information in the five-tuple information by referring to setting a predefined security identification library on the mobile terminal device or cloud server, and the predefined security identification library can include application program whitelist, application program Blacklist, and application characteristic data. The whitelist can include the names of known trusted applications (including the UID (unique identifier) of the application and the package name of the installation package of the application), and the blacklist of the application can include known malicious applications. The name of the application program (including the UID (unique identifier) of the application program and the package name of the installation package of the application program), the application program feature data may include data of known malicious features (such as copycat application features).

It can be understood that the above five-tuple information is only a representative example of the software information to be detected, and the present application is not limited thereto. For example, the following information can also be collected for detection to determine whether it is malware. 1) Android installation package name: packageName; 2) Android installation package version number: versionCode; 3) MD5 of the digital signature of the Android installation package: signature[0]; 4) Android component receiver; 5) instructions in classes.dex ; 6) Strings in the ELF file; 7) MD5 of each file in the assets, res, lib and other directories; 8) Android component service, activity.

Fig. 4 shows a flow chart of collecting information of installed software in a mobile terminal according to an exemplary embodiment of the present invention. As shown in FIG. 4, the above step S1200 may include sub-steps S1250 to S1280. In sub-step S1250, the app package name of the installed software in the mobile terminal is acquired. Among the five-tuple information, only the app package name is directly obtainable. Subsequently, in sub-step S1260, the installation file storage path of the installed software is determined according to the app package name. Moreover, in sub-step S1270, the installation file of the installed software may be acquired and decompressed according to the storage path of the installation file of the above-mentioned installed software. Then, in substep S1280, the app version number, app version name, the SHA1 value of META-INF/CERT.RSA in the app file and the SHA1 value of AndroidManifest. The five-tuple information of .

FIG. 5 shows a block diagram of a mobile terminal according to an exemplary embodiment of the present invention. As shown in FIG. 5 , a mobile terminal 5000 may include a detection unit 5100 , a collection unit 5200 and a sending unit 5300 . The detection unit 5100 may detect whether there is a file recording the time stamp of the last collected information in the cache of the mobile terminal 5000 . The collection unit 5200 may collect information of installed software in the mobile terminal 5000 according to the detection result of the detection unit 5100 . The sending unit 5300 can send the collected information to the server for detection. The server may be preset with non-malware information for comparison with the collected information.

According to one embodiment, if the detection unit 5100 detects that there is no file recording the time stamp of the last collected information in the cache of the mobile terminal 5000, the collection unit 5200 performs a full scan on all installed software in the mobile terminal 5000 to collect information. Conversely, if the detection unit 5100 detects that there is a file recording the time stamp of the last collected information in the cache of the mobile terminal 5000, the collection unit 5200 will scan the time stamp of the last full scan and the last incremental scan according to the file record in the cache. Collect the information of the installed software in the mobile terminal 5000 with the current time stamp.

Fig. 6 shows a block diagram of a collection unit according to an exemplary embodiment of the present invention. As shown in FIG. 6 , the collection unit 5200 may include a comparison subunit 5210 and a collection subunit 5220 . The comparison subunit 5210 may compare the last full scan time stamp of the file records in the cache of the mobile terminal 5000 with the current time stamp. The collection subunit 5220 may collect information of installed software in the mobile terminal 5000 according to the comparison result of the comparison subunit 5210 .

According to one embodiment, if the comparison subunit 5210 finds that the current timestamp is later than the last full scan timestamp of the file records in the cache and exceeds a predetermined first threshold, the collection subunit 5220 will perform a check on all installed software in the mobile terminal 5000 Scan to gather information.

Conversely, if the comparison subunit 5210 compares that the current timestamp is later than the last full scan timestamp of the file records in the cache and does not exceed the predetermined first threshold, the collection subunit 5220 will The scanning time stamp and the current time stamp collect information of installed software in the mobile terminal 5000 .

Specifically, if the comparison subunit 5210 compares that the current timestamp is later than the last incremental scan timestamp of the file record in the cache and exceeds the predetermined second threshold, the collection subunit 5220 will collect information about the installed software in the mobile terminal 5000 Incremental scans are performed to gather information.

According to one embodiment, the comparison subunit 5210 may also compare the timestamps of all installed software in the mobile terminal 5000 with the last incremental scan timestamp of the file records in the cache. The collection subunit 5220 may collect information of installed software in the mobile terminal 5000 whose time stamp is later than the last incremental scan time stamp of the file records in the cache.

According to an embodiment, the information of each installed software collected by the collecting unit 5200 includes 5-tuple information of the software. Specifically, the five-tuple information of the software may include: app package name, app version number, app version name, SHA1 value of META-INF/CERT.RSA in the app file, and SHA1 value of AndroidManifest.xml in the app file.

Fig. 7 shows a block diagram of a collection unit according to another exemplary embodiment of the present invention. As shown in FIG. 7 , the collection unit 5200 may include an acquisition subunit 5250 , a determination subunit 5260 and a decompression subunit 5270 . The obtaining subunit 5250 can obtain the app package name of the installed software in the mobile terminal 5000 . The determination subunit 5260 may determine the installation file storage path of the installed software according to the app package name acquired by the acquisition subunit 5250 . The decompression subunit 5270 may obtain and decompress the installation file of the installed software according to the storage path of the installation file of the installed software determined by the determination subunit 5260 . The obtaining subunit 5250 can also obtain the app version number, app version name, SHA1 value of META-INF/CERT.RSA in the app file and SHA1 value of AndroidManifest.xml in the app file according to the file decompressed by the decompression subunit 5270.

The above descriptions of various embodiments of the present invention are for a better understanding of the present invention, which are only exemplary rather than intended to implement the present invention. It should be noted that in the above description, features described and/or illustrated for one embodiment can be used in the same or similar manner in one or more other embodiments, in combination with features in other embodiments, Or replace the features in other embodiments. Those skilled in the art can understand that without departing from the concept of the present invention, various changes and modifications made to the above-described implementation manners all fall within the scope of the present invention.

Claims (16)

1. a kind of detect with the presence or absence of the method for Malware in mobile terminal, including：

Detect the file for the timestamp for collecting information in the caching of the mobile terminal with the presence or absence of record last time, the timestamp For the entry time of the characteristic information of application program；

The information that software has been installed in the mobile terminal is collected according to testing result, if specifically, record is not present in caching Last time collects the file of the timestamp of information, then carries out full dose scanning to all softwares of having installed in the mobile terminal to collect Information；If caching in exist record last time collect information timestamp file, the file record according to caching it is upper Secondary full dose sweep time stamp and last time incremental sweep timestamp are collected in the mobile terminal with current time stamp and have installed software Information；

Collected information is sent to server and detected, will install software according to testing result is divided into safety, danger Danger, careful and four level of securitys of wooden horse；

Wherein described server is preset with the information of non-malicious software, for compared with collected information.

2. the method as described in claim 1, wherein the full dose sweep time last time stamp of the file record according to caching and Last time incremental sweep timestamp includes with having installed the information of software in the current time stamp collection mobile terminal：

Compare the full dose sweep time last time stamp and current time stamp of file record described in caching；And

The information that software has been installed in the mobile terminal is collected according to comparative result.

3. method as claimed in claim 2, wherein collecting the letter that software has been installed in the mobile terminal according to comparative result Breath includes：

If the full dose sweep time last time stamp that current time stamp is later than file record described in caching exceedes predetermined first threshold, Then all softwares of having installed in the mobile terminal are scanned to collect information；And

If full dose sweep time last time that current time stamp is later than file record described in caching is stabbed not less than the first predetermined threshold Value, then the last time incremental sweep timestamp of the file record according to caching and current time stamp are collected in the mobile terminal The information of software has been installed.

4. method as claimed in claim 3, wherein the last time incremental sweep timestamp of the file record according to caching with The information of software has been installed in the current time stamp collection mobile terminal to be included：

If the last time incremental sweep timestamp that current time stamp is later than file record described in caching exceedes predetermined Second Threshold, Incremental sweep then is carried out to collect information to the information that software has been installed in the mobile terminal.

5. method as claimed in claim 4, wherein carrying out incremental sweep to the information that software has been installed in the mobile terminal Included with collecting information：

By all last time incremental sweeps for having installed file record described in the timestamp and caching of software in the mobile terminal Timestamp is compared；And

Collect the peace that timestamp in the mobile terminal is later than the last time incremental sweep timestamp of file record described in caching Fill the information of software.

6. such as the method any one of claim 1-5, wherein each information for having installed software includes five yuan of software Group information.

7. method as claimed in claim 6, wherein the five-tuple information of the software includes：App bags name, app version numbers, AndroidManifest.xml in META-INF/CERT.RSA SHA1 values and app files in app versions name, app files SHA1 values.

8. method as claimed in claim 7, wherein collecting the letter that software has been installed in the mobile terminal according to testing result Breath includes：

Obtain the app bag names that software has been installed in the mobile terminal；

Determined that the installation file store path of software has been installed according to the app bags name；

According to the installation file store path for having installed software, the installation file for having installed software is obtained and decompressed；And

According to decompressed file acquisition app version numbers, app versions name, in app files META-INF/CERT.RSA SHA1 AndroidManifest.xml SHA1 values in value and app files.

9. a kind of mobile terminal, including：

Detection unit, the text of the timestamp of information was collected in the caching for detecting the mobile terminal with the presence or absence of record last time Part, the timestamp are the entry time of the characteristic information of application program；

Collector unit, the letter of software is installed for being collected according to the testing result of the detection unit in the mobile terminal Breath, if being specially the file that the detection unit detects the timestamp that record last time collection information is not present in the caching, Then the collector unit carries out full dose scanning to collect information to all softwares of having installed in the mobile terminal, if the detection Unit detects the file for the timestamp that record last time collection information in the caching be present, then the collector unit is according to The full dose sweep time last time stamp and last time incremental sweep timestamp of file record described in caching collect institute with current time stamp State the information that software has been installed in mobile terminal；

Transmitting element, detected for collected information to be sent to server, software will have been installed according to testing result It is divided into safety, dangerous, careful and four level of securitys of wooden horse；

Wherein described server is preset with the information of non-malicious software, for compared with collected information.

10. mobile terminal as claimed in claim 9, wherein the collector unit includes：

Comparing subunit, full dose sweep time last time stamp and current time for file record described in the caching Stamp；And

Subelement is collected, software has been installed for being collected according to the comparative result of the comparing subunit in the mobile terminal Information.

11. mobile terminal as claimed in claim 10, wherein

If the comparing subunit compares the last time full dose scanning that current time stamp is later than file record described in the caching Timestamp exceedes predetermined first threshold, then the collection subelement is swept to all softwares of having installed in the mobile terminal Retouch to collect information；And

If the comparing subunit compares the last time full dose scanning that current time stamp is later than file record described in the caching Timestamp is not less than predetermined first threshold, then the last time increasing for collecting subelement file record according to the caching Amount sweep time stamp collects the information that software has been installed in the mobile terminal with current time stamp.

12. mobile terminal as claimed in claim 11, wherein

If the comparing subunit compares the last time incremental sweep that current time stamp is later than file record described in the caching Timestamp exceedes predetermined Second Threshold, then the subelement of collecting is carried out to the information that software has been installed in the mobile terminal Incremental sweep is to collect information.

13. mobile terminal as claimed in claim 12, wherein the comparing subunit is additionally operable in mobile terminal described in comparison The last time incremental sweep timestamp of all timestamps for having installed software and file record described in the caching, and the receipts Collection subelement be additionally operable to collect timestamp in the mobile terminal be later than caching described in file record last time incremental sweep when Between the information for having installed software stabbed.

14. such as the mobile terminal any one of claim 9-13, wherein each collected by the collector unit having pacified The information of dress software includes the five-tuple information of software.

15. mobile terminal as claimed in claim 14, wherein the five-tuple information of the software includes：App bags name, app versions This number, app versions name, in app files in META-INF/CERT.RSA SHA1 values and app files AndroidManifest.xml SHA1 values.

16. mobile terminal as claimed in claim 15, wherein the collector unit includes：

Subelement is obtained, the app bag names of software have been installed for obtaining in the mobile terminal；

Determination subelement, the installation file that the app bags name for being obtained according to the acquisition subelement determines to have installed software are deposited Store up path；And

Subelement is decompressed, for the installation file store path for having installed software determined according to the determination subelement, is obtained And the installation file for having installed software is decompressed,

The wherein described subelement that obtains is according to the file acquisition app version numbers of the decompression subelement decompression, app versions name, app In file in META-INF/CERT.RSA SHA1 values and app files AndroidManifest.xml SHA1 values.