Method and system for detecting malicious application

A malicious application detecting system, comprising:

• a feature extracting unit receiving a plurality of training malicious applications (APK files) and a plurality of training benign applications (APK files), obtaining a manifest file and a de-compiled code respectively from each of the training malicious applications and each of the training benign applications, and extracting a plurality of static features from each manifest file and each de-compiled code;
• a clustering unit coupled to the feature extracting unit for generating at least one malicious application group based on the training malicious applications using a clustering algorithm, and grouping the training benign applications into at least one benign application group according to a classification rule designed by an application market, wherein for each of the at least one malicious application group, the clustering unit generates a malicious application detecting model representing the malicious application group according to the static features of the training malicious applications in the malicious application group, and for each of the at least one benign application group, the clustering unit generates a benign application detecting model representing the benign application group according to the static features of the training benign applications in the benign application group;
• and
• a determining unit coupled to the feature extracting unit and the clustering unit for controlling the feature extracting unit to obtain a target manifest file and a target de-compiled code from a target application when the target application is received and extracting a plurality of target static features from the target manifest file and the target de-compiled code,
• wherein the determining unit determines whether the target application belongs to any of the at least one malicious application group according to a classification algorithm, the target static features, the malicious application detecting model of each of the at least one malicious application group, and the benign application detecting model of each of the at least one benign application group, and generates a warning message when determining that the target application belongs to one of the at least one malicious application group.