# US 2018/0025153 A1 · Method and device for detecting malicious code in an intelligent terminal > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0025153 A1 - Document ID: US20180025153A1 - Status: Published application - Kind: A1 - Application number: 15/714,721 - Filed: 2017-09-25 - Published: 2018-01-25 - Earliest claimed: 2013-12-30 - Assignees: Beijing Qihoo Technology Company Limited - Applicants: Beijing Qihoo Technology Company Limited - Inventors: Kang YANG; Zhuo CHEN; Hai TANG - Web page: https://patentgrep.com/patent/US20180025153A1 ## CPC - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/562: {Static detection} - G06F 21/563: {by source code analysis} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 2221/033: Test or assess software - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention discloses a method and device for detecting malicious code in an intelligent terminal. The method comprises: acquiring a virtual machine executable file of an application from an application layer of an intelligent terminal operating system; decompiling the virtual machine executable file to obtain a decompiled function information structure; parsing the decompiled function information structure to extract a function calling sequence in the decompiled function information structure; matching the function calling sequence using a preset malicious code feature library; if matching succeeds, determining that the virtual machine executable file of the application contains malicious code. By applying the solution of the present invention, through a virtual machine executable file of the application, it may be analyzed and determined whether the application comprises malicious code, such that a tampered application program or a malicious software may be detected and removed, thereby protecting security of the intelligent terminal. ## Claims ### Claim 1 A method for detecting malicious code in an intelligent terminal, comprising: acquiring a virtual machine executable file of an application from an application layer of an intelligent terminal operating system; decompiling the virtual machine executable file to obtain a decompiled function information structure; parsing the decompiled function information structure to obtain a virtual machine instruction sequence and a virtual machine mnemonic sequence corresponding to the virtual machine instruction sequence; analyzing and determining function performance of the virtual machine mnemonic sequence, and determining a target feature according to the virtual machine instruction sequence corresponding to the virtual machine mnemonic sequence having the function performance; and matching the target feature using preset malicious codes feature library, and if matching succeeds, determining that the virtual machine executable file of the application contains malicious codes. ### Claim 2 (depends on 1) The method according to claim 1, wherein the analyzing and determining function performance of the virtual machine mnemonic sequence comprises: extracting a function calling sequence from the virtual machine mnemonic sequence; determining function performance of the virtual machine mnemonic sequence by analyzing an instruction of sequentially executing multiple function calling sequences. ### Claim 3 (depends on 2) The method according to claim 2, wherein the instruction of sequentially executing the plurality of function calling sequences comprises: decrypting a string, creating a message signature instance, obtaining a string pointer, and hash encrypting. ### Claim 4 (depends on 1) The method according to claim 1, wherein the determining a target feature according to the virtual machine instruction sequence corresponding to the virtual machine mnemonic sequence having the function performance comprises: using the virtual instruction sequence that has the function performance and corresponds to the virtual machine mnemonic sequence as the target feature, or, using a subset of virtual machine instruction sequence that have the function performance and correspond to the virtual machine mnemonic sequence as the target feature. ### Claim 5 (depends on 1) The method according to claim 1, wherein matching the target feature using a preset malicious code feature library comprises: performing function similarity matching to the target feature and/or performing function feature fussy matching to the function calling sequence using the preset malicious code feature library. ### Claim 6 (depends on 1) The method according to claim 1, wherein the decompiling the virtual machine executable file to obtain a decompiled function information structure comprises: parsing the virtual machine executable file according to a virtual machine executable file format to obtain a function information struct of each class; determining a position and size of a function of the virtual machine executable file according to fields in the function information struct, to obtain the decompiled function information structure. ### Claim 7 (depends on 6) The method according to claim 6, wherein the determining a position and size of a function of the virtual machine executable file according to fields in the function information struct comprises: parsing the function information struct to obtain a bytecode array field indicating a position of the function of the virtual machine executable file and a list length field indicating a size of the function of the virtual machine executable file; determining the position and size of the function of the virtual machine executable file based on the bytecode array field and the list length field. ### Claim 8 (depends on 1) The method according to claim 1, wherein the decompiling the virtual machine executable file to obtain a decompiled function information structure comprises: decompiling the virtual machine executable file into a virtual machine bytecode using a virtual machine executable file decompiling tool. ### Claim 9 (depends on 1) The method according to claim 1, wherein the acquiring a virtual machine executable file of an application from an application layer of an intelligent terminal operating system comprises: finding an installation package of the application from an application layer of the intelligent terminal operating system; and parsing the installation package to obtain the virtual machine executable file of the application. ### Claim 10 A device for detecting malicious code in an intelligent terminal, comprising a memory stored computer-executable instructions thereon and at least one processor to execute the instructions to cause: acquiring a virtual machine executable file of an application from an application layer of an intelligent terminal operating system; decompiling the virtual machine executable file to obtain a decompiled function information structure; parsing the decompiled function information structure to obtain a virtual machine instruction sequence and a virtual machine mnemonic sequence corresponding to the virtual machine instruction sequence; analyzing and determining function performance of the virtual machine mnemonic sequence, and determining a target feature according to the virtual machine instruction sequence corresponding to the virtual machine mnemonic sequence having the function performance; and matching the target feature using preset malicious codes feature library, and if matching succeeds, determining that the virtual machine executable file of the application contains malicious codes. ### Claim 11 (depends on 10) The device according to claim 10, wherein the processor further executes the instructions to cause: extracting a function calling sequence from the virtual machine mnemonic sequence; determining function performance of the virtual machine mnemonic sequence by analyzing an instruction of sequentially executing multiple function calling sequences. ### Claim 12 (depends on 11) The device according to claim 11, wherein the instruction of sequentially executing the plurality of function calling sequences comprises: decrypting a string, creating a message signature instance, obtaining a string pointer, and hash encrypting. ### Claim 13 (depends on 10) The device according to claim 10, wherein the determining a target feature according to the virtual machine instruction sequence corresponding to the virtual machine mnemonic sequence having the function performance comprises: using the virtual instruction sequence that has the function performance and corresponds to the virtual machine mnemonic sequence as the target feature, or, using a subset of virtual machine instruction sequence that have the function performance and correspond to the virtual machine mnemonic sequence as the target feature. ### Claim 14 (depends on 1) The device according to claim 1, wherein the matching the target feature using a preset malicious code feature library comprises: performing function similarity matching to the target feature and/or performing function feature fussy matching to the function calling sequence using the preset malicious code feature library. ### Claim 15 (depends on 10) The device according to claim 10, wherein the decompiling the virtual machine executable file to obtain a decompiled function information structure comprises: parsing the virtual machine executable file according to a virtual machine executable file format to obtain a function information struct of each class; determining a position and size of a function of the virtual machine executable file according to fields in the function information struct, to obtain the decompiled function information structure. ### Claim 16 (depends on 15) The device according to claim 15, wherein the determining a position and size of a function of the virtual machine executable file according to fields in the function information struct comprises: parsing the function information struct to obtain a bytecode array field indicating a position of the function of the virtual machine executable file and a list length field indicating a size of the function of the virtual machine executable file; determining the position and size of the function of the virtual machine executable file based on the bytecode array field and the list length field. ### Claim 17 (depends on 10) The device according to claim 10, wherein the decompiling the virtual machine executable file to obtain a decompiled function information structure comprises: decompiling the virtual machine executable file into a virtual machine bytecode using a virtual machine executable file decompiling tool. ### Claim 18 (depends on 10) The device according to claim 10, wherein the acquiring a virtual machine executable file of an application from an application layer of an intelligent terminal operating system comprises: finding an installation package of the application from an application layer of the intelligent terminal operating system; and parsing the installation package to obtain the virtual machine executable file of the application. ### Claim 19 A non-transitory computer-readable medium, having instructions stored therein that, when executed by at least one processor, cause the processor to perform operations for detecting malicious code in an intelligent terminal, comprising: acquiring a virtual machine executable file of an application from an application layer of an intelligent terminal operating system; decompiling the virtual machine executable file to obtain a decompiled function information structure; parsing the decompiled function information structure to obtain a virtual machine instruction sequence and a virtual machine mnemonic sequence corresponding to the virtual machine instruction sequence; analyzing and determining function performance of the virtual machine mnemonic sequence, and determining a target feature according to the virtual machine instruction sequence corresponding to the virtual machine mnemonic sequence having the function performance; and matching the target feature using preset malicious codes feature library, and if matching succeeds, determining that the virtual machine executable file of the application contains malicious codes.