利用单分类SVM算法检测Android应用程序

目前, Android应用市场大多数应用程序均采取加壳的方法保护自身被反编译, 使得恶意应用的检测特征只能基于权限等来源于AndroidManifest.xml配置文件. 基于权限等特征的机器学习分类算法因为恶意应用与良性应用差异性变小导致检测效果不理想. 如果将更加细粒度的应用程序调用接口(Application P...

Android Malware Detection Based on One Class SVM Algorithm

At present, most benign applications in the Android market adopt a shelling method to protect themselves from being decompiled so that the detection of malicious applications can only rely on the permissions from AndroidMnifest.xml. However, the machine-learning-based classification algorithm based on permission features has a poor detection effect because of a small difference between malicious applications and benign applications. If a more fine-grained Application Program Interface (API) is taken as a feature, a serious imbalance in the number of positive and negative samples will be caused due to application shelling. In response to the above problems, with a large number of malicious applications as training samples and some benign applications as the point of novelty, we use the one-class SVM algorithm to establish a detection model for malicious applications. Compared with two-class supervised learning, this method can effectively distinguish malicious applications from benign applications, which has practical significance.