一种基于混合特征的移动终端恶意软件检测方法

随着移动终端恶意软件的种类和数量不断增大,本文针对Android系统恶意软件单特征检测不全面、误报率高等技术问题,提出一种基于动静混合特征的移动终端恶意软件检测方法,以提高检测的覆盖率、准确率和效率.该方法首先采用基于改进的CHI方法和凝聚层次聚类算法优化的K-Means方法构建高危权限和敏感API库,然后分别从静态分...

A Malware Detection Method Based on Hybrid Feature for Mobile Terminals

At present, with the large-scale use of the Android system, the types of malware based on the Android system are emerging in endlessly, and the types of viruses are increasing. Aiming at the problems of incomplete detection of single feature of the Android system malware, low accuracy rate, and high false alarm rate, this article proposed a mobile terminal malware detection analysis method based on mixed dynamic and static features to improve the coverage, accuracy and efficiency of malware detection for Android systems. By combining the feature values extracted by the two detection methods, such as the static analysis and dynamic analysis method, the efficiency and accuracy of malware detection are further improved. First, the paper built high-risk permissions and sensitive API libraries based on the improved CHI method and the K-Means method optimized by the agglomerated hierarchical clustering method, and then extracted the mixed characteristics of the mobile terminal system from static analysis and dynamic analysis. In the static analysis, the APK file was decompiled firstly, and the permission application characteristics and sensitive API call characteristics were analyzed. In the dynamic analysis, the dynamic behavior characteristics during the running of the APP were monitored in real time, and the frequency of sensitive API calls during the running process was extracted. Characteristics and system status characteristics. Then the paper used dispersion standardization, TF-IDF weight analysis method and optimal sequence graph method to normalize the mixed features and assign feature weights. Finally, the data sets downloaded from VirusShare and Drebin was de-duplicated and other related processing will be carried out. Then, the malware detection methods based on the mixed features proposed in this article was compared and evaluated, Experiments results showed that this method in this paper had good accuracy and efficiency for the detection of Android system malware, and effectively improves the detection accuracy of malware.