基于API和Permission的Android恶意软件静态检测方法研究

当前大量的Android恶意软件在后台收集用户的位置信息、通话记录、电话号码及短信等信息并将其上传至指定服务器,造成了难以估量的危害。为解决此问题,提出一种Android恶意软件静态检测方法。对收集到的训练集中的所有APK文件进行静态反编译,提取其中的静态信息;对静态信息中的API和Permission进行统计学分析,得到API和Permission在恶意APK和正常APK中的使用率;根据它们的使用率确定基准API和Permission集合,将每一个APK转换成可参与计算的关于API和Permission的特征向量;利用改进的k-NN分类器,对待检测的APK进行分类判定。实验结果表明,该方法可以有效地对APK进行恶意分类。

ANDROID MALWARE STATIC DETECTION METHOD BASED ON API AND PERMISSION

At present,a large number of Android malwares collect users location information,call records,phone numbers and short messages in the background and upload them to the specified server,causing incalculable harm.To solve this problem,this paper proposes a static detection method for Android malware.It performed static decompilation on all the APK files collected in the training set and extracted the static information;it made the statistical analysis for the API and Permission in the static information to obtain the usage rates of API and Permission in the malicious APK and normal APK;the benchmark API and Permission set were determined according to their usage rate,and then each APK was transformed into a feature vector of API and Permission that could participate in the calculation;the improved k-NN classifier was used to determine the APK to be detected.The experimental results show that the static detection method can effectively classify malicious APK.