Android平台恶意应用程序静态检测方法  

Static Detection of Android Malware

作　　者：蒋煦[1] 张长胜[2] 戴大蒙[2] 慕德俊[1] 

机构地区：[1]西北工业大学自动化学院,西安710071 [2]温州大学物理与电子信息工程学院,温州325000

出　　处：《计算机系统应用》2016年第4期1-7,共7页Computer Systems & Applications

基　　金：国家自然科学基金(61303224);浙江省科技厅公益项目(2104C31079)

摘　　要：本文构建的静态检测系统主要用于检测Android平台未知恶意应用程序.首先,对待检测应用程序进行预处理,从Android Manifest.xml文件中提取权限申请信息作为一类特征属性;如待检测应用程序存在动态共享库,则提取从第三方调用的函数名作为另一类特征属性.对选取的两类特征属性分别选择最优分类算法,最后根据上述的两个最优分类算法对待检测应用程序的分类结果判定待检测应用程序是否为恶意应用程序.实验结果表明:该静态检测系统能够有效地检测出Android未知恶意应用程序,准确率达到95.4%,具有良好的应用前景.The static detection system referred in this article is used to detect unknown malware. First of all, the Android application sample is preprocessed and permission information that the application developer applies for is extracted as a kind of characteristic attribute. If there is shared object file, the name of function called from other libraryis is extracted as another kind of characteristic attribute. Secondly, the two optimal classifiers chose are used to hand two classes of features separately. Finally, the result of comprehensive judgment system depends on the result of classifiers about two types of characteristic attribute. The result of experiment shows that the static detection system can detect the unknown malware efficiently, and the accuracy of the static detection system reaches up to 95.4%.

关 键 词：安卓 静态检测 机器学习 特征属性 恶意应用 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP316[自动化与计算机技术—计算机科学与技术]