基于改进朴素贝叶斯的Android恶意应用检测技术  

Android Malware Detection Technology Based on Improved Nave Bayesian

作　　者：许艳萍[1] 伍淳华[1] 侯美佳[2] 郑康锋[1] 姚珊[2] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]国家计算机网络应急技术处理协调中心,北京100029

出　　处：《北京邮电大学学报》2016年第2期43-47,共5页Journal of Beijing University of Posts and Telecommunications

基　　金：国家自然科学基金项目(61272519);"十二五"国家科技支撑计划项目(2012BAH45B00)

摘　　要：在对未知应用静态分析的基础上,提取Android Manifest.xml中申请的权限为特征,采用信息增益算法优化选择分类特征,再采用拉普拉斯校准、乘数取自然对数改进的朴素贝叶斯算法创建恶意应用分类器.通过十折交叉试验验证改进的朴素贝叶斯分类器的准度和精度较高,且通过信息增益优化选择的分类特征在保障准确率的情况下能有效提高检测效率.与k最近邻和k-Means分类器相比,改进的朴素贝叶斯分类器具有较好的分类效果.Permissions are extracted as features via static analysis. The information gain（ IG） algorithm is applied to select significant features. The Nave Bayesian（ NB） classifier is created which is improved through Laplace calibration and natural logarithm of multiplier. The results with 10-fold cross validation indicate that the improved NB classifier achieves higher accuracy and precision,and the selected features by IG algorithm improve the detection efficiency in ensuring the accuracy of the case. Comparing k-nearest neighbor（ KNN） and k-Means classifier,NB classifier has good performance on validity,accuracy and efficiency.

关 键 词：Android权限 恶意应用 信息增益 朴素贝叶斯 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]