Android平台的恶意程序多特征检测  

Multi Feature Detection of Malicious Programs Based on Android Platform

作　　者：吴帆 陆济湘[1] 曹文静 

机构地区：[1]武汉理工大学理学院,武汉430070

出　　处：《小型微型计算机系统》2018年第1期151-155,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金重大研究计划项目(91324201)资助;湖北省普通公路网运行监测与应急处置系统项目(20141h0288)资助

摘　　要：如今恶意程序种类繁多,各种检测技术在运行时都会产生大量数据.近年来学者们开始采用数据挖掘技术检测安卓恶意软件,但仍存在一些不足之处:一方面是分类器需要处理的数据繁多,另一方面是同一算法无法充分检测不同特征.针对以上局限性提出基于多类特征的混合算法,首先使用动态、静态结合技术收集程序的函数调用和系统调用特征;接着对于庞大的特征数据采用卡方统计处理,剔除对分类影响较小的数据;然后针对这两类特征构建不同分类器;最后采用49个家族的1100个恶意程序和1000个正常程序进行实验检测.结果显示,此方法在时间执行效率和检测率上比其他相关工作表现更优.Nowadays ,there are so many malicious programs. Each of detection technology generate a lot of behavioral information. Inrecent years, scholars began to use data mining technology to detect malicious programs. But there are some deficiencies, such as：Forone thing,the classifier needs to deal with a wide variety of data and For another thing,the same algorithm could riot give full use todetect the different characteristics of malicious applications. According to the above limitations, this paper proposed hybrid algorithmbased on multi features. Firstly ,it uses the dynamic-static combination technology to collect the function call and system call feature.Then it uses the chi square statistical to process the huge characteristic data. Finally,it uses 49 families of 1100 malicious programs and1000 normal procedures for the experimental detection. The results show that the performance of the method is better than other relatedwork at the time of execution efficiency and detection rate.

关 键 词：动态分析 静态分析 Android恶意程序 数据挖掘 卡方统计 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]