一种基于改进的关联规则挖掘算法的Android恶意软件检测方法  

One of Android Malware Detection Method Based on Improved Permission Association Rules Mining Algorithm

作　　者：严喆 朱保平[1] YAN Zhe;ZHU Baoping(School of Computer Science and Engineering,Nanjing University of Science and Technology,Nanjing 210094)

机构地区：[1]南京理工大学计算机科学与工程学院,南京210094

出　　处：《计算机与数字工程》2018年第6期1167-1172,共6页Computer & Digital Engineering

摘　　要：针对Android平台恶意软件的检测需求的上升和现有的关联规则挖掘算法的效率较低,不能直接用于恶意软件的检测的问题,论文在改进的关联规则挖掘算法(Eclat)的基础之上,设计了一种挖掘权限之间关联性的算法(AEclat),该算法在49个恶意软件家族之上进行权限频繁模式挖掘,通过得到极大频繁项集,进一步构造权限关系特征库,依此来对恶意软件进行检测。实验分析表明论文提出的方法对恶意软件有较高的识别率和较小的误报率,可以有效增强Android系统的安全性。mTo solve the problem of rising demand for malware detection on Android platforms and the existing association rulemining algorithms are inefficient and they cannot be used directly in the detection of malicious software,an algorithm AEclat is de-signed to dig out permissions association rules which are based on a improved permission association rules data mining algorithmEclat in our paper. This algorithm is used to test 49 malicious application families,then though the maximal frequent item set whichthe permissions association dataset is built to detect malware. The experimental results show that the proposed method has a high rec-ognition rate and a low false alarm rate on malware detection,it can effectively enhance the security of Android system.

关 键 词：ANDROID 关联规则 恶意软件检测 数据挖掘 权限组合 

分 类 号：TP319[自动化与计算机技术—计算机软件与理论]