结合资源特征的Android恶意应用检测方法  

Detection of Android malware using resource features

作　　者：刘楚舒 王伟平[1] 刘鹏飞[1] LIU Chushu;WANG Weiping;LIU Pengfei(School of Information Science and Engineering,Central South University,Changsha 410083,China)

机构地区：[1]中南大学信息科学与工程学院,长沙410083

出　　处：《计算机工程与应用》2018年第15期67-73,共7页Computer Engineering and Applications

基　　金：国家自然科学基金(No.61672543);长沙市移动互联网产业项目(2015年)

摘　　要：近年来Android平台遭到了黑客们的频繁攻击。随着安卓恶意应用的增多,信息泄露以及财产损失等问题也愈发严重。首先测试了恶意应用与正常应用在图片和界面元素两类资源特征上的差异,提出了一种结合资源特征的Android恶意应用检测方法——Mal Assassin。该方法对APK进行静态分析,提取应用的8类共68个特征,包括综合了其他研究所提取的权限、组件、API、命令、硬编码IP地址、签名证书特征,并且结合了所发现的图片与界面元素两类资源特征。这些特征被映射到向量空间,训练成检测模型,并对应用的恶意性进行判定。通过对53 422个正常应用以及5 671个恶意应用的测试,Mal Assassin达到了99.1%的精确度以及召回率。同时,资源特征的引入使得Mal Assassin在不同数据集上具有较好的适应性。Android platform incurs mass attacks from hackers recently.The rapid increment of Android malwares results in the problems of privacy leakage and property loss.This paper firstly tests the difference between benign apps and malwares in two resource features,these features are pictures and widgets.Then MalAssassin,a method for detection of Android malware is proposed.It performs static analysis on Android APK files,gathering 68 features in 8 different categories which are permissions,components,API calls,commands,hard-coded IP address and certificates extracted from other approaches along with pictures and widgets proposed by this paper.These features are mapped to vector spaces to build the detection model which will classify an app as benign or malicious.In an evaluation with 53,422 benign apps and 5,671 malwares,MalAssassin achieves the performance of 99.1%precision and recall,while adapting well in different datasets.

关 键 词：安卓 恶意应用检测 机器学习 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]