基于图核的Android恶意软件检测方法  

Android Malware Detection Method Based on Graph Kernel

作　　者：陈方业 CHEN Fang-ye(School of Computers,Guangdong University of Technology,Guangzhou 510006)

机构地区：[1]广东工业大学计算机学院

出　　处：《现代计算机》2019年第14期73-78,共6页Modern Computer

摘　　要：Android恶意软件的爆发式增长已经给用户的生活和工作带来极大的危害。提出一种基于Weisfeiler-Lehman(WL)图核的Android恶意软件检测方法,将恶意软件检测问题转换成函数调用图的相似度分析问题,引入函数调用过程的API激活事件来增强函数调用图的节点标签,通过图核算法计算函数调用图的相似度来检测Android恶意软件。实验结果表明,使用API激活事件增强的WL图核方法在精确率和召回率上高于CWLK、NHGK与WLK三个图核方法和Drebin、Androguard两个检测方法。The explosive growth of Android malware has caused great harm to users'lives and work.Proposes an Android malware detection method based on Weisfeiler-Lehman(WL)graph kernel,which converts malware detection problem into similarity analysis problem of function call graph,and introduces API activation event of function call procedure to enhance the node label of function call graph.Uses graph ker.nel to calculate the similarity of the function call graph and then detect the Android malware.The experimental results show that the WL kernel method using API activation event is higher than the three nuclear methods of CWLK,NHGK and WLK and the two detection meth.ods of Drebin and Androguard in accuracy and recall rate.

关 键 词：恶意软件 图核 函数调用图 激活事件 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]