基于结构相似度的Andriod恶意外挂软件检测算法  

Andriod External Malware Detection Method Based on Structure Similarity

作　　者：李蓉 周维柏 LI Rong;ZHOU Wei-bai(School of Information Technology and Engineering,Guangzhou College of Commerce,Guangzhou 510280,China)

机构地区：[1]广州商学院信息技术与工程学院

出　　处：《安徽师范大学学报（自然科学版）》2019年第6期527-532,共6页Journal of Anhui Normal University(Natural Science)

基　　金：2018广东省普通高校特色创新项目(自然科学)

摘　　要：针对目前Android外挂恶意软件检测率低的问题,本文提出一种基于结构相似度的Android恶意软件检测算法。算法首先使用逆向工程将App还原成源码,再利用源码里的class、method、API和系统命令行构建结构图,利用互信息MI选出恶意APP常用的API,再化简结构图,最后通过比对结构图包含敏感API的部分来判断是否为恶意软件。算法通过静态分析降低资源消耗、结构对比增加检测效率,从而达到提高外挂恶意软件检测率的目的。实验表明本算法可行可靠。To improve the low detection rate of Android external malware,an Android malware detection algorithm based on structural similarity is presented in this paper. It is firstly developed to use reverse engineering technology to restore APP to source code;then reuse the class, method, API and system command line in the source code to build structure diagram;do with MI to select common API of malicious apps;next simplify the structure diagram;finally determine whether it is a malware through a method, which contrasts the sensitive API parts within the structure diagram. The algorithm reduces the resource consumption through static analysis, increases detection efficiency through structure contrast, so as to improve the detection rate of plug-in malware. Experiment shows that the algorithm is feasible and reliable.

关 键 词：ANDROID API 恶意软件 结构相似度 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]