基于集成学习投票算法的Android恶意应用检测  

Android Malware Detection Based on Ensemble Learning Voting Algorithm

作　　者：赵宇鑫 努尔布力[2] 艾壮 ZHAO Yuxin;Nurbol;AI Zhuang(College of Software,Xinjiang University,Urumqi 830046,China;Network Centre,Xinjiang University,Urumqi 830046,China;College of Information Science and Engineering,Xinjiang University,Urumqi 830046,China)

机构地区：[1]新疆大学软件学院,乌鲁木齐830046 [2]新疆大学网络中心,乌鲁木齐830046 [3]新疆大学信息科学与工程学院,乌鲁木齐830046

出　　处：《计算机工程与应用》2020年第22期74-82,共9页Computer Engineering and Applications

基　　金：国家自然科学基金重点项目(重大联合)(No.61433012);自治区创新环境(人才、基地)建设专项(No.PT1811)。

摘　　要：针对Android平台恶意应用的检测技术,提出一种基于集成学习投票算法的Android恶意程序检测方法MASV(Soft-Voting Algorithm),以有效地对未知应用程序进行分类。从已知开源的数据集中获取了实验的基础数据,使用的应用程序集包含213256个良性应用程序以及18363个恶意应用程序。使用SVM-RFE特征选择算法对特征进行降维。使用多个分类器的集合,即SVM(Support Vector Machine)、K-NN(K-Nearest Neighbor)、NB(Naïve Bayes)、CART(Classification and Regression Tree)和RF(Random Forest),以检测恶意应用程序和良性应用程序。使用梯度上升算法确定集成学习软投票的基分类器权重参数。实验结果表明,该方法在恶意应用程序检测中达到了99.27%的准确率。Aiming at the detection technology of malicious application on Android platform,an Android malicious program detection method MASV(Soft-Voting Algorithm)based on ensemble learning voting algorithm is proposed to effectively classify unknown applications.The underlying data for the experiment are obtained from a known open source dataset by using an application set of 213256 benign applications and 18363 malicious applications.First,the dimensionality of features is reduced by using the SVM-RFE feature selection algorithm.Then,a collection of multiple classifiers is used to detect malicious applications and benign applications,the classifiers include SVM(Support Vector Machine),K-NN(K-Nearest Neighbor),NB(Naïve Bayes),CART(Classification and Regression Tree)and RF(Random Forest).At the same time,the gradient ascent algorithm is used to determine the base classifier weight parameter of the ensemble learning soft vote.The experimental results show that the method achieves an accuracy of 99.27%in malicious application detection.

关 键 词：Android恶意应用 集成学习 投票算法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP316[自动化与计算机技术—计算机科学与技术]