基于textCNN模型的Android恶意程序检测  

Android Malware Detection Based on textCNN Model

作　　者：张雄冠 邵培南[1] ZHANG Xiong-Guan;SHAO Pei-Nan(The 32nd Research Institute of China Electronics Technology Group Corporation,Shanghai 201808,China)

机构地区：[1]中国电子科技集团公司第三十二研究所,上海201808

出　　处：《计算机系统应用》2021年第1期114-121,共8页Computer Systems & Applications

摘　　要：针对当前Android恶意程序检测方法对未知应用程序检测能力不足的问题,提出了一种基于textCNN神经网络模型的Android恶意程序检测方法.该方法使用多种触发机制从不同层面上诱导激发程序潜在的恶意行为;针对不同层面上的函数调用,采用特定的hook技术对程序行为进行采集;针对采集到的行为日志,使用fastText算法来提取词向量;最后使用textCNN模型根据行为日志对Android程序进行检测与识别.实验结果表明,该方法对Android恶意程序检测的平均准确率达到了93.3%,验证了该方法对Android恶意程序检测具有较高的有效性与正确性.Aiming at the problem that the current Android malware detection method has insufficient ability to detect unknown applications,this study proposes an Android malware detection method based on the textCNN neural network model.This method uses a variety of trigger mechanisms to induce the potential malicious behavior of the application from different levels.For function calls at different levels,the specific hook technology is used to collect the application behavior.For the collected behavior logs,the fastText algorithm is used to extract word vectors.Finally,the textCNN model is used to detect and identify Android applications based on behavior logs.Experimental results show that the average accuracy of the method for detecting Android malicious applications reaches 93.3%,which verifies that the method has high effectiveness and correctness for detecting Android malwares.

关 键 词：ANDROID系统 恶意程序检测 行为触发 HOOK技术 fastText模型 textCNN模型 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP311.5[自动化与计算机技术—计算机科学与技术] TP183