基于随机森林的抗混淆Android恶意应用检测  

Anti-Obfuscated Android Malware Detection Based on Random Forest

作　　者：王柯林 杨珂 赵瑞哲 辛丽玲 汪秋云 Wang Kelin;Yang Ke;Zhao Ruizhe;Xin Liling;Wang Qiuyun(University of Chinese Academy of Sciences,Beijing 101400;Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093;State Grid Electronic Commerce Co.,Ltd.(State Grid Xiong’an Financial Technology Group Co.,Ltd.),Beijing 100053;Blockchain Technology Laboratory of State Grid Corporation of China,Beijing 100053)

机构地区：[1]中国科学院大学,北京101400 [2]中国科学院信息工程研究所,北京100093 [3]国网电子商务有限公司(国网雄安金融科技集团有限公司),北京100053 [4]国家电网有限公司区块链技术实验室,北京100053

出　　处：《信息安全研究》2021年第2期126-135,共10页Journal of Information Security Research

基　　金：国家电网科技项目(SGTYHT/19-JS-217)。

摘　　要：Android恶意应用的迅速增长引发了极大的安全隐患,很多行为特征容易受到代码混淆技术的影响,导致恶意行为无法被有效检测.提出了一种基于随机森林的Android恶意应用检测模型.模型选用危险权限、敏感API调用、Service、Activity、Intent、短信发送频率等特征,其中危险权限和Service等Android组件在代码混淆过程中不受影响,采用随机森林、决策树、SVM和卷积神经网络等机器学习方法,利用10折交叉验证的方法训练.通过实验证明,对于未混淆的数据集,该方法能达到分类准确率95.77%的效果;对于混淆之后的数据集可达到分类准确率91.01%的效果.The rapid growth of Android malware has caused significant security risks.Many behavioral characteristics are easily affected by code obfuscation techniques,resulting in malicious behaviors that cannot be effectively detected.This paper proposes an Android malware detection model based on Random Forest.The model uses dangerous permissions,sensitive API calls,Service,Activity,Intent,and SMS sending frequency as features,among which dangerous permissions and Android components such as service are not affected during the code obfuscation process.Machine learning methods such as Random Forest,Decision Tree,SVM,and 1-NN are used.The model is trained by the ten-fold cross-validation method.Experiments have shown that this method can achieve a classification accuracy of 95.77%for the normal data sets;for the obfuscated data sets,it can achieve a classification accuracy of 91.01%.

关 键 词：ANDROID应用 动静态分析 特征选择 随机森林 敏感API调用 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]