一种基于异质模型融合的Android终端恶意软件检测方法  

Android Malware Detection Method Based on Heterogeneous Model Fusion

作　　者：姚烨[1] 朱怡安[1] 钱亮 贾耀 张黎翔 刘瑞亮 YAO Ye;ZHU Yi-an;QIAN Liang;JIA Yao;ZHANG Li-xiang;LIU Rui-liang(School of Computer Science,Northwestern Polytechnical University,Xi'an 710129,China)

机构地区：[1]西北工业大学计算机学院,西安710129

出　　处：《计算机科学》2022年第S01期508-515,共8页Computer Science

基　　金：国家重点研发计划(2020YFB1712200);陕西省重点研发(重点产业链)项目(2019ZDLGY12-07);西安市科技计划项目(GXYD192.1);太仓市大院大所创新项目(TC2019DYDS06);东莞市科技装备动员项目(KZ2018-14)。

摘　　要：针对单一分类模型检测精度有限的问题,提出了一种基于异质模型融合的Android恶意软件检测方法。首先识别和采集恶意软件混合特征信息,采用基于CART决策树的随机森林算法和基于MLP的Adaboost算法分别构造集成学习模型,然后通过Blending算法对这两个分类器进行模型融合,最后得到一种异质模型融合分类器,在此基础上实施移动终端恶意软件检测。实验结果表明所提方法能够有效克服单一分类模型检测精度不足的问题。Aiming at the problem of limited detection accuracy of a single classification model,this paper proposes an Android malware detection method based on heterogeneous model fusion.Firstly,by identifying and collecting the mixed feature information of malicious software,the random forest algorithm based on CART decision tree and the Adaboost algorithm based on MLP are used to construct the integrated learning model respectively,and then the two classifiers are fused by Blending algorithm.Finally,a heterogeneous model fusion classifier is obtained.On this basis,the mobile terminal malware detection is implemented.Experimental results show that the proposed method can effectively overcome the problem of insufficient accuracy of single classification model.

关 键 词：ANDROID系统 恶意软件 模型融合 机器学习 移动终端 

分 类 号：TP391.9[自动化与计算机技术—计算机应用技术]