基于合成图像和Xception改进模型的安卓恶意家族分类方法  

Android Malware Family Classification Method Based on Synthetic Image and Xception Improved Model

作　　者：于兴崭 芦天亮[1] 杜彦辉[1] 王曦锐 杨成 YU Xingzhan;LU Tianliang;DU Yanhui;WANG Xirui;YANG Cheng(Collage of Information and Cyber Security,People’s Public Security University of China,Beijing 100038,China)

机构地区：[1]中国人民公安大学信息网络安全学院,北京100038

出　　处：《计算机科学》2023年第4期351-358,共8页Computer Science

基　　金：国家社会科学基金重点项目(20AZD114);中国人民公安大学基本科研业务费重大项目(2020JKF101)。

摘　　要：针对安卓恶意家族检测领域存在的代码可视化方法构造的信息不充分、分类效果受数据集数量影响大、分类准确率低等问题,提出了一种基于多特征文件合成图像和Xception改进模型的安卓恶意家族分类方法。首先,选用3个特征文件对应RGB多通道合成彩色图像;然后,改进Xception模型引入focal loss函数,缓解由样本不均衡分布带来的负面影响;最后,将注意力机制融合至改进模型,从不同维度提取恶意代码图像特征,提升了模型的分类效果。实验结果表明,所提方法合成的恶意代码图像包含的特征更丰富,相比主流的恶意家族分类方法准确率更高,且对于数量分布不平衡的数据集具备更好的分类效果。Aiming at the problems in the field of Android malicious family detection,such as insufficient code visualization method construction information,large classification effect affected by the number of data sets and low classification accuracy,an Android malicious family classification method based on multi feature file synthetic image and Xception improved model is proposed.Fir-stly,three feature files corresponding to RGB multi-channel are selected to synthesize color images.Then,the improved Xception model introduces the focal loss function to alleviate the negative impact caused by the uneven distribution of samples.Finally,the attention mechanism is integrated into the improved model to extract the image features of malicious code from different dimensions,which improves the classification effect of the model.Experimental results show that the malicious code images synthesized by the proposed method contain richer features,have higher accuracy than the mainstream malicious family classification methods,and have better classification effect for unbalanced data sets.

关 键 词：恶意软件可视化 安卓恶意家族分类 注意力机制 FOCAL LOSS Xception 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]