基于组合特征的安卓恶意软件静态检测方法研究  

Research on Static Detection Method of Android Malware Based on Combinatorial Features

作　　者：姚斌荣 张娜[1] YAO Binrong;ZHANG Na(School of Computer Science and Technology,Zhejiang Sci-Tech University,Hangzhou 310018,China)

机构地区：[1]浙江理工大学计算机科学与技术学院,浙江杭州310018

出　　处：《软件导刊》2024年第2期129-134,共6页Software Guide

基　　金：浙江省重点研发计划项目(2020C03094);浙江省教育厅一般科研项目(Y202147659);浙江省教育厅项目(Y202250706);浙江省基础公益研究计划项目(QY19E050003)。

摘　　要：针对目前Android恶意软件的静态检测方法在特征选取上类型单一、同类型数量较多以及得到的检测模型效率不高等问题,提出一种基于组合特征的安卓恶意软件静态检测方法,组合特征集包含权限、组件和预见性3个方面。首先,不同方面的特征通过实验和推理方式选取并保留各自具有代表性的特征为最终特征集;其次,根据特征属性的信息增益优化决策树节点分类规则,构建检测模型;最后,采用十倍交叉验证法进行实验。实验结果表明,改进后的决策树算法模型检测准确率和检测效率均有较大提升,且在相同实验环境下检测结果优于目前流行的随机森林算法、支持向量机算法和朴素贝叶斯算法。Aiming at the problems that the current static detection methods of Android malware have a single type in feature selection,a large number of the same types and low efficiency of the detection model,this paper proposes a static detection method of Android malware based on combined features.The combined feature set consists of three aspects:permission,component and predictability.First,the features of differ⁃ent aspects are selected and retained as the final feature set by means of experiment and reasoning.Secondly,the classification rules of deci⁃sion tree nodes are optimized according to the information gain of feature attributes,and the detection model is constructed.The experimental results show that the detection accuracy and efficiency of the improved decision tree algorithm model are greatly improved,and the detection results are better than those of the popular random forest algorithm,support vector machine algorithm and naive Bayes algorithm under the same experimental environment.

关 键 词：恶意软件检测 组合特征 静态分析 特征集 决策树算法 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]