基于行为特征和语义特征的多模态Android恶意软件检测方法  

Multimodal Android Malware Detection Method Based on Behavioral and Semantic Characteristics

作　　者：朱晋恺 方兰婷 季小文 黄杰 ZHU Jinkai;FANG Lanting;JI Xiaowen;HUANG Jie(School of Cyber Science and Engineering,Southeast University,Nanjing 211189,China;Zijinshan Laboratory,Nanjing 211189,China;Mobile Information Communication and Security Frontier Science Center,Nanjing 211189,China)

机构地区：[1]东南大学网络空间安全学院,江苏南京211189 [2]紫金山实验室,江苏南京211189 [3]移动信息通信与安全前沿科学中心,江苏南京211189

出　　处：《电子科技》2024年第5期71-78,共8页Electronic Science and Technology

基　　金：国家自然科学基金(61906039);至善青年学者计划;中央高校基本科研专项资金(2242022k30007)。

摘　　要：现有的Android恶意软件检测方法只考虑单一种类的特征,并不能全面描述Android软件的特征。为解决此类问题,文中从权限、字节码概率矩阵和函数调用图3种类型特征出发,提出了一种基于行为特征和语义特征的多模态Android恶意软件检测方法。同时,为了解决函数节点特征表示问题,文中针对函数调用图的生成过程提出了一种新的节点特征生成方法。为了丰富操作码语义信息,提出了一种基于2-gram的字节概率矩阵生成方法。通过实验证明了文中方法相较于其他方法可更加全面地描述Android软件的特征,检测准确率达到95.2%,相较于已有方法准确率平均提升了22%,有效提高了Android恶意软件的检测能力。Existing methods for detecting Android malware only consider a single kind of features,which do not fully describe the features of Android software.In order to solve the above problems,this study presents a multimodal Android malware detection method based on the permissions,byte code probability matrix and function call graph.At the same time,in order to solve the problem of feature representation of function nodes,a new node feature generation method is presented in this study in the generation of function call graph.In order to enrich the semantic information of opcode,a byte probability matrix generation method based on 2-gram is presented.The experiment proves that the method described the characteristics of Android software more comprehensively than other methods,and the detection accuracy rate reached 95.2%.Compared with the existing methods,the accuracy of this method has been improved by 22%on average,effectively improving the detection ability of Android malware.

关 键 词：ANDROID 特征融合 权限 字节概率矩阵 函数调用图 卷积神经网络 恶意软件检测 多模态 

分 类 号：TP183[自动化与计算机技术—控制理论与控制工程]