基于CBAM-CGRU-SVM的Android恶意软件检测方法  

CBAM-CGRU-SVM based malware detection method for Android

作　　者：孙敏[1] 成倩 丁希宁 SUN Min;CHENG Qian;DING Xining(College of Computer and Information Technology,Shanxi University,Taiyuan Shanxi 030006,China)

机构地区：[1]山西大学计算机与信息技术学院,太原030006

出　　处：《计算机应用》2024年第5期1539-1545,共7页journal of Computer Applications

基　　金：山西省基础研究计划项目(20210302123455)。

摘　　要：随着Android恶意软件的种类和数量不断增多,检测恶意软件以保护系统安全和用户隐私变得越来越重要。针对传统的恶意软件检测模型分类准确率较低的问题,提出一种基于卷积神经网络(CNN)、门控循环单元(GRU)和支持向量机(SVM)的模型CBAM-CGRU-SVM。首先,在CNN中添加卷积块注意力模块(CBAM)以学习更多恶意软件的关键特征;其次,利用GRU进一步提取特征;最后,为了解决图像分类时模型泛化能力不足的问题,使用SVM代替softmax激活函数作为模型的分类函数。实验使用了Malimg公开数据集,该数据集将恶意软件数据图像化作为模型输入。实验结果表明,CBAM-CGRU-SVM模型分类准确率达到94.73%,能够更有效地对恶意软件家族进行分类。With the increasing variety and quantity of Android malware,it becomes increasingly important to detect malware to protect system security and user privacy.To address the problem of low classification accuracy of traditional malware detection models,A malware detection model for Android named CBAM-CGRU-SVM was proposed based on Convolutional Neural Network(CNN),Gated Recurrent Unit(GRU),and Support Vector Machine(SVM).In this model,more key features of malware were learned by adding a Convolutional Block Attention Module(CBAM)to the convolutional neural network,and GRUs were employed to further extract features.In order to solve the problem of insufficient generalization ability of the model when performing image classification,SVM was used instead of softmax activation function as the classification function of the model.Experiments were conducted on Malimg public dataset,in which the malware data was transformed to images as model input.Experimental results show that the classification accuracy of CBAM-CGRU-SVM model reaches 94.73%,which can effectively classify malware families.

关 键 词：恶意软件 卷积神经网络 卷积块注意力模块 门控循环单元 支持向量机 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]