基于混合特征和深度学习的安卓恶意软件动态检测研究  

Research on dynamic detection of Android malware based on mixed features and deep learning

作　　者：田娟[1] 徐钊 TIAN Juan;XU Zhao(Karamay Vacation&Technical College,Xinjiang 834000,China)

机构地区：[1]新疆维吾尔自治区克拉玛依职业技术学院,新疆维吾尔自治区834000

出　　处：《自动化与仪器仪表》2024年第6期257-260,共4页Automation & Instrumentation

摘　　要：为避免用于隐私泄露,设计基于混合特征和深度学习的安卓恶意软件动态检测方法,实现安卓恶意软件动态检测的高效性以及准确性。通过反探测方案防止恶意安卓软件检测模拟环境进程,并在模拟器中运行待测安卓软件,采集安卓软件动态运行数据,通过解压与反编译处理完成安卓软件运行数据文件预处理,从预处理后的安卓软件文件中提取以函数调用图特征、字节概率特征以及APK权限特征组成的安卓恶意软件混合特征,将获取的安卓恶意软件混合特征作为改进自编码网络的输入数据,输出安卓软件是正常或恶意软件的动态检测结果。实验表明:该方法可实现安卓恶意软件动态检测,并获取恶意软件类型,且动态检测时间短,具有较好的安卓恶意软件动态检测评价指标数值。To avoid privacy breaches,a dynamic detection method for Android malware based on mixed features and deep learning is studied to achieve the efficiency and accuracy of Android malware dynamic detection.Prevent malicious Android software from detecting simulated environment processes through anti detection schemes,and run the tested Android software in the simulator.Collect dynamic running data of the Android software,and preprocess the Android software running data file through decompression and decompilation.Extract Android malware mixed features composed of function call graph features,byte probability features,and APK permission features from the preprocessed Android software file,Use the obtained mixed features of Android malware as input data for improving the self coding network,and output the dynamic detection results of whether the Android software is normal or malicious.The experiment shows that this method can achieve dynamic detection of Android malware and obtain the type of malware,with a short dynamic detection time and good evaluation index values for Android malware dynamic detection.

关 键 词：混合特征 深度学习 安卓恶意软件 动态检测 函数调用图 自编码网络 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]