一种基于系统行为序列特征的Android恶意代码检测方法
CSTR:
作者:
作者单位:

作者简介:

通讯作者:

中图分类号:

TP309

基金项目:

重庆市技术创新与应用发展专项(CSTC2019jscx-msxm0341)。


An android malware detection method based on system behavior sequences
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    基于行为特征建立机器学习模型是目前Android恶意代码检测的主要方法,但这类方法的特征集中各行为特征相互独立,而行为特征间的顺序关系是反映恶意行为的重要因素。为了进一步提高检测准确率,提出了一种基于系统行为序列特征的Android恶意代码检测方法。该方法提取了程序运行发生的敏感API调用、文件访问、数据传输等系统活动的行为序列,基于马尔科夫链模型将系统行为序列转换为状态转移序列并生成了状态转移概率矩阵,将状态转移概率矩阵和状态发生频率作为特征集对SAEs模型进行了学习和训练,最后利用训练后的SAEs实现了对Android恶意代码的检测。实验结果证明,提出的方法在准确率、精度、召回率等指标上优于典型的恶意代码检测方法。

    Abstract:

    At present, behavior features of machine learning based Android malicious code detecting approaches are independent from each other, whereas the sequential relationships between behavior features could indicate malicious behavior. In order to furtherly improve the detection accuracy, an Android malicious code detection method based on the features of system behavior sequence was proposed. Firstly, the sequences of system activities including sensitive API calls, file access, data transmission, etc. were extracted. Next, based on Markov chain model the system behavior sequences were transformed into state transition sequence, and state transition probability matrix were created. Then, the state transition probability matrix and the state occurrence frequency were used as feature sets to train the SAEs model. Finally, we examined the performance of the trained SAEs model on a dataset. The experimental results show that the proposed method performed better than the typical malicious code detection method on accuracy, precision and recall.

    参考文献
    相似文献
    引证文献
引用本文

杨吉云,陈钢,鄢然,吕建斌.一种基于系统行为序列特征的Android恶意代码检测方法[J].重庆大学学报,2020,43(9):54-63.

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:
  • 最后修改日期:
  • 录用日期:
  • 在线发布日期: 2020-09-29
  • 出版日期:
文章二维码