The invention belongs to the technical field of
network security, and particularly relates to an Android malicious
software detection method and device based on a
capsule network, and the method comprises the steps: collecting an Android
software file sample, decompressing a to-be-processed file, converting the to-be-processed file into an RGB three-channel
color image, and enabling the RGB three-channel
color image to serve as training sample data; constructing a
capsule network, and training the
capsule network by using the sample data to obtain a trained
network model containing a graph structure and network parameters, the capsule network realizing transmission between feature vectors in a capsule layer through an iterative dynamic
routing algorithm; and inputting the to-be-detected target file into the trained capsule
network model for testing, and judging whether the to-be-detected target file is a malicious
software file or not through an output result. The method and device canefficiently run on the Android operation platform, occupy few resources, are high in efficiency and accuracy, can realize high-accuracy classification detection tasks even under the condition of small-scale training samples, and achieve the purpose of protecting the Android intelligent mobile terminal.