Static characteristic extraction and selection based detection method for Android malicious application

Abstract

The present invention discloses a static characteristic extraction and selection based detection method for an Android malicious application. The method, based on the occurrence frequency of an attribute, selects extracted static attributes, thereby increasing the accuracy rate and recall rate of detection, and at the same time, lowering the error judgment rate and the time overhead. Compared with an existing detection method for an Android malicious application, the method disclosed by the present invention has the characteristics that the accuracy rate is increased by 21.4%, the recall rate is increased by 34.7%, and the error judgment rate is reduced by 22.6%.

Description

technical field [0001] The invention relates to electronic computer network technology, in particular to a method for detecting Android malicious applications based on static feature extraction and selection. Background technique [0002] The Android malicious application detection system is an important means of Android platform defense, that is, by extracting and selecting static features of Android applications (such as requested permissions, API calls, etc.), and using classification algorithms in machine learning to detect Android applications Android malicious apps that exist in the market. [0003] With the increasing popularity of Android devices and applications, more and more user privacy data, such as account information, mobile phone numbers, and short messages, are stored on Android devices. Android malicious applications target the platform and create a large number of Android malicious applications, seriously endangering the security of Android users. The me...

AI Technical Summary

Problems solved by technology

From their experimental results, it can be seen that the accuracy of classifying whether an application is malicious or not based on permissions alone is not high, and related literature has also confirmed that some APIs marked as source are not protected by permissions, which means that not only permission-based The security mechanism is not reliable, and the accuracy of the permission-based malicious application detection technology cannot be guaranteed. Therefore, if you want to use data mining to detect malicious applications, how to select the characteristics of the application will be an important factor affecting the accuracy of the results. and there is also a lack of tools that are practical on the user end

Images