Method and device for Android malicious software classification based on Naive Bayes

Abstract

The invention discloses a method and a device for Android malicious software classification based on Naive Bayes, wherein the method is used for extracting authority attribute characteristics and sensitive API (Application Programming Interface) attribute characteristics of malicious software mainly through a dynamic and static combination method, and performing classification through a Naive Bayes algorithm; and the device comprises a characteristic attribute set module, an authority characteristic attribute module, a sensitive API characteristic attribute module, a Naive Bayes classification model module, an output module and an updating module. The algorithm has firm mathematical foundation and steady classification efficiency, and needs relatively less parameters; the algorithm is simple; and malicious applications can be classified quickly and accurately, and thus, classification efficiency is improved.

Description

technical field [0001] The invention relates to the field of software security, in particular to a naive Bayesian-based Android malware classification method and device. Background technique [0002] Since Android came out in 2007, Google has positioned it as an open-source mobile operating system, adopting a software stack architecture. The bottom layer is based on the Linux kernel, the middle layer includes software libraries and Dalivk virtual machines, and the top layer is various applications. . With the rapid development of Android, the number of mobile terminals, software developers, and applications based on the Android platform is increasing day by day to become the dominant position in the smartphone market. The target of new malicious software and variant Trojan horses are growing explosively every quarter, and there are more and more attacks and threats on mobile terminals, and the leakage of private information. [0003] At present, the focus of Android platfo...

AI Technical Summary

Problems solved by technology

Support vector machine (SupportVectorMachine, SVM) can solve high-dimensional problems and nonlinear problems well, but it is highly sensitive to missing data; K-nearest neighbor (KNN) algorithm is simple and effective, but the amount of calculation is large, When the sample is unbalanced, the error rate is high; the artificial neural network algorithm has high classification accuracy, but requires a large number of parameter support

Images