Android malicious software sorting method based on dynamic behavior dependency graph

Abstract

The invention relates to an Android malicious software sorting method based on a dynamic behavior dependency graph. The sorting method includes the steps that an APP is run through a user-defined Dalvik virtual machine, and dynamic behavior information such as framework layer interface calling behaviors and dependency among the behaviors is extracted; the corresponding dynamic behavior dependency graph is constructed according to the dynamic behavior information; the dynamic behavior dependency graph is optimized and divided into subgraphs; similar subgraph structures are extracted from a set composed of Android malicious software of different types and are used as essential characteristics; according to the essential characteristics, model training is conducted on a training set composed of known malicious software and normal software to obtain a classifier; unknown APPs are classified and judged through the classifier; the method is verified and assessed. Similarity of the behavior subgraphs is measured with the graph editing distance, basic characteristics are found on the basis, and the sorting method has good flexibility and expandability.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method for classifying Android malicious software based on a dynamic behavior dependency graph. Background technique [0002] With the popularity of the Android system, more and more application software is downloaded and installed by users. According to official data from Google, more than 1.5 billion apps are downloaded from the Google Play application market every month. Driven by this huge benefit, attackers have developed a large number of Android malware and uploaded them to the Internet or third-party application markets for damage or profit. As McAfee Labs reported, they detected 1.1 million mobile malware in the first quarter of 2015. These malware seriously threaten the security of the Android system platform. [0003] In order to protect the security of the Android system and resist malicious software attacks, researchers have proposed a serie...

AI Technical Summary

Problems solved by technology

Or simply conduct a simple malicious assessment based on the key interface call behavior, such as distinguishing malicious or normal software, which cannot effectively determine the specific type of malware

In addition, dynamic analysis methods are also used to extract malware thread-level API behavior sequences for analysis, but this method will be attacked by techniques such as dividing thread behavior or recording independent APIs

Images