Dalvik instruction abstraction-based Android malicious code detection method

Abstract

The invention discloses a Dalvik instruction abstraction-based Android malicious code detection method. The method comprises the following steps of 1) detecting a malicious code and training a classification model: extracting a Dalvik operation code from a smali file, performing abstraction simplification to obtain an instruction symbol, performing statistics and normalization processing on N-Gram sequence characteristics of the abstract Dalvik instruction symbol, and finally establishing a malicious code detection model and a malicious family classification model by adopting a machine learning-based classification algorithm; and 2) preprocessing a to-be-detected APK file firstly, extracting Dalvik instruction characteristics, performing abstraction simplification and N-Gram serialization processing, and preliminarily judging whether the code is a malicious code or not through detection of the malicious code detection model; and if not, directly giving a detection result, or if yes, obtaining a malicious code family type further through the malicious family classification model. The method is high in speed and relatively high in validity.

Description

technical field [0001] The invention relates to the technical field of malicious code detection, in particular to a method for detecting Android malicious codes. Background technique [0002] With the development of the mobile Internet, mobile smart terminals are becoming more and more popular, and the types and quantities of mobile applications are showing rapid growth. Smartphones have become the most commonly used tools for Internet users. Statistics from Gartner show that in the fourth quarter of 2015, the global sales volume of smartphones was more than 400 million units, of which the Android system accounted for 80.7%. As of February 1, 2016, the number of applications on Google Play, the official Android application market, is close to 2 million. At the same time, the types and numbers of mobile malicious applications are also showing rapid growth. According to the 2015 Mobile Security Virus Annual Report released by Aliju Security, 18% of Android devices have been i...

AI Technical Summary

Problems solved by technology

[0006] In order to overcome the shortcomings of poor rapidity and low effectiveness of existing Android malicious code detection methods, the present invention provides a fast and effective Android malicious code detection method based on Dalvik instruction abstraction

Images