Android malicious code family classifying method based on bytecode image clustering

Abstract

An Android malicious code family classifying method based on bytecode image clustering includes the following steps of firstly, mapping an APK program code into a grayscale image; secondly, extracting characteristics through a GIST algorithm, wherein a pixel point matrix with the same height and width is calculated according to the total number of pixel points of an original image, the matrix still stores pixel points of the original image, a square image can be generated through the matrix, wavelet filtering in eight directions and four dimensions is conducted on each sub-region to extract texture characteristic information of the images, a 512 dimension characteristic vector is obtained finally for each image, and dimension reducing and data visualizing are conducted on obtained high-dimension data; thirdly, classifying the characteristics through a random forest algorithm, and completing Android malicious code family classifying by completing the clustering of the grayscale image. The method is high in accurate measurement precision and low in false alarm rate.

Description

technical field [0001] The invention relates to the technical field of malicious code analysis, in particular to a method for classifying Android malicious code families. Background technique [0002] With the vigorous development of the mobile Internet, the types and quantities of mobile applications have shown rapid growth, and at the same time, the scale of malicious code in mobile applications has also shown exponential growth. Alibaba Security’s 2015 Mobile Security Virus Annual Report pointed out that about 1 out of 5.6 devices on the Android platform was infected with a virus, and the device infection rate was as high as 18%, and about 95% of the applications contained virus counterfeiting. [0003] Although the number of malicious codes is increasing every year, most of the new variants are obtained through some transformation operations on the basis of the original malicious codes. Malware writers often use module reuse or automated tools to write variants during t...

AI Technical Summary

Problems solved by technology

In 2014, D Arp and others collected 5,560 malicious samples and proposed a DREBIN method, which can classify Android malicious codes and normal codes as well as different families of Android malicious codes. This method has Higher detection rate, but higher false positive rate

Images