Application category-based Android malicious software detection method

Abstract

The invention discloses an application category-based Android malicious software detection method. The detection method comprises the following steps of a characteristic extracting stage; a dangerous weight endowing stage; a category-based dangerous value calculation stage; a machine learning classifying stage; and a stage of adding new characteristics to new samples. According to the detection method, all static characteristics and dynamic characteristics are collected; the dangerous value of each category is calculated based on the category of the characteristics; the dangerous value of each category of the characteristics is calculated based on the application category; and the application is classified by applying a kNN algorithm, and the algorithm is optimized, so as to improve accuracy.

Description

technical field [0001] The invention belongs to the technical field of communications, and in particular relates to an application category-based Android malware detection method. Background technique [0002] With the development of mobile communication technology, smart phones have become popular in today's society. People begin to use mobile phones for social and entertainment activities. However, the number of malicious software installed on mobile phones has increased sharply, which has brought great threats to users. According to statistics, Android phones account for 83.6% of the global smartphones, but in mobile platforms, up to 91.1% of malware comes from the Android system. China's mobile phone virus has increased by more than 400%, and the security threat of mobile smart terminals is no less than that of traditional computers. [0003] The security issues of Android phones are becoming more and more prominent. Smartphones have rich functions, and users can add v...

AI Technical Summary

Problems solved by technology

Static detection analyzes the source code, but the accuracy is low

Dynamic detection executes the program in the sandbox, and can only judge whether it is malware based on the behavior of the software when it is running, and cannot analyze the source code

[0005] Static detection and dynamic detection have their own advantages and disadvantages. If only one of the static or dynamic methods is used, the analysis of the application is not comprehensive enough, and there is still a defect of low detection rate.

Images