Android malware real-time detection method based on network flow analysis

Abstract

The invention discloses an Android malware real-time detection method based on network flow analysis. The method comprises the following steps: (1) collecting network data; (2) dividing network data flow groups; (3) extracting a network data flow minimum unit; (4) judging whether a flow minimum unit port number is 80; (5) extracting network data packet field features; (6) judging whether the flow minimum unit port number is 443; (7) extracting network data flow statistical features; (8) training a statistical feature detection module; (9) training a field feature detection module; (10) extracting the network data feature of a to-be-detected sample; (11) judging whether a feature vector of the to-be-detected sample is a field feature vector; and (12) inputting the feature vector of the to-be-detected sample into the field feature detection model or a statistical feature detection model to obtain a detection result. By use of the real-time detection method disclosed by the invention, the malware can be detected in real time, and an encryption protocol can be used for detecting the software for performing the network data transmission.

Description

technical field [0001] The invention belongs to the technical field of communication, and further relates to a real-time detection method for Android malware based on network traffic analysis in the technical field of network security. The invention can be used to detect in real time whether malicious software exists in the Android mobile terminal, so that other network security technologies can process the malicious software existing in the Android mobile terminal, thereby ensuring the information security of the Android mobile terminal users. Background technique [0002] Android malware detection technology is used to discover malware existing on mobile devices, so that other network security technologies can prevent malware from harming mobile devices. Android malware detection technology based on network traffic analysis has attracted the attention of scholars in recent years. This method usually analyzes the network traffic data generated by applications, and extracts ...

AI Technical Summary

Problems solved by technology

[0005] In summary, some Android malware detection methods based on network traffic analysis at this stage have the following deficiencies: First, the existing Android malware detection methods based on network traffic analysis usually analyze the network traffic in different TCP sessions analysis, or the processing method of analyzing network data packets one by one makes the real-time performance of malware detection cannot be guaranteed; then, the network traffic characteristics used in the existing Android malware detection methods based on network traffic analysis are usually The characteristics of the application layer header field of the network data packet, this method cannot effectively detect the application program that uses the TLS / SSL protocol for encrypted transmission; finally, the existing Android malware detection method based on network traffic analysis The characteristics of the network traffic data used are relatively single, and various types of characteristics of network traffic are not fully utilized.

Images