Android malware static detection method based on random forest

Abstract

The invention relates to an Android malware static detection method based on random forest and belongs to the technical field of network security. According to the method, characteristic vectors consisting of permissions, monitored system events, sensitive APIs and permission rates are constructed, a training model and a prediction model of Android malware based on a random forest algorithm in support machine learning are established, then, the validity of the models is verified through sample calculation with a tenfold cross validation method. The prediction accuracy of the model can reach 89.91%. The method has the significant advantages as follows: 1) main characteristics involved in each Android application are acquired with a simple and quick static analysis method, besides, no dynamic tracking is involved, and the characteristics of low cost and high efficiency are realized; 2) the used four groups of characteristic vectors comprising the permissions, monitored system events, sensitive APIs and permission rates can be captured easily by each Android application, and the method is easy to popularize on an Android platform.

Description

technical field [0001] The invention relates to a detection method of an Android malicious App. The detection method is based on a random forest algorithm in machine learning and belongs to the field of information security. Background technique [0002] Google's Android platform has developed rapidly in recent years, and has occupied a dominant position in the market. The types and numbers of Android software have increased sharply, and malicious software has also emerged in an endless stream. According to statistics, the number of malicious software based on the Android platform is increasing exponentially, which poses a serious security threat to users. Smartphones provide users with great convenience and speed, such as: they can enjoy mobile banking services, mobile client malls, web search and social networking services anytime and anywhere. security vulnerabilities and threats. At present, hackers are gradually expanding their attack targets from personal computers t...

AI Technical Summary

Problems solved by technology

[0009] The object of the present invention is to provide a kind of Android malicious software static detection technology based on random forest, overcome the low accuracy rate (that is, the universality of malware feature is relatively poor) when unknown software is detected by traditional static detection technology problems, and made up for the relatively complex process of dynamic detection technology, the consumption of more resources, and the high false alarm rate caused by insufficient training.

Images