A large-scale Android malware automatic detection system and method

Abstract

The invention relates to a large-scale malicious Android software automatic detection system and method based on multi-class features and machine learning. The method includes: collecting security andmalware libraries, using software analysis tools such as Androguard and Droidbox, collecting the characteristics of each software from both dynamic and static angles, processing the receipts of the forms, defining the thresholds in different angles, when a certain feature does not meet the threshold requirements, deleting the feature, and utilizing a support vector machine, a neural network, an ensemble learning algorithm and other algorithms for detection, and obtaining the optimal results of detection results are obtained, so as to realize the automatic detection of large-scale malware. Theinvention can be used for detecting and identifying large-scale malicious mobile phone software and protecting the privacy and safety of users.

Description

technical field [0001] The invention relates to the technical field of mobile terminal security, in particular to a large-scale malicious software automatic detection system and method. Background technique [0002] With the popularity of smartphones, malware is also growing rapidly. For mobile devices with the Android operating system, its open source nature makes it a prime target for malware developers. [0003] With the continuous disclosure of various system vulnerabilities, the existing Android smartphones are like a leaky ship. Even though the mobile phone security software can alleviate some security risks, the loopholes in the system have not been effectively repaired, and the Android security software cannot It is granted the highest authority of the system, so Android system security issues have always been very difficult. The traditional way of detecting whether software is malicious mainly relies on manually analyzing the code, but with the increasing number o...

AI Technical Summary

Problems solved by technology

[0003] With the continuous disclosure of various system vulnerabilities, the existing Android smartphones are like a leaky ship. Even though the mobile phone security software can alleviate some security risks, the loopholes in the system have not been effectively repaired, and the Android security software cannot Has been granted the highest authority of the system, so Android system security issues have always been very difficult

Most of the proposed solutions are based on permission features to detect malware. However, with the emergence of technologies such as decompilation, code tampering, and disassembly, malware cannot be identified well only by permission features. Although the combined method has increased the feature selection method on the basis of the past, it is still unable to select features more comprehensively.

Secondly, on the algorithm of machine learning, generally only one algorithm will be selected for testing. Whether it is machine learning or deep learning, it is impossible to improve the accuracy of the overall learning.

Images