An Android malware detection method and technology based on a behavior graph

Abstract

The invention relates to the technical field of mobile platform malicious code detection, aiming at providing an Android malware detection method and model based on a behavior graph. The method adoptsa detection scheme based on behavior graph, which comprises the following steps: converting application binary data into behavior graph containing directed edges; providing a new feature extraction method based on graph kernel, which extracts more complete feature information from the data of graph structure, wherein the feature contains context-related structured feature information, and can represent the specific behavior of application program more accurately; adopting a stochastic combinatorial updating machine learning algorithm based on on-line multi-core learning to update the model automatically to adapt to the ever-changing distribution; by designing comparative experiments, recording experimental data, and counting the general differences in the criteria for the designation ofthe method. This model has wide applicability and can detect unknown malware effectively. The invention provides a new solution for detecting Android malicious software.

Description

technical field [0001] The invention relates to a behavior graph-based Android malicious software detection method and technology, belonging to computer security technology. Background technique [0002] With the rapid development of smartphones, mobile platforms are now prime targets for malware aggregation. According to Tencent Security's 2017 Internet Security Report, rogue behavior and resource consumption accounted for over 80% of mobile viruses. Almost all personal data information is saved on mobile devices. In the current era of big data, these user data are quite attractive to illegal personnel. The openness of the Android platform makes it impossible for Google to effectively supervise applications. The low threshold for application development and the diversity of distribution channels also provide great convenience for criminals and great troubles for users. [0003] The Android platform has a complex and diverse ecology, and the security situation of mobile ph...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to improve the low detection accuracy of the existing detection methods, the imperfect feature extraction of the detection method based on the graph structure, and the inability of the detection method based on batch processing learning to effectively adapt to the newly added malware types, etc., to provide A behavior graph-based Android malware detection method and detection model, using static analysis as the main method and dynamic analysis as the auxiliary detection method

Images