Event-aware Android malicious software detection method

Abstract

The invention discloses an event-aware Android malicious software detection method. The method comprises the following steps: extracting a calling graph of an API in Android software by utilizing FlowDandroid; all events of the Android software are acquired by utilizing the calling graph; converting the API in each event into a word vector by using Doc2Vec; dividing each API in the event into corresponding functional clusters by using a clustering algorithm to form a functional cluster of the event; data features are classified by using a specially designed neural network; and finally, deploying a feature extraction module and a trained neural network to detect the Android software online, and analyzing a behavior mode of the event in the Android software by utilizing a function cluster inthe event to enhance the resistance to malicious software evolution and improve the capability of detecting malicious behaviors hidden by the malicious software.

Description

technical field [0001] The invention belongs to malware detection in the field of software security, and in particular relates to an event-aware Android malware detection method. technical background [0002] With the popularity of Android phones and the proliferation of Android applications, malicious applications have received more and more attention because of their loss of user privacy and property. In 2017, Android accounted for 86 percent of the smartphone market, up 1.1 percent from the previous year. Due to the increasing popularity of the Android system by users and manufacturers and the open source nature of its development ecosystem, more and more malicious applications have appeared in the Android market. These Android applications that steal user privacy for profit have become a Great worry. According to Qihoo 360’s 2017 Android Malware Security Report, 80% of malware is designed to increase user traffic consumption. In addition, other malware, such as Trojans...

AI Technical Summary

Problems solved by technology

Behavior hidden in this way is difficult to detect with most motion detection techniques

At the same time, many static detection technologies cannot distinguish APIs in different events, so it is impossible to judge whether the behavior of an event is abnormal

[0006] To sum up, the current Android malicious application detection technology based on static and dynamic analysis cannot adapt well to the evolution of malicious applications. Most of these technologies are based on API calls for detection, but only considered from the API level, and cannot extract Sufficient effective semantic information, so it is difficult to detect malicious applications developed based on new version systems

Images