An Android malicious software detection method based on a semi-supervised K-Means clustering algorithm

Abstract

The invention discloses an Android malicious software detection method based on a semi-supervised K-Means clustering algorithm. The method comprises the following steps of S1, analyzing an Android application software package, selecting a proper amount of labeled samples and two times of quantity of unlabeled samples, and opening the Android application software package of the samples by using a decompression tool to obtain permission sets P1, P2 and P3; S2, constructing a feature matrix, counting the scoring results s1, s2 and s3 of the permission sets P1, P2 and P3 of each sample through aninformation gain algorithm, and selecting a proper amount of labeled samples to construct feature matrixes FN and FM; S3, detecting the malicious software, utilizing a semi-supervised K-means algorithm to detect the malicious software in the samples of a feature matrix FN and a feature matrix FM. According to the technical scheme, by using a large number of unlabeled samples and using the labeledsamples as few as possible for classification, the higher accuracy is achieved for malicious software detection.

Description

technical field [0001] The invention relates to the technical fields of malware detection and network security, in particular to an Android malware detection method based on a semi-supervised K-Means clustering algorithm. Background technique [0002] Due to the open source and free features of the system, the Android system, as a mainstream mobile operating system, has become the main target of malware attacks. Judging from the distribution of new malware in 2017, the proportion of tariff-consuming malicious samples has reached 3 / 4, indicating that malware still seeks economic benefits by promoting advertisements, consuming traffic, and increasing traffic tariffs for mobile phone users. Security cannot be guaranteed, so it is still necessary to study Android malware detection methods. [0003] There are currently two main methods for Android malicious code analysis research, namely static analysis and dynamic detection. Static analysis refers to judging the program behavi...

AI Technical Summary

Problems solved by technology

[0005] The object of the present invention is to provide a kind of Android malware detection method based on semi-supervised K-Means clustering algorithm, to solve the problem that K-Means clustering algorithm detects Android malware easily affected by the initial clustering center

Images