Android malicious application family classification method, device and electronic equipment

Abstract

The embodiment of the invention provides an Android malicious application family classification method and device and electronic equipment, and the method comprises the steps: carrying out the preprocessing of an APK file of an Android malicious application, and obtaining a smali file corresponding to the APK file; Bbased on the smali file, counting different method blocks containing sensitive elements, and based on the semantic information of the Opcode, uniformly expressing the Opcode by using a formalized operation code to generate a sensitive operation code sequence; And based on the sensitive operation code sequence, generating a text feature vector, and based on the text feature vector, classifying the Android malicious applications. According to the embodiment of the invention, thebehavior of the malicious application can be more accurately depicted, so that the classification precision of the malicious application is more effectively improved.

Description

technical field [0001] Embodiments of the present invention relate to the technical field of data information security, and more specifically, relate to a method, device and electronic device for classifying Android malicious application families. Background technique [0002] The development of the mobile Internet and the widespread use of smart phones have increased the threat of malicious codes to the system security and information security of smart phones. Therefore, the detection and identification of malicious code is of great significance to ensure the system security and information security of smartphones, which is conducive to the effective identification and interception of malicious applications and the protection of user data security. [0003] At present, more and more attention is paid to the detection and identification of malicious codes and malicious applications. Among them, in an android malicious code detection method, the dex file format is first parse...

AI Technical Summary

Problems solved by technology

[0004] In the above detection method, it is necessary to obtain the OP segment data of the OpCode code segment with API call or data assignment behavior and the data corresponding to the index segment. This method can easily bypass the detection method by simply modifying the values ​​of these fields.

More importantly, simply obtaining the behavior of API calls and data assignments cannot accurately describe the behavior of malicious applications, and there are high false positives in multi-classification tasks, and because only simple matching algorithms are used as subsequent decision-making algorithms , it is easy to reduce the classification accuracy due to overfitting

Images