Android malware detection method and device based on capsule network

Abstract

The invention belongs to the technical field of network security, and particularly relates to a capsule network-based Android malware detection method and device. The method includes: collecting Android software file samples, decompressing files to be processed, and converting them into RGB three-channel color images as Training sample data; construct a capsule network, and use the sample data to train the capsule network to obtain a trained network model including graph structure and network parameters. Transfer; input the target file to be detected into the trained capsule network model for testing, and judge whether the target file to be detected is a malware file through the output result. The invention can run efficiently on the Android operating platform, occupy less resources, and have high efficiency and accuracy. Even in the case of small-scale training samples, the classification and detection tasks with high accuracy can be realized, and the purpose of protecting Android smart mobile terminals is achieved.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a capsule network-based Android malware detection method and device. Background technique [0002] With the advent of the era of big data, Internet technology and mobile Internet technology have achieved rapid development, and the number of malicious application software has also increased rapidly, especially the new mobile malicious application software has shown an exponential growth trend. Space presents unprecedented challenges. Existing malware detection methods include: static detection methods based on OpCoden-gram type and formal description of Dalvik instructions to extract features; dynamic detection methods such as dynamic analysis based on API call sequence comparison, TaintDroid model using dynamic taint tracking technology; Based on Naive Bayesian (NativeBes, NB), Support Vector Machine (Support Vector Machine, SVM) and other machine learning classificatio...

AI Technical Summary

Problems solved by technology

However, today's obfuscation techniques are becoming more and more complex. Static analysis techniques based on signatures can be bypassed by multiple obfuscation techniques such as polymorphism, encryption, and packaging, while detection methods based on software signature libraries cannot detect new unknown malware; behavior-based Although the dynamic detection technology can avoid the interference of obfuscation technology, it needs to dynamically monitor and track executable programs in a honeypot environment, which has the disadvantages of high computing resource requirements and low execution efficiency, and cannot cope with large-scale sample detection. Disadvantages that cannot be applied to smart mobile device terminals; the feature extraction and screening of malware in the early stage of machine learning classification algorithms is too cumbersome, and the design of detection models is too complicated; detection algorithms based on convolutional neural networks require a large number of data samples to obtain good results. classification effect

None of the above detection methods can work well on smart mobile terminals based on the Android operating device platform.

Images