Android malicious software detection method and system based on RNN and CNN

Abstract

The invention provides an Android malicious software detection method and system based on RNN and CNN, and the method comprises the steps: carrying out the feature extraction of an original installation file of a training sample, and obtaining an operation code sequence; training a BLSTM network by using the operation code sequence; extracting the operation code sequence as a feature picture by using the trained BLSTM network; training a convolutional neural network by utilizing the feature pictures. Firstly, feature extraction is conducted on an installation file of a to-be-detected Android application, and an operation code sequence of the to-be-detected Android application is obtained. The operation code sequence is input into a trained BLSTM network, and a feature picture is extracted.Finally, the feature picture is input into a trained convolutional neural network, and a classification result that whether the feature picture belongs to malicious software or not is output. According to the method, recognition and distinguishing of good software and malicious software under the Android platform are achieved, and the safety of the Android software platform is improved.

Description

technical field [0001] The invention relates to the field of malware detection, in particular to a method and system for detecting Android malware based on RNN and CNN. Background technique [0002] Now, the Internet is a very important part of our life and work. However, malware-based cyber-attacks are also a serious problem. With the development of science and technology, the types and complexity of malware are getting higher and higher, and the identification of malware is becoming more and more difficult, especially in the mobile field platform. In view of the rapid growth of mobile devices and mobile application stores, the number of new applications is too large to manually check the malicious behavior of each program, malware detection has become an important technical guarantee for the development of the mobile Internet field today. Researching and implementing a high-accuracy malware detection system has very important practical significance, and has received clos...

AI Technical Summary

Problems solved by technology

However, with the sharp increase in the number of malware, the size of the dataset used to train the model also has a significant impact on detection accuracy and training efficiency

Although the detection accuracy of the n-gram method is high, it requires a lot of computing resources and time to handle the dynamic growth of the required model parameters

However, CNNs are able to handle explosive data growth because the increase in the number of parameters does not imply an increase in computing resources and required time

However, if the opcode sequence is directly converted into a feature matrix with one-hot encoding as the input of the convolutional neural network, the context of the opcode sequence is ignored.

Images