Dynamic and static combination detection method for Android mobile network terminal malicious codes based on SVM

Abstract

The invention discloses an SVM-based dynamic and static combination detection method for Android mobile network terminal malicious codes. The method comprises the following steps: constructing a training sample data set accommodating malicious software and non-malicious software; obtaining a static feature and a dynamic behavior feature of each sample in the training sample data set, and constructing a feature vector of each software sample; adding malicious software marking fields to the feature vectors of all the software samples, and training a support vector machine classifier; adding malicious software category marking fields to the feature vectors of the malicious software samples, and training a random forest classifier; extracting a static feature vector and a dynamic feature vector of to-be-tested software, and constructing a feature vector of the to-be-tested software; a support vector machine classifier is used for malicious software detection; If the software is detected tobe malicious software, further utilizing a random forest classifier to judge the malicious software family to which the software belongs. According to the method, the accuracy of software malicious behavior detection is improved, Meanwhile, the ability of malicious family classification is achieved.

Description

technical field [0001] The invention belongs to the field of information security, and in particular relates to a dynamic and static detection method based on an SVM-based Android mobile network terminal malicious code. Background technique [0002] Currently, the application of smart phones has been involved in all aspects of people's lives, and the Android system occupies a large share in smart phones. Therefore, accurate detection of Android malicious codes is of great significance and application value for protecting the privacy and property security of Android users. In the existing research on multi-label detection of Android malicious code, generally only the static analysis method is used to extract the characteristics of Android software, which cannot handle dynamic loading, runtime encryption and decryption, etc., and the detection accuracy of malware and the classification accuracy of malicious families are low. . Contents of the invention [0003] The purpose ...

AI Technical Summary

Problems solved by technology

In the existing research on multi-label detection of Android malicious code, generally only the static analysis method is used to extract the characteristics of Android software, which cannot handle dynamic loading, runtime encryption and decryption, etc., and the detection accuracy of malware and the classification accuracy of malicious families are low.

Images