Population-oriented Android malicious software detection model library method

Abstract

The invention discloses a population-oriented Android malicious software detection model library method, which comprises the following steps of: 1) collecting an application file, extracting an application permission use condition, integrating the application permission use condition into a permission information matrix, and forming population information of an application according to a categorylabel; 2) training a classifier according to the extracted application permission set; 3) acquiring an authority information matrix of the to-be-detected application, determining the category of the to-be-detected application by using the classifier, and taking the population information of the to-be-detected application as the input of the model library; finding a recognizer pool corresponding tothe population in the model library, and detecting the application by using the recognizer which most conforms to the constraint condition according to the constraint condition to judge the maliciousness of the application. According to the method, the thought of the biological population is used for reference, the permission characteristics of the application are processed, the application is divided into different populations, the corresponding recognition algorithm model is found in the model base through constraint, and finally a better recognition result is obtained.

Description

technical field [0001] The present invention relates to malware detection technology, in particular to a population-oriented Android malware detection model library method. Background technique [0002] Maliciousness detection of Android applications is an uncertain problem. So far, malware detection methods can be divided into static detection, dynamic detection and combination of dynamic and static detection. However, with the rise of machine learning and data mining, more and more researchers choose to combine the previous dynamic and static detection methods with machine learning techniques. [0003] At present, the detectors applied to malicious detection of Android applications are mainly trained by machine learning methods such as support vector machines, random forests, and K-means. Various detection methods have laid the foundation for Android detection, but there are also some shortcomings: due to the diversity of Android applications, the use of privacy permissi...

AI Technical Summary

Problems solved by technology

Various detection methods have laid the foundation for Android detection, but there are also some shortcomings: due to the diversity of Android applications, the use of privacy permissions is a typical uncertainty problem, and it is difficult to distinguish between normal permissions and privacy permissions. relationship between

Therefore, the same type of permission poses different risks to applications of different types of functions.

Images