Android malicious software family clustering method based on method call graph

Abstract

The invention discloses an Android malicious software family clustering method based on a method call graph. The method belongs to the field of Android malicious software detection, and comprises thefollowing steps: S1, generating a method call graph: obtaining an entry point list of an Android application and an application program interface API call relationship by decompiling an APK file, andautonomously constructing the method call graph of the Android application; s2, preprocessing a method call graph: preprocessing the method call graph to generate a simplified call graph, performing graph division on the simplified call graph by a community discovery algorithm, and dividing the simplified call graph into a plurality of relatively independent sub-graphs SG; S3, performing feature extraction; S4, performing malicious family clustering. According to the method for constructing the method call graph provided by the invention, the method call graph is used as a malicious software detection feature, and the method call graph is cut in combination with a community discovery algorithm and simple graph division, so that the detection efficiency of the Android malicious software isimproved.

Description

technical field [0001] The invention belongs to the field of Android malware detection, in particular to a clustering method for Android malware families based on a method call graph. Background technique [0002] With the rapid development of digital technology, the performance of mobile terminals is getting higher and higher, and human-computer interaction is becoming more and more intelligent. While the development of technology brings convenience to people, it also provides a more solid software and hardware environment for malicious applications. Therefore, the status of mobile phone security protection in the security field is becoming more and more important, and has even become an important part of national security. [0003] Android malware detection is the first to use a signature-based detection method, which can only detect malware that has been discovered, but is powerless for unknown malware. Then researchers turned their attention to the research of algorith...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is: the API sequence generated by the existing software is highly random, and there is a lot of noise, which has a relatively large impact on the detection effect and the method call graph is due to the similarity of the graph in the application of machine learning. Compared with the problem that the amount of calculation is very huge, the present invention provides a method for clustering Android malware families based on method call graphs

Images