A method and system for detecting malicious applications using discriminative adversarial networks

Abstract

The invention discloses a malicious application detection method and system for discriminating against a network. The method comprises the following steps: establishing an API calling neural network of an application; establishing an authority neural network of the application; establishing an operation code sequence neural network of the application; The above three types of neural networks input the corresponding features, and obtain three output feature vectors respectively; input the three output feature vectors into the discriminative confrontation network, and output the recognition result of the application. The method and system identify malicious applications by establishing a discriminative adversarial network (DAN) architecture that replaces the generator in the traditional GAN ​​with a discriminator, one of the discriminators of the discriminative adversarial network (DAN) Malware can be detected, another discriminator is obfuscated agnostic, can identify obfuscated and unobfuscated malicious applications with different domains, and removes the bias introduced by obfuscation in learning.

Description

technical field [0001] The invention relates to the field of mobile phone malicious application detection, in particular to a malicious application detection method and system for discriminating against networks Background technique [0002] The existing Android malicious code detection technologies are mainly based on static detection technology and sandbox-based dynamic behavior detection technology, or use a hybrid detection technology of both. [0003] The general static analysis contents include signature information analysis, code semantic analysis, control flow analysis, data flow analysis, etc. A typical static detection method uses static analysis tools of source code to detect and analyze the code content in the application without running the application or installing the application, and then summarizes and analyzes the resource usage of the code during the execution process. [0004] The dynamic behavior detection method uses a virtual machine environment (sand...

AI Technical Summary

Problems solved by technology

Compared with the static detection method, this kind of method is better than the detection method based on the feature code in the detection effect of the unknown malicious application, and can reduce the false negative, but the speed is slow, and its computing resources and time are unbearable, and some After the application detects that the sandbox is running, it will change its behavior in a targeted manner to avoid detection

[0005] The prior art has the following defects: low detection accuracy

Traditional machine learning systems use statistical methods and feature sets that are manually intervened by malware resulting in detection systems that can be slow to react to changes and new threats

With such laborious manual engineering and functional changes occurring over time, these detection methods may only be effective in the short term

In addition, there is insufficient research on the classification of obfuscated Android malicious applications at this stage

Inaccurate feature learning

Images