Android malicious application detection method and system based on deep learning

Abstract

The invention relates to an Android malicious application detection method and system based on deep learning, and relates to the technical field of network safety. According to the Android malicious application detection method and system based on deep learning, the defect of processing speed of a traditional malicious application detection technology based on feature codes in coping with the generation of new malicious applications can be reduced. According to the method, the file containing the static information of the application is decompiled, the information capable of representing whether the application is the malicious application is extracted from the file, the feature information input matrix is generated after data preprocessing, the multi-layer convolutional neural network is adopted for training and optimization to obtain better parameters, and the malicious application can be effectively detected.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a deep learning-based Android malicious application detection method and system. Background technique [0002] In the past few years since Android was born, it has gained a huge market penetration rate due to the openness of its platform. At the same time, the number of various malicious applications targeting Android has increased sharply. Since Kaspersky first discovered SMS Trojans in 2010, Android malware has evolved to evade detection by adding code obfuscation and covert command and control communication channels. Whether it is the widely used signature and feature code technology, the static detection technology for analyzing application content, or the sandbox dynamic detection technology, all have their drawbacks. [0003] Signature-based and signature-based technology appeared first, and its advantages are fast detection speed and low false alarm rate, and it ...

AI Technical Summary

Problems solved by technology

[0003] Signature-based and signature-based technology appeared first, and its advantages are fast detection speed and low false alarm rate, and it is still adopted by current security vendors, but it cannot detect unknown malicious applications that burst out in a short period of time, and with the continuous growth of the number of malware, it is very difficult to Difficult to maintain a large feature library

Moreover, the detection accuracy of the traditional static detection method is not high, and the dynamic detection method takes a lot of detection time, and it is becoming more and more difficult to adapt to the rapid growth of the number of malicious applications.

Images