Conceptual drift-oriented interpretable Android malicious software detection method

Abstract

The invention discloses a concept drift-oriented interpretable Android malicious software detection method, and belongs to the technical field of information security. The method comprises the following steps: introducing detection features through an artificial Android malicious software analysis report, improving a traditional feature package based on an automatic machine learning algorithm and an interpretable algorithm, and fusing an identically distributed inspection and transfer learning algorithm. According to the method, the interpretability of the Android malicious software detection model is improved, manual verification of the detection model by reverse analysts is facilitated, the influence of the concept drift problem on the accuracy of the detection model is reduced, low-cost long-time maintenance of high accuracy of the detection model is facilitated, and the method is used for detection and analysis of Android malicious application software.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to an interpretable Android malware detection method oriented to concept drift. Background technique [0002] In the first quarter of 2021, 360 Internet Security Center intercepted about 2.065 million new samples of malicious programs on mobile terminals, an increase of 426.5% over the same period in 2020, causing per capita economic losses of 14,611 yuan. As of April 2021, compared with the iOS operating system, the Android operating system occupies 76.91% of the Chinese mobile terminal market, and the application software ecosystem of the Android open platform makes it more vulnerable to malware threats. [0003] The existing Android malware detection technology is divided into three categories: signature-based detection technology, machine learning-based static detection technology, and machine learning-based application behavior detection technology. The sandbox me...

AI Technical Summary

Problems solved by technology

[0007] 3. The high-frequency update of the Android system version leads to a certain market share of the Android applications developed based on the software development kits of each version

However, due to the phenomenon of concept drift, the machine learning model trained at the cost of a large number of samples performs poorly in the detection of Android malware in different periods

Images