Android malicious code detection method based on API enhancement sequence

Abstract

The invention discloses an Android malicious code detection method based on an API (Application Program Interface) enhancement sequence, which comprises the following steps of: mining similarity among APIs by utilizing context information in an API sequence, and enhancing an original API calling sequence by utilizing the similarity, so as to realize sensitivity to different same behaviors of application programs; meanwhile, the adjacency matrix of the enhanced API sequence is used for replacing an API calling graph, and the feature scale can be effectively reduced; the method mainly comprises the steps of completing the extraction of an API calling sequence of a complete system of an application program by using a recursion-based method, implementing an API embedding model based on a CBOW model principle, and constructing a detection framework based on a convolutional neural network (CNN). The method is mainly used for an Android malicious code detection task, and the problems that an existing detection method is insufficient in API change elasticity, and the performance is reduced when Android malicious software adopts encryption, confusion and other measures are solved.

Description

technical field [0001] The invention belongs to the field of network information security, and in particular relates to an Android malicious code detection method based on an API enhancement sequence. Background technique [0002] The development of mobile smart terminals not only brings convenience to people's lives, but also provides a breeding ground for Android malware. The explosive growth of Android malware poses a serious threat to Android security. There is a steady stream of new work in the field of Android malware detection, with previous researchers pioneering many novel and efficient methods in the game against malware makers. Previous studies have shown that extracting application features based on dynamic-static or hybrid methods and inputting them into machine learning or deep learning models for classification is an effective detection method. Static analysis does not need to run the program. It extracts interesting features by examining the program's manif...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the present invention provides a method for detecting Android malicious code based on an API enhanced sequence, which can solve the problem that the existing Android malicious code detection method is insufficient in flexibility to API changes, and performance declines when Android malware adopts encryption, confusion and other measures question

Images