A malicious application detection method based on Android application behavior classification

Abstract

The present invention relates to a malicious application detection method based on Android application behavior classification. First, an automated testing tool is used to perform coverage testing on Android applications. During the coverage testing, an interface interception tool is used to obtain information about interfaces called during the testing process. Then, a system call vector is constructed according to the calling interface. After dimensionality reduction processing is performed on the vector, the application corresponding to each vector is classified and the applications are added to application sets of different categories. Finally, the similarity between the system call vectors of each application and other applications in each application set is calculated, and applications with similarity below a set threshold are defined as malicious applications. The entire design method can make up for the problem that the current mainstream static detection algorithm has insufficient ability to resist code obfuscation, has the characteristics of real-time performance, is not restricted by static code, has better compatibility than static detection, and has high execution efficiency. It can truly detect the maliciousness of a large number of sample Android application sets.

Description

Technical Field

[0001] The present invention relates to a malicious application detection method based on Android application behavior classification, belonging to the technical field of Android malicious application detection. Background Art

[0002] With the rapid growth of the mobile internet, Android, the mobile operating system with the largest market share, is also booming. According to data released by CNNIC, as of June 2020, the number of mobile internet users in my country continued to grow, reaching 932 million. 99.2% of these users use mobile internet, and there are 3.59 million apps available on the domestic Android app market. Android mobile apps have captured a significant share of the domestic mobile internet, and their development and application are becoming increasingly far-reaching.

[0003] However, as the mainstream operating system for mobile devices, Android, due to the openness of its source code and application development, has become a prime target for attackers creating malicious applications. According to the "2020 China Mobile Security Status Report" released by 360 and the China Academy of Information and Communications Technology, the Android app market intercepted approximately 4.546 million malicious mobile applications by 2020, and the growth of malicious applications has been increasing year by year, with the number of malicious applications increasing by 151.3% compared to 1.809 million in 2019. These malicious behaviors primarily manifest in resource consumption, privacy theft, and malicious fee deductions.

[0004] Security detection methods for malicious applications generally target Android applications at both the static code and dynamic behavior levels. Malicious applications also target these two aspects for evasion. Static code security detection for malicious applications involves decompiling the Android application's APK installation package to obtain its bytecode file, then analyzing the bytecode file's code logic to determine if the application is malicious. Dynamic behavior detection, on the other hand, intercepts the data interaction information generated by the application during operation to determine if the application is malicious. Currently, many malicious applications are constantly evolving their methods of evading security detection, such as through code obfuscation of variant malware or malicious modules attached to legitimate software, resulting in suboptimal detection results. Therefore, accurate and effective detection and prevention of variant malware is crucial.

[0005] As the mobile application ecosystem continues to improve, a wide variety of applications are emerging. Due to the lack of unified standards for reviewing and regulating applications in numerous third-party app stores, the number of malicious applications has increased dramatically. This has caused significant damage to the Android ecosystem and posed severe challenges to the application market and regulatory authorities. The security issues posed by malicious applications, such as malicious charges and privacy theft, have prompted researchers to develop efficient and automated detection methods that can effectively detect malicious Android applications. Most current malicious application detection methods target bytecode files generated after decompilation of Android applications. These detection methods have the advantages of high speed, low energy consumption, and low real-time requirements. However, due to their high reliance on static code, they have poor resistance to interference from various code obfuscation techniques. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a malicious application detection method based on Android application behavior classification, which adopts a newly designed execution strategy and can efficiently detect Android applications and complete the detection of malicious applications.

[0007] In order to solve the above technical problems, the present invention adopts the following technical solution: the present invention designs a malicious application detection method based on Android application behavior classification, which is used to detect malicious applications for N Android applications to be tested, including the following steps:

[0008] Step A. Using the Apk installation package name of the Android application to be tested as a parameter, obtain the original package name of the Apk installation package of each Android application to be tested, and then proceed to step B;

[0009] Step B. Based on the startup of the Android application to be tested, obtain the parent process identifier corresponding to each Android application to be tested, and then proceed to step C;

[0010] Step C. For each Android application to be tested, based on the test and tracking of the running Android application, obtain the number of system calls made by the Android application to be tested to 360 systems under the Android operating system, and form the 360 ​​system calls corresponding to the Android application to be tested. × 1-dimensional system call count vector; then obtain the system call count vector T corresponding to each Android application to be tested n , which constitutes the 360 ​​corresponding to all Android applications to be tested × N-dimensional system call feature matrix A=(T1,...,T n ,...,T N ) T , 1≤n≤N, T n Represents the system call count vector corresponding to the nth Android application to be tested, and then proceeds to step D;

[0011] Step D: Perform dimensionality reduction operations on the dimensions of various systems involved in the system call feature matrix A, and update the system call count vector T corresponding to each Android application to be tested. n is m × 1-dimensional vector, and then update the system call feature matrix A to m × N-dimensional matrix, m represents the number of corresponding systems involved after the system calls the feature matrix A for dimensionality reduction operation, and then enters step E;

[0012] Step E. Based on the system call feature matrix A, classify the N Android applications to be tested, obtain each classified application set, and then proceed to step F;

[0013] Step F. For each classified application set, calculate the similarity between the permission sets of each Android application to be tested in the classified application set and the permission sets of the remaining Android applications to be tested in the set to which it belongs, and further calculate the average similarity of each Android application to be tested in the classified application set within the set to which it belongs, thereby obtaining the average similarity corresponding to the N Android applications to be tested, and then proceed to Step G;

[0014] Step G: for each Android application to be tested, determine whether the average similarity corresponding to the Android application to be tested is less than a preset similarity threshold. If so, determine that the Android application to be tested is a malicious application; otherwise, do not determine the Android application to be tested.

[0015] As a preferred technical solution of the present invention: in the step B, for each Android application to be tested, based on the startup of the Android application to be tested, the process information set of the environment in which the Android application to be tested is running is obtained, and according to the original package name of the Android application to be tested, the application process information corresponding to the Android application to be tested is obtained from the NAME column of the corresponding process information in the process information set, and the parent process identifier of the application process information is further obtained; then the parent process identifier corresponding to each Android application to be tested is obtained, and then step C is entered.

[0016] As a preferred technical solution of the present invention: in the step C, for each Android application to be tested, based on the operation of the Android application to be tested, the original package name of the Android application to be tested is used as a parameter, and a random test is performed on the Android application to be tested, and the parent process identifier corresponding to the Android application to be tested is used as a parameter to track the system call sequence of the Android application to be tested. After the test is completed, the number of system calls of the Android application to be tested on 360 systems under the Android operating system is obtained, and a 360×1-dimensional system call number vector corresponding to the Android application to be tested is constructed.

[0017] As a preferred technical solution of the present invention: the step D includes the following steps D1 to D4;

[0018] Step D1. According to the 360 ​​corresponding to all Android applications to be tested × N-dimensional system call feature matrix A, obtain the corresponding 360 × 360-dimensional system call characteristic left singular matrix U, and N × N-dimensional system call characteristic right singular matrix V T , then proceed to step D2;

[0019] Step D2. Calculate the eigenvalue set λ corresponding to the system call characteristic left singular matrix U U ={λ U1 ,λ U2 ,λ U3 ,...,λ U360} and the set of eigenvectors ξ U ={ξ U1 ,ξ U2 ,ξ U3 ,...,ξ U360}, and obtain the system call characteristic right singular matrix V T The corresponding eigenvalue set λ V ={λ V1 ,λ V2 ,λ V3 ,...,λ VN} and the set of eigenvectors ξ V ={ξ V1 ,ξ V2 ,ξ V3 ,...,ξ VN}, then go to step D3;

[0020] Step D3. According to the system call characteristic left singular matrix U and the system call characteristic right singular matrix V T , eigenvector set ξ U , eigenvector set ξ V , obtain the intermediate matrix W in which all elements except the diagonal of the system call feature matrix A are 0, and then proceed to step D4;

[0021] Step D4. Determine whether there is an element at position (i, i) in the intermediate matrix W that is 0. If so, for each position (i, i), delete the number of system calls corresponding to each i-th system of each Android application under test in the system call feature matrix A, and update the system call number vector T corresponding to each Android application under test. n is m × 1-dimensional vector, and then update the system call feature matrix A to m ×N-dimensional matrix, m represents the number of corresponding systems involved after the system call feature matrix A is updated, 1≤i≤360, and then enters step E.

[0022] As a preferred technical solution of the present invention: in step D1, according to the 360 × The N-dimensional system call feature matrix A is as follows:

[0023]

[0024] Get the corresponding 360 × 360-dimensional system call characteristic left singular matrix U, and N × N-dimensional system call characteristic right singular matrix V T .

[0025] As an optimal technical solution of the present invention: in the step D3, according to the system call characteristic left singular matrix U, the system call characteristic right singular matrix V T , eigenvector set ξ U , eigenvector set ξ V , according to the following formula:

[0026]

[0027] Obtain the intermediate matrix W in which all elements except the diagonal in the system call feature matrix A are 0, 1≤i≤360, j represents the column of the intermediate matrix W, w ij Represents the element in the i-th row and j-th column of the intermediate matrix W.

[0028] As a preferred technical solution of the present invention: the step E includes the following steps E1 to E4;

[0029] Step E1. Randomly generate NUM cluster vectors with dimension m, which are cluster vector sets Clu={C1,...,C num ,...,C NUM}, NUM is equal to N, 1≤num≤NUM, then initialize the classified application sets corresponding to each clustering point vector in the clustering point vector set Clu to an empty set, and initialize the state of each Android application to be tested to an unclassified state, and enter step E2;

[0030] Step E2. Based on the system call feature matrix A, for each Android application under test in the unclassified state, calculate the clustering point vector in the clustering point vector set Clu that has the smallest distance to the system call count vector of the Android application under test, add the Android application under test to the classified application set corresponding to the clustering point vector, and update the state of the Android application under test to the classified state. After the classification operation for all Android applications under test is completed, the classified application set corresponding to each clustering point vector in the clustering point vector set Clu is updated, and then the process proceeds to Step E3.

[0031] Step E3. For each of the cluster vectors in the cluster vector set Clu, determine whether there are any classified application sets containing no more than N / a Android applications to be tested. If so, delete each of the classified application sets, define the status of each Android application to be tested in each of the classified application sets as unclassified, and update NUM with the number of remaining classified application sets, and then proceed to step E4. Otherwise, the classification of the N Android applications to be tested is completed, and each classified application set is obtained, and then proceed to step F; where a is a preset parameter, 1 <a<N;

[0032] Step E4. For each classified application set, based on the system call count vector of each Android application to be tested in the classified application set, calculate and update the clustering point vector corresponding to the classified application set, and then update the clustering point vector corresponding to each classified application set, and update the clustering point vector set Clu of NUM clustering point vectors = {C1, ..., C num ,...,C NUM}, then return to step E2.

[0033] As a preferred technical solution of the present invention: in step E2, for each Android application to be tested, the following formula is used:

[0034]

[0035] Calculate the number of calls to the Android application system under test in the cluster vector set Clu and T n The cluster vector C with the smallest distance between them num , where C num =(c num,1 ,c num,2 ,...,c num,m ), T n =(t n,1 ,t n,2 ,...,t n,m ).

[0036] As a preferred technical solution of the present invention: in step E4, for each classified application set, based on the system call count vector of each Android application to be tested in the classified application set, the following formula is used:

[0037]

[0038] Calculate and update the cluster point vector C corresponding to the classified application set num , where L num Indicates the number of Android applications to be tested in the num-th classified application set, T Lnum,num Indicates the Lth in the numth classified application set num A vector of the number of system calls of the Android application under test.

[0039] As a preferred technical solution of the present invention: In step F, the permission set Role of the two Android applications p and q is obtained as follows: p and Role q Similarity Sim pq The formula is:

[0040]

[0041] For each classified application set, calculate the similarity between each Android application permission set to be tested in the classified application set and the remaining Android application permission sets to be tested in the set to which it belongs; where |Role p |Represents the permission set Role of Android application p p The number of permissions in |Role q |Represents the permission set Role of Android application q q The number of permissions in |Role pq |Represents the permission set Role p and Role q The number of common permissions between them.

[0042] The malicious application detection method based on Android application behavior classification described in the present invention adopts the above technical solution and has the following technical effects compared with the existing technology:

[0043] (1) The malicious application detection method designed by the present invention is based on the classification of Android application behavior. First, an automated testing tool is used to perform coverage testing on Android applications. During the coverage testing, an interface interception tool is used to obtain the interface information called during the test process. Then, a system call vector is constructed according to the calling interface. After the vector is subjected to dimensionality reduction processing, the application corresponding to each vector is classified and the applications are added to application sets of different categories. Finally, the similarity between each application and the system call vector of other applications in each application set is calculated, and applications with a similarity lower than a set threshold are set as malicious applications. The entire design method can make up for the problem that the current mainstream static detection algorithm has insufficient ability to resist code obfuscation. It has the characteristics of real-time performance and is not subject to static code. Therefore, dynamic detection is used to analyze the intention behind the malicious behavior and the evolution of the malicious behavior. Compared with static detection, it has better compatibility and high execution efficiency, and can truly perform malicious detection on a large number of sample Android application sets.

[0044] (2) The malicious application detection method designed by the present invention is based on the classification of Android application behavior. It uses automated testing technology and system call interception tools to extract the system call status of the application during operation and establish a system call vector based on this. In the process of obtaining the system call, the tool is used to perform random testing on the application being tested to achieve the purpose of sufficient testing. In the test process, the tool is used to intercept the number of times the application calls the system interface during the test process. At the same time, a vector dimensionality reduction algorithm is used to reduce the dimensionality of the system call vector, thereby reducing the complexity of the algorithm for subsequent application classification based on the system call vector. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a flow chart of a malicious application detection method designed by the present invention based on Android application behavior classification. DETAILED DESCRIPTION

[0046] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0047] The present invention designs a malicious application detection method based on Android application behavior classification, which is used to detect malicious applications for N Android applications to be tested. In actual application, Figure 1 As shown, the specific implementation includes the following steps A to G.

[0048] Step A. Based on the installation of each Android application to be tested on the Android emulator, for each Android application to be tested, for the Apk installation package on the command prompt, use the aapt tool provided by the SDK, with the Apk installation package name of the Android application to be tested as a parameter, to obtain the original package name of the Apk installation package of each Android application to be tested, and then proceed to step B.

[0049] Step B. For each Android application to be tested, based on the startup of the Android application to be tested on the Android emulator, execute the adb tool provided by the SDK in the command prompt to obtain the process information set of the environment where the Android application to be tested is running, and according to the original package name of the Android application to be tested, obtain the application process information corresponding to the Android application to be tested from the NAME column of the corresponding process information in the process information set, and further obtain the parent process identifier of the application process information; then obtain the parent process identifier corresponding to each Android application to be tested, and then enter step C.

[0050] Step C. Based on the testing and tracing of the running Android application, for each Android application to be tested, the adb monkey tool is used to perform random testing on the Android application to be tested, with the original package name of the Android application to be tested as a parameter, and the strace tool is used to trace the system call sequence of the Android application to be tested, with the parent process identifier corresponding to the Android application to be tested as a parameter. After the test is completed, the number of system calls of the Android application to 360 systems under the Android operating system obtained by the strace tool is obtained, and a 360×1-dimensional system call count vector corresponding to the Android application to be tested is constructed; and then the system call count vector T corresponding to each Android application to be tested is obtained. n , forming a 360×N-dimensional system call feature matrix A=(T1,...,T n ,...,T N ) T , 1≤n≤N, T n Represents the system call count vector corresponding to the nth Android application to be tested, and then proceeds to step D.

[0051] Step D: Perform dimensionality reduction operations on the dimensions of various systems involved in the system call feature matrix A, and update the system call count vector T corresponding to each Android application to be tested. n is m × 1-dimensional vector, and then update the system call feature matrix A to m × N-dimensional matrix, m represents the number of corresponding systems involved after the system calls the feature matrix A for dimensionality reduction operation, and then enters step E.

[0052] In actual application, the above step D specifically performs the following steps D1 to D4.

[0053] Step D1. According to the 360 ​​corresponding to all Android applications to be tested × The N-dimensional system call feature matrix A is as follows:

[0054]

[0055] Get the corresponding 360 × 360-dimensional system call characteristic left singular matrix U, and N × N-dimensional system call characteristic right singular matrix V T , then go to step D2.

[0056] Step D2. Calculate the eigenvalue set λ corresponding to the system call characteristic left singular matrix U U ={λ U1 ,λ U2 ,λ U3 ,...,λ U360} and the set of eigenvectors ξ U ={ξ U1 ,ξ U2 ,ξ U3 ,...,ξ U360}, and obtain the system call characteristic right singular matrix V T The corresponding eigenvalue set λ V ={λ V1 ,λ V2 ,λ V3 ,...,λ VN} and the set of eigenvectors ξ V ={ξ V1 ,ξ V2 ,ξ V3 ,...,ξ VN}, then go to step D3.

[0057] Step D3. According to the system call characteristic left singular matrix U and the system call characteristic right singular matrix V T , eigenvector set ξ U , eigenvector set ξ V , according to the following formula:

[0058]

[0059] Obtain the intermediate matrix W in which all elements except the diagonal in the system call feature matrix A are 0, 1≤i≤360, j represents the column of the intermediate matrix W, w ij Represent the element in the i-th row and j-th column in the intermediate matrix W, and then go to step D4.

[0060] Step D4. Determine whether there is an element at position (i, i) in the intermediate matrix W that is 0. If so, for each position (i, i), delete the number of system calls corresponding to each i-th system of each Android application under test in the system call feature matrix A, and update the system call number vector T corresponding to each Android application under test. n is m × 1-dimensional vector, and then update the system call feature matrix A to m × N-dimensional matrix, m represents the number of corresponding systems involved after the system call feature matrix A is updated, 1≤i≤360, and then enters step E.

[0061] Step E. Based on the system call feature matrix A, classify the N Android applications to be tested according to the following steps E1 to E4 to obtain each classified application set, and then proceed to step F.

[0062] Step E1. Randomly generate NUM cluster vectors with dimension m, which are cluster vector sets Clu={C1,...,C num ,...,C NUM}, NUM is equal to N, 1≤num≤NUM, then initialize the classified application sets corresponding to each clustering point vector in the clustering point vector set Clu to an empty set, and initialize the state of each Android application to be tested to an unclassified state, and enter step E2.

[0063] Step E2. Based on the system call feature matrix A, for each Android application to be tested that is in the unclassified state, use the following formula:

[0064]

[0065] Calculate the number of calls to the Android application system under test in the cluster vector set Clu and T n The cluster vector C with the smallest distance between them num , and add the Android application to be tested to the classified application set corresponding to the clustering point vector, update the state of the Android application to be tested to the classified state, and after completing the classification operation of all Android applications to be tested, update the classified application set corresponding to each clustering point vector in the clustering point vector set Clu, and then enter step E3; wherein, C num =(c num,1 ,c num,2 ,...,c num,m ), T n =(t n,1 ,t n,2 ,...,t n,m ).

[0066] Step E3. For each of the cluster vectors in the cluster vector set Clu, determine whether there are any classified application sets containing no more than N / a Android applications to be tested. If so, delete each of the classified application sets, define the status of each Android application to be tested in each of the classified application sets as unclassified, and update NUM with the number of remaining classified application sets, and then proceed to step E4. Otherwise, the classification of the N Android applications to be tested is completed, and each classified application set is obtained, and then proceed to step F; where a is a preset parameter, 1 <a<N。

[0067] Step E4. For each classified application set, based on the system call count vector of each Android application to be tested in the classified application set, the following formula is used:

[0068]

[0069] Calculate and update the cluster point vector C corresponding to the classified application set num , and then update the clustering point vectors corresponding to each classified application set, and update the clustering point vector set Clu of NUM clustering point vectors = {C1,...,C num ,...,C NUM}, then return to step E2; where L num Indicates the number of Android applications to be tested in the num-th classified application set, T Lnum,num Indicates the Lth in the numth classified application set num A vector of the number of system calls of the Android application under test.

[0070] Step F. First, for each Android application to be tested, decompress the Apk installation package of the Android application to be tested, and obtain the permission set corresponding to the Android application to be tested from the decompressed file AndroidManifest.xml, and then obtain the permission set corresponding to each Android application to be tested; then obtain the permission set Role of the two Android applications p and q as follows p and Role q Similarity Sim pq The formula is:

[0071]

[0072] For each classified application set, calculate the similarity between each permission set of the Android application to be tested in the classified application set and the permission sets of the other Android applications to be tested in the set to which it belongs, and further obtain the average similarity of each Android application to be tested in the classified application set within the set to which it belongs, and then obtain the average similarity corresponding to the N Android applications to be tested, and then enter step G; wherein, |Rolep |Represents the permission set Role of Android application p p The number of permissions in |Role q |Represents the permission set Role of Android application q q The number of permissions in |Role pq |Represents the permission set Role p and Role q The number of common permissions between them.

[0073] Step G: for each Android application to be tested, determine whether the average similarity corresponding to the Android application to be tested is less than a preset similarity threshold. If so, determine that the Android application to be tested is a malicious application; otherwise, do not determine the Android application to be tested.

[0074] The above technical solution designs a malicious application detection method based on Android application behavior classification. First, an automated testing tool is used to perform coverage testing on Android applications. During the coverage testing, an interface interception tool is used to obtain the interface information called during the test. Then, a system call vector is constructed according to the calling interface. After the vector is subjected to dimensionality reduction processing, the application corresponding to each vector is classified and the applications are added to application sets of different categories. Finally, the similarity between each application and the system call vector of other applications in each application set is calculated, and applications with a similarity lower than a set threshold are defined as malicious applications. The entire design method can make up for the problem that the current mainstream static detection algorithm has insufficient ability to combat code obfuscation. It has the characteristics of real-time performance and is not subject to static code. Therefore, dynamic detection is used to analyze the intentions behind malicious behaviors and the evolution of malicious behaviors. Compared with static detection, it has better compatibility and high execution efficiency, and can truly detect the maliciousness of a large number of sample Android application sets.

[0075] In actual applications, automated testing technology and system call interception tools are used to extract the system call status of the application during operation, and based on this, the system call vector is established; in the process of obtaining the system call, the tool is used to perform random testing on the application being tested to achieve the purpose of sufficient testing, and during the test process, the tool is used to intercept the number of times the application calls the system interface during the test; at the same time, the vector dimensionality reduction algorithm is used to reduce the dimensionality of the system call vector, thereby reducing the complexity of the subsequent algorithm for application classification based on the system call vector.

[0076] The embodiments of the present invention are described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Various changes can be made within the scope of knowledge possessed by ordinary technicians in this field without departing from the spirit of the present invention.

Claims

1. A malicious application detection method based on Android application behavior classification, characterized by: It is used to detect malicious applications for N Android applications to be tested, including the following steps: Step A. Using the Apk installation package name of the Android application to be tested as a parameter, obtain the original package name of the Apk installation package of each Android application to be tested, and then proceed to step B; Step B. Based on the startup of the Android application to be tested, obtain the parent process identifier corresponding to each Android application to be tested, and then proceed to step C; Step C. For each Android application under test, based on the test and tracking of the Android application under test, obtain the number of system calls made by the Android application under test to 360 systems under the Android operating system, and form a 360×1-dimensional system call count vector corresponding to the Android application under test; then obtain the system call count vector T corresponding to each Android application under test. n , forming a 360×N-dimensional system call feature matrix A=(T1,...,T n ,...,T N ) T , 1≤n≤N, T n Represents the system call count vector corresponding to the nth Android application to be tested, and then proceeds to step D; Step D: Perform dimensionality reduction operations on the dimensions of various systems involved in the system call feature matrix A, and update the system call count vector T corresponding to each Android application to be tested. n is an m×1-dimensional vector, and then the system call feature matrix A is updated to an m×N-dimensional matrix, where m represents the number of corresponding systems involved after the system call feature matrix A is reduced in dimension, and then the process goes to step E; Step E. Based on the system call feature matrix A, classify the N Android applications to be tested, obtain each classified application set, and then proceed to step F; Step F. For each classified application set, calculate the similarity between the permission sets of each Android application to be tested in the classified application set and the permission sets of the remaining Android applications to be tested in the set to which it belongs, and further calculate the average similarity of each Android application to be tested in the classified application set within the set to which it belongs, thereby obtaining the average similarity corresponding to the N Android applications to be tested, and then proceed to Step G; Step G: for each Android application to be tested, determine whether the average similarity corresponding to the Android application to be tested is less than a preset similarity threshold. If so, determine that the Android application to be tested is a malicious application; otherwise, do not determine the Android application to be tested.

2. The method for detecting malicious applications based on Android application behavior classification according to claim 1, characterized in that: In the step B, for each Android application to be tested, based on the startup of the Android application to be tested, a process information set of the running process in the environment where the Android application to be tested is located is obtained, and according to the original package name of the Android application to be tested, the application process information corresponding to the Android application to be tested is obtained from the NAME column of the corresponding process information in the process information set, and the parent process identifier of the application process information is further obtained; then the parent process identifier corresponding to each Android application to be tested is obtained, and then step C is entered.

3. The method for detecting malicious applications based on Android application behavior classification according to claim 1, characterized in that: In the step C, for each Android application to be tested, based on the operation of the Android application to be tested, a random test is performed on the Android application to be tested with the original package name of the Android application to be tested as a parameter, and the parent process identifier corresponding to the Android application to be tested is used as a parameter to track the system call sequence of the Android application to be tested. After the test is completed, the number of system calls of the Android application to 360 systems under the Android operating system obtained by the tracking is obtained to form a 360×1-dimensional system call number vector corresponding to the Android application to be tested.

4. The method for detecting malicious applications based on Android application behavior classification according to claim 1, characterized in that: The step D includes the following steps D1 to D4; Step D1. According to the 360×N dimensional system call feature matrix A corresponding to all the Android applications to be tested, obtain the corresponding 360×360 dimensional system call feature left singular matrix U and N×N dimensional system call feature right singular matrix V T , then proceed to step D2; Step D2. Calculate the eigenvalue set λ corresponding to the system call characteristic left singular matrix U U ={λ U1 ,λ U2 ,λ U3 ,...,λ U360 } and the set of eigenvectors ξ U ={ξ U1 ,ξ U2 ,ξ U3 ,...,ξ U360 }, and obtain the system call characteristic right singular matrix V T The corresponding eigenvalue set λ V ={λ V1 ,λ V2 ,λ V3 ,...,λ VN } and the set of eigenvectors ξ V ={ξ V1 ,ξ V2 ,ξ V3 ,...,ξ VN }, then go to step D3; Step D3. According to the system call characteristic left singular matrix U and the system call characteristic right singular matrix V T , eigenvector set ξ U , eigenvector set ξ V , obtain the intermediate matrix W in which all elements except the diagonal of the system call feature matrix A are 0, and then proceed to step D4; Step D4. Determine whether there is an element at position (i, i) in the intermediate matrix W that is 0. If so, for each position (i, i), delete the number of system calls corresponding to each i-th system of each Android application under test in the system call feature matrix A, and update the system call number vector T corresponding to each Android application under test. n It is an m×1 dimensional vector, and then the system call feature matrix A is updated to an m×N dimensional matrix, where m represents the number of corresponding systems involved after the system call feature matrix A is updated, 1≤i≤360, and then enters step E.

5. The method for detecting malicious applications based on Android application behavior classification according to claim 4, characterized in that: In step D1, according to the 360×N-dimensional system call feature matrix A corresponding to all the Android applications to be tested, the following formula is used: Obtain the corresponding 360×360 dimensional system call feature left singular matrix U and N×N dimensional system call feature right singular matrix V T .

6. The method for detecting malicious applications based on Android application behavior classification according to claim 4, characterized in that: In step D3, according to the system call characteristic left singular matrix U and the system call characteristic right singular matrix V T , eigenvector set ξ U , eigenvector set ξ V , according to the following formula: Obtain the intermediate matrix W in which all elements except the diagonal in the system call feature matrix A are 0, 1≤i≤360, j represents the column of the intermediate matrix W, w ij Represents the element in the i-th row and j-th column of the intermediate matrix W.

7. The method for detecting malicious applications based on Android application behavior classification according to claim 1, characterized in that: The step E includes the following steps E1 to E4; Step E1. Randomly generate NUM cluster vectors with dimension m, which are cluster vector sets Clu={C1,...,C num ,...,C NUM }, NUM is equal to N, 1≤num≤NUM, then initialize the classified application sets corresponding to each clustering point vector in the clustering point vector set Clu to an empty set, and initialize the state of each Android application to be tested to an unclassified state, and enter step E2; Step E2. Based on the system call feature matrix A, for each Android application under test in the unclassified state, calculate the clustering point vector in the clustering point vector set Clu that has the smallest distance to the system call count vector of the Android application under test, add the Android application under test to the classified application set corresponding to the clustering point vector, and update the state of the Android application under test to the classified state. After the classification operation for all Android applications under test is completed, the classified application set corresponding to each clustering point vector in the clustering point vector set Clu is updated, and then the process proceeds to Step E3. Step E3. For each of the cluster vectors in the cluster vector set Clu, determine whether there are any classified application sets containing no more than N / a Android applications to be tested. If so, delete each of the classified application sets, define the status of each Android application to be tested in each of the classified application sets as unclassified, and update NUM with the number of remaining classified application sets, and then proceed to step E4. Otherwise, the classification of the N Android applications to be tested is completed, and each classified application set is obtained, and then proceed to step F; where a is a preset parameter, 1 <a<N; Step E4. For each classified application set, based on the system call count vector of each Android application to be tested in the classified application set, calculate and update the clustering point vector corresponding to the classified application set, and then update the clustering point vector corresponding to each classified application set, and update the clustering point vector set Clu of NUM clustering point vectors = {C1, ..., C num ,...,C NUM }, then return to step E2.

8. The method for detecting malicious applications based on Android application behavior classification according to claim 7, characterized in that: In step E2, for each Android application to be tested, the following formula is used: Calculate the number of calls to the Android application system under test in the cluster vector set Clu and T n The cluster vector C with the smallest distance between them num , where C num =(c num,1 ,c num,2 ,...,c num,m ), T n =(t n,1 ,t n,2 ,...,t n,m ).

9. The method for detecting malicious applications based on Android application behavior classification according to claim 7, characterized in that: In step E4, for each classified application set, based on the system call count vector of each Android application to be tested in the classified application set, the following formula is used: Calculate and update the cluster point vector C corresponding to the classified application set num , where L num Indicates the number of Android applications to be tested in the num-th classified application set, T Lnum,num Indicates the Lth in the numth classified application set num A vector of the number of system calls of the Android application under test.

10. The method for detecting malicious applications based on Android application behavior classification according to claim 1, characterized in that: In step F, the permission set Role of the two Android applications p and q is obtained as follows: p and Role q Similarity Sim pq The formula is: For each classified application set, calculate the similarity between each Android application permission set to be tested in the classified application set and the remaining Android application permission sets to be tested in the set to which it belongs; where |Role p |Represents the permission set Role of Android application p p The number of permissions in |Role q |Represents the permission set Role of Android application q q The number of permissions in |Role pq |Represents the permission set Role p and Role q The number of common permissions between them.

Images