The invention relates to an 
active defense system based on Android platform 
software behavior detection. The 
active defense system based on Android platform 
software behavior detection is used for actively defending 
mobile phone security threats. According to the 
active defense system, process data are collected by using a top command or a PS command, and ActivityManager.MemoryInfo () and ActivityManager.AppProcessInfo () which are provided by an API (
Application Programming Interface) of Android; the collected data are analyzed by using a PCA (
Principal Component Analysis) method, features which best reflect samples are extracted, and the samples are loaded to a neural 
network model; and partial samples are randomly selected for learning so as to obtain 
model parameters which serve as 
model parameters of an evaluation portion, thus, the samples to be detected are evaluated, whether the samples are normal or not is judged, and then, whether some process is abnormal or not is judged. According to the active defense system, PCA 
dimensionality reduction is introduced into mobile phones in a manner of being combined with a BP (Back Propagation) neural network, so that the traditional computation amount and memory capacity of the BP neural network are reduced, the active defense system can be excellently implemented on mobile devices with limited computing power and storage capacity, such as the mobile phones, and the security of the mobile phones is guaranteed.