基于CNN的Android恶意代码检测方法

    Android Malicious Code Detection Based on CNN

    • 摘要: 针对传统Android恶意应用检测技术无法对当前爆发增长的恶意应用进行高效检测,对移动终端安全造成严重威胁的问题,利用深度学习中卷积神经网络(convolutional neural network,CNN)的分类算法,设计并实现了一种基于静态权限特征的恶意应用检测方案.首先,对Android应用包反编译获取AndroidManifest.xml文件,从中提取出应用申请的系统权限;然后,根据权限危险级别将权限列表特征化,获得权限特征数据集,进而,对CNN多次训练,获得应用类别分类器;最后,用分类器判断应用是否包含恶意代码.实验结果表明,检测方案的准确率达到98.8%,能够高效判断Android平台中的恶意应用,降低安全威胁.

       

      Abstract: Targeted at the problem that traditional detection technology for Android malicious applications can no longer effectively detect malicious applications that are in explosive growth, which brought great challenge to the security of the mobile terminal, a classification algorithm of convolutional neural network (CNN) in deep learning was adopted to design and implement a detection solution for malicious applications based on static permission characteristics. First, the Android application package was decompiled to obtain the AndroidManifest.xml file, and the system permissions of applications were extracted. Second, the permission list based on the risk level of permissions were characterized, and the data set of permission characteristics was obtained. Furthermore, a convolutional neural network was trained repeatedly to obtain the application classifier. Finally, the classifier was used to determine whether the application contains malicious code or not. Results show that the accuracy of the detection solution can reach 98.8% and can efficiently identify malicious applications on Android platform to address security threats.

       

    /

    返回文章
    返回