Android malware family classification method based on the image of bytecodeConstruction of MDS matrices

Yi-min YANG; Tie-ming CHEN

doi:10.11959/j.issn.2096-109x.2016.00066

您当前的位置：

首页 >

文章列表页 >

Android malware family classification method based on the image of bytecodeConstruction of MDS matrices

academic paper | 更新时间：2024-06-03

- Android malware family classification method based on the image of bytecodeConstruction of MDS matrices
- Chinese Journal of Network and Information Security Vol. 2, Issue 6, Pages: 38-43(2016)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2016.00066
  CLC： TP301
- Online First：2016-06，
  
  Published：15 June 2016
- 稿件说明：
移动端阅览
Yi-min YANG, Tie-ming CHEN. Android malware family classification method based on the image of bytecodeConstruction of MDS matrices[J]. Chinese Journal of Network and Information Security, 2016, 2(6): 38-43.
DOI：

Yi-min YANG, Tie-ming CHEN. Android malware family classification method based on the image of bytecodeConstruction of MDS matrices[J]. Chinese Journal of Network and Information Security, 2016, 2(6): 38-43. DOI： 10.11959/j.issn.2096-109x.2016.00066.

摘要

面对Android恶意代码高速增长的趋势，提出基于字节码图像的Android恶意代码家族分类方法，通过将Android恶意应用的字节码转化为256阶灰度图形式的字节码图像，利用GIST算法提取图像的纹理特征，并结合随机森林算法对特征进行分类。对常见的14种Android恶意代码家族的样本进行了实验验证，并与DREBIN方法进行比较，实验结果表明，该方法可有效进行Android恶意代码家族分类，具有检测精度高且误报率低的优点。

Abstract

An Android malware family classification method based on the image of bytecode was proposed accord-ing to the exponential growth of Android malware.A bytecode file of Android malware was converted to a 256-level grayscale image and texture features was extracted from the image by GIST.The random forest algorithm was ap-plied to classify the extracted features.The method by the experimental data of 14 kinds of common Android mal-ware families was verified and was compared against the DREBIN on the same dataset.The experimental results show that the proposed method has high detection precision and low false positive rate.

关键词

Keywords

references

阿里聚安全 [EB/OL ] . http://jaq.alibaba.com/ http://jaq.alibaba.com/ . 2016 .

Ali poly security [EB/OL ] . http://jaq.alibaba.com/ http://jaq.alibaba.com/ . 2016 .

FOSSI M , EGAN G , HALEY K , et al . Symantec internet security threat report trends for 2010 [R ] . 2010 .

CONTI G , DEAN E , SINDA M , et al . Visual reverse engineering of binary and data files [J ] . Journal of General Physiology , 2008 , 115 ( 5 ): 637 .

ANDERSON B , STORLIE C , LANE T . Improving malware classi-fication:bridging the static/dynamic gap [C ] // The 5th ACM Work-shop on Security and Artificial Intelligence .c 2012 : 3 - 14 .

NATARAJ L , YEGNESWARAN V , PORRAS P , et al . A compara-tive assessment of malware classification using binary texture analysis and dynamic analysis [C ] // The 4th ACM Workshop on Se-curity and Artificial Intelligence .c 2011 : 21 - 30 .

NATARAJ L , KARTHIKEYAN S , JACOB G , et al . Malware im-ages:visualization and automatic classification [C ] // The 8th Interna-tional Symposium on Visualization for Cyber Security,ACM .c 2011 : 4 .

WU Y , YAP R . Experiments with malware visualization [M ] // De-tection of Intrusions and Malware,and Vulnerability Assessment . Berlin Heidelberg : Springer , 2012 : 123 - 133 .

HAN K , LIM J , IM E . Malware analysis method using visualization of binary files [C ] // The 2013 Research in Adaptive and Convergent Systems,ACM .c 2013 : 317 - 321 .

SHAID M , ZAINUDEEN S , MAAROF M . Malware behavior image for malware variant identification [C ] // 2014 International Symposium on Biometrics and Security Technologies (ISBAST),IEEE .c 2014 : 238 - 243 .

韩晓光，曲武，姚宣霞，等．基于纹理指纹的恶意代码变种检测方法研究 [J ] . 通信学报 , 2014 , 35 ( 8 ): 125 - 136 .

HAN X G , QU W , YAO X X , et al . Malicious code variants detec-tion method based on texture fingerprint study [J ] . Journal of Com-munications , 2014 , 35 ( 8 ): 125 - 136 .

ZHOU Y , JIANG X . Dissecting android malware:characterization and evolution [C ] // 2012 IEEE Symposium on Security and Privacy (SP),IEEE .c 2012 : 95 - 109 .

ARP D , SPREITZENBARTH M , HUBNER M , et al . DREBIN:effective and explainable detection of android malware in your pocket [C ] // Network and Distributed System Security Symposium (NDSS) .c 2014 .

ELENKOV N . Android security internals:an in-depth guide to android's security architecture [M ] . No Starch Press , 2014 .

OLIVA A , TORRALBA A . Modeling the shape of the scene:a holistic representation of the spatial envelope [J ] . International Journal of Computer Vision , 2001 , 42 ( 3 ): 145 - 175 .

T-SNE [EB/OL ] . http://lvdmaaten.github.io/tsne/ http://lvdmaaten.github.io/tsne/ . 2016 .

HAN J , KAMBER M , PEI J , . Data mining [M ] San Francisco : Morgan Kaufmann , 2011 .

The drebin dataset [EB/OL ] . http://user.informatik.uni-goettingen.de/～darp/drebin/ http://user.informatik.uni-goettingen.de/～darp/drebin/ . 2016 .

Views

545

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Bytecode-based approach for Ethereum smart contract classification

Android complex information flow analysis method based on communicating sequential process

Classified risk assessment method of Android application based on multi-factor clustering selection

Mining behavior pattern of mobile malware with convolutional neural network

Android malware detection method based on deep neural network

Related Author

Zibin ZHENG

Jiajing WU

Kaixin LIN

Dan LIN

Xuehui DU

Shuyuan JIN

Hongqi ZHANG

Zhi YANG

Related Institution

School of Software Engineering, Sun Yat-sen University

School of Computer Science and Engineering, SunYat-sen University

Information Engineering University

Sun Yat-sen University

College of Cryptogram Engineering,Information Engineering University

⁰