Android malware detection method based on deep neural network

Fan CHAO; Zhi YANG; Xuehui DU; Yan SUN

doi:10.11959/j.issn.2096-109x.2020060

您当前的位置：

首页 >

文章列表页 >

Android malware detection method based on deep neural network

Papers | 更新时间：2024-06-03

- Android malware detection method based on deep neural network
- Chinese Journal of Network and Information Security Vol. 6, Issue 5, Pages: 67-79(2020)
- 作者机构：
  
  1. 信息工程大学密码工程学院，河南郑州 450001
  2. 中国电子技术标准化研究院，北京 100007
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020060
  CLC： TP309.5
- Online First：2020-10，
  
  Published：15 October 2020
- 稿件说明：
移动端阅览
Fan CHAO, Zhi YANG, Xuehui DU, et al. Android malware detection method based on deep neural network[J]. Chinese Journal of Network and Information Security, 2020, 6(5): 67-79.
DOI：

Fan CHAO, Zhi YANG, Xuehui DU, et al. Android malware detection method based on deep neural network[J]. Chinese Journal of Network and Information Security, 2020, 6(5): 67-79. DOI： 10.11959/j.issn.2096-109x.2020060.

摘要

Android 系统正日益面临着恶意软件的攻击威胁。针对支持向量机等传统机器学习方法难以有效进行大样本多分类的恶意软件检测，提出一种基于深度神经网络的Android恶意软件检测与家族分类方法。该方法在全面提取应用组件、Intent Filter、权限、数据流等特征基础上，进行有效的特征选择以降低维度，基于深度神经网络进行面向恶意软件的大样本多分类检测。实验结果表明，该方法能够进行有效检测和分类，良性、恶意二分类精度为 97.73%，家族多分类精度可达到 93.54%，比其他机器学习算法有更好的分类效果。

Abstract

Android is increasingly facing the threat of malware attacks.It is difficult to effectively detect large-sample and multi-class malware for traditional machine learning methods such as support vector machine

method for Android malware detection and family classification based on deep neural network was proposed.Based on the comprehensive extraction of application components

Intent Filter

permissions

and data flow

the method performed an effective feature selection to reduce dimensions

and conducted a large-sample detection and multi-class classification for malware based on deep neural network.The experimental results show that the method can conduct an effective detection and classification.The accuracy of binary classification between benign and malicious Apps is 97.73%

and the accuracy of family multi-class classification can reach 93.54%

which is higher than other machine learning algorithms.

关键词

Keywords

references

ARP D , SPREITZENBARTH M , HUBNER M , et al . Drebin:efficient and explainable detection of Android malware in your pocket [C ] // The 19th Annual Network and Distributed System Security Symposium (NDSS) . 2014 : 1 - 12 .

AVDIIENKO V , KUZNETSOV K , GORLA A , et al . Mining APPs for abnormal usage of sensitive data [C ] // The 37th International Conference on Software Engineering (ICSE) . 2015 : 426 - 436 .

XU K , LI Y , DENG R H . ICCDetector:ICC-based malware detection on Android [J ] . IEEE Transactions on Information Forensics and Security , 2016 , 11 ( 6 ): 1252 - 1264 .

DAHL G E , STOKES J W , DENG L , et al . Large-scale malware classification using random projections and neural networks [C ] // The 38th International Conference on Acoustics,Speech and Signal Processing . 2013 : 3422 - 3426 .

HUANG W Y , STOKES J W . MtNet:a multi-task neural network for dynamic malware classification [C ] // The 5th International Conference on Detection of Intrusions and Malware,and Vulnerability Assessment . 2016 : 399 - 418 .

TOBIYAMA S , YAMAGUCHI Y , SHIMADA H , et al . Malware detection with deep neural network using process behavior [C ] // IEEE 40th Annual Conference on Computer Software and Applications . 2016 : 577 - 582 .

李璐 . 基于函数调用图的Android恶意软件检测 [J ] . 现代计算机(专业版) , 2018 ( 12 ): 28 - 33 .

LI L . Android malware detection based on function call graph [J ] . Modern Computer , 2018 ( 12 ): 28 - 33 .

NIX R , ZHANG J . Classification of Android APPs and malware using deep neural networks [C ] // The 17th International Joint Conference on Neural Networks . 2017 : 1871 - 1878 .

MCLAUGHLIN N , RINCON J M , KANG B J , et al . Deep Android malware detection [C ] // The 7th ACM on Conference on Data and Application Security and Privacy (CODASPY) . 2017 : 301 - 308 .

杨宏宇 , 那玉琢 . 一种Android恶意软件检测模型 [J ] . 西安电子科技大学学报 , 2019 , 46 ( 3 ): 45 - 51 .

YANG H Y , NA Y Z . Android malware detection model [J ] . Journal of Xidian University , 2019 , 46 ( 3 ): 45 - 51 .

欧阳立 , 芦天亮 . 基于深度置信网络的 Android 恶意软件检测 [J ] . 信息技术与网络安全 , 2019 , 38 ( 5 ): 22 - 27 .

OUYANG L , LU T L . Android malware detection using deep belief network [J ] . Journal of Information Technology and Network Security , 2019 , 38 ( 5 ): 22 - 27 .

吴招娣 , 徐洋 , 谢晓尧 . 基于AE-DBN的Android恶意软件检测 [J ] . 贵州师范大学学报(自然科学版) , 2019 , 37 ( 3 ): 96 - 101 .

WU Z D , XU Y , XIE X Y . Android malware detection based on AE-DBN [J ] . Journal of Guizhou Normal University (Natural Sciences) , 2019 , 37 ( 3 ): 96 - 101 .

石兴华 , 曹金璇 , 芦天亮 . 基于深度森林的安卓恶意软件行为分析与检测 [J ] . 软件 , 2019 , 40 ( 10 ): 1 - 5 ,72.

SHI X H , CAO J X , LU T L . Analysis and detection of Android malware based on Gcforest [J ] . Computer Engineering ＆ Software , 2019 , 40 ( 10 ): 1 - 5 ,72.

YUAN Z L , LU Y Q , WANG Z G , et al . Droid-Sec:deep learning in Android malware detection [J ] . ACM SIGCOMM Computer Communication Review , 2014 , 44 ( 4 ): 371 - 372 .

YUAN Z L , LU Y Q , XUE Y B . DroidDetector:Android malware characterization and detection using deep learning [J ] . Tsinghua Science and Technology , 2016 , 21 ( 1 ): 114 - 123 .

苏志达 , 祝跃飞 , 刘龙 . 基于深度学习的安卓恶意应用检测 [J ] . 计算机应用 , 2017 , 37 ( 6 ): 1650 - 1656 .

SU Z D , ZHU Y F , LIU L . Android malware application detection using deep learning [J ] . Journal of Computer Applications , 2017 , 37 ( 6 ): 1650 - 1656 .

XU L F , ZHANG D P , JAYASENA N , et al . HADM:hybrid analysis for detection of malware [C ] // The 3rd SAI Intelligent Systems Conference . 2016 : 702 - 724 .

王涛 , 李剑 . 基于深度学习的Android恶意软件检测系统的设计和实现 [J ] . 信息安全研究 , 2018 , 4 ( 2 ): 140 - 144 .

WANG T , LI J . Design and implementation of Android malware detection system based on deep learning [J ] . Journal of Information Security Research , 2018 , 4 ( 2 ): 140 - 144 .

周明 , 孙树栋 . 遗传算法原理及应用 [M ] . 北京 : 国防工业出版社 , 1999 .

ZHOU M , SUN S D . Genetic algorithm theory and applications [M ] . Beijing : National Defense Industry PressPress , 1999 .

ARZT S , RASTHOFER S , FRITZ C , et al . FlowDroid:precise context,flow,field,object-sensitive and lifecycle-aware taint analysis for Android APPs [C ] // The 35th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) . 2014 : 259 - 269 .

RASTHOFER S , ARZT S , BODDEN E . A machine-learning approach for classifying and categorizing Android sources and sinks [C ] // The 19th Annual Network and Distributed System Security Symposium (NDSS) . 2014 ( 42 ): 1 - 15 .

DESNOS A . Androguard documentation,release 3.3.5 [R ] . 2019 .

黄文坚 , 唐源 . TensorFlow 实战 [M ] . 北京：电子工业出版社 , 2017 .

HUANG W J , TANG Y . TensorFlow practice [M ] . Beijing : Electronic Industry PressPress , 2017 .

ZHOU Y J , JIANG X X . Dissecting Android malware:characterization and evolution [C ] // The 33rd IEEE Symposium on Security and Privacy (Oakland) . 2012 : 95 - 109 .

Google Groups . VirusTotal [EB ] .

周志华 . 机器学习 [M ] . 北京 : 清华大学出版社 , 2016 .

ZHOU Z H . Machine learning [M ] . Beijing : Tsinghua University PressPress , 2016 .

Views

1050

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Multi-feature fusion malware detection method based on attention and gating mechanisms

Classified risk assessment method of Android application based on multi-factor clustering selection

Adversarial detection based on feature invariant in license plate recognition systems

Adversarial method for malicious ELF file detection based on deep reinforcement learning

Automatic generation of AppArmor security policies based on large language models

Related Author

Jianbiao ZHANG

Zhongyuan CHEN

Bing HAN

Xuehui DU

Zhi YANG

Fan CHAO

HUANG Zheng

QIU Weidong

Related Institution

School of Cyber Science and Engineering, Shanghai Jiao Tong University

College of Computer Science, Sichuan University

School of Cyber Science and Engineering, Sichuan University

Key Laboratory of Experimental Physics and Computational Mathematics

Nanjing Nanrui Information and Communication Technology Limited Company

⁰