Mining behavior pattern of mobile malware with convolutional neural network

Xin ZHANG; Weizhong QIANG; Yueming WU; Deqing ZOU; Hai JIN

doi:10.11959/j.issn.2096-109x.2020073

您当前的位置：

首页 >

文章列表页 >

Mining behavior pattern of mobile malware with convolutional neural network

Special Column:Network Application and Protection Technology | 更新时间：2024-06-03

- Mining behavior pattern of mobile malware with convolutional neural network
- Chinese Journal of Network and Information Security Vol. 6, Issue 6, Pages: 35-44(2020)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020073
  CLC： TP393
- Online First：2020-12，
  
  Published：15 December 2020
- 稿件说明：
移动端阅览
Xin ZHANG, Weizhong QIANG, Yueming WU, et al. Mining behavior pattern of mobile malware with convolutional neural network[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 35-44.
DOI：

Xin ZHANG, Weizhong QIANG, Yueming WU, et al. Mining behavior pattern of mobile malware with convolutional neural network[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 35-44. DOI： 10.11959/j.issn.2096-109x.2020073.

摘要

现有的安卓恶意应用检测方法所提取的特征冗余且抽象，无法在高级语义上反映恶意应用的行为模式。针对这一问题，提出一种可解释性检测方法，通过社交网络检测算法聚类可疑系统调用组合，将其映射为单通道图像，用卷积神经网络进行分类，并利用卷积层梯度权重类激活映射可视化方法发现最可疑的系统调用组合，从而挖掘理解恶意应用行为。实验结果表明，所提方法在高效检测的基础上，能够正确发现恶意应用的行为模式。

Abstract

The features extracted by existing malicious Android application detection methods are redundant and too abstract to reflect the behavior patterns of malicious applications in high-level semantics.In order to solve this problem

an interpretable detection method was proposed.Suspicious system call combinations clustering by social network analysis was converted to a single channel image.Convolution neural network was applied to classify Android application.The model trained was used to find the most suspicious system call combinations by convolution layer gradient weight classification activation mapping algorithm

thus mining and understanding malicious application behavior.The experimental results show that the method can correctly discover the behavior patterns of malicious applications on the basis of efficient detection.

关键词

Keywords

references

Google android security 2018 report [EB ] .

RASTOGI V , CHEN Y , JIANG X . Catch me if you can:evaluating android anti-malware against transformation attacks [J ] . IEEE Transactions on Information Forensics and Security , 2013 , 9 ( 1 ): 99 - 108 .

SELVARAJU R R , COGSWELL M , DAS A , et al . Grad-cam:visual explanations from deep networks via gradient-based localization [C ] // Proceedings of the IEEE International Conference on Computer Vision . 2017 : 618 - 626 .

ARP D , SPREITZENBARTH M , HUBNER M , et al . Drebin:effective and explainable detection of android malware in your pocket [C ] // NDSS . 2014 23 - 26 .

ZHANG M , DUAN Y , YIN H , et al . Semantics-aware android malware classification using weighted contextual api dependency graphs [C ] // Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security . 2014 : 1105 - 1116 .

FENG Y , ANAND S , DILLIG I , et al . Apposcopy:semantics-based detection of android malware through static analysis [C ] // Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering . 2014 : 576 - 587 .

MARICONTI E , ONWUZURIKE L , ANDRIOTIS P , et al . Mamadroid:detecting android malware by building markov chains of behavioral models [J ] . arXiv preprint arXiv:1612.04433 , 2016

NATARAJ L , KARTHIKEYAN S , JACOB G , et al . Malware images:visualization and automatic classification [C ] // Proceedings of the 8th International Symposium on Visualization for Cyber Security . 2011 :4.

HSIEN-DE , HUANG T T , KAO H Y . R2-D2:color-inspired convolutional neural network (CNN)-based android malware detections [C ] // 2018 IEEE International Conference on Big Data (Big Data) . 2018 : 2633 - 2642 .

[EB/OL ] . https://ibotpeaches.github.io/Apktool https://ibotpeaches.github.io/Apktool .

RASTHOFER S , ARZT S , BODDEN E . A machine-learning approach for classifying and categorizing android sources and sinks [C ] // NDSS . 2014 :1125.

BLONDEL V D , GUILLAUME J L , LAMBIOTTE R , et al . Fast unfolding of communities in large networks [J ] . Journal of Statistical Mechanics:Theory and Experiment , 2008 ( 10 ):10008.

WU H C , LUK R W P , WONG K F , et al . Interpreting TF-IDF term weights as making relevance decisions [J ] . ACM Transactions on Information Systems (TOIS) , 2008 , 26 ( 3 ):13.

FAN M , LIU J , WANG W , et al . Dapasa:detecting android piggybacked apps through sensitive subgraph analysis [J ] . IEEE Transactions on Information Forensics and Security , 2017 , 12 ( 8 ): 1772 - 1785 .

KRIZHEVSKY A , SUTSKEVER I , HINTON G E . Imagenet classification with deep convolutional neural networks [C ] // Advances in neural information processing systems . 2012 : 1097 - 1105 .

SIMONYAN K , ZISSERMAN A . Very deep convolutional networks for large-scale image recognition [J ] . arXiv preprint arXiv:1409.1556 , 2014

HE K , ZHANG X , REN S , et al . Deep residual learning for image recognition [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 770 - 778 .

Views

360

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Unbalanced protocol recognition method based on improved residual U-Net

Research on the robustness of convolutional neural networks in image recognition

Android complex information flow analysis method based on communicating sequential process

Architecture design of re-configurable convolutional neural network on software definition

Classified risk assessment method of Android application based on multi-factor clustering selection

Related Author

Tiantian MA

Zheng HONG

Jisheng WU

Ping YI

Li PAN

Dian LIN

Xuehui DU

Shuyuan JIN

Related Institution

Information Engineering University

Sun Yat-sen University

Information Technology Innovation Center of Tianjin Binhai New Area

College of Cryptogram Engineering,Information Engineering University

China Electronics Standardization Institute

⁰