基于字节码图像的Android恶意代码家族分类方法

杨益敏; 陈铁明

doi:10.11959/j.issn.2096-109x.2016.00066

您当前的位置：

首页 >

文章列表页 >

基于字节码图像的Android恶意代码家族分类方法

学术论文 | 更新时间：2024-06-03

- 基于字节码图像的Android恶意代码家族分类方法
- Android malware family classification method based on the image of bytecodeConstruction of MDS matrices
- 网络与信息安全学报 2016年2卷第6期页码：38-43
- 作者机构：
- 作者简介：
  
  [ "杨益敏（1985-），男，浙江宁波人，浙江工业大学硕士生，主要研究方向为网络与信息安全。" ]
  [ "陈铁明（1978-），男，博士，浙江工业大学教授，主要研究方向为网络与信息安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(U1509214);浙江省自然科学基金资助项目;The Natural Science Foundation of Zhejiang Province(LY16F020035)
- DOI：10.11959/j.issn.2096-109x.2016.00066
  中图分类号： TP301
- 网络首发：2016-06，
  
  纸质出版：2016-06-15
- 稿件说明：
移动端阅览
杨益敏, 陈铁明. 基于字节码图像的Android恶意代码家族分类方法[J]. 网络与信息安全学报, 2016,2(6):38-43.

Yi-min YANG, Tie-ming CHEN. Android malware family classification method based on the image of bytecodeConstruction of MDS matrices[J]. Chinese Journal of Network and Information Security, 2016, 2(6): 38-43.
杨益敏, 陈铁明. 基于字节码图像的Android恶意代码家族分类方法[J]. 网络与信息安全学报, 2016,2(6):38-43. DOI： 10.11959/j.issn.2096-109x.2016.00066.

Yi-min YANG, Tie-ming CHEN. Android malware family classification method based on the image of bytecodeConstruction of MDS matrices[J]. Chinese Journal of Network and Information Security, 2016, 2(6): 38-43. DOI： 10.11959/j.issn.2096-109x.2016.00066.

摘要

面对Android恶意代码高速增长的趋势，提出基于字节码图像的Android恶意代码家族分类方法，通过将Android恶意应用的字节码转化为256阶灰度图形式的字节码图像，利用GIST算法提取图像的纹理特征，并结合随机森林算法对特征进行分类。对常见的14种Android恶意代码家族的样本进行了实验验证，并与DREBIN方法进行比较，实验结果表明，该方法可有效进行Android恶意代码家族分类，具有检测精度高且误报率低的优点。

Abstract

An Android malware family classification method based on the image of bytecode was proposed accord-ing to the exponential growth of Android malware.A bytecode file of Android malware was converted to a 256-level grayscale image and texture features was extracted from the image by GIST.The random forest algorithm was ap-plied to classify the extracted features.The method by the experimental data of 14 kinds of common Android mal-ware families was verified and was compared against the DREBIN on the same dataset.The experimental results show that the proposed method has high detection precision and low false positive rate.

关键词

Keywords

references

阿里聚安全 [EB/OL ] . http://jaq.alibaba.com/ http://jaq.alibaba.com/ . 2016 .

Ali poly security [EB/OL ] . http://jaq.alibaba.com/ http://jaq.alibaba.com/ . 2016 .

FOSSI M , EGAN G , HALEY K , et al . Symantec internet security threat report trends for 2010 [R ] . 2010 .

CONTI G , DEAN E , SINDA M , et al . Visual reverse engineering of binary and data files [J ] . Journal of General Physiology , 2008 , 115 ( 5 ): 637 .

ANDERSON B , STORLIE C , LANE T . Improving malware classi-fication:bridging the static/dynamic gap [C ] // The 5th ACM Work-shop on Security and Artificial Intelligence .c 2012 : 3 - 14 .

NATARAJ L , YEGNESWARAN V , PORRAS P , et al . A compara-tive assessment of malware classification using binary texture analysis and dynamic analysis [C ] // The 4th ACM Workshop on Se-curity and Artificial Intelligence .c 2011 : 21 - 30 .

NATARAJ L , KARTHIKEYAN S , JACOB G , et al . Malware im-ages:visualization and automatic classification [C ] // The 8th Interna-tional Symposium on Visualization for Cyber Security,ACM .c 2011 : 4 .

WU Y , YAP R . Experiments with malware visualization [M ] // De-tection of Intrusions and Malware,and Vulnerability Assessment . Berlin Heidelberg : Springer , 2012 : 123 - 133 .

HAN K , LIM J , IM E . Malware analysis method using visualization of binary files [C ] // The 2013 Research in Adaptive and Convergent Systems,ACM .c 2013 : 317 - 321 .

SHAID M , ZAINUDEEN S , MAAROF M . Malware behavior image for malware variant identification [C ] // 2014 International Symposium on Biometrics and Security Technologies (ISBAST),IEEE .c 2014 : 238 - 243 .

韩晓光，曲武，姚宣霞，等．基于纹理指纹的恶意代码变种检测方法研究 [J ] . 通信学报 , 2014 , 35 ( 8 ): 125 - 136 .

HAN X G , QU W , YAO X X , et al . Malicious code variants detec-tion method based on texture fingerprint study [J ] . Journal of Com-munications , 2014 , 35 ( 8 ): 125 - 136 .

ZHOU Y , JIANG X . Dissecting android malware:characterization and evolution [C ] // 2012 IEEE Symposium on Security and Privacy (SP),IEEE .c 2012 : 95 - 109 .

ARP D , SPREITZENBARTH M , HUBNER M , et al . DREBIN:effective and explainable detection of android malware in your pocket [C ] // Network and Distributed System Security Symposium (NDSS) .c 2014 .

ELENKOV N . Android security internals:an in-depth guide to android's security architecture [M ] . No Starch Press , 2014 .

OLIVA A , TORRALBA A . Modeling the shape of the scene:a holistic representation of the spatial envelope [J ] . International Journal of Computer Vision , 2001 , 42 ( 3 ): 145 - 175 .

T-SNE [EB/OL ] . http://lvdmaaten.github.io/tsne/ http://lvdmaaten.github.io/tsne/ . 2016 .

HAN J , KAMBER M , PEI J , . Data mining [M ] San Francisco : Morgan Kaufmann , 2011 .

The drebin dataset [EB/OL ] . http://user.informatik.uni-goettingen.de/～darp/drebin/ http://user.informatik.uni-goettingen.de/～darp/drebin/ . 2016 .

浏览量

545

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于字节码的以太坊智能合约分类方法

基于通信顺序进程的Android程序复杂信息流分析方法

基于多因素聚类选择的Android应用程序分类风险评估方法

基于卷积神经网络恶意安卓应用行为模式挖掘

基于深度神经网络的Android恶意软件检测方法