基于操作码的安卓恶意代码多粒度快速检测方法

张雪涛; 孙蒙; 王金双

doi:10.11959/j.issn.2096-109x.2019064

您当前的位置：

首页 >

文章列表页 >

基于操作码的安卓恶意代码多粒度快速检测方法

学术论文 | 更新时间：2024-06-03

- 基于操作码的安卓恶意代码多粒度快速检测方法
- Multi-granularity Android malware fast detection based on opcode
- 网络与信息安全学报 2019年5卷第6期页码：85-94
- 作者机构：
- 作者简介：
  
  [ "张雪涛（1995- ），男，河北保定人，硕士，主要研究方向为网络安全以及恶意软件检测" ]
  [ "孙蒙（1984- ），男，山东齐河人，博士，陆军工程大学副教授，主要研究方向为人工智能和网络安全" ]
  [ "王金双（1978- ），男，黑龙江佳木斯人，博士，陆军工程大学副教授，主要研究方向为系统安全，机器定理证明" ]
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2019064
  中图分类号： TP393
- 网络首发：2019-12，
  
  纸质出版：2019-12-15
- 稿件说明：
移动端阅览
张雪涛, 孙蒙, 王金双. 基于操作码的安卓恶意代码多粒度快速检测方法[J]. 网络与信息安全学报, 2019,5(6):85-94.

Xuetao ZHANG, Meng SUN, Jinshuang WANG. Multi-granularity Android malware fast detection based on opcode[J]. Chinese Journal of Network and Information Security, 2019, 5(6): 85-94.
张雪涛, 孙蒙, 王金双. 基于操作码的安卓恶意代码多粒度快速检测方法[J]. 网络与信息安全学报, 2019,5(6):85-94. DOI： 10.11959/j.issn.2096-109x.2019064.

Xuetao ZHANG, Meng SUN, Jinshuang WANG. Multi-granularity Android malware fast detection based on opcode[J]. Chinese Journal of Network and Information Security, 2019, 5(6): 85-94. DOI： 10.11959/j.issn.2096-109x.2019064.

摘要

基于操作码的检测方式被广泛用于安卓恶意软件检测中，但存在特征提取方法复杂、效率低等问题。针对此类问题，提出一种基于操作码的安卓恶意软件多粒度快速检测方法，其中多粒度指以词袋模型为基础、函数为基本单位提取特征，通过逐级聚合特征获得 APK 多层级信息，通过对数长度表征函数规模；并基于Dalvik指令集中操作码语义上的相似性对其进行压缩映射以提升效率，构建相应分类模型。测试表明所提方法在性能和效率上均有明显优势。

Abstract

The detection method based on opcode is widely used in Android malware detection

but it still contains some problems such as complex feature extraction method and low efficiency.In order to solve these problems

a multi-granularity fast detection method based on opcode for Android malware was proposed.Multi-granularity refers to the feature based on the bag of words model

and with the function as basic unit to extract features.By step-by-level aggregation feature

the APK multi-level information is obtained.The log length characterizes the scale of the function.And feature can be compressed and mapped to improve the efficiency and construct the corresponding classification model based on the semantic similarity of the Dalvik instruction set.Tests show that the proposed method has obvious advantages in performance and efficiency.

关键词

Keywords

references

360互联网安全中心 . 2018中国手机安全生态报告 [R ] . 2018 .

360 Internet Security Center . 2018 China mobile phone security ecological Report [R ] . 2018 .

ZHOU W , ZHOU Y J , JIANG X X , et al . Detecting repackaged smartphone applications in third-party Android marketplaces [C ] // The Second ACM Conference on Data and Application Security and Privacy . 2012 : 317 - 326 .

汪润 , 唐奔宵 , 王丽娜 . DeepRD:基于 Siamese LSTM 网络的Android重打包应用检测方法 [J ] . 通信学报 , 2018 , 39 ( 8 ): 69 - 82 .

WANG R , TANG B X , WANG L N . Deeprd:Android repackaging application detection method based on Siamese LSTM network [J ] . Journal on Communications , 2018 , 39 ( 8 ): 69 - 82 .

TIAN K , YAO D D , RYDER B G , et al . Detection of repackaged android malware with code-heterogeneity features [J ] . IEEE Transactions on Dependable and Secure Computing , 2017 : 1 - 1 .

SHABTAI A , MOSKOVITCH R , FEHER C , et al . Detecting unknown malicious code by applying classification techniques on opcode patterns [J ] . Security Informatics , 2012 , 1 ( 1 ): 1 - 22

LINDORFER M , NEUGSCHWANDTNER M , PLATZER C . MARVIN:efficient and comprehensive mobile app classification through static and dynamic analysis [C ] // IEEE Computer Software＆ Applications Conference.IEEE Computer Society . 2015 .

YERIMA S Y , SEZER S , MUTTIK I . High accuracy android malware detection using ensemble learning [J ] . Iet Information Security , 2016 , 9 ( 6 ): 313 - 320 .

JEROME Q , ALLIX K , STATE R , et al . Using opcode-sequences to detect malicious Android applications [C ] // 2014 IEEE International Conference on Communications (ICC) . 2014 : 914 - 919 .

KANG B J , YERIMA S Y , MCLAUGHLIN K , et al . N-opcode analysis for android malware classification and categorization [C ] // 2016 International Conference on Cyber Security and Protection of Digital Services (Cyber Security) . 2016 : 1 - 7 .

YEWALE A , SINGH M . Malware detection based on opcode frequency [C ] // IEEE International Conference on Advanced Communication Control ＆ Computing Technologies . 2017 .

CHEN T , MAO Q , YANG Y , et al . TinyDroid:a lightweight and efficient model for android malware detection and classification [J ] . Mobile Information Systems , 2018 : 1 - 9 .

BAKHSHINEJAD N , HAMZEH A . A new compression based method for android malware detection using opcodes [C ] // IEEE Artificial Intelligence and Signal Processing Conference . 2018 : 256 - 261 .

DONG H , HE N Q , HU G , et al . Malware detection method of android application based on simplification instructions [J ] . The Journal of China Universities of Posts and Telecommunications , 2014 , 21 : 94 - 100 .

KIM Y , . Convolutional neural networks for sentence classification [C ] // The 2014 Conference on Empirical Methods in Natural Language Processing . 2014 .

KLAMBAUER G , UNTERTHINER T , MAYR A , et al . Self- normalizing neural networks [C ] // Advances in Neural Information Processing Systems 30 (NIPS 2017) . 2017 : 971 - 980 .

ARP D , SPREITZENBARTH M , HUBNER M , et al . Drebin:effective and explainable detection of android malware in your pocket [C ] // NDSS . 2014 : 23 - 26 .

MCLAUGHLIN N , RINCON J M D , KANG B J , et al . Deep android malware detection [C ] // ACM on Conference on Data ＆ Application Security ＆ Privacy . 2017 .

浏览量

368

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于卷积神经网络恶意安卓应用行为模式挖掘