基于卷积神经网络恶意安卓应用行为模式挖掘

张鑫; 羌卫中; 吴月明; 邹德清; 金海

doi:10.11959/j.issn.2096-109x.2020073

您当前的位置：

首页 >

文章列表页 >

基于卷积神经网络恶意安卓应用行为模式挖掘

专栏：网络应用与防护技术 | 更新时间：2024-06-03

- 基于卷积神经网络恶意安卓应用行为模式挖掘
- Mining behavior pattern of mobile malware with convolutional neural network
- 网络与信息安全学报 2020年6卷第6期页码：35-44
- 作者机构：
- 作者简介：
  
  [ "张鑫（1993- ），男，河南汝州人，华中科技大学硕士生，主要研究方向为恶意软件检测" ]
  [ "羌卫中（1977- ），男，江苏南通人，博士，华中科技大学教授、博士生导师，主要研究方向为系统安全及软件安全" ]
  [ "吴月明（1993- ），男，湖北洪湖人，华中科技大学博士生，主要研究方向为恶意软件检测、漏洞检测" ]
  [ "邹德清（1975- ），男，湖南湘潭人，博士，华中科技大学教授、博士生导师，主要研究方向为软件安全" ]
  [ "金海（1966- ），男，上海人，博士，华中科技大学教授、博士生导师，主要研究方向为分布式计算" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(61772221);国家重点研发计划项目;The National Key Research ＆ Development (R＆D) Plan of China(2017YFB0802205)
- DOI：10.11959/j.issn.2096-109x.2020073
  中图分类号： TP393
- 网络首发：2020-12，
  
  纸质出版：2020-12-15
- 稿件说明：
移动端阅览
张鑫, 羌卫中, 吴月明, 等. 基于卷积神经网络恶意安卓应用行为模式挖掘[J]. 网络与信息安全学报, 2020,6(6):35-44.

Xin ZHANG, Weizhong QIANG, Yueming WU, et al. Mining behavior pattern of mobile malware with convolutional neural network[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 35-44.
张鑫, 羌卫中, 吴月明, 等. 基于卷积神经网络恶意安卓应用行为模式挖掘[J]. 网络与信息安全学报, 2020,6(6):35-44. DOI： 10.11959/j.issn.2096-109x.2020073.

Xin ZHANG, Weizhong QIANG, Yueming WU, et al. Mining behavior pattern of mobile malware with convolutional neural network[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 35-44. DOI： 10.11959/j.issn.2096-109x.2020073.

摘要

现有的安卓恶意应用检测方法所提取的特征冗余且抽象，无法在高级语义上反映恶意应用的行为模式。针对这一问题，提出一种可解释性检测方法，通过社交网络检测算法聚类可疑系统调用组合，将其映射为单通道图像，用卷积神经网络进行分类，并利用卷积层梯度权重类激活映射可视化方法发现最可疑的系统调用组合，从而挖掘理解恶意应用行为。实验结果表明，所提方法在高效检测的基础上，能够正确发现恶意应用的行为模式。

Abstract

The features extracted by existing malicious Android application detection methods are redundant and too abstract to reflect the behavior patterns of malicious applications in high-level semantics.In order to solve this problem

an interpretable detection method was proposed.Suspicious system call combinations clustering by social network analysis was converted to a single channel image.Convolution neural network was applied to classify Android application.The model trained was used to find the most suspicious system call combinations by convolution layer gradient weight classification activation mapping algorithm

thus mining and understanding malicious application behavior.The experimental results show that the method can correctly discover the behavior patterns of malicious applications on the basis of efficient detection.

关键词

Keywords

references

Google android security 2018 report [EB ] .

RASTOGI V , CHEN Y , JIANG X . Catch me if you can:evaluating android anti-malware against transformation attacks [J ] . IEEE Transactions on Information Forensics and Security , 2013 , 9 ( 1 ): 99 - 108 .

SELVARAJU R R , COGSWELL M , DAS A , et al . Grad-cam:visual explanations from deep networks via gradient-based localization [C ] // Proceedings of the IEEE International Conference on Computer Vision . 2017 : 618 - 626 .

ARP D , SPREITZENBARTH M , HUBNER M , et al . Drebin:effective and explainable detection of android malware in your pocket [C ] // NDSS . 2014 23 - 26 .

ZHANG M , DUAN Y , YIN H , et al . Semantics-aware android malware classification using weighted contextual api dependency graphs [C ] // Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security . 2014 : 1105 - 1116 .

FENG Y , ANAND S , DILLIG I , et al . Apposcopy:semantics-based detection of android malware through static analysis [C ] // Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering . 2014 : 576 - 587 .

MARICONTI E , ONWUZURIKE L , ANDRIOTIS P , et al . Mamadroid:detecting android malware by building markov chains of behavioral models [J ] . arXiv preprint arXiv:1612.04433 , 2016

NATARAJ L , KARTHIKEYAN S , JACOB G , et al . Malware images:visualization and automatic classification [C ] // Proceedings of the 8th International Symposium on Visualization for Cyber Security . 2011 :4.

HSIEN-DE , HUANG T T , KAO H Y . R2-D2:color-inspired convolutional neural network (CNN)-based android malware detections [C ] // 2018 IEEE International Conference on Big Data (Big Data) . 2018 : 2633 - 2642 .

[EB/OL ] . https://ibotpeaches.github.io/Apktool https://ibotpeaches.github.io/Apktool .

RASTHOFER S , ARZT S , BODDEN E . A machine-learning approach for classifying and categorizing android sources and sinks [C ] // NDSS . 2014 :1125.

BLONDEL V D , GUILLAUME J L , LAMBIOTTE R , et al . Fast unfolding of communities in large networks [J ] . Journal of Statistical Mechanics:Theory and Experiment , 2008 ( 10 ):10008.

WU H C , LUK R W P , WONG K F , et al . Interpreting TF-IDF term weights as making relevance decisions [J ] . ACM Transactions on Information Systems (TOIS) , 2008 , 26 ( 3 ):13.

FAN M , LIU J , WANG W , et al . Dapasa:detecting android piggybacked apps through sensitive subgraph analysis [J ] . IEEE Transactions on Information Forensics and Security , 2017 , 12 ( 8 ): 1772 - 1785 .

KRIZHEVSKY A , SUTSKEVER I , HINTON G E . Imagenet classification with deep convolutional neural networks [C ] // Advances in neural information processing systems . 2012 : 1097 - 1105 .

SIMONYAN K , ZISSERMAN A . Very deep convolutional networks for large-scale image recognition [J ] . arXiv preprint arXiv:1409.1556 , 2014

HE K , ZHANG X , REN S , et al . Deep residual learning for image recognition [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 770 - 778 .

浏览量

360

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于改进的残差U-Net的不平衡协议识别方法

面向图像识别的卷积神经网络鲁棒性研究进展

基于通信顺序进程的Android程序复杂信息流分析方法

基于软件定义的可重构卷积神经网络架构设计

基于多因素聚类选择的Android应用程序分类风险评估方法