基于API语义聚类的安卓恶意软件检测方法研究

王练; 青山科

doi:10.11959/j.issn.2096-109x.2025075

您当前的位置：

首页 >

文章列表页 >

基于API语义聚类的安卓恶意软件检测方法研究

学术论文 | 更新时间：2026-01-28

- 基于API语义聚类的安卓恶意软件检测方法研究
- Research on Android malware detection method based on API semantic clustering
- 网络与信息安全学报 2025年11卷第6期页码：165-177
- 作者机构：
  
  重庆邮电大学，重庆 400065
- 作者简介：
  
  [ "王练（1976- ），女，贵州遵义人，博士，大学重庆邮电教授，主要研究方向为无线网络编码、无线网络安全。" ]
  [ "青山科（1999- ），男，四川成都人，重庆邮电大学硕士生，主要研究方向为恶意软件检测、API语义。" ]
- 基金信息：
  
  重庆市教委科学技术研究项目(KJZD-K202500604)
- DOI：10.11959/j.issn.2096-109x.2025075
  中图分类号： TP393
- 收稿：2025-03-21，
  
  修回：2025-07-06，
  
  纸质出版：2025-12-25
- 稿件说明：
移动端阅览
王练, 青山科. 基于API语义聚类的安卓恶意软件检测方法研究[J]. 网络与信息安全学报, 2025, 11(6): 165-177.

WANG Lian, QING Shanke. Research on Android malware detection method based on API semantic clustering[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 165-177.
王练, 青山科. 基于API语义聚类的安卓恶意软件检测方法研究[J]. 网络与信息安全学报, 2025, 11(6): 165-177. DOI： 10.11959/j.issn.2096-109x.2025075.

WANG Lian, QING Shanke. Research on Android malware detection method based on API semantic clustering[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 165-177. DOI： 10.11959/j.issn.2096-109x.2025075.

摘要

针对传统安卓恶意软件检测方法在面对变种样本时存在检测准确性下降和模型老化问题，提出一种基于应用程序编程接口（application programming interface

API）语义聚类的恶意软件检测方法。首先，通过函数调用图优化算法去除冗余节点，并结合Skip-Gram模型对API调用序列进行语义向量嵌入，以捕捉API间的功能关联与上下文相似性；然后，利用K-means聚类将语义相近的API归为同类，并通过动态扩展算法适应新出现的API。为验证所提方法的有效性，实验部分首先基于2017—2018年的大量数据集进行训练，然后针对2019—2023年进化的恶意样本进行检测。将所提方法与经典检测方法MaMaDroid和MalScan等开展对比实验，结果显示所提方法的平均

1分数达到96.6%。在模型老化实验中，所提方法的平均

1值提升了8.3%~23.1%。此外，通过API语义特征对比实验和不同类簇数量实验，进一步验证了语义提取精度与类簇设置对检测性能具有提升效果。综合上述实验结果可知，所提方法能够实现更高的检测准确性和更低的老化速度。

Abstract

To address the challenges of declining detection accuracy and model aging in traditional Android malware detection methods when encountering variant samples

a ma

lware detection method based on API semantic clustering was proposed. Redundant nodes were eliminated through a function call graph optimization algorithm

and API call sequences were embedded into semantic vectors using the Skip-Gram model to capture functional and contextual similarities between APIs. Semantically similar APIs were then grouped via K-means clustering

and a dynamic extension algorithm was introduced to adapt to newly emerged APIs.To verify the effectiveness of the proposed method

experiments were conducted by training on a large-scale dataset from 2017—2018

followed by detection on evolved malicious samples from 2019—2023. The proposed method was compared with the classic detection methods such as MaMaDroid and Malscan through experiments. The results showed that the average

1 score of the proposed method reached 96.6%. In model aging experiments

the proposed method improved the average

1-score by 8.3%~23.1%. Furthermore

comparative experiments on API semantic features and cluster quantity analysis confirm that the precision of semantic extraction and cluster configuration significantly improves detection performance. Experimental results indicate that the proposed method achieves higher detection accuracy and exhibits a slower aging rate.

关键词

Keywords

references

范铭 , 刘烃 , 刘均 , 等 . 安卓恶意软件检测方法综述 [J ] . 中国科学: 信息科学 , 2020 , 50 ( 8 ): 1148 - 1177 .

FAN M , LIU T , LIU J , et al . Android malware detection: a survey [J ] . Scientia Sinica (Informationis) , 2020 , 50 ( 8 ): 1148 - 1177 .

KIVVA A . Smartphone malware statistics, Q1 [R ] . 2023 .

DHALARIA M , GANDOTRA E . Android malware detection techniques: a literature review [J ] . Recent Patents on Engineering , 2021 , 15 ( 2 ): 225 - 245 .

王思远 , 张仰森 , 曾健荣 , 等 . Android恶意软件检测方法综述 [J ] . 计算机应用与软件 , 2021 , 38 ( 9 ): 1 - 9 .

WANG S Y , ZHANG Y S , ZENG J R , et al . Overview of Android malware detection methods [J ] . Computer Applications and Software , 2021 , 38 ( 9 ): 1 - 9 .

WANG W , WANG X , FENG D W , et al . Exploring permission-induced risk in Android applications for malicious application detection [J ] . IEEE Transactions on Information Forensics and Security , 2014 , 9 ( 11 ): 1869 - 1882 .

LIU J , HUANG J Z , ZHOU Y , et al . From distributed machine learning to federated learning: a survey [J ] . Knowledge and Information Systems , 2022 , 64 ( 4 ): 885 - 917 .

DEHKORDY D T , RASOOLZADEGAN A . A new machine learning-based method for Android malware detection on imbalanced dataset [J ] . Multimedia Tools and Applications , 2021 , 80 ( 16 ): 24533 - 24554 .

KEYVANPOUR M R , BARANI-SHIRZAD M , HEYDARIAN F . Android malware detection applying feature selection techniques and machine learning [J ] . Multimedia Tools and Applications , 2023 , 82 ( 6 ): 9517 - 9531 .

DONG S , SHU L H , NIE S . Android malware detection method based on CNN and DNN bybrid mechanism [J ] . IEEE Transactions on Industrial Informatics , 2024 , 20 ( 5 ): 7744 - 7753 .

SHU L H , DONG S , SU H D , et al . Android malware detection methods based on convolutional neural network: a survey [J ] . IEEE Transactions on Emerging Topics in Computational Intelligence , 2023 , 7 ( 5 ): 1330 - 1350 .

NAEEM H , CHENG X C , ULLAH F , et al . A deep convolutional neural network stacked ensemble for malware threat classification in Internet of Things [J ] . Journal of Circuits, Systems and Computers , 2022 , 31 ( 17 ): 2250302 .

NAEEM H , DONG S , FALANA O J , et al . Development of a deep stacked ensemble with process based volatile memory forensics for platform independent malware detection and classification [J ] . Expert Systems with Applications , 2023 , 223 : 119952 .

ZHU H J , WANG L M , ZHONG S , et al . A hybrid deep network framework for Android malware detection [J ] . IEEE Transactions on Knowledge and Data Engineering , 2022 , 34 ( 12 ): 5558 - 5570 .

DAREM A A , GHALEB F A , AL-HASHMI A A , et al . An adaptive behavioral-based incremental batch learning malware variants detection model using concept drift detection and sequential deep learning [J ] . IEEE Access , 2021 , 9 : 97180 - 97196 .

FICCO M . Malware analysis by combining multiple detectors and observation windows [J ] . IEEE Transactions on Computers , 2021 , 71 ( 6 ): 1276 - 1290 .

LU H , JIN C J , HELU X H , et al . Research on intelligent detection of command level stack pollution for binary program analysis [J ] . Mobile Networks and Applications , 2021 , 26 ( 4 ): 1723 - 1732 .

XU K , LI Y J , DENG R , et al . DroidEvolver: self-evolving Android malware detection system [C ] // Proceedings of the 2019 IEEE European Symposium on Security and Privacy (EuroS&P) . Piscataway : IEEE Press , 2019 : 47 - 62 .

KASPERSKY . Machine learning methods for malware detection [R ] . 2019 .

D’ANGELO G , FICCO M , PALMIERI F . Association rule-based malware classification using common subsequences of API calls [J ] . Applied Soft Computing , 2021 , 105 : 107234 .

ARICONTI E , ONWUZURIKE L , ANDRIOTIS P , et al . MaMaDroid: detecting Android malware by building Markov chains of behavioral models (extended version) [J ] . ACM Transactions on Privacy and Security (TOPS) , 2019 , 22 ( 2 ): 1 - 34 .

YUMLEMBAM R , ISSAC B , YANG L Z , et al . Android malware classification and optimisation based on BM25 score of Android API [C ] // Proceedings of the IEEE INFOCOM 2023 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) . Piscataway : IEEE Press , 2023 : 1 - 6 .

WU Y M , LI X D , ZOU D Q , et al . MalScan: fast market-wide mobile malware scanning by social-network centrality analysis [C ] // Proceedings of the 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE) . Piscataway : IEEE Press , 2019 : 139 - 150 .

ZHANG X H , ZHANG Y , ZHONG M , et al . Enhancing state-of-the-art classifiers with API semantics to detect evolved Android malware [C ] // Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2020 : 757 - 770 .

CUI L , CUI J C , JI Y D , et al . API2Vec: learning representations of API sequences for malware detection [C ] // Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis . New York : ACM , 2023 : 261 - 273 .

蒋煦 , 张长胜 , 戴大蒙 , 等 . Android平台恶意应用程序静态检测方法 [J ] . 计算机系统应用 , 2016 , 25 ( 4 ): 1 - 7 .

JIANG X , ZHANG C S , DAI D M , et al . Static detection of Android malware [J ] . Computer Systems & Applications , 2016 , 25 ( 4 ): 1 - 7 .

朱晋恺 , 方兰婷 , 季小文 , 等 . 基于行为特征和语义特征的多模态Android恶意软件检测方法 [J ] . 电子科技 , 2024 , 37 ( 5 ): 71 - 78 .

ZHU J K , FANG L T , JI X W , et al . Multimodal Android malware detection method based on behavioral and semantic characteristics [J ] . Electronic Science and Technology , 2024 , 37 ( 5 ): 71 - 78 .

YANG H Y , WANG Y W , ZHANG L , et al . A novel Android malware detection method with API semantics extraction [J ] . Computers & Security , 2024 , 137 : 103651 .

ZHANG Y X , YANG S M , XU L J , et al . A malware detection framework based on semantic information of behavioral features [J ] . Applied Sciences , 2023 , 13 ( 22 ): 12528 .

LIU Z , WANG R Y , JAPKOWICZ N , et al . SeGDroid: an Android malware detection method based on sensitive function call graph learning [J ] . Expert Systems with Applications , 2024 , 235 : 121125 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据