基于权限相关性的Android恶意软件检测

Android malware detection based on permission correlation

针对Android平台恶意软件检测需求和Android权限特征冗余的问题,提出一套从权限相关性角度快速检测恶意软件的方案。采用卡方检验计算各权限属性对于分类结果的影响大小,去除冗余权限特征,再对权限属性聚类,提取代表性权限特征,进一步减少冗余。最后利用基于不同权限特征权重的改进朴素贝叶斯算法进行软件分类。在收集的2000个软件样本上进行了实验,恶意软件漏检率为10.33%,总体预测准确率达到88.98%。实验结果表明,该方案利用少量权限特征,能够初步检测Android应用软件是否有恶意倾向,为深入判断分析提供参考依据。

Considering the demand of detecting Android malware and the redundancy of permission properties, a fast scheme was proposed to detect malware from the perspective of permission correlation. To eliminate the redundant permissions, Chi-square test was used to compute the influence of the permission on the classification resuhs. Then some representative permissions were selected on the basis of permission clustering to further reduce redundancy. Finally an improved Naive Bayesian classification based on the weights of different permissions was proposed to classify the software. Results of the experiments conducted on 2000 software samples show that the miss rate of malware detection is 10.33% and the overall prediction accuracy is 88.98%. Experiments indicate that this scheme is capable of detecting malware on Android platform by using a few permission properties, which can provide a reference for further analysis and judgment.