基于FWKN-SVM的Android异常入侵检测的研究

Research of Android Abnormal Intrusion Detection Based on Feature-weighted K-nearest-neighbor SVM

针对Android手机平台提出了基于特征加权K最近邻支持向量机(FWKN-SVM)的异常入侵检测方法。首先,分析了传统SVM在实际应用中的局限性,提出了一种基于特征类内类间距离的特征加权K最近邻的训练集约减策略。随后,根据手机恶意软件对系统造成的影响定义了系统行为,并通过在Android手机上编写的数据采集模块构建测试集和训练集。最后,利用特征加权K最近邻方法进行SVM训练集的精简和分类器的构建,并进行测试集预测。仿真结果表明,FWKN-SVM分类方法在Android异常入侵检测中应用效果良好。

In this paper,an abnormal intrusion detection method based on FWKN-SVM（Feature-weighted K-nearestneighbor Support Vector Machine）for the Android platform was proposed.Firstly,we analyzed the limitations of the traditional SVM in practical applications,and proposed the feature-weighted K-nearest-neighbor method to lessen training set.Then,the system behavior was defined,according to the impact of mobile malware on the system,and the test set and the training set were built by using the data acquisition module implemented on Android phone.Lastly,we used the feature-weighted K-nearest neighbor method to lessen the training set and construct SVM classifier,and then predicted the test set.Simulation result shows that FWKN-SVM classification method has a good performance in Android abnormal intrusion detection.