移动网络中恶意代码优化检测仿真研究

Research on Malware Optimizing Detection Simulation in Mobile Network

针对现有移动恶意代码检测准确率低和检测器生成质量差等问题,为了提高检测器对非我空间的覆盖率,提出了一种基于超椭球免疫理论的移动恶意代码检测模型。利用动态和静态分析结合的方法全面提取和表征移动恶意代码特征,采用超椭球对免疫检测器进行编码。基于阴性选择算法通过免疫耐受生成成熟检测器,对亲和度较高的超椭球检测器进行克隆变异实现检测器的优化,获得检测性能更加优良的变异后代。最后,对收集的Android恶意应用样本进行仿真,结果表明,所提出模型生成的超椭球检测器具有较高的恶意代码检测效率和准确率。

According to the problem of low detection rate and bad quality of generated detectors, to improve the non - self space coverage, a mobile malware detection model based on hyper - ellipsoid immune theory was proposed. The method of combined dynamic and static analysis was used to comprehensively extract and characterize mobile malware characteristics, and immune detectors were encoded based on hyper - ellipsoid. Mature detectors were gener- ated through immune tolerance based on negative selection algorithm. Hyper - ellipsoid detectors were optimized through clone, the high affinity detectors were mutated, and the offspring with better detection performances were ob- tained. Finally, Android malicious application samples were collected and experimental simulation was carried out. The results show that the proposed model has higher detection efficiency and accuracy.