基于系统调用的安卓恶意应用检测方法

Android malware detection method based on system calls

针对恶意应用静态检测方法精度低的问题,以安卓(Android)应用运行时产生的系统调用为研究对象,提出1种恶意应用动态检测方法。将Android移动应用在沙盒环境下通过事件仿真获得的系统调用序列进行特征化,设计了基于系统调用次数和基于系统调用依赖图的2种特征表示方法。采用集成学习方法构建分类器,区分恶意应用和正常应用。采用来自于第三方应用市场的3 000个样本进行了实验验证。结果表明,基于系统调用依赖图的特征表示方法优于基于系统调用次数的特征表示方法,采用集成分类器具有较好的检测精度,达95.84%。

A dynamic Android malware detection approach is proposed aiming at tstatic malware detection approaches by researching the system calls of Android acalls achieved by stimulated events of Android applies from the sandbox are characterized, and twofeature representation methods are designed based on system call frequency and system calldependency respectively. Malware and goodware are distinguished byaclassifier constructed by ensemble method. The two methods are tested on 3 000 Android applications fmarket. The experimental results show that, the feature representation method based on system calldependency is better than that based on system call frequency, and the ea good detection accuracy of 95. 8 4 % .