基于可信度的Android恶意代码多模型协同检测方法

A Confidence-guided Hybrid Android Malware Detection System with Multiple Heterogeneous Algorithms

当前,基于机器学习模型的Android恶意代码检测系统存在退化问题。因为恶意代码在不断地快速变异和进化,产生了概念漂移现象,恶意代码的数据分布规律随时间产生变化。概念漂移破坏了机器学习提出的数据分布规律具有稳定性的假设。为了缓解检测模型的退化问题,本文提出基于可信度的支持多模型协同检测的方法,对多个异构模型的预测结果进行可信度和置信度分析,突破了由于模型的异构性而不能相互学习和协同检测的问题,建立了开放的多模型协同检测平台,缓解恶意代码的概念漂移问题。实验表明,多模型协同可以提升检测效果。在对66 000多个Android样本的预测中,SVM模型和随机森林模型各有优劣,协同检测系统能够在保证不低于任一种单模型的基础上对预测效果有所提升。

At present, machine learning based Android malware detection approaches has the problem of model aging. Malware is constantly changing and evolving rapidly with time, which leads to concept drift. Concept drift makes underlying data distribution change over time, which violates the machine learning assumption that the data distribution is stable. In order to alleviate the problem of model aging, a confidence-guided hybrid malware detection system is proposed. By analyzing the credibility and confidence of the predicted results of heterogeneous models, this system can break through the problem that the heterogeneous models could not cooperate with each other. An open hybrid detection platform is established to mitigate concept drift. Experiments show that hybrid Android malware detection system is effective. In an evaluation with 66 000 applications, SVM model and random forest model have their own advantages and disadvantages. Hybrid Android malware detection system can improve the prediction effect on the basis of one single model.