对抗环境下基于集成学习的细粒度恶意应用分类检测

Fine-grained Malicious Application Classification Detection Based on Integrated Learning

当前绝大多数对Android恶意应用的检测只是在粗粒度层面对恶意应用进行检测,不能准确地探知具体的恶意应用所属类别而且准确度不高,同时在对抗性环境下检测效果不佳。文章提出了一种基于集成学习的细粒度恶意应用分类检测方法,通过静态分析入手,然后对应用进行聚类;接着对聚类所得的每一个类训练其专属的集成分类器,以针对不同的软件类别采用不同的方法来更准确地甄别恶意软件。然后针对对抗性环境下的攻击原理,研究有助于提升系统整体鲁棒性的对抗性策略。实验表明,基于集成学习的细粒度恶意应用分类检测方法与对抗性策略跟传统算法相比,在各自的领域均有更好的效果。

Most of the current research on Android malicious application detection just detect malicious applications at a coarse-grained level. It cannot accurately detect the category of specific malicious applications and the accuracy is not high. On the other hand, it has no effect in an adversarial environment. The paper proposes a fine-grained malicious application classification detection method based on integrated learning, which starts with static analysis and then clusters the application;and then trains its own integrated classifier for each class obtained by clustering,then uses different methods to identify malware more accurately. Then, based on the attack principle in the confrontational environment, the research will help to improve the overall robustness of the system.Experiments show that the fine-grained maliciou s application classification detection method and adversarial strategy based on integrated learning have better results in their respective fields than traditional algorithms.