基于随机森林的抗混淆Android恶意应用检测

Anti-Obfuscated Android Malware Detection Based on Random Forest

Android恶意应用的迅速增长引发了极大的安全隐患,很多行为特征容易受到代码混淆技术的影响,导致恶意行为无法被有效检测.提出了一种基于随机森林的Android恶意应用检测模型.模型选用危险权限、敏感API调用、Service、Activity、Intent、短信发送频率等特征,其中危险权限和Service等Android组件在代码混淆过程中不受影响,采用随机森林、决策树、SVM和卷积神经网络等机器学习方法,利用10折交叉验证的方法训练.通过实验证明,对于未混淆的数据集,该方法能达到分类准确率95.77%的效果;对于混淆之后的数据集可达到分类准确率91.01%的效果.

The rapid growth of Android malware has caused significant security risks.Many behavioral characteristics are easily affected by code obfuscation techniques,resulting in malicious behaviors that cannot be effectively detected.This paper proposes an Android malware detection model based on Random Forest.The model uses dangerous permissions,sensitive API calls,Service,Activity,Intent,and SMS sending frequency as features,among which dangerous permissions and Android components such as service are not affected during the code obfuscation process.Machine learning methods such as Random Forest,Decision Tree,SVM,and 1-NN are used.The model is trained by the ten-fold cross-validation method.Experiments have shown that this method can achieve a classification accuracy of 95.77%for the normal data sets;for the obfuscated data sets,it can achieve a classification accuracy of 91.01%.