结合应用接口可达性特征的Android恶意软件检测

Android malware detection based on accessibility features of application interface

针对Android恶意软件检测,现有的研究多数提出了多种类特征结合机器学习来提高恶意程序检测中检测率,却少有考虑程序内应用接口调用之间的关联和程序调用图中的边信息。设计了基于应用接口可达性特征的Android恶意软件检测的方法,该方法基于恶意行为提取了应用接口的可达性特征,有效地使特征集包含边信息。在VirusShare所收集的2018年的恶意程序集中的1 151个恶意程序与来自Google Player的1 021个良性程序上进行了实验,结果为采用随机森林方法得到的模型相比其他4种方法更有效实现恶意程序的检测,并且模型整体的准确率达到了98.90%。结果表明应用接口可达性特征使得模型的召回率和精度均有所提高,并且相比实验中的其他特征更为重要。

For Android malware detection,most of research proposed multi-type features combined with machine learning to improve the detection rate of malware detection,but rarely considered association between application interface and edge information in call graph.Designs a method of Android malware detection based on accessibility feature of application interface.This method extracts accessibility features of application interface based on malicious behaviors,effectively makes feature set contain edge information.Experiments were conducted on 1151 malware collected by VirusShare in 2018and 1021benign programs from Google Player.Experiments show that random forest is more effective than other four methods in malware detection,and accuracy of model reaches 98.90%.Results show that accessibility features improved recall rate and precision of the model,and is more important than other features in the experiment.