基于CHMM的物联网应用平台Android程序恶意行为识别

Malicious behavior recognition of Android program of internet of things application platform based on CHMM

针对物联网应用平台受Android程序恶意攻击时,对其恶意行为特征关联信息挖掘不足,导致检测识别准确性较低的问题,提出基于连续隐马尔可夫模型(Continuous Hidden Markov Model,CHMM)的物联网应用平台Android程序恶意行为特征检测方法。采用云融合调度方法分析恶意行为的大数据特征,构建恶意行为特征信息加载和关联特征融合模型;结合特征信息重组和空间结构匹配方法,挖掘恶意行为的关联规则分布集;采用CHMM模糊聚类方法聚类恶意行为的关联信息,实现对物联网应用平台Android程序恶意行为优化识别。仿真测试结果表明,采用该方法进行物联网应用平台Android程序恶意行为识别的检测率较高,漏报率和误报率较低,提高了物联网应用平台Android程序恶意行为的辨识能力。

When the Internet of things application platform is attacked maliciously by the Android program,the problem of low detection and recognition accuracy is caused by the insufficient mining of its malicious behavior feature association information.This paper puts forward a malicious behavior feature detection method based on continuous hidden Markov model Android program.The cloud fusion scheduling method is used to analyze the big data features of malicious behavior,to construct the malicious behavior feature information loading and association feature fusion model,to mine the association rule distribution set of malicious behavior by combining feature information reorganization and spatial structure matching method.CHMM fuzzy clustering method is used to cluster malicious behavior.The simulation results show that the detection rate of malicious behavior identification of the Android program of the Internet of things application platform is high,the rate of missing report and the rate of false alarm are low,and the identification ability of malicious behavior of the Android program of the Internet of things application platform is improved.