基于随机森林的Android恶意软件检测方法研究

doi:10.3969/j.issn.1671-1122.2019.09.001

信息网络安全 ›› 2019, Vol. 19 ›› Issue (9): 1-5.doi: 10.3969/j.issn.1671-1122.2019.09.001

基于随机森林的Android恶意软件检测方法研究

宋鑫¹, 赵楷^2,³, 张琳琳^2,³, 方文波⁴

1.国防科技大学计算机学院,湖南长沙 410073
2.新疆大学网络空间安全学院,新疆乌鲁木齐 830046
3.新疆大学信息科学与工程学院,新疆乌鲁木齐 830046
4.新疆大学软件学院,新疆乌鲁木齐 830008

收稿日期:2019-07-15 出版日期:2019-09-10 发布日期:2020-05-11
作者简介:
作者简介：宋鑫（1996—）,女,河南,硕士研究生,主要研究方向为网络安全、移动应用安全;赵楷（1976—）,男,安徽,副教授,博士,主要研究方向为恶意代码检测、云计算安全;张琳琳（1974—）,女,河南,副教授,博士,主要研究方向为移动应用安全、恶意代码检测、软件安全;方文波（1991—）,男,陕西,硕士研究生,主要研究方向为移动应用安全、恶意代码检测。
基金资助:
国家自然科学基金[61867006];新疆维吾尔自治区创新环境（人才、基地）建设专项（自然科学基金）联合基金[2019D01C062];新疆维吾尔自治区高校科研计划[XJEDU2017M005]

Research on Android Malware Detection Based on Random Forest

Xin SONG¹, Kai ZHAO^2,³, Linlin ZHANG^2,³, Wenbo FANG⁴

1. College of Computer, National University of Defense Technology, Changsha Hunan 410073, China
2. College of Cyber Science and Engineering, Xinjiang University, Urumqi Xinjiang 830046, China
3. College of Information Science and Engineering, Xinjiang University, Urumqi Xinjiang 830046,China
4. College of Software, Xinjiang University, Urumqi Xinjiang 830008, China

Received:2019-07-15 Online:2019-09-10 Published:2020-05-11

摘要/Abstract

摘要：

文章基于随机森林提出一种Android恶意软件检测方法。以Android的权限作为特征定义了有效权限,利用数据挖掘算法中的支持度和关联规则对权限进行分析,实现有效权限识别。文章构建了随机森林分类器,将有效权限矩阵作为分类器的输入进行训练和测试。实验结果表明,文中方法的检测结果准确率达到92.84%,F值达到93.05%,明显优于其他检测模型。

关键词: Android恶意软件检测, 有效权限, 关联规则, 随机森林

Abstract:

Based on the strong classifier random forest, an Android malware detection method is proposed. With the permission of Android as the feature, the effective permission is defined; the support and association rules in the data mining algorithm are employed to analyze the permission and realize the effective permission identification. Finally, a random forest classifier is constructed, and the effective permission matrix is used as the input of the classifier for training and testing. The experimental results show that the accuracy of the proposed method is 92.84%, and the F-value is 93.05%, which is obviously superior to other detection models.

Key words: Android malware detection, effective permission, association rules, random forest

中图分类号:

TP309

宋鑫, 赵楷, 张琳琳, 方文波. 基于随机森林的Android恶意软件检测方法研究[J]. 信息网络安全, 2019, 19(9): 1-5.

Xin SONG, Kai ZHAO, Linlin ZHANG, Wenbo FANG. Research on Android Malware Detection Based on Random Forest[J]. Netinfo Security, 2019, 19(9): 1-5.

图/表 7

图1

图2

图3

图4

图5

图6

图7

参考文献 14

[1]	Symantec. Android OS. Fakeplayer[EB/OL]. , 2016-8-1.
[2]	CASTILLO C A. Android Malware Past, Present, Future[EB/OL]. , 2016-8-1.
[3]	ZHANG Yuan, YANG Min, XU Bingquan, et al.Vetting Undesirable Behaviors in Android Apps with Permission Use Analysis[C]//ACM. 20th SIGSAC Conference on Computer & Communications Security, November, 4-8, 2013, Berlin, Germany. New York: ACM, 2010: 611-622.
[4]	WILLIAM E, PETER G, CHUN B G, et al.TaintDroid: An Information-flow Tracking System for Realtime Privacy Monitoring on Smartphones[J]. ACM Transactions on Computer Systems, 2014, 32(2): 99-106.
[5]	CAI Haipeng, MENG Na, RYDER B, et al.DroidCat: Effective Android Malware Detection and Categorization via App-Level Profiling[J]. IEEE Transactions on Information Forensics and Security, 2019, 14(6): 1455-1470.
[6]	FENG Yu, ANAND S, DILLIG I, et al.Apposcopy: Semantics-based Detection of Android Malware through Static Analysis[C]//ACM. 22nd SIGSOFT International Symposium on Foundations of Software Engineering, November 16-22, 2014, Hong Kong, China. New York: ACM, 2014: 576-587.
[7]	YANG Zhemin, YANG Min.Leakminer: Detect Information Leakage on Android with Static Taint Analysis[C]//IEEE. 3rd World Congress on Software Engineering, November 6-8, 2012, Wuhan, China. New Jersey: IEEE, 2012: 101-104.
[8]	YANG Wei, XIAO Xueshegn, ANDOW B, et al.AppContext: Differentiating Malicious and Benign Mobile APP Behaviors Using Context[C]//IEEE. 37th International Conference on Software Engineering, May 16-24, 2015, Florence, Italy. New Jersey: IEEE, 2015: 303-313.
[9]	SHARMA A, DOEGAR A.Permission-set Based Detection and Analysis of Android Malware[J]. Springer Cyber Security, 2018, 729(1): 231-239.
[10]	DURMUS O S, OGUZ E K, SEDAT A, et al.New Results on Permission Based Static Analysis for Android Malware[C]//IEEE. 6th International Symposium on Digital Forensic and Security, March 22-15, 2018, Antalya, Turkey. New Jersey: IEEE, 2018: 1-4.
[11]	LI Xiang, LIU Jianyi, HUO Yanyu, et al.An Android Malware Detection Method Based on AndroidManifest File[C]//IEEE. 4th IEEE International Conference on Cloud Computing and Intelligence Systems, August 17-19, 2016, Beijing, China. New Jersey: IEEE, 2016: 239-243.
[12]	QING Sihan.Research Progress on Android Security[J]. Journal of Software, 2016, 27(1): 45-71.
	卿斯汉. Android安全研究进展[J]. 软件学报,2016,27(1):45-71.
[13]	LIN Jiaping, LI Hui.Review of Android Malware Detection[J]. Netinfo Security, 2016, 16(10): 80-88.
	林佳萍,李晖. 安卓恶意软件检测研究综述[J]. 信息网络安全,2016,16(10):80-88.
[14]	LOPEZ C C U, CADAVID A N. Framework for Malware Analysis in Android[J]. Sistemas & Telemática, 2016, 14(37): 45-56.

基于随机森林的Android恶意软件检测方法研究

Research on Android Malware Detection Based on Random Forest

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 7

参考文献 14

相关文章 11

编辑推荐

Metrics

本文评价

[1]	马泽文, 刘洋, 徐洪平, 易航. 基于集成学习的DoS攻击流量检测技术[J]. 信息网络安全, 2019, 19(9): 115-119.
[2]	段詠程, 王雨晴, 李欣, 杨乐. 基于RSAR的随机森林网络安全态势要素提取[J]. 信息网络安全, 2019, 19(7): 75-81.
[3]	张蕾华, 牛红太, 王仲妮, 刘雪红. 基于大数据的前科人员犯罪预警模型构建研究[J]. 信息网络安全, 2019, 19(4): 82-89.
[4]	王旭东, 余翔湛, 张宏莉. 面向未知协议的流量识别技术研究[J]. 信息网络安全, 2019, 19(10): 74-83.
[5]	翟继强, 肖亚军, 杨海陆, 王健. 改进的人工蜂群结合优化的随机森林的U2R攻击检测研究[J]. 信息网络安全, 2018, 18(12): 38-45.
[6]	林伟宁, 陈明志, 詹云清, 刘川葆. 一种基于PCA和随机森林分类的入侵检测算法研究[J]. 信息网络安全, 2017, 17(11): 50-54.
[7]	胡雪,封化民,李明伟,丁钊. 数据挖掘中一种增强的Apriori算法分析[J]. 信息网络安全, 2015, 15(11): 77-83.
[8]	. 基于随机森林算法的网络舆情文本信息分类方法研究[J]. , 2014, 14(11): 36-.
[9]	杨康;张伟. Apriori算法在DNS记录挖掘中的应用与研究[J]. , 2012, 12(2): 0-0.
[10]	齐战胜;高峰;腾达. 数据挖掘技术在计算机取证中的应用研究[J]. , 2011, 11(9): 0-0.
[11]	刘秀如. 基于粗糙集理论在公安工作中的研究[J]. , 2011, 11(6): 0-0.