摘要
安卓系统的恶意程序数量多且危害大,研究相应的检测方法是当前研究热点。现有方法仅单独提取语法或语义特征,难以准确刻画恶意程序的攻击意图。提出一种混合提取语法和语义特征的检测方法,语义特征为基于类抽象的污点传播路径集合,并结合权限声明和Intent-Action等语法特征,对特征规范化后应用K-means算法训练样本集生成恶意程序家族的特征向量,应用欧氏距离检测未知程序与特征向量的相似度。基于FlowDroid实现原型系统,对400个真实程序的分析结果表明该方法有较高的精确度。
Currently, Android malware detection is one of the hotpots in the security research field. Since Android is open source and very popular, the Android platform becomes a target of most mal-wares. Current approaches only extract syntax features or semantic features respectively so that it is dif-ficult for them to k n o w the real intention of the malware exactly. We propose a hybrid feature extractionmethod, using the set of class-based taint propagation paths as semantic featusions and Inten--Actions as syntax features. W e normalize all the extracted features beforclustering data sets by K -means, and then produce feature vectors of each malware family. Finally w e a-dopt the Euclidean distance computation to measure the similarity between the unknown program andfeature vectors. The prototype is implemented on top of FlowDroid to analyze 400 real programs, andthe results demonstrate that the method has higher precision.
出处
《计算机工程与科学》
CSCD
北大核心
2017年第10期1837-1846,共10页
Computer Engineering & Science
基金
基金项目:WEB程序污点分析的形式化定义和验证研究(61562040)
关键词
恶意程序检测
语义特征
污点传播
聚类
malware detection
semantic features
taint propagation
clustering
