摘要
针对现有方法特征提取较为雷同,涉及文件较单一的不足,提出一种基于非常规特征的Android恶意软件检测方法。首先,提出新的文件熵、界面布局和方法指令特征,然后,结合随机森林算法分别进行单一和组合特征检测实验。最后分析实验结果,验证该特征的有效性与可行性,其单一检测准确率比传统的Intents特征和统计学特征效果平均提高8%,训练效率提升近50%,与传统表征效果更好的权限特征组合使用效果更佳,可比单一检测准确率提升近10%。该方法从非常规特征的角度为恶意软件的检测提供了新思路。
Aiming at the disadvantages of the existing methods, which have similar feature extraction and involve single file, proposes a new method of detecting Android malware based on unconventional features. Firstly, proposes a new document entropy, interface layout and method in. struction feature. Then, carries out the single and combined feature detection experiments with random forest algorithm. Finally, analyzes the experimental results to verify the validity and feasibility of the feature. The single detection accuracy is about 8% higher than the tradi. tional Intents feature and statistical feature, and the training efficiency is nearly 50%. The combination of the permission features with the traditional representation is better, and the accuracy is nearly 10% higher than that of the single detection. This method provides a new idea for malware detection from the perspective of unconventional features.
作者
鲁倩
吴向前
LU Qian;WU Xiang-qiang(College of Information Science and Engineering, Xinjiang University, Urumqi 830046;Network Center, Xinjiang University, Urumqi 830046)
出处
《现代计算机》
2019年第16期65-69,95,共6页
Modern Computer
基金
新疆维吾尔自治区重大专项基金(No.2017B01006-4)
