Android malware detection based on APK signature information feedback

Xin-yu LIU; Jian WENG; Yue ZHANG; Bing-wen FENG; Jia-si WENG

doi:10.11959/j.issn.1000-436x.2017095

您当前的位置：

首页 >

文章列表页 >

Android malware detection based on APK signature information feedback

Academic communication | 更新时间：2024-06-05

- Android malware detection based on APK signature information feedback
- Journal on Communications Vol. 38, Issue 5, Pages: 190-198(2017)
- 作者机构：
  
  暨南大学信息科学技术学院，广东广州510632
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61133014);The National Natural Science Foundation of China(61272413);The National Natural Science Foundation of China(61373158);The National Natural Science Foundation of China(61472165);Key Program for Guangdong Province Applied Science and Technology R&D Special Funds(2016B010124009)
- DOI：10.11959/j.issn.1000-436x.2017095
  CLC： TP309.1
- Online First：2017-05，
  
  Published：25 May 2017
- 稿件说明：
移动端阅览
Xin-yu LIU, Jian WENG, Yue ZHANG, et al. Android malware detection based on APK signature information feedback[J]. Journal on Communications, 2017, 38(5): 190-198.
DOI：

Xin-yu LIU, Jian WENG, Yue ZHANG, et al. Android malware detection based on APK signature information feedback[J]. Journal on Communications, 2017, 38(5): 190-198. DOI： 10.11959/j.issn.1000-436x.2017095.

摘要

提出一种新的基于APK签名信息反馈的Android恶意应用检测方法（SigFeedback）。该方法在SVM分类算法的基础上采用启发式规则学习的方式对特征值进行提取，并对检测集中的 APK 签名信息进行验证筛选，实现了启发式反馈，达到更加准确地检测恶意应用的目的。SigFeedback 检测算法具有检测率高、误报率低的特点。最后通过实验显示SigFeedback算法具有较高的效率，且能使误报率从13%降低到3%。

Abstract

A new malware detection method based on APK signature of information feedback (SigFeedback) was proposed.Based on SVM classification algorithm

the method of eigenvalue extraction adoped heuristic rule learning to sig APK information verify screening

and it also implemented the heuristic feedback

from which achieved the purpose of more accurate detection of malicious software.SigFeedback detection algorithm enjoyed the advantage of the high detection rate and low false positive rate.Finally the experiment show that the SigFeedback algorithm has high efficiency

making the rate of false positive from 13% down to 3%.

关键词

Keywords

references

WEI F , ROY S , OU X , et al . Amandroid:a precise and general inter-component data flow analysis framework for security vetting of Android apps [C ] // ACM SIGSAC Conference on Computer and Communications Security . ACM , 2014 : 1329 - 1341 .

WU S , WANG P , LI X , et al . Effective detection of Android malware based on the usage of data flow APIs and machine learning [J ] . Information & Software Technology , 2016 , 75 ( C ): 17 - 25 .

CAO Y , FRATANTONIO Y , BIANCHI A , et al . EdgeMiner:Automatically detecting implicit control flow transitions through the Android framework [C ] // Network and Distributed System Security Symposium . 2015 .

QIAN Q , CAI J , XIE M , et al . Malicious behavior analysis for Android applications [J ] . International Journal of Network Security , 2016 , 18 ( 1 ): 182 - 192 .

文伟平 , 梅瑞 , 宁戈 , 等 . Android恶意软件检测技术分析和应用研究 [J ] . 通信学报 , 2014 , 35 ( 8 ): 78 - 86 .

WEN W P , MEI R , NING G , et al . Malware detection technology analysis and applied research of Android platform [J ] . Journal on Communications , 2014 , 35 ( 8 ): 78 - 86 .

ZHENG M , SUN M , LUI J C S . Droid analytics:a signature based analytic system to collect,extract,analyze and associate Android malware [C ] // IEEE International Conference on Trust,Security and Privacy in Computing and Communications . IEEE Computer Society , 2013 : 163 - 171 .

秦中元 , 王志远 , 吴伏宝 , 等 . 基于多级签名匹配算法的 Android恶意应用检测 [J ] . 计算机应用研究 , 2016 , 33 ( 3 ): 891 - 895 .

QIN Z Y , WANG Z Y , WU F B , et al . Android malware detection base on muti-level signature matching [J ] . Application Research of Computer , 2016 , 33 ( 3 ): 891 - 895 .

卿斯汉 . Android安全研究进展 [J ] . 软件学报 , 2016 , 27 ( 1 ): 45 - 71 .

QING S H . Research progress on Android security [J ] . Journal of Software , 2016 , 27 ( 1 ): 45 - 71 .

ARP D , SPREITZENBARTH M , HUBNER M , et al . DREBIN:effective and explainable detection of Android malware in your pocket [C ] // Network and Distributed System Security Symposium . 2014 .

FAN R E , CHANG K W , HSIEH C J , et al . LIBLINEAR:a library for large linear classification [J ] . Journal of Machine Learning Research , 2008 , 9 ( 9 ): 1871 - 1874 .

JOACHIMS T , . Text categorization with support vector machines:learning with many relevant features [C ] // European Conference on Machine Learning . Berlin Heidelberg , 1998 : 137 - 142 .

苗夺谦 , 胡桂荣 . 知识约简的一种启发式算法 [J ] . 计算机研究与发展 , 1999 , 36 ( 6 ): 681 - 684 .

MIAO D Q , HU G R . A heuristic algorithm for deduction of knowledge [J ] . Journal of Computer Research & Development , 1999 , 36 ( 6 ): 681 - 684 .

HART P E , NILSSON N J , RAPHAEL B . A formal basis for the heuristic determination of minimum cost paths [J ] . IEEE Transactions on Systems Science & Cybernetics , 1968 , 4 ( 2 ): 100 - 107 .

PEARL J . Heuristics:intelligent search strategies for computer problem solving [M ] . Addison-Wesley Pub . Co , 1984 .

杨文 . 基于支持向量机的Android恶意软件方法研究 [D ] . 南京:南京理工大学 , 2015 .

YANG W . Research of malware detection on Android based on support vector machine [D ] . Nanjing:Nanjing University of Science and Technology , 2015 .

ZHANG M , DUAN Y , YIN H , et al . Semantics-aware Android malware classification using weighted contextual API dependency Graphs [C ] // Computer and Communications Security . ACM , 2014 : 1105 - 1116 .

MAESSCHALCK R D , JOUAN-RIMBAUD D , MASSART D L . The Mahalanobis distance [J ] . Chemometrics & Intelligent Laboratory Systems , 2000 , 50 ( 1 ): 1 - 18 .

杨欢 , 张玉清 , 胡予濮 , 等 . 基于多类特征的 Android 应用恶意行为检测系统 [J ] . 计算机学报 , 2014 , 37 ( 1 ): 12 - 27 .

YANG H , ZHANG Y Q , HU Y P , et al . A malware behavior detection system of Android applications based on multi-class features [J ] . Chinese Journal of Computers , 2014 , 37 ( 1 ): 12 - 27 .

HANG A , DE LUCA A , HUSSMANN H . I know what you did last week! do you?:dynamic security questions for fallback authentication on smartphones [C ] // Conference on Human Factors in Computing Systems . 2015 : 1383 - 1392 .

Views

2821

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Optimum response scheme of intrusion detection based on information theory

Model of runtime memory leak detection based on the virtual machine introspection

SyncPoint based scoring method in IDS evaluation

Related Author

Youliang TIAN

Yulong WU

Qiuxian LI

Ru-liang XIAO

Jun JIANG

You-cong NI

Xin DU

Guo-qing XIE

Related Institution

College of Computer Science and Technology, Guizhou University

Guizhou Provincial Key Laboratory of Public Big Data

Institute of Cryptography ＆Data Security, Guizhou University

Faculty of Software,Fujian Normal University

School of Computer Science and Technology,Southeast University

AI问答

⁰