Mobile malware traffic detection approach based on value-derivative GRU

Hanxun ZHOU; Chen CHEN; Runze FENG; Junkun XIONG; Hong PAN; Wei GUO

doi:10.11959/j.issn.1000-436x.2020005

您当前的位置：

首页 >

文章列表页 >

Mobile malware traffic detection approach based on value-derivative GRU

Papers | 更新时间：2024-06-05

- Mobile malware traffic detection approach based on value-derivative GRU
- Journal on Communications Vol. 41, Issue 1, Pages: 102-113(2020)
- 作者机构：
  
  1. 辽宁大学信息学院，辽宁沈阳 110036
  2. 辽宁大学数字经济研究院，辽宁沈阳 110036
  3. 沈阳航空航天大学计算机学院，辽宁沈阳 110135
- 作者简介：
- 基金信息：
  
  The Transportation Technology Project of Liaoning Province(61300233);The Transportation Technology Project of Liaoning Province(61402298);The National Natural Science Foundation of China(61472169);The National Natural Science Foundation of China(51704138);Liaoning Provincial Department of Education Project(JYT19053);The Natural Science Foundation of Liaoning Province(2019-MS-149)
- DOI：10.11959/j.issn.1000-436x.2020005
  CLC： TP393.4
- Online First：2020-01，
  
  Published：25 January 2020
- 稿件说明：
移动端阅览
Hanxun ZHOU, Chen CHEN, Runze FENG, et al. Mobile malware traffic detection approach based on value-derivative GRU[J]. Journal on Communications, 2020, 41(1): 102-113.
DOI：

Hanxun ZHOU, Chen CHEN, Runze FENG, et al. Mobile malware traffic detection approach based on value-derivative GRU[J]. Journal on Communications, 2020, 41(1): 102-113. DOI： 10.11959/j.issn.1000-436x.2020005.

摘要

针对移动恶意软件数量和种类的急剧增加给移动用户的信息安全带来的巨大挑战，提出了一种基于值导数GRU的移动恶意软件流量检测方法，旨在解决基于RNN的移动恶意软件流量检测方法难以捕获网络异常流量的动态变化和关键信息的问题。值导数 GRU 算法通过引入“累计状态变化”的概念，可以同时描述移动网络恶意流量的低阶和高阶动态变化信息。此外，通过增设池化层使算法可以捕获移动恶意流量的关键信息。最后，通过仿真实验分析累计状态变化、隐藏层和池化层对于值导数GRU算法性能的影响。实验表明，基于值导数GRU的移动恶意软件流量检测方法拥有较高的检测准确率。

Abstract

For the dramatic increase in the number and variety of mobile malware had created enormous challenge for information security of mobile network users

a value-derivative GRU-based mobile malware traffic detection approach was proposed in order to solve the problem that it was difficult for a RNN-based mobile malware traffic detection approach to capture the dynamic changes and critical information of abnormal network traffic.The low-order and high-order dynamic change information of the malicious network traffic could be described by the value-derivative GRU approach at the same time by introducing the concept of “accumulated state change”.In addition

a pooling layer could ensure that the algorithm can capture key information of malicious traffic.Finally

simulation were performed to verify the effect of accumulated state changes

hidden layers

and pooling layers on the performance of the value-derivative GRU algorithm.Experiments show that the mobile malware traffic detection approach based on value-derivative GRU has high detection accuracy.

关键词

Keywords

references

HE D , CHAN S , GUIZANI M . Mobile application security:malware threats and defenses [J ] . IEEE Wireless Communications , 2015 , 22 ( 1 ): 138 - 144 .

冯勇 , 张丽颖 , 顾兆旭 , 等 . 面向高校多源异构数据环境的元数据集成方法 [J ] . 辽宁大学学报(自然科学版) , 2019 , 46 ( 2 ): 135 - 141 .

FENG Y , ZHANG L Y , GU Z X , et al . A metadata integration method for multi-source heterogeneous data environment in universities [J ] . Journal of Liaoning University:Natural Science , 2019 , 46 ( 2 ): 135 - 141 .

SAYYAR S , . Enhanced TWOACK based AODV protocol for intrusion detection system [C ] // International Conference on Computing,Mathematics and Engineering Technologies . 2018 : 1 - 4 .

MIMURA M , TANAKA H . Long-term performance of a generic intrusion detection method using Doc2vec [C ] // 2017 Fifth International Symposium on Computing and Networking (CANDAR) . 2017 : 456 - 462 .

KHATRI V , ABENDROTH J . Mobile guard demo:network based malware detection [C ] // IEEE International Conference on Trust,Security and Privacy in Computing and Communications . 2015 : 1177 - 1179 .

ADEEL M , TOKARCHUK L N . Analysis of mobile P2P malware detection framework through cabir ＆ commwarrior families [C ] // IEEE Third International Conference on Privacy,Security,Risk and Trust . 2011 : 1335 - 1343 .

MOGHADDAM S H , . Sensitivity analysis of static features for Android malware detection [C ] // 22nd Iranian Conference on Electrical Engineering . 2014 : 920 - 924 .

TRIPP O , PISTOIA M , FERRARA P , et al . Pinpointing mobile malware using code analysis [C ] // IEEE/ACM International Conference on Software Engineering and Systems . 2016 : 275 - 276 .

NGUYEN TRI-HAI , YOO M . A behavior-based mobile malware detection model in software-defined networking [C ] // International Conference on Information Science and Communications Technologies . 2017 : 1 - 3 .

LI D F , WANG Z G , XUE Y B . Fine-grained Android malware detection based on deep learning [C ] // IEEE Conference on Communications and Network Security . 2018 : 1 - 2 .

YUAN Z L , LU Y Q , XUE Y B . Droiddetector:Android malware characterization and detection using deep learning [J ] . Tsinghua Science and Technology , 2016 , 22 ( 1 ): 114 - 123 .

KIM T G , KANG B J , RHO M , et al . A multimodal deep learning method for Android malware detection using various features [J ] . IEEE Transactions on Information Forensics and Security , 2019 , 14 ( 3 ): 773 - 788 .

SU X , ZHANG D F , LI W J , et al . A deep learning approach to Android malware feature learning and detection [C ] // IEEE International Conference on Trust,Security and Privacy in Computing and Communications . 2016 : 244 - 251 .

CHEN Z X , YAN Q B , HAN H B . Machine learning based mobile malware detection using highly imbalanced network traffic [C ] // IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing . 2017 : 588 - 595 .

ZHANG L , FAN X P . A fusion financial prediction strategy based on RNN and representative pattern discovery [C ] // International Conference on Parallel and Distributed Computing,Applications and Technologies . 2017 : 92 - 97 .

BENGIO Y . Learning long-term dependencies with gradient descent is difficult [J ] . IEEE Transactions on Neural Networks , 2002 , 5 ( 2 ): 157 - 166 .

BEAUFAYS S S . Long short-term memory recurrent neural network architectures for large scale acoustic modeling [J ] . Computer Science , 2014 , 15 ( 3 ): 338 - 342 .

CHO K , MERRIENBOER VAN B , GULCEHRE C . Learning phrase representations using RNN encoder-decoder for statistical machine translation [J ] . Computer Science , 2014 , 12 ( 1 ): 236 - 248 .

Views

872

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Multi-type honeypot deployment scheme based on Stackelberg game and DQN

Survey of research on Tor-based anonymous networking technologies

Domain name generation algorithm based on improved Markov chain

Research and implementation of reputation-based inter-domain routing selection mechanism

Multi-level loss object tracking adversarial attack method based on spatial perception

Related Author

Han Yu

Chen Yuanheng

Wang Yichuan

Ma Yibin

Hei Xinhong

ZHU Yufei

HU Yuxiang

CHEN Bo

Related Institution

School of Computer Science and Engineering, Xi’an University of Technology

School of Cyberspace Security, Zhengzhou University

Institute of Information Technology, Information Engineering University

National Key Laboratory of Advanced Communication Networks

Key Laboratory of Cyberspace Security, Ministry of Education of China

AI问答

⁰