基于卷积神经网络的Android恶意软件检测技术研究

Android Malware Detection Technology Based on Deep Convolutional Neural Network

摘要:

Android系统的迅速迭代及其开源特性使得Android恶意软件产生大量的变种，这对Android恶意软件检测和分类带来不小的挑战.机器学习方法已成为恶意软件分类的主流方法，但现有的大多数机器学习方法都使用传统的算法(如支持向量机).目前卷积神经网络(CNN)作为一种深度学习方法表现出了更好的性能，特别是在图像分类等应用上.结合这一优势以及迁移学习的思想，本文提出了一种基于CNN架构的Android恶意软件检测和分类方法.首先，提取Android应用的DEX文件然后将其转换成灰度图像并放入CNN中进行训练分类. 本文实验使用Drebin和Android Malware Dataset(AMD)两个样本集.实验结果显示，该方法在Android恶意软件家族分类上准确率达到97.36%，在Android恶意软件检测中在不同样本集上的准确率都达到了99%以上. 实验表明，本文提出的方法具有较高的分类准确率和泛化性能.

Abstract:

The rapid iteration of the Android system and its open source features have resulted in many variants of Android malware, which brings great challenges to the classification and detection of Android malware. Machine learning is the mainstream method for classifying malware，with the development of deep learning and the success of convolutional neural network (CNN) ,especially in image classification, this paper proposes an Android malware detection and its classification method based on and transfer learning. First, the Android DEX file is extracted and converted to a grayscale image being put into CNN for training classification. Drebin and AMD datasets were used in the experiment. The experimental results show that the accuracy of the proposed method in the classification of Android malware family is 97.36%, and the accuracy rates of Android malware detection are both more than 99% in the two datasets. Experiments show that the proposed method has high classification accuracy and generalization ability.