基于N-gram的Android恶意检测
|
摘要
随着Android系统的广泛应用,Android平台下的恶意应用层出不穷,并且恶意应用躲避现有检测工具的手段也越来越复杂,亟需更有效的检测技术来分析恶意行为。文中提出并设计了一种基于N-gram的静态恶意检测模型,该模型通过逆向手段反编译Android APK文件,利用N-gram技术在字节码上提取特征,以此避免传统检测中专家知识的依赖。同时,该模型使用深度置信网络,能够快速而准确地学习训练。通过对1267个恶意样本和1200个善意样本进行测试,结果显示模型整体的检测准确率最高可以达到98.34%。实验进一步比较了该模型和其他算法的检测结果,并对比了相关工作的检测效果,结果表明该模型有更好的准确率和鲁棒性。
With the widespread use of Android operating system,malicious applications are constantly emerging on the Android platform,meanwhile,the means by which malicious applications evade existing detection tools are becoming increasingly complicated.In order to effectively analyze malicious behavior,more efficient detection technology is required.This paper presented and designed a static malicious detection model based on N-gram technology.The model decompiles Android APK files by reversing engineering and uses N-gram technology to extract features from bytecodes.In this way,the model avoids dependence on expert knowledge in traditional detection.At the same time,the model combines with deep belief network,which allows it to rapidly and accurately train and detect application samples.1267 malicious samples and 1 200 benign samples were tested.The results show that the overall accuracy is up to 98.34%.Further more,the results of the model were compared with those of other machine learning algorithms,and the detection results of the related work were also compared.The results show that the model has better accuracy and robustness.
With the widespread use of Android operating system,malicious applications are constantly emerging on the Android platform,meanwhile,the means by which malicious applications evade existing detection tools are becoming increasingly complicated.In order to effectively analyze malicious behavior,more efficient detection technology is required.This paper presented and designed a static malicious detection model based on N-gram technology.The model decompiles Android APK files by reversing engineering and uses N-gram technology to extract features from bytecodes.In this way,the model avoids dependence on expert knowledge in traditional detection.At the same time,the model combines with deep belief network,which allows it to rapidly and accurately train and detect application samples.1267 malicious samples and 1 200 benign samples were tested.The results show that the overall accuracy is up to 98.34%.Further more,the results of the model were compared with those of other machine learning algorithms,and the detection results of the related work were also compared.The results show that the model has better accuracy and robustness.
引文
[1] TAM K,FEIZOLLAH A,ANUAR N B,et al.The evolution of android malware and android analysis techniques[J].ACM Computing Surveys(CSUR),2017,49(4):76.
[2] ZHOU Y,JIANG X.Dissecting android malware:Characterization and evolution[C]∥2012IEEE Symposium on Security and Privacy(SP).IEEE,2012:95-109.
[3] QING S H.Research progress on Android security[J].Journal of Software,2016,27(1):45-71.(in Chinese)卿斯汉.Android安全研究进展[J].软件学报,2016,27(1):45-71.
[4] DESNOS A,GUEGUEN G.Android:From reversing to decompilation[C]∥Proceedings of Black Hat Abu Dhabi.2011:77-101.
[5] LI T,DONG H,YUAN C Y,et al.Description of Android malware feature based on Dalvik instructions[J].Journal of Computer Research and Development,2014,51(7):1458-1466.(in Chinese)李挺,董航,袁春阳,等.基于Dalvik指令的Android恶意代码特征描述及验证[J].计算机研究与发展,2014,51(7):1458-1466.
[6] HOU S,DU Y H,LU T L,et al.Research on Android permission detection mechanism based on K-means algorithm[J].Application Research of Computers,2018,35(4):1165-1168.(in Chinese)侯苏,杜彦辉,芦天亮,等.基于K-means算法的Android权限检测机制研究[J].计算机应用研究,2018,35(4):1165-1168.
[7] SHAO S D,YU H Q,FAN G S.Detecting Malware by combining API and Permission Features[J].Computer Science,2017,44(4):135-139.(in Chinese)邵舒迪,虞慧群,范贵生.基于权限和API特征结合的Android恶意软件检测方法[J].计算机科学,2017,44(4):135-139.
[8] YANG H,ZHANG Y Q,HU Y P,et al.A malware behavior detection system of Android applications based on multi-class features[J].Chinese Journal of Computers,2014,37(1):15-27.(in Chinese)杨欢,张玉清,胡予濮,等.基于多类特征的Android应用恶意行为检测系统[J].计算机学报,2014,37(1):15-27.
[9] HOU S,SAAS A,YE Y,et al.DroidDelver:An Android Malware Detection System Using Deep Belief Network Based on API Call Blocks[C]∥International Conference on Web-Age Information Management.Springer International Publishing,2016:54-66.
[10]HINTON G E,OSINDERO S,TEH Y W.A fast learning algorithm for deep belief nets[J].Neural Computation,2006,18(7):1527-1554.
[11]YANG Z,YANG M.Leakminer:Detect information leakage on android with static taint analysis[C]∥2012Third World Congress on Software Engineering(WCSE).IEEE,2012:101-104.
[12]GIBLER C,CRUSSELL J,ERICKSON J,et al.AndroidLeaks:Automatically Detecting Potential Privacy Leaks in Android Applications on a Large Scale[C]∥Proceedings of International Conference on Trust and Trustworthy Computing.Heidelberg:Springer,2012:291-307.
[13]ARZT S,RASTHOFER S,FRITZ C,et al.Flowdroid:Precise context,flow,field,object-sensitive and lifecycle-aware taint analysis for android apps[J].Acm Sigplan Notices,2014,49(6):259-269.
[14]BODDEN E.Inter-procedural data-flow analysis with ifds/ide and soot[C]∥Proceedings of the ACM SIGPLAN International Workshop on State of the Art in Java Program Analysis.ACM,2012:3-8.
[15]OCTEAU D,MCDANIEL P,JHA S,et al.Effective intercomponent communication mapping in android with epicc:An essential step towards holistic security analysis[C]∥Proceedings of USENIX Security Symposium.Berkeley:USENIX Association,2013:543-558.
[16]SANTOS I,PENYA Y K,DEVESA J,et al.N-grams-based File Signatures for Malware Detection[C]∥Proceedings of the 2009International Conference on Enterprise Information Systems(ICEIS).Heidelberg:Springer,2009:317-320.
[17]APKTOOL.A tool for reverse engineering Android apk files(Version 2.3.4)[EB/OL].https://ibotpeaches.github.io/Apktool.
[18]HINTON G.A practical guide to training restricted Boltzmann machines[J].Momentum,2010,9(1):926-947.
[19]SCHMIDHUBER J.Deep learning in neural networks:An overview[J].Neural Networks,2015,61:85-117.
[20]LIU X M.Anomaly Detection of Malicious Android Application based on K-nearest Neighbor[D].Beijing:Beijing Jiaotong University,2016.(in Chinese)刘晓明.基于KNN算法的Android应用异常检测技术研究[D].北京:北京交通大学,2016.
[21]BARROS R C,BASGALUPP M P,RC,et al.A Survey of Evolutionary Algorithms for Decision-Tree Induction[J].IEEE Transactions on Systems Man&Cybernetics Part C,2012,42(3):291-312.
[22]GU B,SHENG V S,TAY K Y,et al.Incremental Support Vector Learning for Ordinal Regression[J].IEEE Transactions on Neural Networks&Learning Systems,2015,26(7):1403-1416.
[2] ZHOU Y,JIANG X.Dissecting android malware:Characterization and evolution[C]∥2012IEEE Symposium on Security and Privacy(SP).IEEE,2012:95-109.
[3] QING S H.Research progress on Android security[J].Journal of Software,2016,27(1):45-71.(in Chinese)卿斯汉.Android安全研究进展[J].软件学报,2016,27(1):45-71.
[4] DESNOS A,GUEGUEN G.Android:From reversing to decompilation[C]∥Proceedings of Black Hat Abu Dhabi.2011:77-101.
[5] LI T,DONG H,YUAN C Y,et al.Description of Android malware feature based on Dalvik instructions[J].Journal of Computer Research and Development,2014,51(7):1458-1466.(in Chinese)李挺,董航,袁春阳,等.基于Dalvik指令的Android恶意代码特征描述及验证[J].计算机研究与发展,2014,51(7):1458-1466.
[6] HOU S,DU Y H,LU T L,et al.Research on Android permission detection mechanism based on K-means algorithm[J].Application Research of Computers,2018,35(4):1165-1168.(in Chinese)侯苏,杜彦辉,芦天亮,等.基于K-means算法的Android权限检测机制研究[J].计算机应用研究,2018,35(4):1165-1168.
[7] SHAO S D,YU H Q,FAN G S.Detecting Malware by combining API and Permission Features[J].Computer Science,2017,44(4):135-139.(in Chinese)邵舒迪,虞慧群,范贵生.基于权限和API特征结合的Android恶意软件检测方法[J].计算机科学,2017,44(4):135-139.
[8] YANG H,ZHANG Y Q,HU Y P,et al.A malware behavior detection system of Android applications based on multi-class features[J].Chinese Journal of Computers,2014,37(1):15-27.(in Chinese)杨欢,张玉清,胡予濮,等.基于多类特征的Android应用恶意行为检测系统[J].计算机学报,2014,37(1):15-27.
[9] HOU S,SAAS A,YE Y,et al.DroidDelver:An Android Malware Detection System Using Deep Belief Network Based on API Call Blocks[C]∥International Conference on Web-Age Information Management.Springer International Publishing,2016:54-66.
[10]HINTON G E,OSINDERO S,TEH Y W.A fast learning algorithm for deep belief nets[J].Neural Computation,2006,18(7):1527-1554.
[11]YANG Z,YANG M.Leakminer:Detect information leakage on android with static taint analysis[C]∥2012Third World Congress on Software Engineering(WCSE).IEEE,2012:101-104.
[12]GIBLER C,CRUSSELL J,ERICKSON J,et al.AndroidLeaks:Automatically Detecting Potential Privacy Leaks in Android Applications on a Large Scale[C]∥Proceedings of International Conference on Trust and Trustworthy Computing.Heidelberg:Springer,2012:291-307.
[13]ARZT S,RASTHOFER S,FRITZ C,et al.Flowdroid:Precise context,flow,field,object-sensitive and lifecycle-aware taint analysis for android apps[J].Acm Sigplan Notices,2014,49(6):259-269.
[14]BODDEN E.Inter-procedural data-flow analysis with ifds/ide and soot[C]∥Proceedings of the ACM SIGPLAN International Workshop on State of the Art in Java Program Analysis.ACM,2012:3-8.
[15]OCTEAU D,MCDANIEL P,JHA S,et al.Effective intercomponent communication mapping in android with epicc:An essential step towards holistic security analysis[C]∥Proceedings of USENIX Security Symposium.Berkeley:USENIX Association,2013:543-558.
[16]SANTOS I,PENYA Y K,DEVESA J,et al.N-grams-based File Signatures for Malware Detection[C]∥Proceedings of the 2009International Conference on Enterprise Information Systems(ICEIS).Heidelberg:Springer,2009:317-320.
[17]APKTOOL.A tool for reverse engineering Android apk files(Version 2.3.4)[EB/OL].https://ibotpeaches.github.io/Apktool.
[18]HINTON G.A practical guide to training restricted Boltzmann machines[J].Momentum,2010,9(1):926-947.
[19]SCHMIDHUBER J.Deep learning in neural networks:An overview[J].Neural Networks,2015,61:85-117.
[20]LIU X M.Anomaly Detection of Malicious Android Application based on K-nearest Neighbor[D].Beijing:Beijing Jiaotong University,2016.(in Chinese)刘晓明.基于KNN算法的Android应用异常检测技术研究[D].北京:北京交通大学,2016.
[21]BARROS R C,BASGALUPP M P,RC,et al.A Survey of Evolutionary Algorithms for Decision-Tree Induction[J].IEEE Transactions on Systems Man&Cybernetics Part C,2012,42(3):291-312.
[22]GU B,SHENG V S,TAY K Y,et al.Incremental Support Vector Learning for Ordinal Regression[J].IEEE Transactions on Neural Networks&Learning Systems,2015,26(7):1403-1416.