【摘要】 为实现Android应用程序恶意行为的有效分析,提出了基于HMMs-SVM的程序行为分类模型,将隐马尔可夫模型(HMM)和支持向量机(SVM)相结合,以动态行为序列作为关键特征,对移动应用软件运行中的网络收发、文件访问等行为建模.该模型融合了HMM和SVM的优势,并克服了二者的不足,适合于在获取连续动态行为特征序列后进行行为分类.实验结果表明,该方法分析召回率较高,可以有效对应用中的异常行为进行捕捉,并可以将其按类型分类.更多还原

【Abstract】 A detection method was proposed to analyze the malicious behavior on Android,that combines hidden-Markov model( HMM) with support vector machine( SVM) for modeling as well as construct model for behaviors like networking and data accessing. This model takes advantage of both HMM and SVM and overcomes the shortcomings inside,and it is suitable for classification using dynamic behavior sequences. Experiments show that this method can capture the abnormal behaviors with high accuracy rate and lower false positive rate.更多还原