【摘要】 在安卓应用安全研究领域的静态分析中，一种有效的方式是使用逆向工程工具对应用程序进行反编译，并从反编译后的代码文件中提取函数调用图(Function Call Graph, FCG)作为恶意软件识别的主要特征，特别是基于敏感API的FCG调用子图已经得到广泛验证。然而，现有的此类基于敏感API的研究工作大多依赖较早的敏感API集，没有随着系统API迭代继续更新。通过实验可以发现，使用传统的敏感API集从应用的函数调用图(FCG)中提取特征节点时，很多情况下无法获取到所需的特征节点。例如随着安卓系统的迭代更新，出现显著的API调整和更换，或者使用反射机制(Reflect)相关技术可以动态隐式调用系统API。对此，文中根据最新的安卓应用综合研究框架，提出了一种基于MOBSF＿rule提取FCG子图的安卓恶意软件检测方法。该方法首先从应用程序反编译的代码文件中生成函数调用图(FCG);然后利用MOBSF＿rule规则集提取特征节点，生成包含这些特征节点的五点图、六点图和七点图，统计不同构型子图的出现频率；最后把频率矩阵输入机器学习方法中进行训练、推理。相比现有的敏感API集，所提方法有如下优势。1)MOBSF＿rule过滤规则集在提取特征节点方面表现出色，能够有效提取包括反射机制、组件交互、签名验证、网络通信和客户端/服务器(C/S)架构通信等关键API特征，对比传统敏感API集，在最新恶意软件数据集中特征提取有效率提升了69.765%。2)MOBSF＿rule规则集在不同时间标签下提取特征节点的能力表现出色，具有较强的稳定性。它不仅能够适应安卓系统的持续更新，还能在不同版本之间保持高度一致的特征提取能力。2012-2022年期间，相比传统敏感API集，MOBSF＿rule规则集的特征提取有效率的多年总体方差降低了98.747%。3)采用了Stacking集成学习方法，对比随机森林集成学习方法和多层感知机方法，准确率提升了4.32%。更多还原

【Abstract】 In the field of Android application security research, a highly effective method within static analysis involves utilizing reverse engineering tools to decompile the application and subsequently extracting the Function Call Graph(FCG) from the decompiled code files, which serves as a primary feature for malware identification.Notably, FCG subgraphs based on sensitive APIs have been widely validated.However, the majority of existing research efforts in this area rely on older sets of sensitive APIs and have not continued to update with the iteration of system APIs.Through experimentation, it has been discovered that when using traditional sensitive API sets to extract feature nodes from the application’s FCG,many cases fail to obtain the desired feature nodes.For instance, with the iterative updates of the Android system, there are significant API adjustments and replacements, or dynamic implicit invocation of system APIs can be achieved using reflection mechanism(Reflect)-related technologies.In response to this, based on the latest comprehensive research framework for Android applications, this paper proposes an Android malware detection method that extracts FCG subgraphs using MOBSF＿rule.The method first generates the FCG from the decompiled code files of the application.Then, it utilizes the MOBSF＿rule set to extract feature nodes, generating five-node, six-node, and seven-node graphs containing these feature nodes, and statistically analyzing the occurrence frequency of different configuration subgraphs.Finally, the frequency matrix is input into the machine learning method for training and inference.Compared to existing sensitive API sets, the proposed method has the following advantages.1)The MOBSF＿rule filtering rule set demonstrates outstanding performance in extracting feature nodes, effectively extracting key API features including reflection mechanisms, component interactions, signature verification, network communication, and client/server(C/S) architecture communication.Compared to traditional sensitive API sets, the effective rate of feature extraction in the latest malware datasets has increased by 69.765%.2)The MOBSF＿rule set shows excellent capability in extracting feature nodes across different time tags, exhibiting strong stability.It can not only adapt to the continuous updates of the Android system but also maintain a highly consistent feature extraction capability across different versions.Between 2012 and 2022,compared to traditional sensitive API sets, the overall variance in feature extraction effectiveness over multiple years decreases by 98.747%.3)The method employs the Stacking ensemble learning approach, and compared to the random forest ensemble learning method and the multilayer perceptron method, the accuracy rate has increased by 4.32%.更多还原