【作者】 张锐；

【导师】 杨吉云；

【作者基本信息】 重庆大学 ， 计算机应用技术， 2014， 硕士

【摘要】 近年来，智能手机快速普及，逐渐成为人们日常生活中不可或缺的一部分。在众多的智能手机系统中，Android系统以其免费开源的特点，迅速占领了智能手机操作系统市场。Android平台下丰富的软件应用给人们的生活带来了极大的便利。然而，混杂在正常应用软件中的恶意软件数量也以惊人的速度不断增长，Android平台的安全问题变得越来越严重。因此，如何应对Android恶意软件的飞速发展，以较小的开销准确的检测出Android恶意软件是一个值得研究的课题。本文以静态检测的方式对Android环境下恶意软件检测进行了研究，具体成果如下：①首先，对智能手机的发展历史进行了回顾，分析了移动恶意软件对于智能手机平台的安全威胁。然后，按照检测时机的不同，对三种主要的恶意软件检测方法（动态检测，静态检测和云计算检测）进行了介绍和优缺点分析。最后，对国内外学术界在Android恶意软件检测领域的研究成果以及难点进行了阐述和总结。②针对低开销初步判断Android软件恶意倾向的需求，提出一种从Android权限角度判断恶意软件的检测方法。分析Android权限机制自身的特点,利用特征预处理知识，从权限之间以及权限和恶意倾向之间的相关性入手，进行特征选取和特征去冗余，形成最具代表性的权限特征集合作为分类依据。实验结果表明，在少量特征情况下，获得了一定的检测准确率。作为初步检测方案，具备一定的实用价值。③针对静态检测在应对新型Android恶意软件时，检测准确率下降的问题，提出一种基于集成概率神经网络的恶意软件检测方法。检测方案以逆向获取的高危API作为检测特征，利用概率神经网络用于分类所具备的样本容错性好、追加能力强等特点作为分类器。同时,利用Bagging集成技术,形成差异度大的个体概率神经网络进行集成，进一步提高Android恶意软件检测的泛化能力。实验结果表面，整体检测准确率较高，新样本学习能力强，应用于新型Android恶意软件检测，检测准确率只出现了小幅度下滑，改善了泛化能力。更多还原

【Abstract】 In recent years, with the rapid spread of smart phones, it has been more and moreindispensable in people’s daily life. Among the many smart phone system, Androidquickly occupied the smart phone operating system market with its advantages of freeand open source. Explosive growth of the software based on Android system hasbrought great convenience to people’s lives. However, the number of malicious softwaremixed in normal software is also growing at an alarming rate. Therefore, how to copewith the rapid development of Android malware and detect the Android malwareaccurately with less overhead is a topic worth studying. This thesis mainly studies bystatic method to classify the Android software, to achieve the purpose of detectingmalicious android software，the main work is as follows:①Review the development history of smart phones. Analysis the mobile malwarethreats to the security of smart phones. Three main malware detection methods(dynamic detection method, static detection method and the cloud based detectionmethod) are introduced and analysis of its advantages and disadvantages. Review andsummarize the domestic and foreign research achievements in the field of Androidmalware detection.②Considering the demand of preliminary detecting malware of android at low cost,a method of detecting malicious tendency is proposed on the basis of permissioncorrelation. Use pre-treatment knowledge of characteristics to select typical features andreduce redundancy on the basis of correlation between each permission and thepermissions to malicious tendencies to get the most representative permissions set as theclassification basis. The experimental results show that the proposed scheme under thecondition of small features, obtain a certain detection accuracy. It has a certain practicalvalue as a preliminary test method.③Considering the ubiquitous issue of accuracy drop when detecting new androidsoftware samples on the basis of old samples, a new malware detection method wasproposed based on the probabilistic neural network ensemble. Decompile android codeto identify the Dalvik API as the high-risk characteristics through reverse engineering.Probabilistic Neural Network was used as classifier with its features of goodfault-tolerance and additional ability. And Bagging integration technology was used toform the difference degree of individual probabilistic neural network, and integrate each probabilistic neural network to improve the generalization ability on Android malwaredetection. The experimental results show that the proposed scheme has high detectionaccuracy with strong samples learning ability. When applied to detect new Androidmalware, detection accuracy rate appears only a small decline, and generalization abilityhas been improved.更多还原