【作者】 吴帆；

【导师】 陆济湘；

【作者基本信息】 武汉理工大学 ， 数学， 2017， 硕士

【摘要】 精准高效的Android恶意程序检测技术,不仅是用户对自身安全的迫切需要,更是Android市场发展的前提.传统的静态分析方法正确率低,无法检测经过代码混淆处理的恶意程序;动态分析方法检测过程复杂、耗时,不适合检测大量的恶意样本;目前机器学习检测方法尚存在一些不足之处,譬如处理冗余特征不够充分、算法单一、选取的特征不能很好地体现恶意行为等.针对上述3种检测方法存在的不足之处,本文提出基于机器学习的多特征检测方案.首先,文章利用Baksmali.jar和strace工具,提取各应用程序的函数调用和系统调用序列,为分类器提供数据准备.函数调用直接关系到程序的功能,可在classes.dex文件中提取;系统调用属于Linux底层信息,是连接程序和系统资源的桥梁.这两项特征不仅能更好地体现程序执行时的行为,而且克服了代码混淆技术的影响.然后,本文运用改进的卡方统计CHI-IDF处理特征.基于此,既可防止部分重要特征因样本数量少而被忽略,又可避免某些意义不大的特征因样本多而被“重视”.通过该方法,能高效地剔除对分类影响极小的特征.接着,为了克服单一算法精度与泛化能力不够等问题,本文结合Naive Bias、KNN和SVM构建分类器.在采用KNN分类时,为减小属性值大的特征对距离的影响,本文将属性值映射到[0,1]区间上.Naive Bias能在分类器对某些样本难以做出分类时,能给出最优的“猜测结果”,并给出相应概率估计;SVM被誉为最优的“现成”分类器,不需修改即可使用.以上三种算法结合一起能取长补短.最后,本文选取正常程序和恶意程序各1000个,在WEKA平台上运用十折交叉法进行实验,每次实验样本数依次为400、800、1200、1600、2000.通过研究梯度样本数目下的分类效果,可以分析本方案的性能趋势,对预测分类器在检测庞大数目样本时更有帮助.为了进一步验证本检测方案的可行性,本文采用Androguard工具,在相同的样本集下进行对比实验.结果显示,本检测方案在时间执行效率和正确率上表现更优.更多还原

【Abstract】 The accurate and efficient Android malware detection technology is not only the user’s urgent need for their own security,but also a prerequisite for the development of Android.The traditional static analysis method has low accuracy,and can not deal with malicious programs that have been confused by code.Dynamic analysis method is unsuitable for a large number of malware detection due to its complex and time-consuming detection process.At present,the detection technology of machine learning still exists several shortcomings,such as redundant features are dealt insufficiently,algorithm used is single and some of the features can not well reflect the malicious behavior.In order to overcome the shortcomings mentioned above,this paper proposes a multi feature detection scheme based on machine learning.Firstly,Baksmali.jar and strace tools are used to extract the function call and system call,which prepare data for the classifier.The function call is directly related to the function of the application,and can be viewed in the classes.dex file;system call as underlying information of Linux,becomes a bridge connecting applications and system resources.Application need interact with these two features during the implementation of each function.Therefore,these two features can better reflect the behavior of the program execution and overcome the impact of code obfuscation technology.Secondly,this paper uses the improved chi-square statistics method named CHI-IDF to select features.It can prevent some important features with the small sample size from being ignored,and avoid some features of little significance with the large sample size from being overvalued.In this method,not only the data which has little influence on the classification can be eliminated,but also the weight of each feature can be balanced.Thirdly,in order to overcome the problem that the accuracy and generalization ability is not well for the single algorithm,classifiers are constructed by using Naive Bias,KNN and SVM algorithm.In the use of KNN classification,in order to reduce the influence of the large attribute value on the distance,this paper maps the attribute value to [0,1] interval.When it is hard for the classifier to make classification ofsome samples,Naive Bayesian can give an optimal "Guess-results" and its corresponding probability estimation.SVM algorithm is regarded as the best "Ready-made " classifier,that can be used without being modified.The above three algorithms can promote each other when combined together.Finally,10-fold cross-validation is used on the WEKA platform to conduct the ladder experiment on the 1000 malicious programs and the 1000 normal programs.The number of samples in each experiment was selected 400,800,1200,1600 and2000.By studying the classification effect of the gradient samples,we can analyze the classification trend of the classifier,and it is more helpful to predict the result when these classifiers detect the large number of samples.In order to further verify the feasibility of the detection scheme,this paper uses the Androguard tool to carry on the contrast experiment under the same sample set.The experimental results show that the proposed scheme performs better in terms of time efficiency and accuracy.更多还原