| In recent years,with the development and growing of mobile internet,the development of smart phone is becoming more and more rapidly.Android system occupies a large share of global smart phone operating system market and there is still a rising trend.Meanwhile,Android has also become a major platform for the proliferation of malware.The malicious behavior of Android malware is various,which has brought great harm and economic loss to users and even the whole society.Therefore,how to detect Android malware rapidly and efficiently has become a hot research topic.This paper first summarizes the Android platform,analyzes the system architecture and application components of Android,and then analyzes the machine learning algorithm and the Spark parallel environment framework,which lays a good foundation for the following research.Then,aiming at the defect of vote principle in random forest algorithm which is incapable of distinguishing the differences between strong classifier and weak classifier,this paper proposed a weighted voting improved method,and proposed an improved random forest classification model(IRFCM)to detect Android malware on the basis of this method.The IRFCM chose Permission information and Intent information as attribute features from AndroidManifest.xml files,and then used feature selection algorithm to optimize them into feature vector sets,lastly applied the model to classify the final feature vector sets.The experimental results show that IRFCM has better classification accuracy and classification efficiency.Lastly,according to the problem of long time consuming in the process of decompiling the application installation packages and slow feature extraction in large data environment,this paper combined the IRFCM with the Spark framework,designing and implementing the Android malware detection in the parallel environment.The sample data are converted into resilient distributed dataset(RDD),and the RDD is used for feature extraction and classification in virtual machine in parallel.Compared with the single machine environment,the experimental results in parallel environment can effectively improve the detection efficiency of Android malware. |
