| Android is the most popular operating system with a market share of 85.9%,but the number of Android malwares has risen sharply due to the openness of Android and the non-standard Android application market.Although Android malware detection technology based on machine learning is becoming mature,but little research focused on malware behavior.Therefore,an Android malware detection system based on semi-supervised learning for Android malware detection and malware behavios’s analysis problems is presented in the thesis.The research steps are as follows:the first step is to collect Android benign software by using web crawler technology and to collect malware from research institutions as the experimental data set.The second step is to decompile the Android binaries,extract the static features,and then use the Droidbox dynamic analysis tool to extract dynamic features.The third step is to mark malicious behaviors of malicious software,first obtain the software’s malware family,then determine five malicious behaviors by manual analysis and cluster analysis of the top 20 malicious software families.The fourth step is to use the improved semi-supervised learning algorithm to retrain the unlabeled sample to get the classification model.In the fifth step,the accuracy,recall rate,and other indicators are used to evaluate the Random Forest,Gradient Boosting Decision Tree,Co-Forest,and the Co-RFGBDT algorithm proposed in the thesis.It is proved that the improved algorithm has higher accuracy in studying this kind of problems.In the sixth step,an Android malware detection system based on Flask framework is implemented.The main work is to propose a semi-supervised learning algorithm named Co-RFGBDT.Compared with supervised learning,this algorithm solves the problem of difficult marking of malicious behaviors.Compared with the Co-Forest algorithm,it combines the advantages of random forest to reduce the variance of prediction,and the advantage of GBDT to reduce the prediction bias.Re-train the data sets using the improved algorithm in combination with unlabeled samples to improve the accuracy of malware detection.In addition,for the problem of endless malicious behavior,unknown malicious behavior is identified by setting the confidence threshold.The system uses a semi-supervised learning method to detect and analyze Android malware and constructs a better classification model for data set consists of 16179 Android benign software and 31964 Android malwares.The overall accuracy of the system is as high as 91.56%.The experimental results show that the proposed Android malware detection and malicious behavior analysis scheme is effective. |
