Research On Abnormal Intrusion Detection System Of Android Platform Based On Density Clustering

With the advent of the mobile internet era,smartphones have gone deep into people's daily lives.The smartphone usually stores personal information,call information and other privacy data,which related to user's privacy security.With the promotion of mobile payment by major companies,the security of mobile internet becomes more and more important.As the one which occupies the largest share of the smartphone market,the security of Android smartphone should not be overlooked.Since the inception of the Android smartphone,it has been the main target of malicious program because of its large number of users and its open source characteristics.There is a lot of Android platform security software on the market,most of them are similar to traditional anti-virus software,some security software also integrates the firewall,the flaw detection and other functions,which has a good detection rate and an ideal detection efficiency,but detection efficiency of those security software often relies on the completeness of the server-side virus database.Intrusion detection is a method which ensures the safety of equipment by analyzing the system and the user's behavior,but sophisticated android intrusion detection systems is rarely seen on the market,because it is difficult to describe user's behavior accurately.This paper designed an intrusion detection system on Android platform: Droid IDS,which collects CPU information,storage information,network traffic of Android system and other information as the basis of behavior construction.This paper described the overall frame of the system in detail,and introduced the implementation method and functions of data extraction module,training module,detection module and response module,and composed a complete intrusion detection system by cooperation between each module on the client and server side.This paper designed an abnormal intrusion detection system based on density clustering,which constructs the user's behavior contour,and comparing the new behavior data to determine whether an intrusion occurred.In order to describe the user's behavior contour accurately,a new abnormal intrusion detection algorithm is proposed,which not only applies a new density clustering algorithm to abnormal intrusion detection for the first time,but also obtains a more accurate behavior contour by using the original clustering feature.According to the principle of the clustering algorithm,that the density of edge data points is lower than the core data points,this paper proposed an algorithm of behavior contour construction,which constructs from the edge point,only the key points and truncation distances are retained as behavioral features,all other points in the truncation distance are deleted,and then build in sequence until the behavior contour is generated.In the detection phase,the distance between the behavior data and all the center points in the behavior contour is computed in order to determine whether an intrusion occurs.In the experimental part of this paper,firstly,several numbers of clusters and truncation distance are tested,and this paper analyzed the reason of this result,and obtained an ideal detection effect.Then the performance of the algorithm is evaluated by comparing with DBSCAN and the original clustering algorithm in memory occupancy,detection efficiency and contour generation speed.Experiments show that the abnormal detection algorithm not only has good detection performance,but also reduces the storage and computation overhead during clustering.