Android Malware Dynamic Detection Method Based On DoI-RNNs

As network tariffs continue to decline,mobile devices are becoming the preferred network terminal,and most users are accustomed to using or even relying too heavily on mobile devices.In addition,the Android operating system has become the mobile device operating system with the highest market share in mainland China.However,with the wide application of the Android operating system,Android devices have gradually become the target of choice for unscrupulous people,and Android malware is constantly emerging.On the one hand,the number of Android malware is increasing.On the other hand,the escape technology of Android malware is constantly upgrading.In the face of the increasingly severe security situation,detecting Android malware and building a security defense system for Android devices has become an important issue that cannot be delayed.Firstly,the dynamic detection method of Android malware based on DoI-RNNs is proposed.The proposed Android malware detection method based on deep learning does not explicitly consider the dynamic changes of Android malware runtime features,and only copyes the deep learning theory that has been successfully applied to other research fields,resulting in poor detection results.By introducing the concept of derivative,the dynamic detection method of Android malware based on DoI-RNNs can not only learn the runtime features of Android malware,but also learn the dynamic changes of Android malware runtime features.Then the dynamic detection method of Android malware based on hierarchical DoI-RNNs model is proposed.The special behavior of Android normal software may also cause dynamic changes in its runtime features,which in turn affects the detection effect of Android malware dynamic detection method based on DoI-RNNs.By introducing the hierarchical model,the Android malware dynamic detection method based on the hierarchical DoI-RNNs model first considers the runtime features of the target Android software system call,network traffic and system components separately,and then synthesizes the above runtime features to determine whether it is Belongs to Android malware,thereby minimizing the interference caused by the special behavior of Android normal software.Finally,the dynamic detection method of Android malware based on DoI-RNNs and the dynamic detection method of Android malware based on hierarchical DoIRNNs model are carried out.According to the experimental results,DoI-RNNs and hierarchical DoI-RNNs models are better than RNNs in detecting Android malware.Among them,the hierarchical DoI-RNNs model has the best ability to detect Android malware.