Research And Application Of Android Malware Detection Based On Deep Learning

With the rapid development of economic society and communication technology,smartphones have become popular and penetrated into people's lives and become an indispensable tool in people's lives.Due to the open source feature of the Android system,it has become the most widely used operating system for smartphones,and it has also become an important target for malicious attacks.The open Android software market allows users to download a variety of Android software from different platforms,while many unofficial app markets are often vulnerable to embedding malicious code by illegal developers.Therefore,it is of great practical significance to propose an effective detection method for Android malware.Machine learning technology has been widely used in the research of Android malware detection,but in the face of the ever-increasing Android malware,the traditional machine learning method has the problem of low detection capability to new malware.For this situation,according to the advantages of deep learning with the ability through surface features to learn and abstract deep features,so this paper proposes a method based on deep learning for Android malware detection.Firstly,from the perspective of static analysis,various features of Android software are extracted as features dataset.Secondly,the AE-DBN model is constructed to learn the features and detect malware based on the advantages of Auto Encoder(AE)and Deep Belief Network(DBN).Thirdly,the effectiveness of this method is proved by experiments.Last,the model is applied to the actual work of information system security assessment in Guizhou Province.They have been carried out the security assessment including the Android software of 20 evaluated units such as He Guiyang,Guizhou Haoxing,Duodada and Guizhou Tongcuncun etc.and the result is well.The specific work and innovations completed in this paper are as follows:The architecture and security mechanism of the Android system are introduced in detail.The composition of the Android package,the malware category and the analysis method of the Android package are analyzed,and the principles of the deep learning about Auto Encoder network and Deep Belief Network are studied.Aiming at the problem that traditional machine learning methods have low detection ability for new malware and complex feature engineering in malware detection research.So this paper proposes an Android malware detection method based on AE-DBN.In order to further improve the accuracy of Android malware detection,according to the significance of application features for malware detection,it is proposed to use permissions,components,intent and sensitive APIs as features for malware recognition,and the original extracted the features were transformed as feature vector.The AE-DBN model is constructed according to the spatial mapping ability of AE with different dimensions to reduce the dimension of the original feature vector,and to learn and abstract the main features.On this basis,the DBN is set as the classifier of deep learning,and the classifier is trained,and the parameter optimization finally obtains the optimal model.By using multiple features and a single feature as the detection basis,it is proved by experiments that the method using multi-features can express the behavior of the application better than using only a single feature,which can improve the accuracy of Android malware detection and be good for studies of Android malicious application detection.Comparing this paper's method with DBN,SVM and KNN,it proves that using deep learning to detect android malware can achieve a better result than the traditional machine learning method.And this method has improved the accuracy and efficiency of Android malware detection.At the same time,the false positive rate is reduced.Applying the detection model proposed in this paper to the actual work,it is proved that the method of this paper can accurately identify Android malware,and has certain practical significance and practical value.