Research On LSTM Model For Android Application Behavior Consistency Verification

In recent years,with the rapid development of mobile Internet communication technology,the types,quantity,and functions of mobile intelligent terminals and mobile applications are showing explosive growth.The Android platform has won a monopolistic market share in the global market with its open source and flexible development process,and inexpensive hardware products.This situation will maintain a continuous growth trend.However,the great popularity of Android platform also attracts a large number of malicious attackers to develop all kinds of malicious applications and release them to the application market,thereby inducing users to download and install the malicious ones.The application market is not perfect for the review and verification mechanism of new applications.It cannot evaluate the accuracy of the function description and the normality of application behavior,resulting in many malicious applications appearing in the user’s vision.Due to the current chaos in the Android market,this paper proposes behavior consistency theory and build a LSTM(Long-Short Term Memory)model for behavior consistency measuring of Android applications.This model can be used to implement category detection and behavior consistency verification of the new released application.The method mainly constructs the network event-behavior temporal sequence with causal and temporal relationship,and designs a LSTM classification model with special input structure to train and learn the behavior sequences,so as to achieve good classification results.In addition,more new data is generated to further improve the classification accuracy of the LSTM model by using the generative adversarial networks GAN.The main research works of this paper are as follows:1、Dynamic network behavior feature extraction and reconstruction of applicationsBy obtaining eight types of popular applications in the Android application markets,the network behaviors of applications in different functionality categories are thoroughly triggered by constructing various sequences of scenario events.Based on the analysis of network traffic data packet,the cleaning and sorting of traffic,four kinds of network behavior characteristics are extracted to construct network event-behavior temporal sequence with causal and temporal relationship.2、Designing LSTM neural net,work for dynamic network behavior modelingIn order to describe the causal relationship and temporal relationship between triggering events and applications network behavior characteristics better,a LSTM recurrent neural network model with special input structure is designed,which can learn the logical relationship above comprehensively and realize the classification model based on the applications network behaviors.3、Generating new network behavior sequence data by designed GAN modelIn order to increase the experimental data,this paper designs GAN model based on GRU(Gated Recurrent Unit)to learn the features of the captured network event-behavior temporal sequences and understand network behavior in different functionality categories,so as to achieve the purpose of creating valid new data.4、Behavior consistency verification of Android applicationsWe verify that the proposed Android applications have behavioral consistency:self-consistency and category-consistency.Self-consistency is calculated by standardized Minkowski distance and category-consistency is verified by LSTM classification model.