| With the popularization of Android smart devices,malicious software targeting Android devices has also shown an endless trend.How to effectively detect Android malicious applications is a current research hotspot.Traditional Android malware analysis has the following problems: the traditional static method requires manual screening of malicious code and then analyzes its characteristics,which is time-consuming and error-prone;Dynamic methods based on system calls often analyze the word frequency of system calls,ignoring the timing information of the entire sequence;Regarding the problem of malware classification,existing researches generally classify malware families,and rarely consider maliciousness of the software.In response to the above problems,this paper proposes an Android malware detection and classification method.In the static analysis,constructing the image by extracting the core files of the application,extracting a variety of image features,and using an improved Light Gradient Boosting Decision Tree to realize malicious application discrimination;In dynamic analysis,the system call sequence of the application program is generated by dynamically detecting the execution process of the application,and the improved Transformer model is adopted to realize the identification of malicious applications;In the classification of maliciousness,a threshold judgment method is adopted,which combines the advantages of dynamic and static analysis,and finally realizes the effective classification of malware.The main work and innovations of this paper are as follows:1.A static detection method based on images is designed and implemented.First,this method analyzes the composition of the Android package and selects the appropriate feature file;then uses the feature file to generate a gray-scale image and uses an interpolation algorithm to scale it to a uniform size;further improves the convolutional neural network model with the semantic embedding branch method,extracts the deep and shallow features of the network layer and merges them;after that,the traditional image texture feature GIST is extracted and combined with the convolutional neural network feature to form a mixed feature with rich expressive ability;Finally,an algorithm that combines Light Gradient Boosting Decision Tree and logistic regression is used to classify the application software,and compares with a variety of different machine learning algorithms.The accuracy and F1-score of this method both reached 98.7%,which is better than other machine learning algorithms.2.A dynamic detection method based on system call is designed and implemented.First,the characteristics of the system call sequence are analyzed,and the feasibility of using the natural language model to analyze the system call sequence and the requirements for the language model are explained;next,this method extracts the system call sequence of the Android software through monkey,strace and other tools;uses the tokenizer class in the Keras framework to analyze the system call sequence and converts it into a vector sequence so that it can be input into the natural language model;next,an efficient natural language model Transformer is introduced,and on the basis of this model,a Longseq-Transformer model which can process ultra-long sequences is proposed to detect applications;finally,through experiments,the model proposed in this article is compared with the LSTM model and the basic Transformer model,showing the advantages of Longseq-Transformer model in terms of resource consumption and detection accuracy.The accuracy and F1-score reached 96.4% and96.39% respectively.3.An Android malware classification system combining static and dynamic method is Designed and implemented.A threshold judgment module is proposed to make full use of the characteristics of fast static detection,and to classify as many benign software as possible without misjudge the malware as benign software;Then the dynamic analysis method is used to classify the remaining software according to the maliciousness;finally,through experiments,the method in this paper is compared with the traditional n-gram classification method,showing the good performance of the method in this paper.The classification accuracy and macro F1-score reached 91.08% and 89.47%,respectively. |
