基于卷积神经网络恶意安卓应用行为模式挖掘

doi:10.11959/j.issn.2096-109x.2020073

Abstract

Abstract:

The features extracted by existing malicious Android application detection methods are redundant and too abstract to reflect the behavior patterns of malicious applications in high-level semantics.In order to solve this problem,an interpretable detection method was proposed.Suspicious system call combinations clustering by social network analysis was converted to a single channel image.Convolution neural network was applied to classify Android application.The model trained was used to find the most suspicious system call combinations by convolution layer gradient weight classification activation mapping algorithm,thus mining and understanding malicious application behavior.The experimental results show that the method can correctly discover the behavior patterns of malicious applications on the basis of efficient detection.

Key words: Android, rapid detection, convolutional neural network, social network analysis

CLC Number:

TP393

Xin ZHANG,Weizhong QIANG,Yueming WU,Deqing ZOU,Hai JIN. Mining behavior pattern of mobile malware with convolutional neural network[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 35-44.

Figures/Tables 15

References 17

[1]	Google android security 2018 report[EB].
[2]	RASTOGI V , CHEN Y , JIANG X . Catch me if you can:evaluating android anti-malware against transformation attacks[J]. IEEE Transactions on Information Forensics and Security, 2013,9(1): 99-108.
[3]	SELVARAJU R R , COGSWELL M , DAS A ,et al. Grad-cam:visual explanations from deep networks via gradient-based localization[C]// Proceedings of the IEEE International Conference on Computer Vision. 2017: 618-626.
[4]	ARP D , SPREITZENBARTH M , HUBNER M ,et al. Drebin:effective and explainable detection of android malware in your pocket[C]// NDSS. 2014 23-26.
[5]	ZHANG M , DUAN Y , YIN H ,et al. Semantics-aware android malware classification using weighted contextual api dependency graphs[C]// Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. 2014: 1105-1116.
[6]	FENG Y , ANAND S , DILLIG I ,et al. Apposcopy:semantics-based detection of android malware through static analysis[C]// Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering. 2014: 576-587.
[7]	MARICONTI E , ONWUZURIKE L , ANDRIOTIS P ,et al. Mamadroid:detecting android malware by building markov chains of behavioral models[J]. arXiv preprint arXiv:1612.04433, 2016
[8]	NATARAJ L , KARTHIKEYAN S , JACOB G ,et al. Malware images:visualization and automatic classification[C]// Proceedings of the 8th International Symposium on Visualization for Cyber Security. 2011:4.
[9]	HSIEN-DE , HUANG T T , KAO H Y . R2-D2:color-inspired convolutional neural network (CNN)-based android malware detections[C]// 2018 IEEE International Conference on Big Data (Big Data). 2018: 2633-2642.
[10]	[EB/OL]. .
[11]	RASTHOFER S , ARZT S , BODDEN E . A machine-learning approach for classifying and categorizing android sources and sinks[C]// NDSS. 2014:1125.
[12]	BLONDEL V D , GUILLAUME J L , LAMBIOTTE R ,et al. Fast unfolding of communities in large networks[J]. Journal of Statistical Mechanics:Theory and Experiment, 2008(10):10008.
[13]	WU H C , LUK R W P , WONG K F ,et al. Interpreting TF-IDF term weights as making relevance decisions[J]. ACM Transactions on Information Systems (TOIS), 2008,26(3):13.
[14]	FAN M , LIU J , WANG W ,et al. Dapasa:detecting android piggybacked apps through sensitive subgraph analysis[J]. IEEE Transactions on Information Forensics and Security, 2017,12(8): 1772-1785.
[15]	KRIZHEVSKY A , SUTSKEVER I , HINTON G E . Imagenet classification with deep convolutional neural networks[C]// Advances in neural information processing systems. 2012: 1097-1105.
[16]	SIMONYAN K , ZISSERMAN A . Very deep convolutional networks for large-scale image recognition[J]. arXiv preprint arXiv:1409.1556, 2014
[17]	HE K , ZHANG X , REN S ,et al. Deep residual learning for image recognition[C]// Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2016: 770-778.

Metrics

Recommended 0

No Suggested Reading articles found!

平均值	最小值	25%	50%	75%	最大值
2.8	1	1	1	3	70

图像长度	准确率	FLOPs（M）
400	90.31%	417.7
800	92.74%	720.38
1 200	92.73%	1 023.06

网络层	参数	输出尺寸
Conv > Relu	kernel_size=4,stride=1	(64,797,1)
MaxPool	kernel_size=3,stride=3,padding=1	(64,266,1)
Conv > Relu	kernel_size=5,padding=2	(192,266,1)
MaxPool	kernel_size=3,stride=3,padding=1	(192,89,1)
Conv > Relu	kernel_size=5,padding=2	(384,89,1)
Conv > Relu	kernel_size=5,padding=2	(256,89,1)
Conv > Relu	kernel_size=5,padding=2	(256,89,1)
MaxPool	kernel_size=3,stride=3,padding=1	(256,30,1)
AdaptiveAvgPool	output_size=(6,6)	(256,6,6)
Reshape > Dropout	p=0.5	(9,216)
Linear > Relu > Dropout	p=0.5	(4,096)
Linear> Relu	—	(4,096)
Linear	—	(2)

年份	良性	恶意	总数	平均大小/MB
2012年	1 875	2 000	3 875	3.73
2013年	1 896	2 000	3 896	6.56
2014年	1 826	1 982	3 808	7.15
2015年	1 811	1 839	3 650	8.35
2016年	2 015	1 940	3 955	5.12
2017年	1 884	1 834	3 718	7.92
2018年	2 058	1 919	3 977	8.15
全部	13 365	13 514	26 879	6.69

年份	P	R	F1	A
2012年	94.0	95.6	94.8	94.4
2013年	93.5	94.2	93.9	93.7
2014年	92.3	89.2	90.7	90.6
2015年	91.0	91.9	91.4	91.4
2016年	91.4	92.6	92.0	93.9
2017年	93.4	90.4	91.9	91.8
2018年	95.1	90.9	93.0	93.0
全部	93.0	92.1	92.5	92.7

Mining behavior pattern of mobile malware with convolutional neural network

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 15

References 17

Related Articles 15

Metrics

Recommended 0

指标	2015年	2016年	2017年	2018年
P	91.0	89.5	79.1	89.2
R	91.9	56.9	37.2	60.0
F1	91.4	69.5	50.6	71.7
A	91.4	75.6	64.2	77.2

方法	反汇编/s	调用图/s	特征提取/s	分类/s	可视化/s	总时间/s
MaMaDroid	-	163.2	2.5	0.5	-	166.2
Drebin	-	-	82.4	0.3	-	82.7
本文方法	9.5	4.8	5.0	2.1	1.2	22.7

[1]	Dian LIN, Li PAN, Ping YI. Research on the robustness of convolutional neural networks in image recognition [J]. Chinese Journal of Network and Information Security, 2022, 8(3): 111-122.
[2]	Zhanhui YUAN, Zhi YANG, Hongqi ZHANG, Shuyuan JIN, Xuehui DU. Android complex information flow analysis method based on communicating sequential process [J]. Chinese Journal of Network and Information Security, 2021, 7(5): 156-168.
[3]	Peijie LI, Li ZHANG, Yunfei XIA, Liming XU. Architecture design of re-configurable convolutional neural network on software definition [J]. Chinese Journal of Network and Information Security, 2021, 7(3): 29-36.
[4]	Fan CHAO, Zhi YANG, Xuehui DU, Bing HAN. Classified risk assessment method of Android application based on multi-factor clustering selection [J]. Chinese Journal of Network and Information Security, 2021, 7(2): 161-173.
[5]	Fan CHAO,Zhi YANG,Xuehui DU,Yan SUN. Android malware detection method based on deep neural network [J]. Chinese Journal of Network and Information Security, 2020, 6(5): 67-79.
[6]	Yuchao JIANG,Lixin JI,Chao GAO,Shaomei LI. Multi-scale Logo detection algorithm based on convolutional neural network [J]. Chinese Journal of Network and Information Security, 2020, 6(2): 116-124.
[7]	Xuetao ZHANG,Meng SUN,Jinshuang WANG. Multi-granularity Android malware fast detection based on opcode [J]. Chinese Journal of Network and Information Security, 2019, 5(6): 85-94.
[8]	Ning FANG,Weibing CAO,Donghe NI,Guandong DI. Accelerating cryptographic computation with parallel computing mechanisms in Android platform [J]. Chinese Journal of Network and Information Security, 2019, 5(1): 50-55.
[9]	Futian SHI,Jian MAO,Jianwei LIU. Review of side-channel privacy inference of Android mobile devices [J]. Chinese Journal of Network and Information Security, 2018, 4(4): 12-21.
[10]	Xiaoyan ZHU,Hui ZHANG,Jianfeng MA. Privacy protection system based on Hook for Android [J]. Chinese Journal of Network and Information Security, 2018, 4(4): 38-47.
[11]	Qinrang LIU,Chongyang LIU,Jun ZHOU,Xiaolong WANG. Based on linear systolic array for convolutional neural network’s calculation optimization and performance analysis [J]. Chinese Journal of Network and Information Security, 2018, 4(12): 16-24.
[12]	Jieming GU,Bowen SUN,Peng WU,Qi LI,Yanhui GUO. Anti-obfuscation Android application similarity detection method based on API call [J]. Chinese Journal of Network and Information Security, 2018, 4(1): 63-68.
[13]	Hui-ying YAN,Zhen-ji ZHOU,Li-fa WU,Zheng HONG,He SUN. Symbolic execution based control flow graph extraction method for Android native codes [J]. Chinese Journal of Network and Information Security, 2017, 3(7): 33-46.
[14]	Yi-lin YE,Zhen-ji ZHOU,Zheng HONG,Hui-ying YAN,Li-fa WU. Static-analysis-based event input generation approach for Android application [J]. Chinese Journal of Network and Information Security, 2017, 3(6): 21-32.
[15]	Ya-wei WANG,Chang-gen PENG,Hong-fa DING,Kai ZHOU. Identity authentication scheme of Android client based on identifiers [J]. Chinese Journal of Network and Information Security, 2017, 3(4): 32-38.