基于APK签名信息反馈的Android恶意应用检测Androidmalware.PDFVIP

第 38 卷第 5 期 通 信 学 报 Vol.38 No.5 2017 年 5 月 Journal on Communications May 2017 doi:10.11959/j.issn.1000-436x.2017095 基于 APK 签名信息反馈的 Android 恶意应用检测 刘新宇，翁健，张悦，冯丙文，翁嘉思 （暨南大学信息科学技术学院，广东广州 510632 ） 摘 要：提出一种新的基于 APK 签名信息反馈的 Android 恶意应用检测方法（SigFeedback ）。该方法 SVM 分 类算法的基础上采用启发式规则学习的方式对特征值进行提取，并对检测集中的 APK 签名信息进行验证筛选， 实现了启发式反馈，达到更加准确地检测恶意应用的目的。SigFeedback 检测算法具有检测率高、误报率低的特 点。最后通过实验显示 SigFeedback 算法具有较高的效率，且能使误报率从 13%降低到 3% 。 关键词：误报率；恶意应用；启发式学习；有效性；检测率 中图分类号：TP309.1 文献标识码：A Android malware detection based on APK signature information feedback LIU Xin-yu, WENG Jian, ZHANG Yue, FENG Bing-wen, WENG Jia-si (College of Information Science and Technology, Jinan University, Guangzhou 510632, China) Abstract: A new malware detection method based on APK signature of information feedback (SigFeedback) was pro- posed. Based on SVM classification algorithm, the method of eigenvalue extraction adoped heuristic rule learning to sig APK information verify screening, and it also implemented the heuristic feedback, from which achieved the purpose of more accurate detection of malicious software. SigFeedback detection algorithm enjoyed the advantage of the high detec- tion rate and low false positive rate. Finally the experiment show that the SigFeedback algorithm has high efficiency, making the rate of false positive from 13% down to 3%. Key words: false positive rate, malicious application, heuristic learning, effectiveness, detection rate 机的生产。 1 引言