Multi-feature mobile terminal malicious software detecting method based on network flow and multi-feature mobile terminal malicious software detecting system based on network flow

Abstract

The invention discloses a multi-feature mobile terminal malicious software detecting method based on network flow and a multi-feature mobile terminal malicious software detecting system based on the network flow. The method comprises the following steps of: extracting features capable of effectively representing mobile terminal malicious software network behaviors from network flow data; classifying the extracted features capable of effectively representing the mobile terminal malicious software network behaviors according to different feature types; building detecting models adapting to the classified features, wherein each kind of types has one corresponding unique detecting model; and selecting the corresponding detecting model for each kind of features, and outputting the corresponding detecting result. By aiming at different feature types of the mobile terminal network flow, the detecting models adapting to different feature types are designed; a user can select the required model by the self according to requirements; the detecting accuracy can be improved to a certain degree through different detecting models designed by aiming at different feature types; and the individualized requirements of the user are met.

Description

technical field [0001] The invention relates to a method for detecting malicious software network behavior by using mobile terminal network traffic, in particular to a detection method and system for designing corresponding different detection models for multi-type characteristics of mobile terminal network traffic. Background technique [0002] With the widespread use of mobile terminals, especially the rapid popularization of smart phones, mobile smart terminals have brought great changes to modern society. Since entering the 21st century, we have quickly entered the mobile era. The mobile phone is no longer limited to communication services in the traditional sense, but has become a powerful terminal integrating e-commerce, personal payment, social entertainment and other functions. According to Gartner's report statistics, in 2014, the global mobile phone market has reached 3.5 billion units (including 2.7 billion Android systems), which has exceeded the number of PCs, a...

AI Technical Summary

Problems solved by technology

[0005] (1) Existing methods for detecting malware based on mobile terminal network traffic are only limited to a certain type of feature, for example, only using DNS features for malware detection, lacking a systematic summary and analysis of mobile terminal network traffic characteristics. Detection methods for different types of network traffic characteristics

[0006] (2) The existing network traffic behavior characteristics based on mobile terminals often only focus on the statistical analysis of port, data packet size, start time, end time and other characteristics, and lack the network interaction behavior characteristics of mobile terminal malware

[0007] (3) Since the existing research on malware detection technology based on mobile terminal network traffic is still in its infancy, it often learns from traditional PC-side detection methods, and traditional PC-side malware detection is also faced with insufficient ability to discover unknown malware. question

Images