Method, device and storage medium for detecting android malicious program based on api

Abstract

An embodiment of the invention provides an API-based Android malicious program detection method, includes decompiling APK file to get smali file, obtaining sensitive API set by Pscout tool, matching API in smali file with API in sensitive API set, composing matching sensitive API set by successful matching API. LibD tool is used to eliminate the API called by the third party library in the matching sensitive API set, and the purified matching sensitive API set is obtained. According to the purified matching sensitive API set, the first eigenvector is constructed, and TF-IDF algorithm reconstructs the first feature vector to obtain a second feature vector;taking the second feature vector as training set, the training depth learning model is used to get the effective classification model, and the effective classification model is used to detect the Android program and obtain the Android malicious program. The embodiment of the invention also provides an active interactive device and a non-transient readable storage medium for realizing the method. The invention can accurately detect the Android malicious program.

Description

technical field [0001] The embodiment of the present invention relates to the technical field of network security, in particular to an API-based Android malicious program detection method, device and storage medium. Background technique [0002] Android malicious application attack technology has become increasingly mature, emerging malware emerges in an endless stream, with many characteristics such as involving a wide range of areas, affecting a wide range, being difficult to detect, leaking state secrets, and causing economic losses to users. Many domestic and foreign scholars have done a lot of research on the detection of Android system. [0003] The current mainstream Android malware detection method is: first, extract the static or dynamic features of the Android application, and combine the static or dynamic features to generate the feature vector of the application; eigenvectors are marked as 1, otherwise 0. Then, use a certain machine learning algorithm to train ...

AI Technical Summary

Problems solved by technology

However, the value of the feature vector using binary (0,1) can only indicate that a certain sensitive behavior has been detected, but having a certain sensitive behavior does not mean that it is malicious in this application. The malicious degree of an Android application is the same as the program itself. Expected Functional Correlation

Images