ANNs on Co-occurrence Matrices for Mobile Malware Detection
ANNs on Co-occurrence Matrices for Mobile Malware Detection
复制标题
用于移动恶意软件检测的共现矩阵上的人工神经网络
DOI：
10.3837/tiis.2015.07.023
复制
发表时间：
2015
影响因子：
1.5
通讯作者：
Jiang Yong
中科院分区：
文献类型：
--
作者：
Xiao Xi;Wang Zhenlong;Li Qi;Li Qing;Jiang Yong
安卓主导了移动操作系统市场，这刺激了移动恶意软件的快速传播。检测移动恶意软件是一项非常具有挑战性的工作。系统调用序列分析被广泛用于识别恶意软件。然而，现有方法的恶意软件检测精度并不令人满意，因为它们没有考虑序列中系统调用的相关性。本文提出了一种新的基于共现矩阵Droid的人工神经网络(ANN)方案，利用共现矩阵挖掘系统调用的相关性。我们的重点观察是，恶意软件和良性软件的系统调用相关性存在显著差异，可以用共现矩阵准确地表示，神经网络可以有效地识别共现矩阵中的异常。因此，我们首先从系统调用序列中计算共现矩阵，然后将其转换为向量。最后，将这些向量反馈到人工神经网络中进行恶意软件检测。通过实际实验验证了ANNCMDroid的有效性。实验结果表明，在594个被评估的良性应用程序中，只有4个应用程序被误判为恶意软件，在614个被评估的恶意应用程序中，只有18个应用程序未被检测到。结果，ANNCMDroid的F-分数达到了0.981878，远远高于其他方法。
Android dominates the mobile operating system market, which stimulates the rapid spread of mobile malware. It is quite challenging to detect mobile malware. System call sequence analysis is widely used to identify malware. However, the malware detection accuracy of existing approaches is not satisfactory since they do not consider correlation of system calls in the sequence. In this paper, we propose a new scheme called Artificial Neural Networks (ANNs) on Co-occurrence Matrices Droid (ANNCMDroid), using co-occurrence matrices to mine correlation of system calls. Our key observation is that correlation of system calls is significantly different between malware and benign software, which can be accurately expressed by co-occurrence matrices, and ANNs can effectively identify anomaly in the co-occurrence matrices. Thus at first we calculate co-occurrence matrices from the system call sequences and then convert them into vectors. Finally, these vectors are fed into ANN to detect malware. We demonstrate the effectiveness of ANNCMDroid by real experiments. Experimental results show that only 4 applications among 594 evaluated benign applications are falsely detected as malware, and only 18 applications among 614 evaluated malicious applications are not detected. As a result, ANNCMDroid achieved an F-Score of 0.981878, which is much higher than other methods.