CTDroid: Leveraging a Corpus of Technical Blogs for Android Malware Analysis
CTDroid: Leveraging a Corpus of Technical Blogs for Android Malware Analysis
复制标题
CTDroid：利用技术博客库进行 Android 恶意软件分析
DOI：
10.1109/tr.2019.2926129
复制
发表时间：
2020
影响因子：
5.9
通讯作者：
Liu Ting
中科院分区：
文献类型：
--
作者：
Fan Ming;Luo Xiapu;Liu Jun;Nong Chunyin;Zheng Qinghua;Liu Ting
Android恶意软件的快速增长导致大量的方法致力于通过利用机器学习算法进行恶意软件分析。然而，这些方法的有效性主要取决于手动特征工程过程，这是耗时和劳动密集型的专家知识和直觉的基础上。在本文中，我们提出了一种自动化的方法，工程师信息功能的Android恶意软件相关的技术博客，这是写在一种方式，反映了人类的特征工程过程的语料库。然而，有两个主要挑战。首先，在海量的博客信息中很难识别出有用的知识。为此，我们利用自然语言处理技术来处理博客，并提取一组敏感的行为，可能会做有害的活动，潜在的用户。第二，在提取的敏感行为和编程语言之间存在语义鸿沟。为此，我们提出了两个语义匹配规则，以匹配的行为与具体的代码片段，使应用程序可以进行实验测试。我们设计并实现了一个名为CTDroid的恶意软件分析系统，包括恶意软件检测（MD）和家族分类（FC）。经过对大规模真实的恶意软件和良性应用程序的CTDroid评估，实验结果表明，CTDroid的真阳性率为95.8%，MD的假阳性率仅为1%，FC的准确率为97.9%。此外，我们提出的功能比那些国家的最先进的方法更翔实。
The rapid growth of Android malware results in a large body of approaches devoted to malware analysis by leveraging machine learning algorithms. However, the effectiveness of these approaches primarily depends on the manual feature engineering process, which is time-consuming and labor-intensive based on expert knowledge and intuition. In this paper, we propose an automatic approach that engineers informative features from a corpus of Android malware related technical blogs, which are written in a way that mirrors the human feature engineering process. However, there are two main challenges. First, it is difficult to recognize useful knowledge in the magnanimity information of thousands of blogs. To this end, we leverage natural language processing techniques to process the blogs and extract a set of sensitive behaviors that might do harmful activities to users potentially. Second, there exists a semantic gap between the extracted sensitive behaviors and the programming language. To this end, we propose two semantic matching rules to match the behaviors with concrete code snippets such that the apps can be tested experimentally. We design and implement a system called CTDroid for malware analysis, including malware detection (MD) and familial classification (FC). After the evaluation of CTDroid on a large scale of real malware and benign apps, the experimental results demonstrate that CTDroid can achieve 95.8% true positive rate with only 1% false positive rate for MD and 97.9% accuracy for FC. Furthermore, our proposed features are more informative than those of state-of-the-art approaches.