基于多源软件行为表征的Android恶意软件特征构建与家族识别方法

Android恶意软件的快速增长使得家族识别成为了热点问题，然而现有方法面临着恶意代码形态多样化以及未知恶意家族特征选择两个主要挑战。针对恶意代码形态多样化挑战，本项目拟提出一种具备抗混淆能力的多源软件异构行为特征融合表征方法，通过动静结合的程序分析技术抽取多维度、多模态、多语义的软件行为集合，然后采用主成分分析、图表征等技术，将异构行为映射到同构空间中，从而提高特征的抗混淆能力并降低其特征维度。针对未知恶意家族特征选择挑战，本项目拟提出一种基于代表性样本分析的恶意家族特征选择方法，通过恶意软件相似关系网络构建以及社团发现算法选择恶意家族中代表性样本，然后挖掘代表性样本共性行为来有效表征其家族特征。最终基于上述理论方法设计实现家族识别原型系统，有效表征软件行为特征并准确识别恶意软件家族信息。

Family identification is a hot topic due to the rapid growth of Android malware. However, existing methods are facing two major challenges: the diversity of malicious code and the feature selection of unknown malware family. For the diversified challenge of malicious code, we propose a multi-source software heterogeneous behavior feature fusion method with resilience ability to obfuscation techniques. We first extract multi-dimensional, multi-modal and multi-semantic software behavior through dynamic and static program analysis. Then, we map the heterogeneous behavior into the isomorphic space with PCA and graph embedding techniques, thus improving the resilience ability to obfuscation techniques and reducing the feature dimension. To solve the challenge of feature selection for unknown malware family, we propose a feature selection method for malware family based on the analysis of representative malware samples. We first select the representative malware samples through the construction of a malware link network and the community detection of malware family. Then, we mine the common behavior of representative samples to represent the family feature. Based on the above theoretical methods, we design and implement the prototype that can effectively characterize the software behavior and correctly identify the family labels of Android malware.