CN114547605B - Dynamic detection method and system for malicious application of android system - Google Patents

Dynamic detection method and system for malicious application of android system

Info

Publication number
CN114547605B
CN114547605B CN202210094057.7A CN202210094057A CN114547605B CN 114547605 B CN114547605 B CN 114547605B CN 202210094057 A CN202210094057 A CN 202210094057A CN 114547605 B CN114547605 B CN 114547605B
Authority
CN
China
Prior art keywords
system call
call sequence
transition probability
application
probability matrix
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202210094057.7A
Other languages
Chinese (zh)
Other versions
CN114547605A (en
Inventor
杜学绘
王娜
刘敖迪
杨智
任志宇
王文娟
单棣斌
黄琳娜
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Information Engineering University Of Chinese People's Liberation Army Cyberspace Force
PLA Information Engineering University
Original Assignee
Information Engineering University Of Chinese People's Liberation Army Cyberspace Force
PLA Information Engineering University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Information Engineering University Of Chinese People's Liberation Army Cyberspace Force, PLA Information Engineering University filed Critical Information Engineering University Of Chinese People's Liberation Army Cyberspace Force
Priority to CN202210094057.7A priority Critical patent/CN114547605B/en
Publication of CN114547605A publication Critical patent/CN114547605A/en
Application granted granted Critical
Publication of CN114547605B publication Critical patent/CN114547605B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N7/00—Computing arrangements based on specific mathematical models
    • G06N7/01—Probabilistic graphical models, e.g. probabilistic networks

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Mathematical Physics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Artificial Intelligence (AREA)
  • Health & Medical Sciences (AREA)
  • Computational Linguistics (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Molecular Biology (AREA)
  • Algebra (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Computational Mathematics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Virology (AREA)
  • Collating Specific Patterns (AREA)
  • Debugging And Monitoring (AREA)

Abstract

The invention belongs to the technical field of mobile internet security, and particularly relates to a dynamic detection method and a dynamic detection system for malicious applications of an android system, wherein a debug bridge command is utilized to conduct interaction between a host end and an android simulator through collected known benign applications and malicious applications, and system call sequence features for reflecting dynamic behavior modes of application programs are extracted in the interaction process; the method comprises the steps of taking a system call sequence as a Markov chain, obtaining a state transition probability matrix of the system call sequence by using the transition probability matrix of the Markov chain, converting the state transition probability matrix of the system call sequence into a gray image to train a convolutional neural network model, taking the gray image of the state transition probability matrix of the system call sequence of a target application program as input, and outputting the category of the target application program according to a model classification result. The invention can provide a supporting technology for detecting malicious application programs of the mobile Internet operating system, and can further ensure safe and reliable operation of the system.

Description

Dynamic detection method and system for malicious application of android system
Technical Field
The invention belongs to the technical field of mobile internet security, and particularly relates to a dynamic detection method and system for malicious applications of an android system.
Background
Mobile internet operating systems benefit from a high degree of openness, and can be personalized and expanded by installing application programs from third party application markets, which is highly appreciated by users. According to statistics and predictions of IDC (international data company, international data corporation), a smart phone with an Android operating system in 2021 will continue to run the world, and its market share will exceed 85%. At the same time, the open system environment and the vast community of users have attracted attention from malware developers. The report shows that by 3 months in 2020, the average number of newly-added Android malicious software reaches 48 ten thousand per month, and the privacy information security of the user is facing serious threat. Android malicious application detection technology has therefore been developed to perform security checks before application installation and determine whether it is a malicious application. To address the challenges presented by Android malware, google authorities have introduced Google Play Protect a detection system for automated scanning of malware, however, according to one experiment of AV-TEST, the actual detection accuracy of the system for malicious applications is less than 40%. Therefore, the user should not rely on the built-in protection program provided by the system, but needs an additional detection technology to protect the Android system more comprehensively.
In recent years, an Android malicious application detection technology based on machine learning achieves a good detection effect. Generally, according to the acquisition mode of the features used for detection, android malicious application detection can be divided into two methods, namely static analysis and dynamic analysis. The static analysis method does not need to actually execute the application, but analyzes the source code of the application program, extracts information such as authority, API (application program interface, application programming interface) function call and the like from the source code as features, and is widely used because of higher detection speed. However, as the means of escape detection of malicious applications is continuously upgraded, static analysis techniques are affected by code confusion and reinforcement, and some applications cannot obtain source code through decompilation. Therefore, the dynamic analysis technology is complementary with the static analysis technology, and analyzes and extracts the behavior characteristics of the application, such as network traffic information, a system call sequence and the like, through actually running the Android application program. The system call sequence can reflect the interaction logic between the application program and the bottom layer of the system, shows the real behavior of the application program, and is the most commonly used dynamic analysis feature. By analyzing the existing work, the Android malicious application detection method based on the system call sequence has the common problems that on one hand, a certain research work ignores the dependency relationship between two adjacent system calls in the sequence, but counts the occurrence frequency or permutation and combination of different system calls, so that the implicit application behavior characteristics in the original sequence are weakened, benign applications and malicious applications cannot be effectively distinguished, and on the other hand, the research work faces the problem of higher calculation complexity.
Disclosure of Invention
Therefore, the dynamic detection method and the dynamic detection system for the malicious application of the android system can effectively provide a support technology for detecting the malicious application program of the mobile Internet operating system, and can ensure safe and reliable operation of the system.
According to the design scheme provided by the invention, the dynamic detection method for the malicious application of the android system comprises the following contents:
The method comprises the steps that collected known benign applications and malicious applications are interacted between a host side and an android simulator by utilizing a debug bridge command, and system call sequence features for reflecting dynamic behavior modes of application programs are extracted in the interaction process;
Based on the Markov process, regarding the system call sequence as a Markov chain, and acquiring a state transition probability matrix of the system call sequence by utilizing the transition probability matrix of the Markov chain;
converting the system call sequence state transition probability matrix into a gray image, taking the gray image as an application program fingerprint characteristic data sample for training the convolutional neural network model, and training the convolutional neural network model;
Aiming at the target application program to be detected, taking the gray level image of the system call sequence state transition probability matrix as input, classifying by utilizing the trained convolutional neural network model, and outputting benign or malicious categories of the target application program to be detected according to the classification result.
As the dynamic detection method for the malicious application of the android system, further, in the interaction process between the host side and the android simulator, an application program automation test tool and a system call tracking tool are utilized to acquire a plurality of continuous system calls of the application program, and the system call sequence characteristics of the application program are constructed according to the dependency relationship among the system calls.
The android system malicious application dynamic detection method is characterized by comprising the steps of firstly installing an application program in a simulator, then tracking the application program process by using a system call tracking tool and recording a system call sequence executed by the application program, triggering the application program behavior by using random event operation preset in an application program automation test tool, capturing a text log stored with the system call sequence, wherein each line in the text log is recorded with the system call operation with a time stamp, and finally constructing the system call sequence feature according to the captured text log.
As the dynamic detection method for malicious application of the android system, further, based on a markov process, the system call sequence is expressed as x= { X m, m=1, 2, & gt.}, s= { S i, i=0, 1, & gt} is used for representing a discrete state space of the system call sequence X, the discrete state space is i= {1,2, & gt, & gt, and a state transition probability matrix of the corresponding system call sequence is constructed by using transition probabilities among all states.
As the dynamic detection method for malicious application of the android system, the method further comprises the step of mapping each element in the state transition probability matrix of the system call sequence to a (0, 255) interval to obtain a corresponding gray image, wherein a value 0 is mapped to (R: 255, G:255, B: 255), a value 255 is mapped to (R: 0, G:0, B: 0), and other values are mapped to gray colors (R: gray ij,G:grayij,B:grayij), and gray ij＝(1-pij)×255,pij is the transition probability between states i and j.
As the dynamic detection method for malicious application of the android system, the method further comprises the steps of utilizing a TF-IDF algorithm to rank the feature importance of all extracted system call sequences according to gray images, and selecting fingerprint feature vectors input as a convolutional neural network model according to ranking results.
As the dynamic detection method for malicious application of the android system, in the feature importance sorting by utilizing the TF-IDF algorithm, the system call is used as the entry, the occurrence frequency of the entry in all documents and the inverse frequency of the entry-containing document in all documents are sequentially obtained, and the formula is utilizedThe TF-IDF values of the feature importance of the system call are obtained, and fingerprint feature vectors are selected by descending arrangement according to the sizes of the TF-IDF values, wherein n i is the number of times that an entry i appears, k is the number of documents, |D| is all the documents, and|d i | is the document containing the entry i.
As the dynamic detection method for malicious application of the android system, the convolutional neural network model adopts a deep learning AlexNet model structure, and input classification results are obtained by carrying out convolution, pooling and full connection operations on the input.
The invention further provides a dynamic detection system for malicious application of the android system, which comprises a data extraction module, a data processing module, a model training module and a target detection module, wherein,
The data extraction module is used for carrying out interaction between the host end and the android simulator by utilizing the debug bridge command through the collected known benign application and malicious application, and extracting the system call sequence characteristics for reflecting the dynamic behavior mode of the application program in the interaction process;
The data processing module is used for regarding the system call sequence as a Markov chain based on a Markov process, and acquiring a state transition probability matrix of the system call sequence by utilizing the transition probability matrix of the Markov chain;
the model training module is used for converting the system call sequence state transition probability matrix into a gray image, taking the gray image as an application program fingerprint characteristic data sample for training the convolutional neural network model, and training the convolutional neural network model;
The target detection module is used for aiming at the target application program to be detected, taking the gray level image of the system call sequence state transition probability matrix as input, classifying by utilizing the trained convolutional neural network model, and outputting benign or malicious category of the target application program to be detected according to the classification result.
The invention has the beneficial effects that:
Aiming at the feature selection problem faced in the modeling of the system call sequence, the invention extracts the system call sequence by analyzing the difference of the benign application and malicious application system call use modes, acquires the fingerprint features of the system call sequence based on the Markov transition state matrix, reduces the feature dimension while retaining a more complete system call dependency relationship, and further can realize the visualization of the system call sequence features and solve the adaptation problem of the sequence fingerprint features and CNN (computer numerical network) by converting the state transition matrix into the gray image, and dynamically detects the malicious application of the android system based on the system call sequence fingerprint features by utilizing the CNN model according to the training requirement of the fingerprint image features, thereby improving the detection efficiency while ensuring the dynamic detection effect, and being applicable to the detection of the malicious application programs in the mobile Internet operation system such as android.
Drawings
Fig. 1 is a flowchart of a dynamic detection method for malicious applications of an android system in an embodiment;
FIG. 2 is a schematic diagram of a dynamic detection framework in an embodiment;
FIG. 3 is an example of a system call log in an embodiment;
FIG. 4 is a schematic illustration of the 25 most frequently used system calls in benign applications in an embodiment;
FIG. 5 is a diagram of 25 system calls with highest frequency of use in malicious applications in an embodiment;
FIG. 6 is a Mann-Whitney U test result illustration of 102 system calls in an embodiment;
FIG. 7 is a schematic diagram of a calculation result of a system call sequence transition probability matrix in an embodiment;
Fig. 8 is a schematic diagram of a AlexNet convolutional neural network structure in an embodiment.
Detailed Description
The present invention will be described in further detail with reference to the drawings and the technical scheme, in order to make the objects, technical schemes and advantages of the present invention more apparent.
The embodiment of the invention provides a dynamic detection method for malicious applications of an android system, which is shown in fig. 1 and comprises the following contents:
S101, collecting known benign applications and malicious applications, utilizing a debug bridge command to conduct interaction between a host end and an android simulator, and extracting system call sequence characteristics for reflecting dynamic behavior modes of application programs in the interaction process;
s102, based on a Markov process, regarding the system call sequence as a Markov chain, and acquiring a state transition probability matrix of the system call sequence by utilizing the transition probability matrix of the Markov chain;
s103, converting the system call sequence state transition probability matrix into a gray image, taking the gray image as an application program fingerprint characteristic data sample for training the convolutional neural network model, and training the convolutional neural network model;
S104, aiming at the target application program to be detected, taking a gray image of a system call sequence state transition probability matrix as input, classifying by using a trained convolutional neural network model, and outputting benign or malicious categories of the target application program to be detected according to a classification result.
Android system calls are mechanisms used by the user-level processes or application layers to request kernel-level services from the operating system, such as process management, memory management, network connectivity, and other access operations to hardware resources. Similar to the Linux system, the Android system also has a user mode and a kernel mode. When a system call is executed, the system mode is switched from user mode to kernel mode, at which time the kernel of the operating system is allowed to perform sensitive operations. When the called system call is completed, the control right returns to the user mode. An application behavior typically involves multiple successive system calls, with dependencies between the system calls constituting a set of system call sequences. In the embodiment, referring to fig. 2, by extracting a system call sequence, constructing fingerprint features of the system call sequence and using a convolutional neural network to dynamically detect malicious applications, a support technology can be effectively provided for detecting malicious applications of the android system, and safe and reliable system operation is ensured.
Further, in the interaction process between the host and the android simulator, an application automation testing tool and a system call tracking tool are utilized to acquire a plurality of continuous system calls of the application, and system call sequence characteristics of the application are constructed according to the dependency relationship between the system calls. Further, in the system call sequence feature extraction, firstly, an application program is installed in a simulator, then, a system call tracking tool is utilized to track the application program process and record a system call sequence executed by the application program, meanwhile, a random event operation preset in an application program automation test tool is utilized to trigger the application program behavior, a text log storing the system call sequence is grabbed, wherein each line in the text log is recorded with a system call operation with a time stamp, and finally, the system call sequence feature is constructed according to the grabbed text log.
A system call sequence is a finite list of a set of system calls ordered sequentially in discrete time, which can be denoted s= (c 1,c2,c3,…,cn), where c n represents a single system call name. The sequence of system calls reflects the dynamic behavior pattern of the application and the different system calls reflect different behaviors. In the embodiment, interaction between a host end and an Android simulator is completed through an ADB (Android debug bridge ) command, and extraction work of an application system call sequence is completed jointly by using an Android application program automation test tool Monkey and a system call tracking tool Strace. Firstly, an application program is installed in an Android 6.0 simulator, then a Strace tool is used for tracking an application process and recording a system call sequence of application execution, meanwhile, a Monkey script is executed in another command line, the behavior of the application program is triggered through 500 random events formed by simulating operations such as touch, click and sliding, at this time, the system call sequence is stored in a text log form, system call operations with time stamps are recorded once in each line, finally, the log stored in the Android simulator end is restored to a host system end, and the application is unloaded and the simulator is reset. The steps of grabbing the system call log and the corresponding commands are shown in table 1:
Table 1 System call Log extraction step and Command
Through the above operation, as shown in fig. 3, each line of the log represents a system call record, and the log may be divided into three parts, namely, a first part [ pid 3853] represents the current active process number 3853, a second part "hh: mm: ss" is the occurrence time of the system call, and a third part is the name, parameter and return value of the system call.
In the embodiment, the system call log is extracted for 5560 malicious applications from Drebin datasets and equivalent benign applications from 360 mobile phone assistants, and a sample set containing 11120 Android application system call sequence features is constructed. The finally extracted system call sequence form can reserve the names and time sequence of the system calls, and 102 different system calls of the Android 6.0 system are extracted in all samples, as shown in table 2.
Table 2 102 system calls contained in application samples
Of the 102 system calls shown in table 2, 25 unique system calls for benign applications are marked with (#) for serial numbers, 4 unique system calls for malicious applications are marked with (#) for serial numbers, and 73 unique system calls for both. From the above data, it can be seen that there are a large number of identical system calls between benign applications and malicious applications. In order to further analyze the difference between the two in the system call use modes, by counting the number of all the system calls and sorting according to the use frequency, the names of the system calls with the top 25 ranks in benign applications and malicious applications and the proportion thereof are respectively shown in fig. 4 and 5, it can be observed from the figure that among the 25 system calls with the highest use frequency in benign applications and malicious applications, 21 system calls still exist in both, so in order to explain whether the system call is an effective feature for distinguishing the malicious applications from the benign applications, in the embodiment, mann-Whitney rank and test are performed on the malicious applications and the benign applications with respect to the system call.
The Mann-Whitney U test is used to verify whether the distribution of a certain variable in two independent samples is different. The test can compare two sets of samples without making any distribution assumptions. The test steps are as follows:
(1) The (n A+nB) observations in samples a of capacity n A and B of capacity n B are arranged in order of magnitude, designating 1 as the rank of the smallest observation, 2 as the rank of the second smallest observation, and so on. If the same observations exist, designating the rank as the average of the sum of their bit sequences;
(2) Calculate the rank sum of two samples, T A and T B;
(3) Formulas for the Mann-Whitney U test are given in accordance with T A and T B. The test statistics are shown in formulas (1) - (3):
UA＝nAnB+nA(nA+1)/2-TA (1)
UB＝nAnB+nB(nB+1)/2-TB (2)
(4) If Z > Z α/2 or Z≤ -Z α/2, the original hypothesis H 0 is rejected.
In the embodiment, the Mann-Whitney U test assumes that the system call modes of the benign application and the malicious application are not significantly different from each other in the original assumption H 0, and the system call modes of the benign application and the malicious application are significantly different in the alternative assumption H 1. For a system call, the sample value is set to 1 if a benign or malicious application uses the system call, and to 0 otherwise. Thus, for each system call, a vector of length 11120 would be obtained, for a total of 102 such system call feature vectors. The hypothesis test results of the corresponding system calls are plotted according to the sequence numbers marked in table 2, the result shown in fig. 6 is obtained, the significant level α=0.05 is shown as a dashed straight line, and it can be seen from the result that the p value of 90 system calls in 102 system calls is less than 0.05, so that the original hypothesis H 0 can be rejected with more than 95% of confidence, and the significant difference exists between the accepted H 1, i.e. benign application and the system call use mode of malicious application, and can be used as the feature of classification detection.
Table 3 shows the length statistics of the system call sequences of benign applications and malicious applications under various statistical parameters, and it can be seen from the data in the table that the lengths of the extracted system call sequences are greatly different no matter whether the benign applications or the malicious applications exist, which further illustrates that the use of the recurrent neural network to directly extract the sequence features has higher complexity.
TABLE 3 System call sequence Length statistical parameters for benign and malicious applications
In the markov chain, let x= { X i, i=1, 2..the sequence consisting of random variables in the discrete-time random process, use s= { S i, i=0, 1..t } to represent the discrete state space of X, and if X satisfies the form in equation (4), i.e. the state at time t + 1 of the sequence is only affected by the state S t at the current time t, and is irrelevant to the state earlier, or all the relevant information of the historical states is represented by the current state S t, the discrete-time random process X is said to have a markov characteristic, and the sequence is the markov chain.
P(Xt+1＝s|Xt＝st,Xt-1＝st-1,...,X0＝s0)＝P(Xt+1＝s|Xt＝st) (4)
The system call sequence is a description of the running state of the system, and the current system call state of the system is directly related to the system call at the previous moment, so the system call sequence can be regarded as a Markov chain.
Among the transition probabilities, the conditional probability p ij(n)＝P{Xn+1＝j|Xn =i is called the transition probability of the markov chain { X n, n∈t } at the time n, and the transition probability describes the probability of jumping from one markov state i to the subsequent state j. The state space is i= {1,2,.. transition probabilities p ij between all states form a transition probability matrix
The transition probability matrix describes the probability statistics of the evolution between states of the markov process, and the sum of the state transition probabilities for each row is equal to 1.
Table 4 example of a System call sequence
Taking the system call sequence with the length of 10 in table 4 as an example, the calculation result of the transition probability matrix is shown in fig. 7.
Based on the above process, a generation algorithm of a system call sequence state transition matrix can be obtained, as shown in Table 5
Table 5 System call sequence transition probability matrix generation algorithm
Further, each element between the obtained system call transition probability matrices (0, 1) is mapped to the (0, 255) interval, for the sake of convenient observation, in this embodiment, the value 0 may be mapped to white (R: 255, g:255, b: 255), the value 255 may be mapped to black (R: 0, g:0, b: 0), and other values may be mapped to gray colors (R: gray ij,G:grayij,B:grayij) of transition from black to white:
grayij＝(1-pij)×255 (6)
The transition probability matrix can be converted into a corresponding gray scale image according to equation (6), which is used as a "fingerprint" feature of the application. The fingerprint images of the malicious applications from the same family have a certain similarity, and the characteristic can be used for realizing the classification of the malicious applications by family.
In order to avoid generating excessive sparse matrixes when generating fingerprint image features, the importance degrees of 102 system calls can be examined, so that a relatively critical system call set is sorted and selected according to the importance degrees according to the requirements of different neural network model input layers. For this purpose, in the present embodiment, feature importance ranking is further performed by using a TF-IDF (term frequency-inverse document frequency) algorithm.
TF-IDF is commonly found in automatic text analysis work in natural language processing to trade-off the importance of a certain keyword. In the present embodiment, considering a system call as an entry, TF represents the frequency of occurrence of a certain entry in all documents, and IDF represents the inverse frequency of occurrence of a document |d i | containing a certain entry in all documents |d|. The TF-IDF is the result of multiplication of the two, and is proportional to the occurrence number of a term in a document and inversely proportional to the occurrence number of the document in which the term is located, as shown in formula (7).
The TF-IDF algorithm is applied to perform feature sequencing on all the system call sequence texts extracted in the scheme of the embodiment, TF-IDF values of 102 system calls can be calculated, descending order is performed according to the values, and the TF-IDF sequencing results of all the system calls are shown in a table 6. By reserving the first 67 system calls with TF-IDF values not less than 1e-5 as row and column indexes of fingerprint image matrix, the size of the fingerprint gray image of the system call sequence can be 67×67.
TABLE 6 TF-IDF ordering results for System calls
Further, in the embodiment of the present disclosure, a AlexNet model structure is used as a convolutional neural network model to realize detection of android malicious applications, and the model AlexNet is trained by using the generated android application system call sequence fingerprint as a model input, so as to obtain a final detection model. The model structure is shown in fig. 8, and may be composed of five convolution layers, three pooling layers and three full connection layers, and the input classification result is obtained by performing convolution, pooling and full connection operations on the input, where the parameter setting of AlexNet networks may be shown in table 7.
Table 7 102 system calls contained in application samples
Further, based on the method, the embodiment of the invention also provides a dynamic detection system for malicious application of the android system, which comprises a data extraction module, a data processing module, a model training module and a target detection module, wherein,
The data extraction module is used for carrying out interaction between the host end and the android simulator by utilizing the debug bridge command through the collected known benign application and malicious application, and extracting the system call sequence characteristics for reflecting the dynamic behavior mode of the application program in the interaction process;
The data processing module is used for regarding the system call sequence as a Markov chain based on a Markov process, and acquiring a state transition probability matrix of the system call sequence by utilizing the transition probability matrix of the Markov chain;
the model training module is used for converting the system call sequence state transition probability matrix into a gray image, taking the gray image as an application program fingerprint characteristic data sample for training the convolutional neural network model, and training the convolutional neural network model;
The target detection module is used for aiming at the target application program to be detected, taking the gray level image of the system call sequence state transition probability matrix as input, classifying by utilizing the trained convolutional neural network model, and outputting benign or malicious category of the target application program to be detected according to the classification result.
The relative steps, numerical expressions and numerical values of the components and steps set forth in these embodiments do not limit the scope of the present invention unless it is specifically stated otherwise.
Based on the above method and/or system, the embodiment of the invention further provides a server, which comprises one or more processors and a storage device, wherein the storage device is used for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors are enabled to realize the above method.
Based on the above-described method and/or system, embodiments of the present invention also provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the above-described method.
Any particular values in all examples shown and described herein are to be construed as merely illustrative and not a limitation, and thus other examples of exemplary embodiments may have different values.
It should be noted that like reference numerals and letters refer to like items in the following figures, and thus once an item is defined in one figure, no further definition or explanation thereof is necessary in the following figures.
It should be noted that the foregoing embodiments are merely illustrative embodiments of the present invention, and not restrictive, and the scope of the invention is not limited to the embodiments, and although the present invention has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that any modification, variation or substitution of some of the technical features of the embodiments described in the foregoing embodiments may be easily contemplated within the scope of the present invention, and the spirit and scope of the technical solutions of the embodiments do not depart from the spirit and scope of the embodiments of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims (8)

1.一种安卓系统恶意应用动态检测方法，其特征在于，包含如下内容：1. A method for dynamically detecting malicious applications in an Android system, comprising the following: 收集的已知的良性应用和恶意应用，利用调试桥命令进行主机端和安卓模拟器之间的交互，并在交互过程中提取用于反应应用程序动态行为模式的系统调用序列特征；The collected known benign and malicious applications use debug bridge commands to interact between the host and the Android emulator, and extract system call sequence features that reflect the dynamic behavior patterns of the applications during the interaction; 基于马尔科夫过程，将系统调用序列视为马尔科夫链，利用马尔科夫链的转移概率矩阵来获取系统调用序列的状态转移概率矩阵；具体为：基于马尔科夫过程，将系统调用序列表示为X＝{Xm,m＝1,2,...}，用S＝{Si,i＝0,1,...}表示系统调用序列X的离散状态空间，离散状态空间为I＝{1,2,...,}，利用所有状态之间的转移概率来构建对应的系统调用序列的状态转移概率矩阵；Based on the Markov process, the system call sequence is regarded as a Markov chain, and the transition probability matrix of the Markov chain is used to obtain the state transition probability matrix of the system call sequence. Specifically, based on the Markov process, the system call sequence is represented as X = { Xm , m = 1, 2, ...}, and the discrete state space of the system call sequence X is represented by S = { Si , i = 0, 1, ...}. The discrete state space is I = {1, 2, ...,}. The state transition probability matrix of the corresponding system call sequence is constructed using the transition probabilities between all states. 将系统调用序列状态转移概率矩阵转换为灰度图像，将该灰度图像作为用于训练卷积神经网络模型的应用程序指纹特征数据样本，并对卷积神经网络模型进行训练；其中，将系统调用序列的状态转移概率矩阵中的每个元素向(0,255)区间映射来获取对应的灰度图像，具体为：将数值0映射为(R:255,G:255,B:255)，数值255映射为(R:0,G:0,B:0)，其他数值映射为灰度颜色(R:grayij,G:grayij,B:grayij)，其中，grayij(＝1-pij)×255，pij为状态i和j之间的转移概率；The state transition probability matrix of the system call sequence is converted into a grayscale image, and the grayscale image is used as an application fingerprint feature data sample for training a convolutional neural network model, and the convolutional neural network model is trained; wherein, each element in the state transition probability matrix of the system call sequence is mapped to the interval (0, 255) to obtain the corresponding grayscale image, specifically: the value 0 is mapped to (R: 255, G: 255, B: 255), the value 255 is mapped to (R: 0, G: 0, B: 0), and the other values are mapped to grayscale colors (R: gray ij , G: gray ij , B: gray ij ), wherein gray ij (= 1-pi ij ) × 255, and p ij is the transition probability between states i and j; 针对待检测的目标应用程序，将其系统调用序列状态转移概率矩阵的灰度图像作为输入，利用已训练的卷积神经网络模型进行分类，依据分类结果输出该待检测的目标应用程序良性或恶意类别。For the target application to be detected, the grayscale image of its system call sequence state transition probability matrix is used as input, and the trained convolutional neural network model is used for classification. The benign or malicious category of the target application to be detected is output based on the classification result. 2.根据权利要求1所述的安卓系统恶意应用动态检测方法，其特征在于，在主机端和安卓模拟器之间的交互过程中，利用应用程序自动化测试工具和系统调用跟踪工具来获取应用程序多个连续的系统调用，依据系统调用之间的依赖关系来构建应用程序的系统调用序列特征。2. The dynamic detection method for malicious applications in the Android system according to claim 1 is characterized in that, during the interaction between the host side and the Android emulator, an application automation testing tool and a system call tracking tool are used to obtain multiple continuous system calls of the application, and the system call sequence characteristics of the application are constructed based on the dependency relationship between the system calls. 3.根据权利要求1或2所述的安卓系统恶意应用动态检测方法，其特征在于，提取系统调用序列特征中，首先，在模拟器中安装应用程序，然后，利用系统调用跟踪工具跟踪应用程序进程并记录应用程序执行的系统调用序列；并同时利用应用程序自动化测试工具中预设的随机事件操作触发应用程序行为，抓取存储有系统调用序列的文本日志，其中，文本日志中每行记录有带时间戳的系统调用操作；最后，根据抓取的文本日志来构建系统调用序列特征。3. The method for dynamic detection of malicious applications in the Android system according to claim 1 or 2 is characterized in that, in extracting system call sequence features, first, the application is installed in the simulator, then, the system call tracking tool is used to track the application process and record the system call sequence executed by the application; and at the same time, the random event operation preset in the application automation testing tool is used to trigger the application behavior, and the text log storing the system call sequence is captured, wherein each line in the text log records the system call operation with a timestamp; finally, the system call sequence features are constructed based on the captured text log. 4.根据权利要求1所述的安卓系统恶意应用动态检测方法，其特征在于，针对灰度图像，利用TF-IDF算法对提取到的所有系统调用序列进行特征重要性排序，依据排序结果选取作为卷积神经网络模型输入的指纹特征向量。4. The method for dynamic detection of malicious applications in the Android system according to claim 1 is characterized in that, for grayscale images, all extracted system call sequences are sorted by feature importance using the TF-IDF algorithm, and fingerprint feature vectors are selected as input to the convolutional neural network model based on the sorting results. 5.根据权利要求4所述的安卓系统恶意应用动态检测方法，其特征在于，利用TF-IDF算法进行特征重要性排序中，将系统调用作为词条，依次获取词条在所有文档中出现的频率及包含词条的文档在所有文档中出现的逆频率，利用公式来获取系统调用特征重要性的TF-IDF值，按照TF-IDF值大小进行降序排列来选取指纹特征向量，其中，ni为词条i出现的次数，k为文档个数，|D|为所有文档，|di|为包含词条i的文档。5. The method for dynamic detection of malicious applications in the Android system according to claim 4 is characterized in that the system call is used as a term in the feature importance ranking using the TF-IDF algorithm, and the frequency of the term appearing in all documents and the inverse frequency of the document containing the term appearing in all documents are obtained in sequence, and the formula is used to calculate the frequency of the term appearing in all documents. To obtain the TF-IDF value of the system call feature importance, the fingerprint feature vector is selected by sorting in descending order according to the TF-IDF value, where ni is the number of times the term i appears, k is the number of documents, |D| is all documents, and |d i | is the document containing the term i. 6.根据权利要求1所述的安卓系统恶意应用动态检测方法，其特征在于，卷积神经网络模型采用深度学习AlexNet模型结构，通过对输入进行卷积、池化和全连接操作来获取输入的分类结果。6. The method for dynamic detection of malicious applications in an Android system according to claim 1 is characterized in that the convolutional neural network model adopts a deep learning AlexNet model structure, and obtains the classification result of the input by performing convolution, pooling and full connection operations on the input. 7.一种安卓系统恶意应用动态检测系统，其特征在于，包含：数据提取模块、数据处理模块、模型训练模块和目标检测二模块，其中，7. A dynamic detection system for malicious applications in an Android system, characterized by comprising: a data extraction module, a data processing module, a model training module, and a target detection module, wherein: 数据提取模块，用于通过收集的已知的良性应用和恶意应用，利用调试桥命令进行主机端和安卓模拟器之间的交互，并在交互过程中提取用于反应应用程序动态行为模式的系统调用序列特征；A data extraction module is used to collect known benign and malicious applications, interact with the host and the Android emulator using debug bridge commands, and extract system call sequence features that reflect the dynamic behavior patterns of the applications during the interaction process; 数据处理模块，用于基于马尔科夫过程，将系统调用序列视为马尔科夫链，利用马尔科夫链的转移概率矩阵来获取系统调用序列的状态转移概率矩阵；具体为：基于马尔科夫过程，将系统调用序列表示为X＝{Xm,m＝1,2,...}，用S＝{Si,i＝0,1,...}表示系统调用序列X的离散状态空间，离散状态空间为I＝{1,2,...,}，利用所有状态之间的转移概率来构建对应的系统调用序列的状态转移概率矩阵；The data processing module is used to regard the system call sequence as a Markov chain based on the Markov process, and use the transition probability matrix of the Markov chain to obtain the state transition probability matrix of the system call sequence. Specifically, based on the Markov process, the system call sequence is represented as X = { Xm , m = 1, 2, ...}, and the discrete state space of the system call sequence X is represented by S = { Si , i = 0, 1, ...}, where the discrete state space is I = {1, 2, ...,}. The state transition probability matrix of the corresponding system call sequence is constructed using the transition probabilities between all states. 模型训练模块，用于将系统调用序列状态转移概率矩阵转换为灰度图像，将该灰度图像作为用于训练卷积神经网络模型的应用程序指纹特征数据样本，并对卷积神经网络模型进行训练；其中，将系统调用序列的状态转移概率矩阵中的每个元素向(0,255)区间映射来获取对应的灰度图像，具体为：将数值0映射为(R:255,G:255,B:255)，数值255映射为(R:0,G:0,B:0)，其他数值映射为灰度颜色(R:grayij,G:grayij,B:grayij)，其中，grayij(＝1-pij)×255，pij为状态i和j之间的转移概率；A model training module is used to convert the state transition probability matrix of the system call sequence into a grayscale image, use the grayscale image as an application fingerprint feature data sample for training the convolutional neural network model, and train the convolutional neural network model; wherein each element in the state transition probability matrix of the system call sequence is mapped to the interval (0, 255) to obtain the corresponding grayscale image, specifically: the value 0 is mapped to (R: 255, G: 255, B: 255), the value 255 is mapped to (R: 0, G: 0, B: 0), and other values are mapped to grayscale colors (R: gray ij , G: gray ij , B: gray ij ), where gray ij (= 1-pi ij ) × 255, and p ij is the transition probability between states i and j; 目标检测模块，用于针对待检测的目标应用程序，将其系统调用序列状态转移概率矩阵的灰度图像作为输入，利用已训练的卷积神经网络模型进行分类，依据分类结果输出该待检测的目标应用程序良性或恶意类别。The target detection module is used to take the grayscale image of the system call sequence state transition probability matrix of the target application to be detected as input, use the trained convolutional neural network model to perform classification, and output the benign or malicious category of the target application to be detected based on the classification result. 8.一种计算机可读存储介质，所述计算机可读存储介质中存储有一个或一个以上的指令，所述一个或一个以上的指令内在处理器执行时实现权利要求1～6中任一项所述的方法。8. A computer-readable storage medium, wherein one or more instructions are stored in the computer-readable storage medium, and wherein the one or more instructions implement the method according to any one of claims 1 to 6 when executed by a processor.
CN202210094057.7A 2022-01-26 2022-01-26 Dynamic detection method and system for malicious application of android system Active CN114547605B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210094057.7A CN114547605B (en) 2022-01-26 2022-01-26 Dynamic detection method and system for malicious application of android system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210094057.7A CN114547605B (en) 2022-01-26 2022-01-26 Dynamic detection method and system for malicious application of android system

Publications (2)

Publication Number Publication Date
CN114547605A CN114547605A (en) 2022-05-27
CN114547605B true CN114547605B (en) 2025-07-29

Family

ID=81672986

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210094057.7A Active CN114547605B (en) 2022-01-26 2022-01-26 Dynamic detection method and system for malicious application of android system

Country Status (1)

Country Link
CN (1) CN114547605B (en)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116010024A (en) * 2022-12-01 2023-04-25 深信服科技股份有限公司 A monitoring method, device and storage medium
CN116467613B (en) * 2023-03-28 2025-11-04 中国工商银行股份有限公司 Application classification methods and apparatus, electronic devices and computer-readable storage media
CN117648242A (en) * 2023-10-19 2024-03-05 天翼安全科技有限公司 An application anomaly detection method, device and electronic equipment
CN119918049A (en) * 2024-12-31 2025-05-02 安徽中品网络技术有限公司 Software safety detection system and software safety detection method

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109753801A (en) * 2019-01-29 2019-05-14 重庆邮电大学 Dynamic detection method of intelligent terminal malware based on system call
CN110263538A (en) * 2019-05-13 2019-09-20 重庆大学 A Malicious Code Detection Method Based on System Behavior Sequence

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10754334B2 (en) * 2016-05-09 2020-08-25 Strong Force Iot Portfolio 2016, Llc Methods and systems for industrial internet of things data collection for process adjustment in an upstream oil and gas environment
CN110704841A (en) * 2019-09-24 2020-01-17 北京电子科技学院 Convolutional neural network-based large-scale android malicious application detection system and method
CN111259397B (en) * 2020-02-12 2022-04-19 四川大学 Malware classification method based on Markov graph and deep learning
BR112022017094A2 (en) * 2020-03-02 2022-11-16 Visual Supply Company SYSTEMS AND METHODS TO AUTOMATE VIDEO EDITING
CN113343670B (en) * 2021-05-26 2023-07-28 武汉大学 Address text element extraction method based on coupling of hidden Markov and classification algorithm

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109753801A (en) * 2019-01-29 2019-05-14 重庆邮电大学 Dynamic detection method of intelligent terminal malware based on system call
CN110263538A (en) * 2019-05-13 2019-09-20 重庆大学 A Malicious Code Detection Method Based on System Behavior Sequence

Also Published As

Publication number Publication date
CN114547605A (en) 2022-05-27

Similar Documents

Publication Publication Date Title
CN114547605B (en) Dynamic detection method and system for malicious application of android system
US11190562B2 (en) Generic event stream processing for machine learning
Sommer et al. Towards probabilistic verification of machine unlearning
Raff et al. Malware detection by eating a whole exe
CN109302410B (en) A method, system and computer storage medium for detecting abnormal behavior of internal users
Sommer et al. Athena: Probabilistic verification of machine unlearning
CN110135157A (en) Malware homology analysis method, system, electronic device and storage medium
WO2018235252A1 (en) Analyzer, method of analyzing log and recording medium
CN109309675A (en) A network intrusion detection method based on convolutional neural network
CN120086427B (en) A method and system for intelligently collecting and analyzing web merchant information
CN113688346A (en) A kind of illegal website identification method, device, equipment and storage medium
CN115964710A (en) Malicious code detection method and system based on internal memory forensics and deep learning
Catanzaro et al. Malware detection by eating a whole exe
CN121117296B (en) Cross-border platform data acquisition method and device, computer equipment and storage medium
CN114547606B (en) Mobile Internet operating system third-party application risk analysis method and system
CN112434294A (en) Malicious code detection method, terminal device and storage medium
CN118114244A (en) A malware family detection method based on the combination of dynamic and static analysis
CN115168729A (en) Message pushing method, device, equipment and storage medium
Kuo et al. Malware Detection Based on Image Conversion
CN119203077B (en) A method and system for detecting and processing genuine software based on big data analysis
US20260127273A1 (en) Results insights
RU2826553C1 (en) Method and apparatus for training isolation forest, as well as method and apparatus for recognizing search robot
JP7513091B2 (en) Information search device, information search method, and program
Wang et al. Cutting away the confusion from crowdtesting
Dangi et al. Investigating Space-Time Dynamics in Live Memory Forensics Using Hybrid Transformer Approaches.

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
CB02 Change of applicant information

Country or region after: China

Address after: 450000 Science Avenue 62, Zhengzhou High-tech Zone, Henan Province

Applicant after: Information Engineering University of the Chinese People's Liberation Army Cyberspace Force

Address before: No. 62 Science Avenue, High tech Zone, Zhengzhou City, Henan Province

Applicant before: Information Engineering University of Strategic Support Force,PLA

Country or region before: China

CB02 Change of applicant information
GR01 Patent grant
GR01 Patent grant