一种基于深度学习的强对抗性Android恶意代码检测方法

针对现有Android恶意代码检测方法容易被绕过的问题,提出了一种强对抗性的Android恶意代码检测方法.首先设计实现了动静态分析相结合的移动应用行为分析方法,该方法能够破除多种反分析技术的干扰,稳定可靠地提取移动应用的权限信息、防护信息和行为信息.然后,从上述信息中提取出能够抵御模拟攻击的能力特征和行为特征,并利用一个基于长短时记忆网络（Long Short-Term Memory,LSTM）的神经网络模型实现恶意代码检测.最后通过实验证明了本文所提出方法的可靠性和先进性.     

基于纹理指纹的恶意代码变种检测方法研究

提出一种基于纹理指纹的恶意代码特征提取及检测方法,通过结合图像分析技术与恶意代码变种检测技术,将恶意代码映射为无压缩灰阶图片,基于纹理分割算法对图片进行分块,使用灰阶共生矩阵算法提取各个分块的纹理特征,并将这些纹理特征作为恶意代码的纹理指纹;然后,根据样本的纹理指纹,建立纹理指纹索引结构;检测阶段通过恶意代码纹理指纹块生成策略,采用加权综合多分段纹理指纹相似性匹配方法检测恶意代码变种和未知恶意代码;在此基础上,实现恶意代码的纹理指纹提取及检测原型系统。通过对6种恶意代码样本数据集的分析和检测,完成了对该系统的实验验证。实验结果表明,基于上述方法提取的特征具有检测速度快、精度高等特点,并且对恶意代码变种具有较好的识别能力。     

Malware variants detection based on ensemble learning

Application programming interface (API) is a procedure call interface to operation system resource. API-based behavior features can capture the malicious behaviors of malware variants. However, existing malware detection approaches have a deal of complex operations on constructing and matching. Furthermore, graph matching is adopted in many approaches, which is a nondeterministic polynominal (NP)-complete problem because of computational complexity. To address these problems, a novel approach is proposed to detect malware variants. Firstly, the API of the malware are divided by their functions and parameters. Then, the classified behavior graph (CBG) is constructed from the API call sequences. Finally, the signature based on CBGs for each malware family is generated. Besides, the malware variants are classified by ensemble learning algorithm. Experiments on 1 220 malware samples show that the true positive rate (TPR) is up to 89.0% with the low false positive rate (FPR) 3.7% by ensemble learning.     

DroidEnemy: Battling adversarial example attacks for Android malware detection

In recent years, we have witnessed a surge in mobile devices such as smartphones, tablets, smart watches, etc., most of which are based on the Android operating system. However, because these Android-based mobile devices are becoming increasingly popular, they are now the primary target of mobile malware, which could lead to both privacy leakage and property loss. To address the rapidly deteriorating security issues caused by mobile malware, various research efforts have been made to develop novel and effective detection mechanisms to identify and combat them. Nevertheless, in order to avoid being caught by these malware detection mechanisms, malware authors are inclined to initiate adversarial example attacks by tampering with mobile applications. In this paper, several types of adversarial example attacks are investigated and a feasible approach is proposed to fight against them. First, we look at adversarial example attacks on the Android system and prior solutions that have been proposed to address these attacks. Then, we specifically focus on the data poisoning attack and evasion attack models, which may mutate various application features, such as API calls, permissions and the class label, to produce adversarial examples. Then, we propose and design a malware detection approach that is resistant to adversarial examples. To observe and investigate how the malware detection system is influenced by the adversarial example attacks, we conduct experiments on some real Android application datasets which are composed of both malware and benign applications. Experimental results clearly indicate that the performance of Android malware detection is severely degraded when facing adversarial example attacks.     

基于对比权限模式的安卓恶意软件检测方法(英文)

As the risk of malware is sharply increasing in Android platform,Android malware detection has become an important research topic.Existing works have demonstrated that required permissions of Android applications are valuable for malware analysis,but how to exploit those permission patterns for malware detection remains an open issue.In this paper,we introduce the contrasting permission patterns to characterize the essential differences between malwares and clean applications from the permission aspect Then a framework based on contrasting permission patterns is presented for Android malware detection.According to the proposed framework,an ensemble classifier,Enclamald,is further developed to detect whether an application is potentially malicious.Every contrasting permission pattern is acting as a weak classifier in Enclamald,and the weighted predictions of involved weak classifiers are aggregated to the final result.Experiments on real-world applications validate that the proposed Enclamald classifier outperforms commonly used classifiers for Android Malware Detection.     

Mobile malware traffic detection approach based on value-derivative GRU

For the dramatic increase in the number and variety of mobile malware had created enormous challenge for information security of mobile network users,a value-derivative GRU-based mobile malware traffic detection approach was proposed in order to solve the problem that it was difficult for a RNN-based mobile malware traffic detection approach to capture the dynamic changes and critical information of abnormal network traffic.The low-order and high-order dynamic change information of the malicious network traffic could be described by the value-derivative GRU approach at the same time by introducing the concept of “accumulated state change”.In addition,a pooling layer could ensure that the algorithm can capture key information of malicious traffic.Finally,simulation were performed to verify the effect of accumulated state changes,hidden layers,and pooling layers on the performance of the value-derivative GRU algorithm.Experiments show that the mobile malware traffic detection approach based on value-derivative GRU has high detection accuracy.     

基于程序分析的Android应用恶意行为检测

随着Android智能手机的普及,手机应用的安全隐患也日益凸显。提出了一种基于程序分析的Android应用程序检测方法,用于检测Android应用程序中的恶意行为。通过预处理剔除不存在恶意行为的应用程序。对通过预处理阶段的应用程序,模拟执行应用程序中的字节码指令,构建出函数的摘要信息,最终在构建的函数摘要上使污点传播算法,检测应用程序中的恶意行为。实验结果表明,该方法可以有效检测出Android应用程序的恶意行为,具有较高的实用性。     

Homology analysis of malware based on graph

Malware detection and homology analysis has been the hotspot of malware analysis.API call graph of malware can represent the behavior of it.Because of the subgraph isomorphism algorithm has high complexity,the analysis of malware based on the graph structure with low efficiency.Therefore,this studies a homology analysis method of API graph of malware that use convolutional neural network.By selecting the key nodes,and construct neighborhood receptive field,the convolution neural network can handle graph structure data.Experimental results on 8 real-world malware family,shows that the accuracy rate of homology malware analysis achieves 93%,and the accuracy rate of the detection of malicious code to 96%.     

Android恶意应用HTTP行为特征生成与提取方法

Android恶意应用数量的不断增加不仅严重危害Android市场安全,同时也为Android恶意应用检测工作带来挑战。设计了一种基于HTTP流量的Android恶意应用行为生成与特征自动提取方法。该方法首先使用自动方式执行恶意应用,采集所生成的网络流量。然后从所生成的网络流量中提取基于HTTP的行为特征。最后将得到的网络行为特征用于恶意应用检测。实验结果表明,所设计的方法可以有效地提取Android恶意应用行为特征,并可以准确地识别Android恶意应用。     

基于权限频繁模式挖掘算法的Android恶意应用检测方法

Android应用所申请的各个权限可以有效反映出应用程序的行为模式,而一个恶意行为的产生需要多个权限的配合,所以通过挖掘权限之间的关联性可以有效检测未知的恶意应用。以往研究者大多关注单一权限的统计特性,很少研究权限之间关联性的统计特性。因此,为有效检测Android平台未知的恶意应用,提出了一种基于权限频繁模式挖掘算法的Android恶意应用检测方法,设计了能够挖掘权限之间关联性的权限频繁模式挖掘算法—PApriori。基于该算法对49个恶意应用家族进行权限频繁模式发现,得到极大频繁权限项集,从而构造出权限关系特征库来检测未知的恶意应用。最后,通过实验验证了该方法的有效性和正确性,实验结果表明所提出的方法与其他相关工作对比效果更优。     

Incremental clustering method based on Gaussian mixture model to identify malware family

Aiming at the logical similarity of the behavioral characteristics of malware belonging to the same family,the characteristics of malware were extracted by tracking the logic rules of API function call from the perspective of behavior detection,and the static analysis and dynamic analysis methods were combined to analyze malicious behavior characteristics.In addition,according to the purpose,inheritance and diversity of the malware family,the transitive closure relationship of the malware family was constructed,and then the incremental clustering method based on Gaussian mixture model was improved to identify the malware family.Experiments show that the proposed method can not only save the storage space of malware detection,but also significantly improve the detection accuracy and recognition efficiency.     

Android malware detection based on APK signature information feedback

A new malware detection method based on APK signature of information feedback (SigFeedback) was proposed.Based on SVM classification algorithm,the method of eigenvalue extraction adoped heuristic rule learning to sig APK information verify screening,and it also implemented the heuristic feedback,from which achieved the purpose of more accurate detection of malicious software.SigFeedback detection algorithm enjoyed the advantage of the high detection rate and low false positive rate.Finally the experiment show that the SigFeedback algorithm has high efficiency,making the rate of false positive from 13% down to 3%.     

基于改进贝叶斯分类的Android恶意软件检测

针对Android手机安全受恶意软件威胁越来越严重这一问题,提出一种改进的Android恶意软件检测算法。监控从Android移动设备应用程序获取的多种行为特征值,应用机器学习技术,通过与卡方检验滤波测试结合的方式改进传统的朴素贝叶斯算法,检测Android系统中的恶意软件。通过实验仿真,结果表明在采取朴素贝叶斯分类模型之前,使用卡方检验过滤应用程序的行为特征,可以使基于Android的恶意软件检测技术拥有较低的误报率和较高的精度。     

An Autonomous Host-Based Intrusion Detection System for Android Mobile Devices

Intrusion Detection System (IDS) is crucial to protect smartphones from imminent security breaches and ensure user privacy. Android is the most popular mobile Operating System (OS), holding above 85% market share. The traffic generated by smartphones is expected to exceed the one generated by personal computers by 2021. Consequently, this prevalent mobile OS will stay one of the most attractive targets for potential attacks on fifth generation mobile networks (5G). Although Android malware detection has received considerable attention, offered solutions mostly rely on performing resource intensive analysis on a server, assuming a continuous connection between the device and the server, or on employing supervised Machine Learning (ML) algorithms for profiling the malware’s behaviour, which essentially require a training dataset consisting of thousands of examples from both benign and malicious profiles. However, in practice, collecting malicious examples is tedious since it entails infecting the device and collecting thousands of samples in order to characterise the malware’s behaviour and the labelling has to be done manually. In this paper, we propose a novel Host-based IDS (HIDS) incorporating statistical and semi-supervised ML algorithms. The advantage of our proposed IDS is two folds. First, it is wholly autonomous and runs on the mobile device, without needing any connection to a server. Second, it requires only benign examples for tuning, with potentially a few malicious ones. The evaluation results show that the proposed IDS achieves a very promising accuracy of above 0.9983, reaching up to 1.

     

A Framework for Designing Unsupervised Pothole Detection by Integrating Feature Extraction Using Deep Recurrent Neural Network

One of the significant causes of road accidents is the presence of potholes. In order to overcome this difficulty, several techniques have been designed, from manual reporting to authorities taking steps for auto-detection of pothole regions. Traditional techniques related to pothole detection fail in terms of risk during weather variations, high setup cost and no provision for night vision due to the lack of development in effective automatic pothole detection models effectively. The main objective of this work  is to design an automatic pothole detection model for identifying potholes at the earliest time period. To make the processing more manageable and improvise the detection performance, an optimized deep recurrent neural network (ODRNN) is proposed. The pothole detection model consists of three phases, pre-processing, feature extraction and unsupervised classification. Initially, the the set of images are gathered to make a dataset. The first phase is responsible for image enhancement which performs input image resizing, background noise removal utilizing median filter approach and RGB to grey scale conversion. The second phase is responsible for extracting the most relevant characteristics of the pothole region using Shape-based feature extraction approach. In the final phase, the extracted features are classified with ODRNN. To enhance the efficiency of conventional RNNs, the weight values of the classifier are optimized using the Improved Atom search optimization algorithm (IASO). It classifies the pothole and non-pothole region with a lesser error function, implemented and tested experimentally in terms of accuracy, recall, precision and error performance. This work provides better performance with a maximum accuracy of 97.7% to become a better strategy for pothole detection.

     

基于混合特征的Android恶意软件静态检测

当前智能手机市场中,Android占有很大的市场份额,又因其他的开源,基于Android系统的智能手机很容易成为攻击者的首选目标。随着对Android恶意软件的快速增长,Android手机用户迫切需要保护自己手机安全的解决方案。为此,对多款Android恶意软件进行静态分析,得出Android恶意软件中存在危险API列表、危险系统调用列表和权限列表,并将这些列表合并,组成Android应用的混合特征集。应用混合特征集,结合主成分分析(PCA)和支持向量机(SVM),建立Android恶意软件的静态检测模型。利用此模型实现仿真实验,实验结果表明,该方法能够快速检测Android应用中恶意软件,且不用运行软件,检测准确率较高。     

Spatial Based Pilot Allocation (SBPA) in Crowded Massive MIMO Systems

Nowadays, the internet of things (IoT) has gained significant research attention. It is becoming critically imperative to protect IoT devices against cyberattacks with the phenomenal intensification. The malicious users or attackers might take control of the devices and serious things will be at stake apart from privacy violation. Therefore, it is important to identify and prevent novel attacks in the IoT context. This paper proposes a novel attack detection system by interlinking the development and operations framework. This proposed detection model includes two stages such as proposed feature extraction and classification. The preliminary phase is feature extraction, the data from every application are processed by integrating the statistical and higher-order statistical features together with the extant features. Based on these extracted features the classification process is evolved for this, an optimized deep convolutional neural network (DCNN) model is utilized. Besides, the count of filters and filter size in the convolution layer, as well as the activation function, are optimized using a new modified algorithm of the innovative gunner (MAIG), which is the enhanced version of the AIG algorithm. Finally, the proposed work is compared and proved over other traditional works concerning positive and negative measures as well. The experimental outcomes show that the proposed MAIG algorithm for application 1 under the GAF-GYT attack achieves higher accuracy of 64.52, 2.38 and 3.76% when compared over the methods like DCNN, AIG and FAE-GWO-DBN, respectively.

     

基于组合式算法的Android恶意软件检测方法

为解决当前恶意软件静态检测方法中适用面较窄、实用性较低的问题,通过组合式算法筛选出最优分类器,并以此为基础实现了一个检测系统。首先使用逆向工程技术提取软件的特征库,并通过多段筛选得到分类器的初步结果。提出了一种基于最小风险贝叶斯的分类器评价标准,并以此为核心,通过对初步结果赋权值的方式得到最优分类器结果。最后以最优结果为核心实现了一个Android恶意软件检测系统原型。实验结果表明,该检测系统的分析精度为86.4%,并且不依赖于恶意代码的特征。     

A LSTM-Based Anomaly Detection Model for Log Analysis

Security devices produce huge number of logs which are far beyond the processing speed of human beings. This paper introduces an unsupervised approach to detecting anomalous behavior in large scale security logs. We propose a novel feature extracting mechanism and could precisely characterize the features of malicious behaviors. We design a LSTM-based anomaly detection approach and could successfully identify attacks on two widely-used datasets. Our approach outperforms three popular anomaly detection algorithms, one-class SVM, GMM and Principal Components Analysis, in terms of accuracy and efficiency.