基于层次分析法的智能手机恶意软件静态检测及评价模型(英文)

• 作 者: 张淼 杨有秀 程工 董航 李承泽
• 机 构: National Engineering Laboratory for Disaster Backup and Recovery,Beijing University of Posts and Tel
• 出 处: 中国通信
• 发表日期: 2012年12期
• 关键词: 恶意软件 层次分析法 detecting 静态检测 grammar Android consistency hazard false Trojan

Mobile malware is rapidly increasing and its detection has become a critical issue.In this study,we summarize the common characteristics of this malicious software on Android platform.We design a detection engine consisting of six parts:decompile,grammar parsing,control flow and data flow analysis,safety analysis,and comprehensive evaluation.In the comprehensive evaluation,we obtain a weight vector of 29 evaluation indexes using the analytic hierarchy process.During this process,the detection engine exports a list of suspicious API.On the basis of this list,the evaluation part of the engine performs a comprehensive evaluation of the hazard assessment of software sample.Finally,hazard classification is given for the software.The false positive rate of our approach for detecting malware samples is 4.7% and normal samples is 7.6%.The experimental results show that the accuracy rate of our approach is almost similar to the method based on virus signatures.Compared with the method based on virus signatures,our approach performs well in detecting unknown malware.This approach is promising for the application of malware detection.

Mobile malware is rapidly increasing and its detection has become a critical issue. In this study, we summarize the common characteristics of this malicious software on Android platform. We design a detection engine consisting of six parts: decompile, grammar parsing, control flow and data flow analysis, safety analysis, and comprehensive evaluation. In the comprehensive evaluation, we obtain a weight vector of 29 evaluation indexes using the analytic hierarchy process. This process, the detection engine exports a list of suspicious API. On the basis of this list , the evaluation part of the engine performs a comprehensive evaluation of the hazard assessment of software sample. Finally, hazard classification is given for the software. The false positive rate of our approach for detecting malware samples is 4.7% and normal samples is 7.6%. The experimental results show that the accuracy rate of our approach is almost similar to the method based on virus signatures. Compared with the method based on virus signatures, our approach performs well in detecting unknown malware. This approach is promising for the application of malware detection.