文献类型：期刊文献

中文题名：基于深度学习的Android恶意软件动态检测

英文题名：Android malware dynamic detection method based on deep learning

作者：张雪芹[1];王逸璇[1];赵敏[1]

机构：[1]华东理工大学信息科学与工程学院,上海200237

年份：2024

卷号：45

期号：1

起止页码：10

中文期刊名：计算机工程与设计

外文期刊名：Computer Engineering and Design

收录：CSTPCD;;北大核心:【北大核心2023】；

基金：国家自然科学基金项目(51975213)。

语种：中文

中文关键词：Android系统;恶意软件;异常检测;网络流量;DenseNet;注意力机制;流量灰度图

外文关键词：Android system;malware;anomaly detection;network traffic;DenseNet network;attention mechanism;flow grey-scale image

摘要：为提高Android恶意软件的检测精度,提出一种基于改进DenseNet网络的Android恶意软件动态检测方法。以应用软件运行特定阶段的网络通信流量为分析对象,根据会话五元组信息切分原始网络流量并转换为灰度图,提出一种基于DenseNet网络改进的分类检测网络DenseNet_IS。通过添加具有不同大小卷积核的卷积分支获取不同感受野的特征,通过引入SimAM注意力模块,从空间和通道两个维度实现对重要特征的关注。结合应用软件判决机制,实现最终分类。在CICAndMal2017数据集上的实验结果表明,所提方法可以达到99.06%的良恶性检测精度和96.51%的多分类精度,验证了该方法的有效性。
To improve the detection accuracy of Android malware,a dynamic detection method of Android malware based on improved DenseNet network was proposed.Taking the network traffic in the specific stage of application software operation as the analysis object,according to the five tuple information of session,the original network traffic was segmented and converted into gray image,and an improved classification detection network DenseNet_IS based on DenseNet was proposed.The features of different receptive fields were obtained by adding convolution branches with different sizes of convolution kernels.The attention to important features was realized from the two dimensions of space and channel by introducing SimAM attention module.Combining with the decision mechanism of application software,the final classification was realized.Experimental results on CICAndMal2017 dataset show that the accuracy of the proposed method can achieve 99.06%on binary classification and 96.51%on multi-classification,which verifies the effectiveness of the method.