The development of the mobile internet has made mobile devices affect all aspects of our lives,which has led to the concentration of personal information in mobile devices.Due to the openness and the imperfect security mechanism of the Android system,the illegal theft of private information by software has become a common problem.Information flow analysis technology aims at ensuring the security of information.It detects whether private data has been leaked by analyzing the legitimacy of data transmission in applications.The method of using information flow analysis technology to detect malware has become a current research hotspot.However,the functional complexity of Android applications is in-creasing,along with the increase of code complexity,the similarity between benign and malware in the behavior patterns of sensitive information flows is getting higher and higher.It is difficult to distinguish between benign and malware by coarse-grained information flow feature description,which will greatly affect the accuracy of detection.In this paper,we propose a new malware detection method based on the relationship features of information flows.This method further ex-cavates the relationship features of information flows based on the extraction of application sensitive information flows.We have made a detailed formal description of the relationship between sensitive API call sequences,and obtained the relationship features and continuous common subsequences between sensitive API call sequences through dynamic pro-gramming analysis.We have expressed the relationship features as five-tuples,and the API in the continuous common subsequence is classified as six-tuples.Finally,the features of these two aspects are fused and input into the convolutional neural networks(CNN)to realize malware detection.The experimental results show that we have achieved 98.5%and 97.6%accuracy respectively in MalGenome and AndroZoo datasets.It can be seen that the more fine-grained expression of the relationship between sensitive information flows plays an important role in distinguishing between benign and mal-ware.
维普
万方数据