머신러닝을 이용한 권한 기반 안드로이드 악성코드 탐지
Android Malware Detection Using Permission-Based Machine Learning Approach
1
조회
0
다운로드
8
인용
0
참고문헌
키워드
초록
본 연구는 안드로이드 정적분석을 기반으로 추출된 AndroidManifest 권한 특징을 통해 악성코드를 탐지하고자한다. 특징들은 AndroidManifest의 권한을 기반으로 분석에 대한 자원과 시간을 줄였다. 악성코드 탐지 모델은1500개의 정상어플리케이션과 500개의 악성코드들을 학습한 SVM(support vector machine), NB(NaiveBayes), GBC(Gradient Boosting Classifier), Logistic Regression 모델로 구성하여 98%의 탐지율을 기록했다. 또한, 악성앱 패밀리 식별은 알고리즘 SVM과 GPC (Gaussian Process Classifier), GBC를 이용하여multi-classifiers모델을 구현하였다. 학습된 패밀리 식별 머신러닝 모델은 악성코드패밀리를 92% 분류했다.
Abstract
This study focuses on detection of malicious code through AndroidManifest permissoion feature extracted based onAndroid static analysis. Features are built on the permissions of AndroidManifest, which can save resources and time foranalysis. Malicious app detection model consisted of SVM (support vector machine), NB (Naive Bayes), Gradient BoostingClassifier (GBC) and Logistic Regression model which learned 1,500 normal apps and 500 malicious apps and 98%detection rate. In addition, malicious app family identification is implemented by multi-classifiers model using algorithmSVM, GPC (Gaussian Process Classifier) and GBC (Gradient Boosting Classifier). The learned family identification machinelearning model identified 92% of malicious app families.
참고문헌 (13)
- "Mobile trends in 2015", KT Economic Management Institute, ~ (2015)
- "IDC" (2017)[URL]
- Threat Report, , McAfee Labs, ~ (2017)
- Jae-wook Jang, "Andro-AutoPsy: Anti-malware system based on similarity matching of malware and malware creator-centric information", Digital Investigation, 14, pp.17~35 (2015), Elsevier BV[DOI]
- Suarez-Tangil, Guillermo, "DroidSieve: Fast and accurate classification of obfuscated android malware", Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, pp.309~320 (2017)
- "apk_parse"[URL]
- "Android-apktool: A tool for reengineering Android apk files"[URL]
- Sarma, Bhaskar Pratim, "Android permissions: a perspective combining risks and benefits", Proceedings of the 17th ACM symposium on Access Control Models and Technologies, pp.13~22 (2012)
- "Dalvik Executable format" (2018)[URL]
- Yang, Zhemin, "Leakminer: Detect information leakage on android with static taint analysis", Software Engineering (WCSE), 2012 Third World Congress on, pp.101~104 (2012)
- Pedregosa, Fabian, "Scikitlearn: Machine learning in Python", Journal of machine learning research, pp.2825~2830 (2011)
- Peiravian, Naser, "Machine learning for android malware detection using permission and api calls", Tools with Artificial Intelligence (ICTAI), 2013 IEEE 25th International Conference on, pp.300~305 (2013)
- Ham, Hyo-Sik, "Analysis of android malware detection performance using machine learning classifiers", ICT Convergence (ICTC), 2013 International Conference on, pp.490~495 (2013)