关键词: 安卓, 恶意软件检测, 随机森林, 半监督学习, GBDT

Abstract: In order to better detect Android malware and analyze its malicious behavior,a research approach of Android malware detection and its malicious behavior analysis based on semi-supervisedlearning is presented in this paper.First 16179 Android benign software and 31964 Android malware are collected, and thendecompiling the APK for Android, extracting permissions, services and sensitive APIs as static features, and then using the dynamic analysis tool called DroidBox to extract seven kinds of dynamic features. Android malware family reflects the malicious behavior of Android malware, but different malware family might have the same malicious behavior. Therefore, the main twenty kinds of malicious families in the sample data are divided into five kinds of malicious behaviors by manual analysis and clustering analysis in this paper. Only the malicious behavior of twenty kinds of malicious families are labelled and malicious behavior of other families are not labelled. In order to make full use of the data, the Co-RFGBDT algorithm which combines the advantages of Random Forest and GBDT in semi-supervised learning is presented. Re-train the data sets using Co-RFGBDT algorithm in semi-supervised learning in combination with unlabeled samples with the overall accuracy of 91.5%. However, malicious behavior is endless, so the unknown malicious behavior is identified by setting the threshold of confidence in the paper.Finally, compared with the benchmark experiment, the overall accuracy is improved by 2%, which proves that the proposed Co-RFGBDT semi-supervised learning algorithm has better performance in this scenario.

Key words: Android, Malware detection, Random Forest, Semi-supervised learning, GBDT