Abstract: In order to improve the efficiency of android malware detection, an improved random forest algorithm is proposed. It optimizes the subset of features selected in the process of splitting each node during the random forest generation process, and the model will be optimized by Cross Validation method. The experiment results show that improved random forest is superior to the original one in the problem of classifying android applications into normal, SMS Trojan, spyware, botnet with a higher precision(94.0%) and recall(90.5%). It can effectively detect different android malware, and the information and property of the users are guaranteed.

Key words: Android, malware, multiple classification, random forest, feature subset, cross validation

摘要： 为了提高安卓恶意软件多分类问题的效率，提出了一种改进的随机森林算法。针对随机森林构建过程中每个节点分裂时选取的特征子集进行优化，同时采用交叉验证方法进行模型优化。实验结果表明，在将安卓应用划分为正常应用、短信木马、间谍软件、僵尸网络问题上，改进的随机森林算法分类性能优于原始的随机森林算法，具有较高的精确率(94.0%)和召回率(90.5%)。能够有效检测出安卓恶意软件类型，保护设备安全，保障用户信息和财产安全。

关键词: 安卓, 恶意软件, 多分类, 随机森林, 特征子集, 交叉验证