关键词: Android平台, 应用分类, 系统调用, 恶意程序检测

Abstract: Considering the increasement of malware for Android, a malware detection based on application classfication and system calls of Android applications is proposed. The method depends on the categories in the Google Play as a reference to count system calls usage threshold of each category. During the installation of the application to a Android mobile phone runtime, the infornation of system calls and the permission infornation is sent to the remote server by the mobile phone. Sequential minimal optimzation algorithm is used to classify the application, and system calls usage value of the this application is calculated after the information of system call frequency is analyzed. Comparing this value and system calls usage threshold of category, whether it is a procedure including hostile program can be ascertained. Users can get the result and change the category of the application to examine the application depending on the requirement. Finally, the effectiveness and feasibility of the method is verified, not only can reduce resource consumption of phones, but also can response the malware as quickly as possible.

Key words: Android, application classfication, system calls, malware detection