关键词: Android变种, 恶意软件检测, 模糊哈希值

Abstract: Malware variants in the Android mobile platform are increasing rapidly. In order to detect the malware variants efficiently, this paper proposes a method to generate the fuzzy Hash number, which is based on the strings and function in the Apks. The malicious software in the same kind of variants has the similar Hash value. Through detecting malware variants, the k-means algorithm is used to simplify the size of malware database. And then the Hamilton distance is used to measure the distance between them. When the distance is less than a threshold, it means a malware variant has been detected. Experimental results demonstrat that the method has a high capability of speed and resistance.

Key words: Android variant, malware detection, fuzzy Hash