关键词: 人工自然杀伤细胞模型, 树突状细胞算法（DCA）, 恶意软件

Abstract:

Aiming at the problems of single and immobilized characteristics in the existing detection methods of Android malware and weak detection ability against unknown and latent malware, a Natural Killer cell（NK） detection model of Android malware is constructed. The artificial natural killer cell model and Dendritic Cell Algorithm（DCA） are studied. Combining the characteristics of software static permission application and dynamic API call, various input signals of the model are formed after data preprocessing. The artificial NK cell output stimulating factor is fused with DCA danger signal, which improves the significance of DCA danger signal and optimizes the detection process of DCA. The experiment included 1,150 samples of various classified malware from VirusTotal and other data sets, and 1,093 samples of benign software. The experimental results show that compared with DCA and [k]-means, the detection model of artificial NK cells improves the accuracy and reduces the rate of false positives.

Key words: Artificial natural killer cell model, Dendritic Cell Algorithm（DCA）, malware