关键词: Android应用, 静态分析, 特征提取, 特征选择, 恶意应用检测

Abstract: With the rapid development of the mobile Internet and the Android operating system, applications running on the Android system have also grows rapidly, but malware hidden in them poses a serious threat to users’ property and privacy. Because of the excessive number of Android application features, which affects the efficiency and accuracy of malware detection. Droid-TF-IDF, an Android malware detection approach based on feature selection, select representative features in benign application and malware according to difference of TF-IDF, is proposed. Firstly, APK files are statically analyzed to extract three types of features：permission, API, and opcode to compose a set of features. Then, the Droid-TF-IDF values of different features are calculated and ranked. Finally, a subset of features with greater Droid-TF-IDF values are selected from the feature set to build models such as random forest, support vector machine（SVM） and convolutional neural networks（CNN） to detect Android malware. A prototype tool is implemented based on the proposed approach, and experiments are carried on 3?006 Android applications. The experimental results show that Droid-TF-IDF can be used for three types of features：permission, API, and opcode, and effectively reduce the dimension of features and improve the performances and efficiency of malware detection. After feature selection, the F1 value for detecting Android malware increased by 0.6 percentage points at most, and the time consumption decreased by 35% at most.

Key words: Android application, static analysis, feature extraction, feature selection, malware detection