Abstract:

In order to solve the problem of Android malware detection, a static detection model of Android malware based on improved random forest algorithm using multiple features is proposed. Android application’s multiple attribute features are selected by static detection technology, which include permission, intents, API and key information such as dynamic code, reflection code, native code, password code, and database. Information Gain（IG） algorithm is used to optimize the selection of feature attribute，then generate the corresponding feature vector set. The random forest algorithm is improved and applied to the Android application detection of this model. The experiment selects 6,000 normal samples and 6,000 malicious samples for classification detection, and the results show that the method has a better detection effect.

Key words: Android, classification, random forest, weighted voting, static feature extraction

摘要：

为解决Android恶意软件检测问题，提出一种利用多特征基于改进随机森林算法的Android恶意软件静态检测模型。模型采用了基于行为的静态检测技术，选取Android应用的权限、四大组件、API调用以及程序的关键信息如动态代码、反射代码、本机代码、密码代码和应用程序数据库等属性特征，对特征属性进行优化选择，并生成对应的特征向量集合。最后对随机森林算法进行改进，并将其应用到本模型的Android应用检测中。实验选取了6?000个正常样本和6?000个恶意样本进行分类检测，结果表明该方法具有较好的检测效果。

关键词: Android, 分类, 随机森林, 加权投票, 静态特征提取