Abstract:

To detect Android malware, the API call information, permission information and source-sink information of Android application are extracted. But the amount of these information is huge, and the feature dimension is up to thirty or forty thousand. In order to eliminate redundant features and reduce classifier building time, hybrid feature selection is proposed using L1 and Binary Particle Swarm Optimization（BPSO）. Aiming at the shortcomings of BPSO premature convergence, an improved binary particle swarm optimization algorithm named SVBPSO is proposed. The SVBPSO looks at the transfer functions of binary particle swarm optimization, and studies the influence of different transfer function on binary particle swam optimization. It is found that the BPSO which uses S-shape transfer function is good at global search, and the BPSO which uses V-shape transfer function has better local search ability. On the basis of BPSO using S-shape transfer function, V-shape transfer function is used for local exploration in every certain number of iterations. Finally, it is proved by experiments that SVBPSO has a better convergence effect. After SVBPSO is used for feature selection, Android malicious application detection can be performed with higher accuracy rate.

Key words: Binary Particle Swarm Optimization（BPSO）, feature selection, transfer function, malware detection

摘要：

为进行Android恶意应用检测，提取了Android应用程序的API调用信息、申请权限信息、Source-Sink信息为特征，这些信息数量庞大，特征维数高达三四万维。为消除冗余特征和减少分类器构建时间，提出了使用[L1]与离散二进制粒子群算法（BPSO）进行混合式特征选择；同时针对BPSO易早熟收敛的缺点，提出了一种改进的二进制粒子群算法SVBPSO。通过研究不同映射函数对二进制粒子群算法的影响发现，使用S型映射函数的BPSO全局搜索能力强，使用V型映射函数的BPSO局部搜索能力强，故该算法使用S型映射函数进行全局搜索，每隔一定迭代次数使用V型映射函数进行局部探索。实验结果证明，SVBPSO具有良好的收敛效果，使用SVBPSO进行特征选择后能提高Android恶意应用检测正确率。

关键词: 二进制粒子群, 特征选择, 映射函数, 恶意应用检测