Android Malware Detection Based on API Pairing

基于API配对的Android恶意应用检测

¹ School of Automation, Northwestern Polytechnical University, Xi'an 710072, China
² Zhengzhou University, Zhengzhou 450000, China

Received: 28 December 2019

Abstract

Aiming at the problem that the permission-based detection is too coarse-grained, a malware detection method based on sensitive application program interface(API) pairing is proposed. The method decompiles the application to extract the sensitive APIs corresponding to the dangerous permissions, and uses the pairing of the sensitive APIs to construct the undirected graph of malicious applications and undirected graph of benign applications. According to the importance of sensitive APIs in malware and benign applications, different weights on the same edge in the different graphs are assigned to detect Android malicious applications. Experimental results show that the proposed method can effectively detect Android malicious applications and has practical significance.

摘要

针对基于Android应用程序申请权限的检测过于粗粒度的问题，提出了基于敏感应用程序编程接口（application program interface，API）配对的恶意应用检测方法。通过反编译应用程序提取危险权限对应的敏感API，将敏感API两两配对分别构建恶意应用无向图与良性应用无向图，再根据恶意应用和良性应用在敏感API调用上的差异分配相同边不同的权重，以此检测Android恶意应用。实验结果表明，提出的方法可以有效地检测出Android恶意应用程序，具有现实意义。