基于同一家族恶意软件在行为上的相似性特征,提出了一种基于行为的Android恶意软件家族聚类方法.该方法构建了软件行为刻画特征集合,通过定制ROM的方式来构建行为捕获机制并采集恶意软件的行为日志,基于行为日志提炼恶意软件特征集,使用DBSCAN(density-based spatial clustering of applications with noise)聚类算法进行家族聚类.通过对大量已经人工分类的恶意软件进行评估,实验结果表明,在最优情况下,本方法在聚类准确率上达到了91.3%,在测试样本识别预测上正确率达到了82.3%.
We analyze the attack steps of malware and focus on the malware loading. Our assumption is that a malware contains no less than one module, so monitoring module loading is indispensable to defeat malware. Moreover, we design security policies and employ these policies when a module is loaded by the operating system. These policies depend on properties of module, the connection to created modules, and the link to user intention. The properties of module and this connection can improve the accuracy of malware detection. User intention can be helpful to handle unknown module and enhances the flexibility of policy. Finally, ModuleGuard, a gatekeeper for dynamic module loading against malware, has been designed and implemented, which integrates these security policies. Our experimental results have shown the feasibility and effectiveness of our method.
