论文标题

柔性Android恶意软件检测模型基于具有代码张量的生成对抗网络

Flexible Android Malware Detection Model based on Generative Adversarial Networks with Code Tensor

论文作者

Yang, Zhao, Deng, Fengyang, Han, Linxi

论文摘要

恶意软件威胁的行为正在逐渐增加,增加了对恶意软件检测的需求。但是,现有的恶意软件检测方法仅针对现有的恶意样本,发现新鲜恶意代码和恶意代码变体的检测是有限的。在本文中,我们提出了一种新颖的方案,该方案可有效地检测恶意软件及其变体。基于生成对抗网络(GAN)的想法,我们获得了满足真实恶意软件特征的“真实”样本分布,使用它们来欺骗歧视器,从而实现针对恶意代码攻击的防御并改善恶意软件检测。首先,提出了一种新的Android恶意软件APK到图像纹理特征提取分割方法,称为段自生长纹理分割算法。其次,张量的奇异值分解(TSVD)基于低血形等级将具有不同尺寸的恶意特征转化为固定的三阶张量均匀地将其输入到训练和学习的神经网络中。最后,提出了基于用代码张量(MTFD-GAN)的GAN的灵活的Android恶意软件检测模型。实验表明,所提出的模型通常可以超过传统的恶意软件检测模型,最大提高效率为41.6 \%。同时,新生成的gans发电机样品极大地丰富了样品多样性。再培训恶意软件探测器可以有效提高传统模型的检测效率和鲁棒性。

The behavior of malware threats is gradually increasing, heightened the need for malware detection. However, existing malware detection methods only target at the existing malicious samples, the detection of fresh malicious code and variants of malicious code is limited. In this paper, we propose a novel scheme that detects malware and its variants efficiently. Based on the idea of the generative adversarial networks (GANs), we obtain the `true' sample distribution that satisfies the characteristics of the real malware, use them to deceive the discriminator, thus achieve the defense against malicious code attacks and improve malware detection. Firstly, a new Android malware APK to image texture feature extraction segmentation method is proposed, which is called segment self-growing texture segmentation algorithm. Secondly, tensor singular value decomposition (tSVD) based on the low-tubal rank transforms malicious features with different sizes into a fixed third-order tensor uniformly, which is entered into the neural network for training and learning. Finally, a flexible Android malware detection model based on GANs with code tensor (MTFD-GANs) is proposed. Experiments show that the proposed model can generally surpass the traditional malware detection model, with a maximum improvement efficiency of 41.6\%. At the same time, the newly generated samples of the GANs generator greatly enrich the sample diversity. And retraining malware detector can effectively improve the detection efficiency and robustness of traditional models.

扫码加入交流群

加入微信交流群

微信交流群二维码

扫码加入学术交流群,获取更多资源