基于APP网络行为追踪和特征学习的移动恶意程序风险评估方法

项目名称： 基于APP网络行为追踪和特征学习的移动恶意程序风险评估方法

项目编号： No.61472189

项目类型： 面上项目

立项/批准年度： 2015

项目学科： 自动化技术、计算机技术

项目作者： 魏松杰

作者单位： 南京理工大学

项目金额： 84万元

中文摘要： 随着移动互联网发展和移动设备的普及，移动应用平台在丰富手机功能、方便应用开发的同时，也滋养了众多恶意应用程序。当前移动恶意检测技术过分依赖分析代码本身，局限于应用代码所展现的权限需求、系统调用、资源访问等程序特征和行为，无法应对零日攻击和复杂代码的恶意程序。典型移动应用的恶意行为和破坏活动，大多借助移动互联网连接和服务来加以实施，可以通过监控单个移动应用程序的网络行为和网络资源使用情况发现。据此本项目提出在互联网通讯的多层次针对移动应用进行网络行为的动态连续监控、单独建档和特征提取。层次网络行为特征之间相互考证，采用数据挖掘的技术对应用程序的网络行为进行聚类，归纳出典型性恶意行为作为检测标准，对未知应用通过比对恶意行为特征匹配度来估算运行风险。本项目探求移动应用恶意属性和分层异常网络行为之间的理论相关性，据此设计并实现一个基于移动应用网络行为特征提取和深度学习的应用程序恶意检测和风险评估系统。

中文关键词： 计算机网络安全；异常检测；软件网络行为；移动互联网；恶意软件

英文摘要： With the evolving mobile internet and the prevailing smart mobile devices, typical mobile application platform and SDK such as Android extraordinarily simplify the development procedure of new application to extend device functionalities. However, they also facilitate the occurrence of mobile malware. Current Android malware detection mostly rely on apk code analysis to reveal permission request, API calls, and system resource visit, which are unreliable for zero-day malware detection, or detection of sophisticatedly coded malware. Typical mobile malware cannot conduct harmful operations without using network connections and services, which inspire us to detect mobile malware by monitoring application's network behaviors. We propose to profile and analyze mobile application behaviors on multiple layers of the Internet protocol stack. Cross-layer network behavior profiles are further refined and summarized by using the data mining clustering technique. Typical network behaviors of mobile malwares can be used to train classifiers to evaluate and detect risks of unknown new applications. This project targets to both prove and specify the correlation between mobile malware and their anomaly network behaviors, and based on the theory, design and implement an application's maliciousness and risk evaluation system based on application's cross-layer network behaviors.

英文关键词： Network Security;Anomaly Detection;Network Behavior;Mobile Internet;Malware