Android Malware of Static Analysis Technology Based on Data Mining

Abstract

With the proliferation of malicious Android applications, an Android malicious code detection system is proposed in this paper. Based on the similarity between cognate malicious software in terms of permission application and behavior, the proposed system detects the malicious codes by performing static analysis on the configuration and Java files. For the configuration file permissions analysis, the permission of the Android software is extracted, and the improved version of the FP-Growth algorithm is used to mine the permission correlation between cognate malicious software. For the Java file analysis, the API sequence is called, and the behavior pattern is represented with the sub-graph; frequent pattern mining is performed on the behavior sub-graph of cognate malicious software using the AGM algorithm. The unknown malicious software is detected by establishing a malicious software feature library consisting of frequent permission clusters and frequent behavior sub-graph relationships. Finally, experiments are carried out to prove the effectiveness and correctness of the proposed schemes. The proposed malicious code detecting system has been made available on the Internet to provide free analysis and detection service.