JDroid:使用混合opcode特征向量进行Android恶意软件检测
1Computer Engineering, Kayseri University, Kayseri, Turkey.
PeerJ. Computer science
|September 24, 2025
概括
研究人员开发了JDroid,这是一种使用opcode分析来检测Android恶意软件的工具. 这种方法有效地识别恶意应用程序,即使是那些使用先进的模糊技术,实现高精度.
科学领域:
- 计算机科学 计算机科学
- 网络安全 网络安全
- 机器学习 机器学习
背景情况:
- 由于Android设备的广泛使用,它们是恶意软件的主要目标.
- 现有的恶意软件检测方法与先进的模糊和变体生成技术相斗争.
- 操作代码提供丰富的语义信息,用于区分良性应用程序和恶意应用程序.
研究的目的:
- 提出JDroid,一个用于检测Android恶意软件的新工具.
- 为了利用opcode序列作为基于静态分析的恶意软件检测的功能.
- 开发一个集体模型,有效地处理模糊的应用程序.
主要方法:
- JDroid 将Dalvik Opcodes和Java ByteCode视为使用静态分析的功能.
- 在堆叠的通用结构中采用集体模型,使用混合的opcode序列.
- 从APK文件中提取opcodes,转换为二进制向量,特征选择将数据集减少到461个特征.
主要成果:
- 拟议的方法在恶意软件检测中实现了98.6%的准确性和99.6%的曲线下的区域 (AUC).
- 该方法证明了对模糊化技术的有效性.
- 在多个基准数据集中的14,000个应用程序的多样化数据集上评估了性能.
结论:
- JDroid为Android恶意软件检测提供了一种高效和高性能解决方案.
- 基于opcode的特征提取和组合模型对模糊性有很强的抵抗力.
- 这种方法通过提高恶意软件识别准确度来增强最终用户的安全性.
相关概念视频
01:31Hybridoma Technology
17.3K
Hybridoma technology is used for the large-scale production of monoclonal antibodies. Monoclonal antibodies bind to only a single antigenic determinant or epitope. Such antibodies are used in research, diagnostics, and disease therapy. The hybridoma technology established in 1975 by Georges Köhler and Cesar Milstein was awarded the Nobel Prize in Medicine in 1984 for revolutionizing research and therapy.
Hybridoma Selection
Commonly used fusion techniques — electroporation,...
Hybridoma Selection
Commonly used fusion techniques — electroporation,...
17.3K
01:20Vector Operations
2.0K
Vectors are physical quantities that have both magnitude and direction. The vector operations include addition, subtraction, and scalar multiplication.
A vector multiplied by a scalar value is called scalar multiplication. The result obtained is a new vector with a different magnitude. If the scalar is positive, the direction of the vector remains the same, but if it is negative, the direction of the vector is reversed. For example, the product of the mass and velocity yields the momentum.
A vector multiplied by a scalar value is called scalar multiplication. The result obtained is a new vector with a different magnitude. If the scalar is positive, the direction of the vector remains the same, but if it is negative, the direction of the vector is reversed. For example, the product of the mass and velocity yields the momentum.
2.0K
02:28Leaky Scanning
5.6K
During most eukaryotic translation processes, the small 40S ribosome subunit scans an mRNA from its 5' end until it encounters the first start AUG codon. The large 60S ribosomal subunit then joins the smaller one to initiate protein synthesis. The location of the translation initiation is largely determined by the nucleotides near the start codon as there may be multiple translation initiation sites present on the mRNA. Marilyn Kozak discovered that the sequence RCCAUGG (where R...
5.6K
01:10Detection of Black Holes
2.5K
Although black holes were theoretically postulated in the 1920s, they remained outside the domain of observational astronomy until the 1970s.
Their closest cousins are neutron stars, which are composed almost entirely of neutrons packed against each other, making them extremely dense. A neutron star has the same mass as the Sun but its diameter is only a few kilometers. Therefore, the escape velocity from their surface is close to the speed of light.
Not until the 1960s, when the first neutron...
Their closest cousins are neutron stars, which are composed almost entirely of neutrons packed against each other, making them extremely dense. A neutron star has the same mass as the Sun but its diameter is only a few kilometers. Therefore, the escape velocity from their surface is close to the speed of light.
Not until the 1960s, when the first neutron...
2.5K
01:29Viruses with RNA Genomes
824
RNA viruses are categorized into positive-strand, negative-strand, or double-stranded groups based on their genomic structure and replication mechanisms. This classification dictates how they exploit host cellular machinery for protein synthesis and replication. Some RNA viruses also utilize reverse transcription as part of their life cycle, further diversifying their replication strategies.Positive-Strand RNA VirusesPositive-strand RNA viruses have genomes that function directly as messenger...
824
01:19Mass Analyzers: Common Types
1.4K
The quadrupole mass analyzer consists of four cylindrical metal rods arranged in a diamond carrying a DC voltage and a radio-frequency AC voltage. The motion of ions through the quadrupole depends on the field strength, causing only ions of a certain m/z to resonate successfully and strike the detector at a given field strength. Though the transmission rate for these analyzers is high, the exact elemental composition of the sample is not determined because of low resolution; however, they are...
1.4K