摘 要

Abstract III

第一章 绪论 1

1.1 研究的目的及意义 1

1.2 研究现状 2

1.3 本课题的主要研究内容 4

第二章 Android及恶意软件相关知识 5

2.1 Android相关知识 5

2.2 恶意软件检测基础知识 5

2.2.1恶意软件的恶意行为分析 5

2.2.2恶意软件检测方法 6

第三章 静态分析检测技术分析 7

3.1 检测原理 7

3.2 算法分析 7

3.2.1 线性判别分析 7

3.2.2 主成分分析法 8

3.2.3 线性判别分析与主成分分析 8

3.2.4 机器学习算法 9

第四章 平台静态检测系统的设计与实现 10

4.1 系统框架 10

4.2 系统检测流程 11

4.3实验结果及分析 12

4.3.1 定义评价标准 12

4.3.2 实验结果 13

参考文献 14

摘 要

随着科学技术的不断发展，人们的生活日新月异。大量的发明创造如移动终端，各种各样的手机应用，运用于人们的日常生活，改变了人们的生活状态，人们的生活越发的丰富多彩。无论是日常的工作，学习，生活，娱乐都离不开移动终端来传递信息。现在我们更是进入了网上购物的时代，我们的信息安全就变得更加重要。否则一旦信息安全得不到保障，不但个人隐私信息可能泄露，而且财产也会不再安全。

安卓系统是世界上用户量最大的移动操作系统，但是它的开源特性导致它更易被不法人员利用造成信息泄露和财产损失。基于以上严重的安全问题，建立一种安全高效的恶意软件检测系统是十分必要的。本课题首先从相关的安卓应用下载网站中下载了大量的恶意软件和正常的软件并且通过通过对它们进行一系列的反编译和特征抽取得到大量的特征样本。之后经过PCA-LDA算法进行特征筛选和特征降噪得到具有良好辨识度的特征向量进而建立起一个行为特征库。我们再将未知软件的文件包也经过上面的方法得到相应的特征向量。最后根据行为特征库和得到的特征值与运用KNN算法的到的阀值比较得出软件的行为特性，从而对软件的安全性进行可靠的判别。

这样基于静态行为分析的恶意软件检测方法的检测效率高识别率强可以用于安卓恶意软件的检测。

关键词：安卓 PCA-LDA算法 KNN算法 静态行为分析 恶意软件检测

Abstract

With the development of science and technology, people's lives better and better. A large number of inventions, such as mobile terminals, a variety of mobile applications, the use of people's daily life, changing people's living conditions, people's lives more and more colorful. Whether it is daily work, study, life, entertainment can not be separated from the mobile terminal to transmit information. Now we are entering the era of online shopping, our information security becomes more important. Otherwise, once the information security is not guaranteed, not only personal privacy information may be leaked, and the property will be no longer safe.

Android is the world's largest user of the mobile operating system, but its open source characteristics cause it to be more easily used by illegal personnel and property losses caused by information leakage. Based on the above serious security problems, it is very necessary to establish a safe and efficient malicious software detection system. Fistly this paper downloaded a lot of malicious software and normal software from the Android application download website then through making a series of decompilation and feature extraction obtained a large number of feature samples.After PCA-LDA algorithm for feature selection and feature noise reduction feature vector obtained with good recognizable behavioral characteristics and thus establish a behavior library.Then we has the unknown software package also been above method to give the corresponding eigenvectors.Finally, according to behavioral characteristics libraries and eigenvalues obtained and with the use of KNN algorithm to obtain the threshold comparison of the behavioral characteristics of the software, so that the security of the software reliably determined.

The detection efficiency of the malicious software detection method based on the static behavior analysis can be used to detect the malicious software of Android.

Keywords:Android; PCA-LDA algorithm ; KNN algorithm; Static behavior analysis;