CN103218566A - Active defense system based on Android platform software behavior detection - Google Patents

Abstract

The invention relates to an active defense system based on Android platform software behavior detection, which actively defends against security threats of mobile phones. The system includes: using the top command or PS command and the ActivityManager.MemoryInfo() and ActivityManager.AppProcessInfo() provided by the Android API to collect process data; using the principal component analysis method to analyze the collected data and extract the most reflective The characteristics of the sample, the sample is sent to the neural network model; a part of the sample is randomly selected for learning, and the model parameters are obtained as part of the model parameters for evaluation, so as to evaluate the sample to be tested, judge whether it is normal, and then judge whether a certain process is abnormal. The present invention introduces the method of combining PCA dimensionality reduction and BP neural network into the machine, thereby reducing the amount of calculation and storage of the traditional BP neural network, and making it available on mobile devices such as mobile phones with limited computing power and storage capacity. Very good implementation, to ensure the safety of mobile phones.

Description

Active Defense System Based on Android Platform Software Behavior Detection

technical field

The invention relates to an active defense system based on Android platform software behavior detection.

Background technique

The wide application of smartphones today, especially the provision of the Android open platform, makes the Android smartphone market show a huge growth advantage, but also because of the openness of the platform, it is more vulnerable to malicious software attacks.

Currently existing mobile phone security software mainly transplants the security software in the form of comparing feature codes in the PC directly to the mobile phone. The form of signature comparison is very effective for killing known malicious programs, but it is helpless for unknown malicious programs. Nowadays, the number of malicious programs is increasing geometrically. Compared with malicious programs, the generation and update of signature databases are often Lag, many times anti-virus software can not kill unknown malicious programs. At the same time, the feature library requires a large amount of storage space, which is a great limitation for mobile devices such as mobile phones with limited storage space and computing power.

The anomaly detection technology based on normal behavior refers to using the established normal behavior profile to detect deviant abnormal behavior. This mechanism can effectively detect unknown anomalies, so it can overcome the disadvantage that signature comparison cannot detect unknown malicious programs. The detection of normal behavior has a high false positive rate.

Contents of the invention

Aiming at the potential safety hazards of the Android platform, the present invention explores a new safety detection system based on behavior detection to realize the function of detecting software abnormal behavior, and achieve the effect of active defense with as little storage and calculation as possible.

The overall framework of the present invention is divided into three modules: data collection, PCA (principal component analysis, principal component analysis) dimensionality reduction, BP (Back Propagation, reverse propagation) neural network classification.

The research on data collection is mainly aimed at how to call the API (Application Programming Interface) of its own system to collect relevant information, and deeply analyze processes, services, tasks, etc.;

Based on the initially collected data, the PCA dimensionality reduction technique is used to extract the main information;

According to the PCA dimension reduction, it is sent to the BP neural network interface, and the learned BP neural network evaluates the data;

In order to solve technical problems, the present invention innovates and transforms every detail, including:

(1) Make a preliminary judgment on the calculation results, respond to the mobile phone, and issue warnings and suggested operations;

(2) For the above method, the process can be run locally without networking or cloud operations;

(3) For the above-mentioned data collection module, the collection process adopts three-dimensional array storage to simplify the difficulty of operation;

(4) for above-mentioned PCA principal component analysis module, described method adopts QR matrix analysis to solve eigenvector;

(5) For the above-mentioned PCA principal component analysis module, the screening of the eigenvalues by the process adopts the multiple comparison contribution rate method, and selects the best quality contribution parameters to build the parameter model;

(6) For the above-mentioned BP neural network module, the learning sub-module adopts learning factors suitable for model learning, and obtains the best parameters mainly through multiple transformation comparisons.

This system applies active defense technology to mobile phones. Compared with the traditional feature code comparison on mobile phones, it can detect in advance and effectively remind users of the threats they face. It solves the problem of continuous data update and huge calculation in mobile phones. problem.

Description of drawings

The present invention will be further described below in conjunction with drawings and embodiments.

Fig. 1 is an overall architecture diagram of the present invention.

Fig. 2 is a flow chart of data collection in the present invention.

Fig. 3 is a flow chart of PCA dimensionality reduction in the present invention.

Fig. 4 is a flow chart of the learning part of the neural network classification module of the present invention.

Fig. 5 is a flowchart of the evaluation part of the neural network classification module of the present invention.

specific implementation plan

As shown in Fig. 1 is the overall architecture of the present invention, including three modules of data collection, PCA dimension reduction and neural network classification. Data collection uses Linux system management commands to collect intrusion-related process information as mobile phone intrusion features, and then uses PCA to reduce the dimensionality of the intrusion features, select the features that best reflect the sample, and finally introduce the dimensionality-reduced features into the BP neural network classifier Perform training to obtain the best model parameters, and use these parameters to classify and identify the samples to be tested.

The embodiment shown in FIG. 2 is a flow chart of data collection in the present invention. The data collection module is mainly used to collect intrusion data information of related software or programs.

Since the Android kernel is Linux, the system management commands of Linux are used to collect process information, and the top command or PS command is used to collect the CPU usage of the process, the number of threads of the process, priority, physical memory, virtual memory, UID and process name. In addition, the ActivityManager.MemoryInfo() and ActivityManager.RunningAppProcessInfo() classes provided by the API in Android obtain the system memory and UID number occupied by the process, and then obtain the traffic usage of the process according to the UID number of the process name.

Since accessing collected data based on files will consume a lot of program running time, a three-dimensional array is used for accessing. The first dimension represents time, the second dimension represents different processes, and the third dimension is process information. Considering the impact of sample storage on the collection itself, a timer is used to collect data at a certain time interval to build a high-dimensional matrix. When the sample detection is over, Java's own recovery mechanism will process the used samples.

The embodiment shown in FIG. 3 is a PCA dimensionality reduction flowchart of the present invention. The PCA dimensionality reduction module mainly extracts the features that can best reflect the sample, realizes the simplification of calculation and achieves better detection results.

Principal component analysis (PCA) is actually a preprocessing method, which can reduce the dimension of the original data, and the variance between the reduced data is the largest (it can also be said that the projection error is the smallest). The assumption is to project a D-dimensional data space into an M-dimensional data space (M<D), arrange the D data eigenvalues from large to small, calculate the contribution rate, find the corresponding eigenvector, and take the corresponding The first M eigenvectors form a projection matrix, and the variance of this matrix is the largest.

The theoretical process assumes that a point in a space is projected into a vector. First, calculate the center point of the original space:

$\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; =</span>\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; N</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; N</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>$

Let u ₁ be the projection vector. According to the variance formula, the variance after projection is:

$\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; N</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; N</span>}}{<span\; class="notranslate">\; \{</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; T</span>}}{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; no</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; T</span>}}\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; x</span>}}<span\; class="notranslate">\; \}</span>}^{\mathrm{<span\; class="notranslate">\; 2</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; T</span>}}{\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>$

Then solve for the eigenvalues:

${\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; T</span>}}{\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&lambda;</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; T</span>}}{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 3</span>}<span\; class="notranslate">\; )</span>$

Deriving the above formula to make it 0, we get:

Su ₁ =λ ₁ u ₁ (4)

Formula (4) is a standard eigenvalue expression, λ is the corresponding eigenvalue, and u is the corresponding eigenvector. The condition for obtaining the maximum value on the left side is that λ ₁ is the largest, that is, when the maximum eigenvalue is obtained. The assumption is to project a D-dimensional data space into an M-dimensional data space (M<D), arrange the eigenvalues from large to small, calculate the contribution rate and take the corresponding first M eigenvectors to form a projection matrix. Then the variance of this matrix is the largest.

In the PCA dimension reduction module, the original data high-dimensional matrix is compressed and transformed to construct a new low-dimensional data matrix, that is, to find a suitable projection vector that best reflects the characteristics of the sample, so that the matrix is projected into a low-dimensional space. The implementation process is to standardize the original data, find the correlation coefficient matrix of the matrix, and use the QR decomposition method to solve the eigenvalues of the correlation coefficient matrix and arrange them in descending order. The size of the eigenvalues obtained above reflects the importance of this feature to distinguish samples. degree. The ratio of each eigenvalue to the sum of eigenvalues is the contribution rate of that feature. Find the cumulative contribution rate of different eigenvalues and compare it with the threshold (95%), select the principal component features, and then calculate the corresponding eigenvectors according to the eigenvalues of the principal components, the obtained eigenvectors are composed of the projection vector matrix, and finally normalized The data matrix of is multiplied by the projection matrix to obtain the dimension-reduced matrix, which is sent to the neural network module.

The embodiment shown in FIG. 4 is a flowchart of the learning part of the neural network classification module of the present invention. The learning part of the neural network module mainly obtains the model parameters by learning the sample data, and the process is as follows:

(1) Call the random() function to initialize the weights of the input layer, hidden layer and output layer, so that the value ranges from -0.5 to 0.5;

(2) Input the sample features after PCA dimension reduction and the corresponding expected output. According to the sample features, select the Sigmoid function as the activation function to calculate the input and output of each layer. The input and output formulas are shown in formulas (5) and (6) :

U _i ^k ＝∑jW _ij ^k X _j ^k-1

  (5)

X _i ^k ＝f(U _i ^k )

(6)

Among them, U _i ^k is the input, X _i ^k is the output, and W _ij ^k is the weight;

(3) Compare the output calculated in formula (6) with the expected output, and then pass it backwards to calculate the error of each layer. The calculation formula is shown in formula (7):

d _i ^k ＝X _i ^k (1-X _i ^k )∑jW _ij d _j ^k+1 (7)

(4) Correct the weights according to the error until the maximum number of learning times is reached or the error meets the requirements. According to the experimental analysis, the maximum number of learning times is selected as 200 times, and the error requirement is less than 0.01.

The embodiment shown in FIG. 5 is a flowchart of the evaluation part of the neural network classification module of the present invention. The evaluation part of the neural network module is mainly used to judge whether a certain sample data is abnormal, thereby judging whether a certain process is abnormal, and prompting the user to perform corresponding operations, such as uninstalling.

The neural network evaluation part uses the weights obtained in the learning part as the initial weights of the input layer, the hidden layer and the output layer, and then calculates the output of each layer according to the input sample data, and compares the output of the output layer with a preset threshold (threshold passed Adjusted to 0.4 after many experiments, if the output is greater than the threshold, it is judged as normal, otherwise, it is judged as abnormal, and the user is prompted to terminate the execution of the program or uninstall the software.

Claims (6)

1. the Active Defending System Against that detects based on the behavior of Android platform software is become by data collection module, PCA dimensionality reduction module and neural network classification module thin,tough silk, it is characterized in that:

(1) data collection module: utilize the system management order of Linux and the information that the class that API provided among the Android is collected process, and adopt three-dimensional array and chronograph mechanism to come access and management;

(2) PCA dimensionality reduction module: link to each other with described data collection module, adopt principal component analysis (PCA) that the above-mentioned data of collecting are carried out dimension-reduction treatment, extract can reflected sample feature;

(3) neural network classification module: link to each other with described PCA dimensionality reduction module, by the data behind the above-mentioned dimensionality reduction repeatedly being learnt determine model parameter, carry out the processing action of this incident again according to the model parameter after the study, and take a decision as to whether abnormal behaviour and make respective response according to the output result.

2. the Active Defending System Against that detects based on the behavior of Android platform software according to claim 1, it is characterized in that: utilize the system management order of Linux to collect the information of process in the module (1), utilize top order or PS order collection process CPU take, the Thread Count of process, priority, physical memory, virtual memory, UID and process name, utilize the Installed System Memory that takies that ActivityManager.MemoryInfo () that API provided among the Android and ActivityManager.AppProcessInfo () class obtain process and UID number, according to UID number of process name, obtain the flow operating position of process then.

3. the Active Defending System Against that detects based on the behavior of Android platform software according to claim 1, it is characterized in that: module is come access data based on file in (1), adopts three-dimensional array to come access, adopts timer simultaneously, gather certain hour data at interval, make up a higher dimensional matrix.

4. the Active Defending System Against that detects based on the behavior of Android platform software according to claim 1 is characterized in that: adopt principal component analysis (PCA) to analyze the data that data collection module is collected in the module (2), and determine that as required threshold value is 95%.

5. the Active Defending System Against that detects based on the behavior of Android platform software according to claim 1, it is characterized in that: give corresponding value to each parameter of institute's established model in the module (3), this value according to collected mass data by repeatedly the experiment and statistical calculations obtain.

6. the Active Defending System Against that detects based on the behavior of Android platform software according to claim 1, it is characterized in that: in the module (3) safety coefficient is divided into two grades, which grade a certain behavior of relatively judgement according to output result and predetermined threshold value (it is 0.4 that the statistical computation by mass data obtains threshold value) belongs to, if the result is less than predetermined threshold value in output, then be judged to be unusual, and point out the user to stop carrying out this program or unload this software, otherwise be judged to be normally, will not process.

Images