面向移动应用安全评估的多属性专家决策模型及应用研究

发布时间：2018-09-12 06:57

【摘要】：随着全球3G/4G网络的快速普及、移动智能设备性能的不断提升、移动智能终端的带宽瓶颈不断突破,移动恶意应用程序快速涌现。根据某安全机构2013年报告显示,2013年1月到12月,Android(安卓)平台新增恶意软件及木马763351个,被感染人数超过1.03亿人次;Symbian(塞班)平台新增恶意程序30049个,感染人数超过409万人次。恶意软件不断跟进当前技术发展并隐藏自身,并且不断通过多种手段窃取用户隐私信息、非法牟利,甚至远程控制用户移动智能设备,形成黑色产业链,因此开展面向海量移动应用程序的安全评估的研究工作迫在眉睫。目前面向移动应用的安全评估所采用的评估手段还是依赖于人员的能力和经验,主要工作集中在漏洞收集、恶意样本行为提取、简单的恶意样本行为关联挖掘方面,而缺乏针对移动智能设备呈指数级增长的恶意攻击事件的压制能力。本文基于移动互联网操作系统进行研究,从恶意样本的多行为属性入手,通过多种不同的数据挖掘决策模型:C4.5决策树、贝叶斯信念网络、神经网络模型、二阶段复合分类,寻找针对恶意样本的最低误报率和漏报率的组合,最终提出自主研究的多属性专家决策模型,并取得了一定成果,本文主要贡献总结如下:(1)研究移动应用数据来源、数据格式,并对应用行为属性类别划分,以及对应用属性模型和算法进行归并提取,并利用该模型针对移动互联网应用安全属性的移动应用的签名属性、敏感字符串判定属性、敏感函数判定属性进行基于KNN最邻近结点算法的模型适配,实现对各种敏感信息的选取。(2)提出了具有高检测率和低误报率的选择分类算法模型SCAM(Selection Classification Algorithm Model)。利用此模型根据需求做出选择,将基础分类算法进行选择、聚合和切割,并采用KNN算法解决了算法分类时的漏报问题。SCAM专家决策模型无需通过增大算法的检测半径来实现对未知样本的分类。另外,本文还提出了基于最大距离的初始算法器生成机制和针对数据噪声和算法重叠覆盖的处理机制,利用精简的算法模型覆盖大量的分类样本,并采用选择机制搜索最优算法模型。通过对已有的C4.5决策树算法、贝叶斯信念算法、模糊神经网络算法和二阶段复合分类算法进行对比,证明了SCAM专家决策模型的优越性。(3)从一个新的视角研究移动应用安全,提出针对海量样本的自动化规则分析,有利于建立恶意软件研判云,针对当前恶意软件爆炸式增长提供一定的压制手段。(4)提出一套针对移动应用安全评估的模型,并建立基于分布式架构的大规模未知样本自动分析平台,用于对移动应用进行安全评估。通过实验证实,经过一定移动应用样本训练后的模型,能够达到95.71%以上的恶意样本识别率,并且针对恶意混淆后的样本,识别效果较好。
[Abstract]:With the rapid popularization of global 3G/4G network and the continuous improvement of mobile intelligent device performance, the bandwidth bottleneck of mobile intelligent terminal has been broken through, and mobile malicious applications have emerged rapidly. According to a 2013 report by a security agency, 763,351 new malware and Trojan horses were added to the Android platform from January to December 2013, and more than 103 million new malicious programs were added to Symbian's Symbian platform, with more than 4.09 million infected. Malware continues to follow current technological developments and hide itself, and constantly steals user privacy information through a variety of means, illegally making profits, and even remotely controlling mobile smart devices to form a black industrial chain. Therefore, it is urgent to carry out research on security assessment for mass mobile applications. At present, the evaluation methods used in security assessment for mobile applications depend on the ability and experience of personnel. The main work is focused on vulnerability collection, malicious sample behavior extraction, simple malicious sample behavior association mining. However, it lacks the ability to suppress malicious attacks that increase exponentially in mobile smart devices. Based on the research of mobile Internet operating system, this paper starts with the multi-behavior attributes of malicious samples, through a variety of different data mining decision models: C4.5 decision tree, Bayesian belief network, neural network model, two-stage composite classification. After searching for the combination of minimum false alarm rate and false alarm rate for malicious samples, a multi-attribute expert decision model is proposed, and some achievements have been achieved. The main contributions of this paper are summarized as follows: (1) Research on mobile application data source, data format, The classification of application behavior attributes, the merging and extracting of application attribute models and algorithms, and the signature attributes of mobile applications with security attributes of mobile Internet applications, and the sensitive string attributes are used to determine the attributes, using this model to classify the categories of application behavior attributes, and to extract the application attribute model and algorithm. The sensitive function attribute is adapted to the model based on the nearest node algorithm of KNN. (2) A selection classification algorithm model SCAM (Selection Classification Algorithm Model). With high detection rate and low false alarm rate is proposed. The model is used to select, aggregate and cut the basic classification algorithm according to the requirement. The KNN algorithm is used to solve the problem of missing information. The expert decision model does not need to increase the detection radius of the algorithm to realize the classification of unknown samples. In addition, this paper also proposes an initial algorithmic generation mechanism based on the maximum distance and a processing mechanism for data noise and overlapping coverage of the algorithm. The simplified algorithm model is used to cover a large number of classification samples. And the selection mechanism is used to search the optimal algorithm model. By comparing the existing C4.5 decision tree algorithm, Bayesian belief algorithm, fuzzy neural network algorithm and two-stage composite classification algorithm, the superiority of SCAM expert decision model is proved. (3) the security of mobile application is studied from a new perspective. This paper proposes an automatic rule analysis for mass samples, which is conducive to the establishment of malicious software research cloud and provides a certain suppression method for the explosive growth of malware. (4) A security evaluation model for mobile applications is proposed. A large scale unknown sample analysis platform based on distributed architecture is established to evaluate the security of mobile applications. It is proved by experiments that the model trained by certain mobile application samples can achieve the recognition rate of more than 95.71% of the malicious samples, and the recognition effect is better for the samples after malicious confusion.
【学位授予单位】：北京工业大学
【学位级别】：博士
【学位授予年份】：2014
【分类号】：TN915.08

【相似文献】