Multi-granularity Android malware fast detection based on opcode

Abstract

The detection method based on opcode is widely used in Android malware detection, but it still contains some problems such as complex feature extraction method and low efficiency. In order to solve these problems, a multi-granularity fast detection method based on opcode for Android malware was proposed. Multi-granularity refers to the feature based on the bag of words model, and with the function as basic unit to extract features. By step-by-level aggregation feature, the APK multi-level information is obtained. The log length characterizes the scale of the function. And feature can be compressed and mapped to improve the efficiency and construct the corresponding classification model based on the semantic similarity of the Dalvik instruction set. Tests show that the proposed method has obvious advantages in performance and efficiency.

Keywords

• opcode
• compression map
• multi-granularity
• rapid detection
• convolutional neural networks