%0 Journal Article
%T 采用LSTM模型的Android应用行为一致性检测
%A 罗娜
%A 魏松杰
%A 时召伟
%A 吴高翔
%J 浙江大学学报(工学版)
%D 2018
%R 10.3785/j.issn.1008-973X.2018.06.008
%X 针对Android应用数目庞大、功能多样而难以准确验证应用实际类别的情况，对Andriod应用的网络行为进行分析研究，提出应用的行为一致性理论，并实现一种基于网络行为一致性验证的LSTM分类模型.通过构造不同场景事件组合来触发不同功能类别应用运行时的网络行为，提取有效的网络特征构建成网络事件行为时序序列，并设计带有特殊输入结构的LSTM循环神经网络模型，对网络事件行为时序序列中潜在的行为模式进行学习与建模.实验验证结果表明，Android应用样本具有行为一致性；所提出的LSTM网络模型能有效地学习与归纳不同类别应用的网络行为模式；最优模型的平均分类准确性可达92.58%，优于常见的面向Android应用的机器学习分类模型.</br>Abstract: The large quantity and numerous categories of Android APPs make it difficult to accurately validate the real category of APPs. Through analysis of the network behaviors of Android APPs, the idea of application behavior consistency theory was presented and a LSTM classification model based on network behaviors was proposed for consistency verification of APPs. The network behaviors of APPs in different functionality categories were thoroughly triggered by constructing various sequences of scenario events when APPs were running. Then, effective network features were extracted to construct a network event-behavior sequence. A LSTM recurrent neural network model with special input structure was designed to explore and model the underlying behavioral patterns in these network event-behavior sequences. The experimental results reflect that the existence of behavior consistency among the experimented APP samples; the proposed special LSTM model is effective in learning and summarizing the network event-behavior sequences of APPs in different functionality categories. The optimal model achieves an average classification accuracy of 92.58%, which is significantly higher than several widely used traditional machine learning classifiers.
%U http://www.zjujournals.com/eng/CN/10.3785/j.issn.1008-973X.2018.06.008