Dynamic behavior analysis method for mobile intelligent terminal software based on support vector machine algorithm
暂无分享,去创建一个
The invention discloses a dynamic behavior analysis method for mobile intelligent terminal software based on a support vector machine (SVM) algorithm. The method comprises the steps: the first step, capturing application program interface (API) function called in the software running by the terminal execution software; the second step, analyzing the NativeAPI calling sequence related to five sensitive behaviors, wherein five sensitive behaviors are the privilege behavior, progress behavior, document behavior, network behavior and terminal memory operation behavior, and calculating the calling frequency of the NativeAPI function related to five sensitive behaviors; the third step, using the calling frequency as the dynamic behavior characteristic of the software, sending to the cloud end, modeling by using the SVM algorithm and training the classifier, and finally detecting the malignant software behavior by using the trained classifier. The method uses the dynamic detection technology and cannot be affected by the deformation and packing encryption technology, and the method is capable of analyzing and detecting the self-modifying program, making up the lack that the static behavior cannot detect the variety behavior, and effectively detecting the vicious software behavior.