摘要： 移动端高级持续性威胁(APT)攻击是近年来出现的一种极其危险的攻击方式,通过窃取信息对设备造成高风险且可持续性的危害。而针对移动端入侵检测的方案由于检测特征不够完善,检测模型准确率不高且存在过拟合问题,导致检测效果不理想。针对上述问题提出一种优化的检测模型,利用静态检测技术提取出终端应用的静态特征,优化模型对恶意应用的敏感程度,引用滑动窗口迭代算法提取出延迟攻击特征,以优化模型对延迟攻击的检测能力,同时使用Boost技术将决策树、逻辑回归、贝叶斯等分类算法进行融合,通过实验证明该模型提升了APT检测准确率并规避了过拟合问题。

关键词: 机器学习, 高级持续性威胁检测, 分类器, 模型融合, 静态检测, 关联分析

Abstract: Advanced Persistent Threat(APT) whose main goal is to steal information becomes a dangerous attack in recent years,which can bring high risk and persistent attack to the mobile devices.The detection features of mobile terminal intrusion detection are not readily available,so the accuracy of detection model is not high enough and there is the over-fitting problem,which lead to poor detection effect.For these problems,this paper proposes an optimized detection model using static detection technology to extract terminal devices’ static features which helps optimize the sensitivity of the model to the malicious application.It uses sliding window iterative algorithm to extract the delaying attack feature so as to optimize the model’s detection capability of delaying attack and uses Boost technology to fuse the classification algorithms including the decision tree,logistic regression and Bayesian classifier.Experimental results show that the model can increase the detection accuracy of APT effectively and avoid over-fitting problem.

Key words: machine learning, Advanced Persistent Threat(APT) detection, classifier, model integration, static detection, correlation analysis

中图分类号: 

• TP309.2