中文摘要：

目前针对未知的Android恶意应用可以采用数据挖掘算法进行检测,但使用单一数据挖掘算法无法充分发挥Android应用的多类行为特征在恶意代码检测上所起的不同作用.文中首次提出了一种综合考虑Android多类行为特征的三层混合系综算法THEA（Triple Hybrid Ensemble Algorithm）用于检测Android未知恶意应用.首先,采用动静态结合的方法提取可以反映Android应用恶意行为的组件、函数调用以及系统调用类特征;然后,针对上述3类特征设计了三层混合系综算法THEA,该算法通过构建适合3类特征的最优分类器来综合评判Android应用的恶意行为;最后,基于THEA实现了Android应用恶意行为检测工具Androdect,并对现实中的1126个恶意应用和2000个非恶意应用进行检测.实验结果表明,Androdect能够利用Android应用的多类行为特征有效检测Android未知恶意应用.并且与其它相关工作对比,Androdect在检测准确率和执行效率上表现更优.

英文摘要：

At present,data mining algorithm is always used to detect unknown malicious applications of Android.While single data mining algorithm could not play the role of multi-class Android features in malware detection.For this problem,a Triple Hybrid Ensemble Algorithm （THEA） was first proposed,which considered multi-class Android features.First,we combined the static and dynamic methods to extract three classes of Android features,which could reflect malicious behavior effectively,such as components,function calls and system calls.Second,we designed THEA to build optimal classifier by handling three classes of features and then made a comprehensive judgment of unknown Android application.Finally,we implemented an automated tool named Androdect to detect 1126 malicious and 2000 non-malicious apps in real.The experimental results show that Androdect plays the role of multi-class Android features in unknown malware detection and it performs better than other related works on the availability,efficiency and accuracy.