Research on Malware Software Detection Technology Based on SVM on Cloud Platform for Mobile Terminal

In recent years, the number of new malware samples has shown a trend of rapid growth. The increasing number of malware has resulted in a huge number of signature databases that the host needs to save, which is difficult to maintain. In view of the above situation, this article builds a distributed cloud platform based on Hadoop, and uses the related technology of the cloud platform to deal with the rapid growth of the number of malware. At the same time, the use of the distributed cloud platform greatly improves the detection efficiency. In order to solve the problem of low detection accuracy of unknown software, a malware detection method based on API call sequence is proposed. First use AndroGuard to extract all the function call graphs under the package of the main class in the APK file. Then, through the analysis of the function call graph, the API call sequence of all the entry nodes is obtained; further, the sequence is sorted according to the address information of the first node of each sequence. Splice the sorted sequences in order, and the resulting sequence is the time-series-based API call sequence. After dimensionality reduction through AutoEncoder, machine learning algorithm SVM is used for malware detection. Experimental results show that the accuracy of the SVM detection model based on the API call sequence is higher than that of the SVM detection model based on other features and other machine learning detection models based on the API call sequence, and can detect Android malware more effectively.