Abstract:

In order to solve the problem of single k nearest neighbor algorithm (KNN) and least squares support vector machine (LSSVM) and improve the identification correct rate of Android malicious behavior, the author proposed an identification model of Android malicious behavior based on KNNLSSVM. Firstly, Android behavior samples were collected and the corresponding feature vector was extracted. Then the training samples were input into LSSVM to learn and calculate the distance between sample and classification plane. If the distance was less than threshold, LSSVM was used to recognize the malicious behavior, otherwise KNN algorithm was used to recognize the malicious behavior. Finally, the performance of KNNLSSVM was tested by simulation experiment. The experimental results show that compared with the single KNN algorithm and LSSVM, KNNLSSVM has improved the identification correct rate of Android malicious behavior, and can satisfy the online identification requirements of Android malicious behavior.

Key words: malicious behavior, smart phone, least squares support vector machine, k nearest neighbor algorithm