CAJ | 학술논문

本文提出了一种分布式的移动设备异常检测系统，该系统采用客户端-服务器架构，客户端程序在移动设备上持续提取特征并传送给服务器，服务器使用异常检测算法分析特征。根据人类日常活动的规律性以及用户使用移动设备的周期性，我们还提出了一种基于用户行为周期的异常检测方法，通过比较待检测特征向量和以往周期相近时间段的特征向量集的距离即可判定该特征向量是否异常，向量比较时采用不受特征间关联以及特征取值范围影响的马氏距离作为距离衡量的标准。实验证明我们采用的移动设备异常检测系统框架和检测方法能够有效提高对移动设备恶意程序的检测率。
본문제출료일충분포식적이동설비이상검측계통，해계통채용객호단-복무기가구，객호단정서재이동설비상지속제취특정병전송급복무기，복무기사용이상검측산법분석특정。근거인류일상활동적규률성이급용호사용이동설비적주기성，아문환제출료일충기우용호행위주기적이상검측방법，통과비교대검측특정향량화이왕주기상근시간단적특정향량집적거리즉가판정해특정향량시부이상，향량비교시채용불수특정간관련이급특정취치범위영향적마씨거리작위거리형량적표준。실험증명아문채용적이동설비이상검측계통광가화검측방법능구유효제고대이동설비악의정서적검측솔。
In this paper, we present a distributed anomaly detection system for mobile devices. The proposed framework realizes a client-server architecture, the client continuously extracts various features of mobile device and transfers to the server, and the server’s major task is to detect anomaly using state-of-art detection algorithms. According to the regularity of human daily activity and the periodic of using mobile device, we also propose a novel user behavior cycle based statistical approach, in which the abnormal is determined by the distance from the undetermined feature vector to the similar time segments’ vectors of previous cycles. We use the Mahalanobis distance as distance metric since it is rarely affected by the correlate and value range of features. Evaluation results demonstrated that the proposed framework and novel anomaly detection algorithm could effectively improve the detection rate of malwares on mobile devices.