Abstract: As the type and amount of Android malware continues to grow, it becomes increasingly important to detect malware to protect system security and user privacy. A CBAM-CGRU-SVM model based on Convolutional Neural Networks (CNN) and Gated Recurrent Unit (GRU) is proposed to address the problem of low classification accuracy of traditional malware detection models. In this model, more key features of malware are first learned by adding a Convolutional Block Attention Module (CBAM) to the convolutional neural network, and then GRU units are vemployed to further extract features. In order to solve the problem of insufficient generalization ability of the model when performing image classification, the model finally uses Support Vector Machine (SVM) instead of softmax activation function as the classification function of the model. The experiments use the malimg public dataset, which images malware data as model input. The experimental results show that the classification accuracy of CBAM-CGRU-SVM model reaches 94.73%, which can effectively classify malware families.

Key words: Keywords: malware, Convolutional neural networks (CNN), CBAM, Gated circulation unit (GRU), Support vector machines (SVM)

摘要： 随着Android恶意软件的种类和数量不断增多，检测恶意软件以保护系统安全和用户隐私变得越来越重要。针对传统的恶意软件检测模型分类准确率较低的问题，提出了一种基于卷积神经网络(CNN)和门控循环单元(GRU)的CBAM-CGRU -SVM模型。该模型中，首先通过在卷积神经网络中添加卷积块注意力模块(CBAM)，来学习更多恶意软件的关键特征，然后采用GRU单元进一步提取特征。为了解决进行图像分类时模型泛化能力不足的问题，模型最后使用支持向量机(SVM)代替softmax激活函数作为模型的分类函数。实验使用了Malimg公开数据集，该数据集将恶意软件数据图像化作为模型输入。实验结果表明，CBAM-CGRU-SVM模型分类准确率达到94.73%，能够更有效地对恶意软件家族进行分类。

关键词: 关键词: 恶意软件, 卷积神经网络, CBAM, 门控循环单元, 支持向量机