This paper presents a novel Android malware classification model planned to classify and categorize Android malicious code at Drebin dataset. The amount of malicious mobile application targeting Android based smartphones has increased rapidly. In this paper, Restricted Boltzmann Machine and Deep Belief Network are used to classify malware into families of Android application. A texture-fingerprint based approach is proposed to extract or detect the feature of malware content. A malware has a unique "image texture" in feature spatial relations. The method uses information on texture image extracted from malicious or benign code, which are mapped to uncompressed gray-scale according to the texture image-based approach. By studying and extracting the implicit features of the API call from a large number of training samples, we get the original dynamic activity features sets. In order to improve the accuracy of classification algorithm on the features selection, on the basis of which, it combines the implicit features of the texture image and API call in malicious code, to train Restricted Boltzmann Machine and Back Propagation. In an evaluation with different malware and benign samples, the experimental results suggest that the usability of this method-using Deep Belief Network to classify Android malware by their texture images and API calls, it detects more than 94% of the malware with few false alarms. Which is higher than shallow machine learning algorithm clearly.

The increasing number of Android malware has made detection and analysis more difficult, aiming to the current malware attacking Android. This paper proposes an Android malware analysis and detection technology based on Attention-CNN-LSTM, which is a types of Multimodel Deep Learning. Selecting open source malware datasets of Drebin for research, extracting texture fingerprint information of Android malware to reflect the similarity of malware binary file blocks, at the same time, in order to improve the detection accuracy, AndroidMainfest.xml is treated as a text document, and its contextual text features are extracted through NLP. Besides, the above two types of features are merged to enhance the expression capability of texture fingerprint information , and Deep Belief Network is used to screen the above features. Above all, the texture fingerprint is processed by one-dimensional serial signal processing, and the end-to-end local correlation features are extracted according to a one-dimensional time-do main convolutional network. At the same time, considering the context relationship of the timing signal for the AndroidMainfest.xml text, combined with the LSTM model with stronger time-series modeling capabilities to analyze and detect the Android malicious code. The experimental results show that the proposed method can detect and analyze malware more effectively.