With the rapid development of the Internet era, the number of malware has reached an unprecedented peak, and therefore malware is threatening global network security seriously. In this paper, we propose an Android malware detection approach based on SIMGRU, which belongs to the static detection approach. The similarity of clustering is widely used in static analysis of android malware, so we introduce the similarity to improve Gated Recurrent Unit (GRU), and obtain three different structures of SimGRU: InputSimGRU, HiddenSimGRU, and InputHiddenSimGRU. The InputHiddenSimGRU is the combination of InputSimGRU and HiddenSimGRU. The experiment shows that InputSimGRU, HiddenSimGRU, and InputHiddenSimGRU outperform the conventional GRU model and other methods.

In today's cyber world, worms pose a great threat to the global network infrastructure. In this paper, we propose a worm detection system based on deep learning. It includes two main modules: one worm detection module based on a convolutional neural network (CNN) and one automatic worm signature generation module based on a deep neural network (DNN). In the CNN-based worm detection module, we propose three kinds of data preprocessing methods: frequency processing, frequency weighted processing, and difference processing, and use CNN to train the model for worm detection. In the DNN-based worm signature generation module, there are two phrase:DNN is firstly utilized for training the model with worm payloads and their corresponding signatures as input in the training phrase. After worm payloads are fed into the trained DNN model in the test phrase, worm signatures are generated by our proposed Signature Beam Search algorithm. In the experiment, we firstly analyzed the impact of different data preprocessing methods and the number of convolution-pooling layers in the CNN model on the worm detection performance. Then we analyzed the effects of different signatures in the DNN algorithm on the automatic generation of worm signatures. Experiments show that the generated signatures have a good detection performance.