隨著4G日益普及以及預見5G的到來，行動應用已經逐漸深入社會各個角落，在此情況下，行動設備的軟硬體條件固然千差萬別，行動用戶也涵蓋從對資安一無所知到對資安謹慎的個人或企業。但傳統的行動應用惡意行為分析與防護系統卻仍對所有用戶一視同仁，很少重視個別用戶的差異，以致裝置上的安全防護機制往往干擾用戶的日常應用，降低一般手機用戶安裝防護軟體的意願而造成普及行動應用安全的一大障礙。為此，本計畫擬結合機器學習與雲端技術，加上特殊設計的情境察覺(Situation Awareness)機制來提供一個用戶友善且速度快、偵測率高的行動應用惡意行為分析系統（稱之為SAI-Droid）。SAI-Droid包含手機與伺服器端二大部分，手機端的特色是有一個可以蒐集從粗略到精細的多級特徵擷取模組以及用戶友善的分析結果呈現與反應模組。伺服器端則提供多樣化的機器學習分析模型來處理型態各異的惡意行為特徵。我們將設計一個智慧型情境察覺與學習演算法，透過此演算法，SAI-Droid會動態察覺手機軟硬體與應用程式執行狀態、用戶對過往警告訊息的回饋記錄以及當前外界網路的威脅程度等，然後綜合這些資訊來自動判斷該採用哪一等級的特徵擷取與哪一種惡意行為分析模型以及何種警訊顯示與反應模式。由於多樣化的機器學習模型也包括訓練耗時的深度學習，所以本計畫也擬開發分析模型管理模組以對深度學習運算作最佳的後台支援。 本計畫將分三年執行，第一年主要在蒐集建立惡意行為樣式資料庫、設計多級特徵擷取模組以及情境察覺模組；第二年繼續擴充情境察覺模組之智慧學習功能並開發特徵上傳模組以及多樣化機器學習分析模型；第三年繼續優化情境察覺之智慧學習功能，開發伺服器端的分析結果發佈模組以及手機端的分析結果呈現與反應模組，最後將系統整合測試並發表研究成果。 ;As more and more popular of 4G and the upcoming of 5G, mobile applications has been seen everywhere in today’s society. With this enormous kinds of mobile applications, not only the mobile device’s hardware and software configurations maybe different very much, but also the knowledge about information security is diverse for mobile users. But unfortunately, traditional solutions to protect these mobile users are ignorant to these differences. As a result, these protection systems often disturb the user’s normal mobile applications and thus discourage the mobile users to use these protection systems. To solve the problem mentioned above, this project plans to integrate the machine learning and cloud technologies, as well as a specialized designed situation awareness mechanism to provide a user friendly platform (named SAI-Droid) with high efficiency and detection rate to analyze mobile application’s malicious behaviors. The components of SAI-Droid reside on smart phone side and server side. In smartphone side, we design a multi-class feature collection module an alerts display and action module. In server side, we provide several kind of machine learning model to analyze various kinds of features. To maximize mobile user’s experience, we will design an intelligent situation awareness and intelligent learning algorithm for SAI-Droid to intelligently select the best arrangement of client and server’s modules. As machine learning also includes the time-consuming deep learning methods, we also plan to develop a model management module to support the computing of various deep learning models. This project will proceed in 3 years. In the first year, we will build the malicious pattern database and design the multi-class feature collection module. We also develop the situation awareness module in the first year. In the second year, we will design and develop the feature upload module and the machine learning models. In the last year, we will enhance the intelligent learning of situation awareness module, and the analysis results push module in the cloud side and the alerts and action module in the smartphone side. Finally, we do the system integration, perform various tests and publish the research results.
