隨著電腦運算速度的提升，許多研究透過深度學習方法來進行Android惡意程式檢測，但是除了惡意程式的二元檢測外，惡意程式家族分類更能夠使惡意程式研究人員了解其惡意家族的行為進而優化檢測方式及預防其變體。然而新出現的惡意程式家族數量少，容易導致分類效果不理想，而基於生成對抗網路的方法來進行擴增雖然可以提升分類效果，但是少量的資料還是會導致生成對抗網路方法所生成出的樣本品質不穩定，進而使分類效果提升有限。因此，本研究提出一種混合擴增方法，首先將提取惡意程式特徵並轉換成RGB圖像，再將樣本數過少的家族先經過高斯雜訊擴增方法（Gaussian Noise），再結合對於圖像擴增有更好效果的深度捲積生成對抗網路（Deep Convolutional Generative Adversarial Network，DCGAN）來擴增少數樣本的惡意程式家族，最後輸入至CNN（Convolutional Neural Network）進行家族分類。實驗結果顯示，使用本研究所提出的混合擴增方法，相較於未擴增以及只使用深度捲積生成對抗網路進行擴增，其F1-Score分別提升7~34%以及2%~7%。;With the improvement of computer computing speed, many researches use deep learning for Android malware detection. In addition to malware detection, malware family classification will help malware researchers understand the behavior of the malware families to optimize detection and prevent variants. However, the new malware family has few samples, which lead to poor classification results. Although the deep learning augmentation method (GAN-based) can improve the classification results, but minor data will still lead to the unstable quality of the data generated by the deep learning augmentation method, which will limit the improvement of classification results. In this study, we will propose a hybrid augmentation method, first extracting malware features and converting them into RGB images, and then the minor families will augment by the gaussian noise augmentation method, and then combined with the deep convolutional generative adversarial network (DCGAN) which have better effect on image augmentation, and finally input to CNN for family classification. The experimental results show that using the hybrid augmentation method proposed in this study, compared to no augmentation and augmentation with only using the deep convolutional generative adversarial network, the F1-Score increased between 7%~34% and 2%~7%.
