Mobile application malicious behavior pattern detection method based on API call graph extraction and recording medium and device for performing the same

A non-transitory computer-readable storage medium having recorded thereon a computer program for performing a mobile application malicious behavior pattern detection method based on Application Programming Interface (API) call graph extraction, wherein the method comprises:

• extracting an API Call Graph (ACG) representing a call flow of an API from benign applications and applications performing malicious behavior;
• generating and vectorizing a training dataset for deep learning using the extracted ACG;
• generating a deep learning algorithm prediction model by training with the vectorized training dataset;
• extracting ACG features used in the malicious behavior from the generated prediction model and extracting a malicious behavior pattern from an intersection of the malicious applications;
• and
• classifying a target application performing malicious behavior through a similarity comparison between the extracted malicious behavior pattern and a pattern extracted from the target application,
• wherein the extracting the malicious behavior pattern comprises:
• extracting the ACG features used in the malicious behavior using a deep learning visualization technique from the prediction model;
• and
• grouping malicious applications having similar ACGs among the extracted ACG features and calculating the intersection of the malicious applications to extract the malicious behavior pattern.

A mobile application malicious behavior pattern detection device based on Application Programming Interface (API) call graph extraction, the device comprising:

• an API call graph extractor extracting an API Call Graph (ACG) representing a call flow of an API from benign applications and applications performing malicious behavior;
• a training dataset vectorizer generating and vectorizing a training dataset for deep learning using the extracted ACG;
• a machine learner generating a deep learning algorithm prediction model by training with the vectorized training dataset;
• a pattern extractor extracting ACG features used in the malicious behavior from the generated prediction model and extract a malicious behavior pattern from an intersection of the malicious applications;
• and
• a risk application classifier classifying a target application performing malicious behavior through a similarity comparison between the extracted malicious behavior pattern and a pattern extracted from the target application,
• wherein the pattern extractor comprises:
• an API call graph feature extractor extracting the ACG features used in the malicious behavior using a deep learning visualization technique from the prediction model;
• and
• a malicious behavior pattern extractor grouping malicious applications having similar ACGs among the extracted ACG features and calculating the intersection of the malicious applications to extract the malicious behavior pattern.