An Android Malware Detection Model Based on DT-SVM

Algorithm 1

The detailed procedure of DT-SVM.

 Step 1. According to the training set , the Gini index is used for feature selection and prepruning, and the decision tree is constructed.

 Step 2. Use the test set to evaluate the decision tree and calculate the of each decision path , then constitute the decision object , and set the decision path accuracy threshold .

 Step 3. Initialize the queue , sort the decision objects generated in step 2 in descending order according to the path depth of the decision path , and sequentially add them to the queue .

 Step 4. Determine if the queue is empty. If it is, the algorithm ends. Otherwise, go to step 5.

 Step 5. Fetch the element from the queue, and compare the decision path Precision rate with the preset threshold . If it is less than the threshold, go to step 6; otherwise, retain the decision path and go to step 4.

 Step 6. Determine whether the sibling node of is a leaf node. If it is, go to step 7; otherwise, go to step 8.

 Step 7. Determine whether the Precision of the path of q’s sibling nodes is lower than the threshold . If it is, all the samples passing through the two decision paths (both path of and q’s siblings) are taken as a training set, which is trained with the SVM model and then merged and updated as SVM nodes; thereafter, the process proceeds to step 4.

 Step 8. Take out all the training sets of the path of , train them with the SVM model, and update them to SVM nodes. Then, go to step 4 and continue to traverse so as to update nodes.