Android malicious software detection system and method based on heterogeneous graph learning

Abstract

The invention provides an Android malicious software detection system and method based on heterogeneous graph learning. The method breaks through a traditional malicious software detection method based on a signature mechanism and static characteristics, and has the basic idea that a function call sequence and a connection structure in malicious software are different from a function call and connection structure of normal software. According to the invention, the internal function call relationship of each piece of to-be-detected Android software is constructed into a heterogeneous graph, then a high-order semantic relationship among different function calls is explored by introducing different meta-paths, the importance of different meta-paths to malicious software detection is measured by using a standard multi-kernel learning algorithm, and the learned weighting function calling interaction matrix is input into a support vector machine to train an automatic model to realize detection. According to the invention, the function call relationship in the malicious software can be effectively explored, the detection accuracy of the malicious software is greatly improved by learning the function call mode of the malicious software, and the efficient and real-time detection requirement can be met.

Description

technical field [0001] The invention relates to the field of network security, in particular to an Android malware detection system and method based on heterogeneous graph learning. Background technique [0002] Malware is software designed to harm a computer, server, or computer network. Malware can cause varying degrees of damage to a target computer after it is planted or somehow compromised. Malicious software is installed and run on the computer without explicitly prompting the user or without the user's permission, manifesting as malicious behaviors such as forced installation, browser hijacking, data theft, malicious collection of user sensitive information, and malicious bundling of software. In recent years, with the rapid development of mobile communications and smart terminals, malware targeting Android terminals emerges in an endless stream, and Android malware is even widely distributed in some well-known application markets. It has a serious impact on Android...

AI Technical Summary

Problems solved by technology

The static analysis method is to decompile the APK file through reverse engineering to extract relevant features without running the application, usually to analyze the intermediate form of code after decompilation of the dex file, such as api calls, etc., followed by the manifest file. Permissions, intent filters, but such methods cannot detect encrypted and dynamically loaded malicious programs

Dynamic analysis is to simulate running an application in a sandbox or virtual machine environment, monitor the runtime characteristics of the application during the process, and analyze and record logs to find malicious behaviors. This method has a better detection effect, but the detection requires The real running state of the program is simulated in the sandbox, and its detection rate cannot guarantee a stream-like fast response

Images