Android malicious software detection method and system based on multi-modal graph characteristics

Abstract

The invention provides an android malicious software detection method and system based on multi-modal graph characteristics, and mainly solves the problems that in an existing graph-based detection technology, malicious program characteristics are not comprehensively mined, and mined characteristics are not fully utilized. The main scheme comprises static features, dynamic features and the like. The features are analyzed and converted into graph structure features, and comprehensive characterization of application program behaviors is achieved through multi-modal graph features; vectorizing the graph structure features of each dimension by using a graph embedding method; based on an attention mechanism, inputting the graph structure feature vectors of all dimensions into a graph neural network for training and learning; and the trained detection model is used for detecting and identifying the Android malicious software.

Description

technical field [0001] The invention belongs to the technical field of malicious code analysis, and provides an Android malware detection method and system based on multimodal graph features. Background technique [0002] With the continuous development of Internet technology and the continuous implementation of the smart city concept, the Android operating system has gradually become the most widely installed operating system in mobile terminal devices due to its advantages of open source and scalability. Therefore, the security of the Android system has become the key to the privacy and property security of the majority of users, and the Android software has also become the main target of hackers. [0003] At present, in the research of Android malware detection and classification methods, graph neural network shows great potential and has become a recent research hotspot, because in the representation of features, the graph structure can greatly represent and express beha...

AI Technical Summary

Problems solved by technology

This method has the following disadvantages: (1) Only a single API feature information is used, which is not very comprehensive in capturing malicious behavior information; (2) The use of API feature information is mainly based on APIs to build APPs. (3) The classification basis is mainly based on the similarity of the API calls used by the APP. If the sample has complex malicious behavior, it may classify itself or even the surrounding samples. Results make a difference

[0006] (1) Only static feature information is used, which is not very comprehensive in capturing malicious behavior information;

[0007] (2) In the use of feature information, the relationship between APPs is mainly based on behavioral features, but the information of the features themselves is not well mined;

Images