Android malware detection method and system based on multi-modal feature linear weighted fusion

Abstract

The application provides an Android malicious program detection method and system based on multi-modal feature linear weighted fusion, and belongs to the technical field of malicious program analysis. Dalvik byte stream data of an Android application is visualized as a "vector" color image; a dynamic permission information table is constructed to perform one-hot encoding processing on permission information of the Android application; feature information represented by the two modalities is processed and analyzed respectively, a lightweight convolutional neural network model is constructed to extract and learn features of image data, and a lightweight feedforward neural network model is constructed to extract and learn features of text data; linear weighting is used to fuse features of the two different modalities of data extracted and learned, the fused feature vector is input into a classifier for classification, and a classification result is obtained, so that the accuracy and efficiency of Android malicious application detection are improved.

Description

Technical Field

[0001] This invention belongs to the field of malicious program analysis technology, and provides an Android malicious program detection method and system based on linear weighted fusion of multimodal features. Background Technology

[0002] Existing Android malware detection methods are mainly divided into traditional methods and artificial intelligence-based methods. Traditional methods are further divided into static analysis and dynamic analysis. Static analysis identifies potential malicious behavior by examining the application's code, permissions, and resource files, without needing to run the application. Dynamic analysis, on the other hand, runs the application in a sandbox environment and monitors its runtime behavior, including system calls, network communications, and file operations, to determine whether it is malware. In recent years, with the development of artificial intelligence technology, malware detection methods based on AI technologies (such as machine learning and deep learning) have gradually emerged. These methods utilize the application's static features (such as permissions, API call frequency, and code structure) and dynamic features (such as runtime behavior and system call sequences) to construct feature vectors, and then train detection models to identify the characteristics of malware, thus achieving malware detection and classification. Applying AI technology to detect Android malware has become the mainstream research in the field of malware analysis; however, how to further improve the accuracy of detection using this technology remains one of the current research hotspots in this field.

[0003] Current methods for detecting Android malware based on artificial intelligence include using static information of the program as features or abstracting the program's byte stream file into grayscale images and matrix images for study. However, these methods have the following drawbacks:

[0004] (1) Most studies only use single modal information as features, which is not comprehensive in representing the information of the application, resulting in less than ideal detection results and poor adaptability, making it difficult to cope with various changes and complex environments.

[0005] (2) Using grayscale images to represent byte stream files, grayscale images can only represent single-channel information and cannot represent richer information and higher analysis accuracy.

[0006] (3) Using matrix images to represent byte streams can easily disrupt the continuity of the byte stream sequence and make the model ignore some feature information; and matrix images usually need to be padded with data to meet their format, which makes the byte stream features represented by matrix images prone to additional noise that affects the model's detection results.

[0007] Due to these shortcomings, the field of Android malware detection still suffers from problems such as low detection accuracy, low efficiency, and insufficient stability. Summary of the Invention

[0008] To address the aforementioned problems, this invention aims to propose an Android malware detection method and system based on linear weighted fusion of multimodal features. It applies heterogeneous multimodal data feature fusion technology to the field of Android malware analysis, enabling the representation of Android application feature information using both image and text modal data. This overcomes the limitations of single-modal data. Simultaneously, a relatively lightweight model is constructed to extract and learn features from different modalities. By leveraging the complementarity between the two modalities, the accuracy and robustness of malware detection are improved.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] A method for detecting Android malware using linear weighted fusion of multimodal features, comprising the following steps:

[0011] Step 1: Use static analysis tools to perform static analysis on the Android application, obtain the static characteristics of the application, obtain the permission information used by it, and extract the Dalvik bytecode data in the Android application.

[0012] Step 2: Encode the program permission information obtained in Step 1 by constructing a dynamic permission table to obtain the Android application permission features represented by text modal data; at the same time, process the Dalvik byte stream data obtained in Step 1 and visualize the byte stream data as a "vector" color image to obtain the Android application features represented by image modal data.

[0013] Step 3: Using the permission feature data of the text modality and the bytecode image feature data of the image modality obtained in Step 2, construct a lightweight feedforward neural network model and a lightweight convolutional neural network model respectively to train and learn them, so as to realize feature extraction of different modal data;

[0014] Step 4: For the feature vectors of different modalities extracted in Step 3, use the linear weighted fusion method to fuse the multimodal features to obtain the fused feature vector, and use it as the input of the final Android malware classifier;

[0015] Step 5: Use the trained classification model to build an Android malware detection system, detect and classify the Android applications to be tested, and obtain the detection and classification results.

[0016] In the above technical solution, the specific method for processing different feature data in step 2 is as follows:

[0017] For the permission features of the text modality obtained in step 1, firstly, by statistically analyzing the permission information of all programs in the dataset including benign and malicious Android applications, the number of times each permission information has been used can be obtained. The permissions are sorted from largest to smallest by the number of times they have been used, and the permissions with a number of times they have been used greater than or equal to a set threshold are extracted to construct a dynamic permission table. This dynamic permission table is used as the basis for the final permission feature encoding. Then, one-hot encoding is used to encode the permission information. That is, if the corresponding permission in the dynamic permission table is used in the program, it is encoded as 1, and otherwise it is encoded as 0. Finally, the feature vector after encoding is obtained.

[0018] For all the Dalvik bytecode data in the obtained APK, all the Dalvik bytecode data are concatenated into a vector byte stream vector. By treating each byte as an 8-bit grayscale pixel value, the grayscale pixel value is normalized (that is, the grayscale value is linearly mapped from [0,255] to the range [0,1]). The normalized grayscale value is then converted into a color value through the Viridis color mapping. Finally, the converted color value is converted back to the range [0,255] to obtain a "vector" color image with a width of 1 and a height equal to the length of the byte stream vector.

[0019] In the above technical solution, the specific method for feature extraction of text modal data in step 3 is as follows:

[0020] The feature vector obtained by encoding the permission features in step 2 is converted into tensor data and a lightweight feedforward neural network model is constructed for feature extraction. An 8-layer network structure is used to construct the feedforward neural network model, which has 1 input layer, 1 output layer, and 6 hidden layers. Each hidden layer from the input layer to the output layer contains 50, 32, 32, 16, 16, and 8 neurons respectively, and the output layer contains 2 neurons. At the same time, PreLU is used as the activation function after each hidden layer. Thus, the feature vector with a dimension of 2 is obtained after using this network structure to extract features from the text permission feature data.

[0021] In the above technical solution, the specific method for feature extraction of image modal data in step 3 is as follows:

[0022] For the "vector" color image visualized in step 2, given the different code lengths of each application, the height of the visualized image also varies. Therefore, it is necessary to normalize the image height to a uniform size to facilitate feature extraction from the convolutional neural network model. First, load the visualized "vector" color image data and normalize its height to a uniform size. Simultaneously, convert the adjusted image into tensor data for use as model input. Then, construct a convolutional neural network model containing 3 convolutional layers, 3 pooling layers, and 2 fully connected layers. Each convolutional layer uses a 1*12 kernel size and a stride of 1. Each pooling layer uses a 1*12 kernel size max pooling layer. PreLU is used as the activation function after each convolutional layer. The input channels of the first 1*12 convolutional layer are... The "vector" image has 32 output channels across its three color channels. The second 1D convolutional layer has 64 output channels, and the third 1D convolutional layer has 128 output channels. The features extracted by the third pooling layer are flattened to obtain 1024 neurons, which are then passed to a fully connected layer with 128 neurons. After calculation, the neurons are passed to a fully connected layer with 2 neurons, using sigmoid as the activation function. Finally, this convolutional neural network model is used to extract features from the image modal feature data to obtain a 2-dimensional feature vector.

[0023] In the above technical solution, the specific method of step 4 is as follows:

[0024] For the feature vectors obtained from feature extraction of text modality permission feature data and image modality feature data in step 3, both feature vectors have a length of 2. A linear weighted fusion method is used to fuse the feature vectors of the two modalities. First, different weights are assigned to the feature vectors of different modalities. The text modality feature vector is then assigned a weight. text Weights are assigned to the feature vectors of image modalities. image Then, the feature vectors of different modalities are multiplied by the corresponding weights assigned to each modality to obtain the final feature vectors of different modalities. Finally, the final feature vectors of different modalities are added together to obtain the fused feature vector. After obtaining the fused feature vectors of different modalities, an Android malware classifier is used to classify them to obtain the classification results of the Android application.

[0025] An Android malware detection system based on linear weighted fusion of multimodal features includes:

[0026] APK file analysis module: used to perform format detection and static analysis on Android APK files, extracting static features and files;

[0027] APK Data Extraction and Preprocessing Module: This module processes the static permission features and files extracted by the APK file analysis module, constructs a dynamic permission table, encodes the static permission features to obtain text modal features, and then constructs the Dalvik bytecode into a byte stream vector and visualizes it as a "vector" color image to obtain image modal features.

[0028] Multimodal feature extraction module: used to build a lightweight convolutional neural network model to extract and learn features from "vector" color images, and to build a lightweight feedforward neural network model to extract and learn permissions features;

[0029] Multimodal feature fusion and classification module: This module is used to fuse feature vectors extracted from different modalities. It performs linear fusion by assigning different weights to the feature vectors of different modalities, and then performs classification processing on the linearly fused features to obtain the classification result of the APK file.

[0030] A computer-readable storage medium stores an Android malware detection program based on the linear weighted fusion of multimodal features. When executed by a computer, the program implements the steps of the Android malware detection method or system based on the linear weighted fusion of multimodal features as described in any of the above-described solutions.

[0031] Compared with existing technologies, this invention provides an Android malware detection method and system based on multimodal feature linear weighted fusion, which has the following beneficial effects and advantages:

[0032] 1. This invention proposes a malware characterization method based on heterogeneous multimodal data features, characterizing different features of malware from both image and text modal perspectives. Multimodal data, through mutual support and fusion among different modalities, allows for a deeper understanding and analysis of Android malware. Furthermore, the multi-faceted descriptions provided by multimodal data enable data integration and complementarity, improving the accuracy and richness of the information contained within the malware.

[0033] 2. This invention converts DEX bytecode files into "vector" color images. "Vector" images do not destroy the bytecode sequence in the DEX file, and generating "vector" images does not require additional image padding to produce unnecessary noise. At the same time, color images, due to their rich color information and higher information content, can provide more effective feature information, thus improving the detection accuracy compared to existing methods.

[0034] 3. This invention constructs different lightweight neural network models for different modal data to extract and learn features, thereby generating different feature representations for different modal data. A linear weighted fusion technique is then used to fuse these feature representations, and classification is performed based on the fused feature representations to obtain the classification results. Compared with existing methods, this invention demonstrates superior performance in training and detection efficiency by constructing lightweight network models.

[0035] Instruction manual illustrations

[0036] Figure 1 This is a schematic diagram of the process provided by the present invention;

[0037] Figure 2 This is a schematic diagram of the overall workflow of the present invention;

[0038] Figure 3 This is a schematic diagram of the structure of the feedforward neural network model provided by the present invention;

[0039] Figure 4 This is a schematic diagram of the structure of the convolutional neural network model provided by the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, examples are provided below.

[0041] This embodiment provides an Android malware detection method based on linear weighted fusion of multimodal features, such as... Figure 1 As shown, it includes the following steps:

[0042] Step 1: Use static analysis tools to perform static analysis on the Android application, obtain the static characteristics of the application, obtain the permission information used by it, and extract the Dalvik bytecode data in the Android application.

[0043] Step 2: Encode the program permission information obtained in Step 1 by constructing a dynamic permission table to obtain the Android application permission features represented by text modal data; at the same time, process the Dalvik byte stream data obtained in Step 1 and visualize the byte stream data as a "vector" color image to obtain the Android application features represented by image modal data.

[0044] The specific method for processing different feature data in step 2 is as follows:

[0045] For the permission features of the obtained text modality, firstly, by statistically analyzing the permission information of all programs in the dataset including benign and malicious Android applications, the usage count of each used permission can be obtained. The permissions are sorted from largest to smallest usage count, and the permissions with usage counts greater than or equal to a set threshold are extracted to construct a dynamic permission table. This dynamic permission table is used as the basis for the final permission feature encoding. Then, one-hot encoding is used to encode the permission information, that is, if the corresponding permission in the dynamic permission table is used in the program, it is encoded as 1, and otherwise encoded as 0. Finally, the encoded feature vector is obtained.

[0046] For the obtained Dalvik bytecode data, firstly, all data is concatenated into a vector byte stream vector. Then, each byte is treated as an 8-bit grayscale pixel value, and the grayscale pixel value is normalized (that is, the grayscale value is linearly mapped from [0,255] to the range [0,1]). The normalized grayscale value is then converted into a color value through the Viridis color mapping. Finally, the converted color value is converted back to the range [0,255] to obtain a "vector" color image with a width of 1 and a height equal to the length of the byte stream vector.

[0047] Step 3: Using the permission feature data of the text modality and the bytecode image feature data of the image modality obtained in Step 2, construct a lightweight feedforward neural network model and a lightweight convolutional neural network model respectively, and train and learn them to achieve feature extraction from different modalities; as shown below. Figure 3 and Figure 4 .

[0048] The specific method for feature extraction of text modal data in step 3 is as follows:

[0049] The feature vector obtained by encoding the permission features in step 2 is converted into tensor data and a lightweight feedforward neural network model is constructed for feature extraction. An 8-layer network structure is used to construct the feedforward neural network model, which has 1 input layer, 1 output layer, and 6 hidden layers. Each hidden layer from the input layer to the output layer contains 50, 32, 32, 16, 16, and 8 neurons respectively, and the output layer contains 2 neurons. At the same time, PreLU is used as the activation function after each hidden layer. Thus, the feature vector with a dimension of 2 is obtained after using this network structure to extract features from the text permission feature data.

[0050] The specific method for feature extraction from image modal data is as follows:

[0051] For the "vector" color image visualized in step 2, given the different code lengths of each application, the height of the visualized image also varies. Therefore, it is necessary to normalize the image height to a uniform size to facilitate feature extraction from the convolutional neural network model. First, load the visualized "vector" color image data and normalize its height to a uniform size. Simultaneously, convert the adjusted image into tensor data for use as model input. Then, construct a convolutional neural network model containing 3 convolutional layers, 3 pooling layers, and 2 fully connected layers. Each convolutional layer uses a 1*12 kernel size and a stride of 1. Each pooling layer uses a 1*12 kernel size max pooling layer. PreLU is used as the activation function after each convolutional layer. The input channels of the first 1*12 convolutional layer are... The "vector" image has 32 output channels across its three color channels. The second 1D convolutional layer has 64 output channels, and the third 1D convolutional layer has 128 output channels. The features extracted by the third pooling layer are flattened to obtain 1024 neurons, which are then passed to a fully connected layer with 128 neurons. After calculation, the neurons are passed to a fully connected layer with 2 neurons, using sigmoid as the activation function. Finally, this convolutional neural network model is used to extract features from the image modal feature data to obtain a 2-dimensional feature vector.

[0052] Step 4: For the feature vectors of different modalities extracted in Step 3, use the linear weighted fusion method to fuse the multimodal features to obtain the fused feature vector, and use it as the input of the final Android malware classifier;

[0053] Step 4 extracts feature vectors from both the text modality and image modality feature data. Since both feature vectors have a dimension of 2, a linear weighted fusion method is used to fuse them. First, different weights are assigned to the feature vectors of different modalities. The text modality feature vector is then assigned a weight. text Weights are assigned to the feature vectors of image modalities. image Then, the feature vectors of different modalities are multiplied by the corresponding weights assigned to each modality to obtain the final feature vectors of different modalities. Finally, the final feature vectors of different modalities are added together to obtain the fused feature vector. After obtaining the fused feature vectors of different modalities, an Android malware classifier is used to classify them to obtain the classification results of the Android application.

[0054] Step 5: Use the trained classification model to build an Android malware detection system, detect and classify the Android applications to be tested, and obtain the detection and classification results.

[0055] This embodiment provides an Android malware detection system based on linear weighted fusion of multimodal features, such as... Figure 2 As shown, it includes the following modules:

[0056] APK file analysis module: used to perform format detection and static analysis on Android APK files, extracting static features and files;

[0057] APK Data Extraction and Preprocessing Module: This module processes the static permission features and files extracted by the APK file analysis module, constructs a dynamic permission table, encodes the static permission features to obtain text modal features, and then constructs the Dalvik bytecode into a byte stream vector and visualizes it as a "vector" color image to obtain image modal features.

[0058] Multimodal feature extraction module: used to build a lightweight convolutional neural network model to extract and learn features from "vector" color images, and to build a lightweight feedforward neural network model to extract and learn permissions features;

[0059] Multimodal feature fusion and classification module: used to fuse feature vectors extracted from different modalities. It performs linear fusion by assigning different weights to the feature vectors of different modalities, and then performs classification processing on the linearly fused features to obtain the classification result of the APK file;

[0060] In this embodiment, the APK data extraction and preprocessing module is specifically implemented as follows:

[0061] First, determine if the given file is a valid APK file. If it is, unpack the file and extract the necessary data. Then, for the permission features of the obtained text modality, first, by statistically analyzing the permission information of all programs in the dataset, including both benign and malicious Android applications, the usage count of each used permission can be obtained. The permissions are sorted from largest to smallest usage count, and the permissions with usage counts greater than or equal to a set threshold are extracted to construct a permission table. This permission table is used as the final permission feature. Then, one-hot encoding is used to encode the permission information. That is, if the corresponding permission in the permission table is used in the program, it is encoded as 1, and otherwise as 0. Finally, the encoded feature vector is obtained.

[0062] For all Dalvik bytecode in the obtained APK, all Dalvik bytecode is concatenated into a vector byte stream vector, and the pixel values ​​are normalized. The grayscale values ​​are linearly mapped from [0,255] to the range [0,1]. The normalized grayscale values ​​are then converted to color values ​​through Viridis color mapping. Finally, the converted color values ​​are converted back to the range [0,255] to obtain a "vector" color image with a width of 1 and a height equal to the length of the byte stream vector.

[0063] In this embodiment, the multimodal feature extraction module is specifically implemented as follows:

[0064] The permission features are encoded to obtain feature vectors, which are then converted into tensor data and used to construct a feedforward neural network model for feature extraction. An 8-layer network structure is used, consisting of one input layer, one output layer, and six hidden layers. Each hidden layer between the input and output layers contains 50, 32, 32, 16, 16, and 8 neurons respectively, while the output layer contains 2 neurons. PreLU is used as the activation function after each hidden layer. This network structure is then used to extract features from the text permission feature data, resulting in a 2-dimensional feature vector.

[0065] The height of the visualized "vector" color image is normalized, and the normalized image is then converted into tensor data for use as model input. A convolutional neural network model is then constructed using three convolutional layers, three pooling layers, and two fully connected layers. Each convolutional layer uses a 1*12 kernel and a stride of 1, and each pooling layer uses a 1*12 max pooling kernel. PreLU is used as the activation function after each convolutional layer. The input channel of the first 1*12 convolutional layer is the "vector". "The color image has 32 output channels. The second 1D convolutional layer has 64 output channels, and the third 1D convolutional layer has 128 output channels. The features extracted by the third pooling layer are flattened to obtain 1024 neurons, which are then passed to a fully connected layer with 128 neurons. After calculation, the neurons are passed to a fully connected layer with 2 neurons, and sigmoid is used as the activation function of the fully connected layer. Finally, this convolutional neural network model is used to extract features from the image modal feature data to obtain a 2-dimensional feature vector."

[0066] In this embodiment, the multimodal feature fusion and classification module is specifically implemented as follows:

[0067] Feature vectors obtained by feature extraction from text modality permission feature data and feature vectors obtained by feature extraction from "vector" color image modality feature data are assigned different weights to the feature vectors of different modalities, and a weight is assigned to the feature vectors of the text modality. text Weights are assigned to the feature vectors of image modalities. image Then, the feature vectors of different modalities are multiplied by the corresponding weights assigned to those modalities to obtain the final feature vectors of each modality. Finally, the final feature vectors of different modalities are added together to obtain the fused feature vector. After obtaining the fused feature vectors of different modalities, an APK file classifier is used to classify them to obtain the classification results of the APK files.

[0068] The specific implementation process of the system described in this embodiment includes the following steps:

[0069] Step 1: Construct the dataset by collecting 8239 Android application samples from the Drebin dataset and the CICMalDroid dataset, including 4011 benign Android application samples and 4228 malicious Android application samples. These samples are divided into training set, test set and validation set in a ratio of 7:2:1, while ensuring that the ratio of benign to malicious samples in each set is consistent with the ratio of benign to malicious samples in the overall sample set.

[0070] Step 2: Process all samples in the dataset, including the following steps:

[0071] Step 2.1: Perform static analysis on the APK file, using the static analysis tool Androguard to obtain the permission information and DEX bytecode file of the APK file;

[0072] Step 2.2: Process the permission information obtained in Step 2.1, count and sort the permission information of the overall sample dataset, set the threshold to 50 and extract the permissions that have been used more than or equal to the set threshold of 50 times to build a dynamic permission table, sort the extracted permission data from high to low according to the number of times they have been used, and obtain a dynamic permission table with a length of 112.

[0073] Step 2.3: Process the DEX bytecode files obtained in Step 2.1, concatenating all DEX files into a vector byte stream vector. Visualize this vector byte stream vector as a "vector" color image. First, obtain the byte data of all DEX files and concatenate these data into a byte stream vector one by one. Second, create a single-channel grayscale image with a width of 1 and a height equal to the length of the byte stream vector using the `Image.frombytes` function from the PIL library in Python. This means that the grayscale value of each pixel directly corresponds to the value of one byte in the byte stream vector. Then, convert the grayscale values ​​of the created grayscale image into a NumPy array and normalize them using the `Normalize` function, normalizing the pixel value range from [0,255] to [0,1]. Next, use the `get_cmap` function from the Matplotlib library to obtain the viridis color map, which maps the normalized grayscale values ​​to color values ​​in the range [0,1]. Finally, the obtained color values ​​in the range [0,1] are multiplied by 255 to restore them to the range [0,255] and a three-channel "vector" color image containing color information and ignoring the alpha channel is generated.

[0074] Step 3: Extract features from the permission feature data of the text modality representation, including the following steps:

[0075] Step 3.1: Use the dynamic permission table constructed in Step 2.2 to perform one-hot encoding on the permission information of the Android APK file. That is, if the corresponding permission in the dynamic permission table is used in the program, it is encoded as 1, otherwise it is encoded as 0. Convert the encoded data into a feature tensor with a dimension of 1 and a length equal to the length of the dynamic permission table.

[0076] Step 3.2: Use the feature vector obtained in Step 3.1 as the input to the feedforward neural network model, and use the model to extract and learn the features of the text modality;

[0077] Step 4: Extract features from the bytecode data of the image modality representation, including the following steps:

[0078] Step 4.1: For the "vector" color image obtained from the visualization in Step 2.3, use the transforms.Resize function of the torchvision library in Python to normalize it into an image with a fixed height of 128*128 and a width of 1, and convert the adjusted image into a feature tensor with dimensions (3,128*128,1).

[0079] Step 4.2: After removing the last dimension from the image feature tensor obtained in Step 4.1, use it as the input to the convolutional neural network model and use the model to extract and learn image features.

[0080] Step 5: Use the text features obtained in Step 3 and the image features obtained in Step 4 as multimodal data features for fusion. Assign a weight of 2 to the image modality features and a weight of 1 to the text modality features. Multiply them with the feature vectors extracted from their respective modalities and then add them together to obtain the fused multimodal feature vector.

[0081] Step 6: Input the multimodal feature vector obtained in Step 5 into the classifier and output the classification result of the APK file, that is, detect whether the Android application is a benign application or a malicious application.

[0082] Based on the above embodiments, the present invention also provides a computer-readable storage medium, wherein the storage medium includes a physical device capable of being read and written to by a computer system, such as a hard disk, a solid-state drive, an optical disk, a USB flash drive, etc., and the storage medium stores an Android malware detection program with multimodal feature linear weighted fusion, which, when executed by a computer, implements the steps of the Android malware detection method or system with multimodal feature linear weighted fusion as described in any of the above embodiments.

Claims

1. A method for Android malware detection based on multi-modal feature linear weighted fusion, characterized in that, The method comprises the following steps: Step 1: static analysis is performed on the Android application by using a static analysis tool, static features of the application are obtained, permission information used by the application is obtained, and Dalvik bytecode data in the Android application is extracted; Step 2: the program permission information obtained in step 1 is coded by constructing a dynamic permission table, and the Android application permission features represented by text modal data are obtained; meanwhile, the Dalvik bytecode stream data obtained in step 1 is processed, and the bytecode stream data is visualized as a "vector” color image, and the Android application features represented by image modal data are obtained; The specific method for visualizing the bytecode data is as follows: the Dalvik bytecode is extracted and spliced into a byte stream vector, each byte is regarded as an 8-bit pixel value, the gray value is linearly mapped from [0, 255] to [0, 1], and the normalized gray value is converted into a color value through viridis color mapping, and finally the converted color value is converted back to the range of [0, 255] to obtain a "vector” color image with a width of 1 and a height of the length of the byte stream vector; Step 3: the text modal permission feature data and the image modal bytecode image feature data obtained in step 2 are used to construct a lightweight feedforward neural network model and a lightweight convolutional neural network model respectively, and the models are trained and learned to realize feature extraction of different modal data; The specific method for feature extraction of the text modal data is as follows: the feature vector obtained by encoding the permission features in step 2 is converted into tensor data, a lightweight feedforward neural network model is constructed, and feature extraction is performed on the tensor data; the feedforward neural network model is constructed by using an 8-layer network structure, wherein the input layer is 1 layer, the output layer is 1 layer, and the hidden layer is 6 layers; each hidden layer between the input layer and the output layer comprises 50, 32, 32, 16, 16 and 8 neurons respectively, and the output layer comprises 2 neurons; meanwhile, prelu is used as an activation function after each hidden layer, and thus the text permission feature data is extracted by using the network structure to obtain a feature vector with a dimension of 2; The specific method for feature extraction of image modal data is: for the "vector" color image obtained by visualizing the bytecode data in step 2, first, the image needs to be normalized to a uniform size to facilitate the construction of a convolutional neural network model for feature extraction, and the adjusted image is converted into tensor data to facilitate input as a model; a convolutional neural network model is constructed using 3 convolutional layers, 3 pooling layers, and two fully connected layers, each convolutional layer uses a one-dimensional convolutional layer with a convolution kernel size of 1*12 and a stride of 1, each pooling layer uses a maximum pooling layer with a convolution kernel size of 1*12, prelu is used as the activation function after each convolutional layer, the input channel of the first one-dimensional convolutional layer is 3 channels of the color image, and the output channel is 32, the output channel of the second one-dimensional convolutional layer is 64, and the output channel of the third one-dimensional convolutional layer is 128. The features extracted by the third pooling layer are flattened to obtain 1024 neurons, which are transmitted to a fully connected layer containing 128 neurons, and after calculation, they are transmitted to a fully connected layer containing 2 neurons again, sigmoid is used as the activation function of the fully connected layer, and the convolutional neural network model is used to extract the image modal feature data to obtain a feature vector with a dimension of 2; Step 4: For the feature vectors extracted in step 3, use linear weighted fusion method to fuse the multi-modal features to obtain the fused feature vector, which is used as the input of the final Android malware classifier; The specific method for multi-modal feature fusion is: for the feature vectors obtained by performing feature extraction on the text modal permission feature data in step 3 and the feature vectors obtained by performing feature extraction on the image modal feature data, the lengths of the feature vectors extracted from the two modalities are both 2, a linear weighted fusion method is used to perform feature fusion on the feature vectors of the two modalities, different weights are first assigned to the feature vectors of different modalities, the feature vector of the text modality is assigned a weight , the feature vector of the image modality is assigned a weight ; then the feature vectors of different modalities are multiplied by the weights assigned to the corresponding modalities to obtain the final feature vectors of different modalities; finally, the final feature vectors of different modalities are added to obtain a fused feature vector; after obtaining the fused feature vectors of different modalities, an Android malicious program classifier is used to classify the fused feature vectors, and a classification result of the Android application is obtained; Step 5: Use the trained classification model to build an Android malware detection system to detect and classify the test Android application, and obtain the detection and classification results.

2. The multi-modal feature linearly weighted fusion based Android malware detection method according to claim 1, characterized in that, The specific method for encoding the permission information in step 2 is: for the obtained text modal permission features, first, count all the permission information of benign and malicious programs in the Android application dataset to obtain the usage frequency of each used permission information, sort the usage frequency from large to small, and take out the permission information whose usage frequency is greater than or equal to the set threshold to construct a dynamic permission table, which is used as the final permission feature; Then use one-hot encoding to encode the permission information, that is, if the corresponding permission in the dynamic permission table is used in the program, it is encoded as 1, otherwise it is encoded as 0, and finally the feature vector after encoding is obtained.

3. The Android malware detection system of claim 1, wherein the multi-modal feature linear weighted fusion is characterized by, The system for implementing the multi-modal feature linear weighted fusion Android malware detection method of claim 1 or 2; the system comprises: APK file analysis module: used for format detection and static analysis of Android APK file, extracting static features and files; APK data extraction and preprocessing module: used for processing the static permission features and files extracted by the APK file analysis module, and constructing a dynamic permission table to encode the static permission features to obtain text modal features, then constructing Dalvik bytecode into bytecode stream vector and visualizing it into "vector" color image to obtain image modal features; The multi-modal feature extraction module is used for constructing a light-weight convolutional neural network model to extract and learn the features of the "vector" color image, and constructing a light-weight feedforward neural network model to extract and learn the permission features; The multi-modal feature fusion and classification module is used for fusing the feature vectors extracted by different modes, performing linear fusion by giving different weights to the feature vectors of different modes, and performing classification processing on the linearly fused features to obtain the classification result of the APK file.

4. A computer-readable storage medium, characterized in that, The storage medium has stored thereon an Android malicious program detection program of multi-modal feature linear weighted fusion. When the program is executed by a computer, the steps of the Android malicious program detection method of multi-modal feature linear weighted fusion according to claim 1 or 2 are implemented.

Images