Detection method for obfuscated Android malicious application based on code semantics and text embedding

Abstract

The invention relates to a method for detecting obfuscated Android malicious applications based on code semantics and text embedding. The method comprises the following steps: collecting a malicious software data set; malicious software in the data set is confused; aPI calling features in the permission and control flow chart are extracted; embedding the features by using a BERT pre-training model, and filtering the features in combination with a clustering algorithm; the API calling features are coded; building a deep learning framework, wherein a deep learning model adopted for training in the framework is a model BERT + Self-Attention + TextCNN (Convolutional Neural Network); and repeating multiple iterations to obtain a final prediction effect. According to the method, code semantics and text embedding are used, a clustering algorithm is combined, and the classification robustness of the confused malicious software can be remarkably improved by training the improved pre-training model.

Description

Technical Field

[0001] The present invention involves complex tasks in multiple technical areas of artificial intelligence, aimed at identifying obfuscated Android malware. The following are some of the key technical areas related to the detection of obfuscated Android malicious apps:

[0002] Feature extraction and preprocessing: Android software has static features such as permissions, API calls, and opcodes. Feature extraction and preprocessing is to extract these features from Android software and process them using artificial intelligence and other technologies to make the model easier to understand.

[0003] Machine Learning and Deep Learning: Machine learning and deep learning methods are widely used in the field of Android malware detection. Large corpus pre-trained models can be used to identify malware and malware variants. By converting malware code into meaningful text sequences, BERT can skillfully identify and extract key features and patterns in the code. Background Art

[0004] Android system has a significant share in the global mobile operating system market, which will reach 70.79% in 2023. At the same time, Android malicious applications are also showing a growing trend. According to statistics, as of 2023, there are 1,111,189,155 malware instances on the Android platform. Various types of malware, including viruses, worms, spyware, phishing, and ransomware, belong to different Android malware families. They can cause various risks, such as user data loss, data corruption, system crashes, information theft, etc. They are increasingly affecting the data and device security of ordinary users.

[0005] However, obfuscation defeats several code analysis methods. Obfuscation is the process of converting an existing application into a functionally equivalent form that is difficult to read and understand. Malware developers often use code obfuscation to mask the malicious intent and behavior of their software. They may employ various obfuscation techniques, including but not limited to Java-level obfuscation, DEX (Dalvik Executable) file obfuscation, and native-level obfuscation. These obfuscation techniques are able to change important identifiers in APK files, such as class names, method names, and variable names, thereby hindering malware detectors from identifying unique malicious code patterns. In addition, obfuscation techniques can introduce complexity into the logical structure of the code, making it difficult for detection mechanisms to accurately analyze the actual behavioral intent of the software. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a detection method for obfuscated Android malicious applications based on code semantics and text embedding in view of the above shortcomings.

[0007] In order to solve the above technical problems, the present invention adopts the following solutions:

[0008] A detection method for obfuscated Android malicious applications based on code semantics and text embedding includes the following steps:

[0009] Step 1: Establish a dataset. The collected dataset contains APK installation applications of Android malware and benign software.

[0010] Step 2: Obfuscate the Android malware in the data set to form an obfuscated malware data set. The obfuscated malware is combined with the data set in step 1 and divided into a training set, a validation set, and a test set. The training set and the validation set are used for training, and the test set is used for testing.

[0011] Step 3: Extract features from all APKs in the data set, extract their permissions and control flow graph features, and process their characters after feature extraction;

[0012] Step 4: Use text embedding technology to convert the processed features into vectors that can be input into the clustering algorithm, and then set a threshold to remove noise features for feature filtering;

[0013] Step 5: Convert the API call features in the control flow graph into triples and map the entities therein;

[0014] Step 6. Build a pre-trained model BERT for binary classification, and combine it with TextCNN and the Self-Attention mechanism for extracting relative position relationships. As a pre-trained language model, BERT has extraordinary capabilities in processing text data. The input of the improved BERT model is the code semantic features processed by steps 4 and 5, as well as the configuration of the model architecture and hyperparameters. During the training process, the model adapts to the training data through loss calculation and multiple iterations of learning, so as to perform good detection effects on the validation set. The output includes an improved BERT classifier for predicting the category of each sample;

[0015] Step 7: Using the classifier trained in step 6, we apply it to the samples processed in steps 4 and 5. Each sample in the test set passes through the forward propagation of the model, and the predicted probability distribution corresponding to different categories is generated using the feature representation and attention mechanism learned in step 6. The output predicted probability distribution is used to analyze the classification accuracy of the model for each sample in the test set.

[0016] Furthermore, the step 2 comprises the following steps:

[0017] Step 2-1: Use the Obfuscapk tool to confuse the malware in the dataset. The obfuscation strategy combines the four obfuscation strategies of Renaming, CallIndirection, Reflection, and Encryption.

[0018] Step 2-2, add the successfully obfuscated malware to the source dataset and divide it into training set, validation set, and test set;

[0019] Furthermore, the step 3 comprises the following steps:

[0020] Step 3-1, use Apktool to obtain the permissionandroid:name information in the Manifest.xml file of the original APK file as the permission feature of the APK file;

[0021] Step 3-2, delete the fields containing "android.permission." and "com.android.launcher.permission." in the extracted permission features;

[0022] Step 3-3, configure and use the androguard tool to extract the control flow graph of the APK file, and finally obtain a GML file containing the control flow graph information of the APK;

[0023] Step 3-4, read the GML file containing the control flow graph information of each APK, set the regular expression pattern to "L([^;]+);->([^()]+)\(", and extract the API call information in the GML file that matches the pattern;

[0024] Further, the step 4 comprises the following steps:

[0025] Step 4-1: Integrate the extracted permissions and API call features of each APK into a set without duplicate features;

[0026] Step 4-2: Input the features in the feature set into BERT for embedding in turn to convert the code semantic features into vector representations;

[0027] Step 4-3: Create a new set to store the features after BERT embedding, and the feature vectors of this set must correspond one-to-one with the feature names in step 4-2;

[0028] Step 4-4: Use the set in step 4-3 as the input of the machine learning K-Means algorithm to perform feature clustering, and finally output the clustering result;

[0029] Step 4-5: After obtaining the clustering result, set the threshold to delete the noise feature and the original code semantic feature corresponding to the feature vector, and finally use the denoised feature set as a filter;

[0030] Further, the step 5 comprises the following steps:

[0031] Step 5-1, converting the extracted API call features into triples according to the directed edges of the control flow graph, where the format of the triples is "entity 1-relationship-entity 2";

[0032] Step 5-2, add all entities to the mapping table in sequence, so that related entities are mapped to approximate but unequal numbers;

[0033] Step 5-3: Map all triple entities to numbers by reading the mapping table, set the "relation" of the triple to the [invoke] field, and finally replace the "(", ")" symbols with [SEP] so that each triple can be understood by the model as a sentence-level feature;

[0034] Further, the step 6 comprises the following steps:

[0035] Step 6-1. Import the required libraries, including Torch and Transformers modules;

[0036] Step 6-2: Define a TextCNN class, which contains a one-dimensional convolution of the input vector; Step 6-3: Define a Self-Attention layer class, which contains the calculation method for obtaining relative position information and the initialization of the weight matrix;

[0037] Step 6-4: Use the BERT pre-trained model as the base model, add the self-attention mechanism and TextCNN of relative position information to the output of the model. Finally, build the complete model through global average pooling, full connection and output layer;

[0038] Step 6-5: Configure the model using the appropriate optimizer, loss function, and evaluation metric to prepare for training;

[0039] Step 6-6: Take the samples of the training set and validation set processed by steps 4 and 5, as well as the model architecture and hyperparameter configuration as input, and iterate 20 times in the BERT+Self-Attention+TextCNN+ model for training. The loss function uses the binary cross entropy loss function, each batch is 32, and the learning rate is defined as 1e-5, and the training epochs is 20;

[0040] Further, the step 7 comprises the following steps:

[0041] Step 7-1, use the obfuscated Android malware detection model trained in step 6 to predict the data of the test set, and use the samples of the test set processed in steps 4 and 5 as input;

[0042] Step 7-2: Check the samples that the model misclassified, and use these samples to help understand the situations in which the model is prone to errors and provide directions for improvement

[0043] The beneficial effects of the present invention are:

[0044] (1) The present invention adopts a training method of increasing samples to combat Android obfuscated malware, which not only enables the detector to maintain the detection effect of the original data set but also improves the robustness of the obfuscated malware detection;

[0045] (2) The present invention designs and implements a feature filtering method based on a machine learning algorithm, which converts features into vector expressions by using text embedding technology, and further implements filtering of features to be extracted by combining a clustering algorithm with a threshold setting, which significantly reduces the resources used for feature extraction and extracts more robust features, thereby improving the detection effect of the model;

[0046] (3) The present invention designs and implements an encoding method for concisely representing the API call information in the control flow graph and enhancing the understanding of the pre-trained model BERT. This encoding method reduces the burden of model training and is more consistent with the model input;

[0047] (4) The present invention adopts a model that combines the pre-trained model BERT, relative position Self-Attention and TextCNN. BERT performs better in classifying sentences with implicit expressions, while TextCNN is better at capturing key features. Combining BERT with TextCNN can not only utilize the powerful context understanding ability of Transformer, but also utilize the ability of CNN to capture local features. This helps to improve the robustness of the model. At the same time, we design the feature vector after BERT embedding to add a layer of self-attention mechanism, focusing on the relative position information in the sequence. This mechanism helps the model to fully pay attention to the feature word order and optimize the gradient.

[0048] (5) We propose a detection method for obfuscated Android malicious applications based on code semantics and text embedding. This method combines the semantic features of permissions and API calls in the control flow graph and utilizes the enhanced pre-trained model BERT. We then develop a self-attention mechanism that relies on relative positioning, emphasizing the interdependence and spatial relationship between features. Based on the optimized feature description, we combine BERT and TextCNN to achieve robust obfuscated malware detection.

[0049] The present invention is described in detail below with reference to the accompanying drawings and examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 The present invention shows a flow chart of a detection method for obfuscated Android malicious applications based on code semantics and text embedding;

[0051] Figure 2 Shows the Android malware obfuscation flow chart;

[0052] Figure 3 The flowchart of feature filtering using text embedding technology is shown;

[0053] Figure 4 Shows the flow chart for encoding API calls;

[0054] Figure 5 The network structure diagram of the pre-trained model BERT, relative position self-attention mechanism and TextCNN is shown; DETAILED DESCRIPTION

[0055] The principles and features of the present invention are described below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0056] The present invention provides a detection method for obfuscated Android malicious applications based on code semantics and text embedding. When Android malware is obfuscated, the code semantic features are extracted and text embedding technology is used. A pre-trained model is adopted to perform improved model BERT, TextCNN and relative position Self-Attention training to obtain the Android obfuscated malware detection model of the present invention, and predict whether the Android APK is malware.

[0057] In order to make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions used in the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the present invention. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0058] The present invention provides a detection method for obfuscated Android malicious applications based on code semantics and text embedding, the flow chart is as follows: Figure 1 As shown, including:

[0059] S1: Dataset collection;

[0060] In step S1, the present invention uses two public data sets and one widely used data set to finally construct two data sets. Dataset 1 is the CIC MalDroid 2020 data set constructed from the Canadian Institute for Cyber ​​Security; Dataset 2 includes the Drebin data set from the Institute for System Security at the Technical University of Braunschweig, which contains 5,560 malicious samples, and a data set of 4,000 benign samples from 2020-2023 collected using the AndroZoo tool. Dataset 1, namely CIC MalDroid, includes 17,341 malware samples from different malicious families such as Adware, Banking, SMS, and Riskware.

[0061] S2: The malware in the data set is obfuscated using a code obfuscation tool. During the obfuscation process, the APK file is repackaged by simulating a real scenario and finally added to the source data set. The system environment needs to be configured with docker and installed. The tool is added to docker using the relevant command docker pull claudiugeorgiu / obfuscapk, and then the tool is built using the dockerbuild-t obfuscapk. command and can be used. A python script is written to read and obfuscate the malware in the data set that needs to be obfuscated one by one. The obfuscation command is "docker run--rm-v working directory, obfuscapk-ipw directory of the obfuscated file-o obfuscation scheme-o Rebuild APK path". The obfuscation schemes of the present invention are: ClassRename, FeldRename, MethodRename, LibEncryption, ResStringEncryption, AssetEncryption, ConstStringEncryption, CallIndirection, Goto, Reflection, and AdvacncedReflection.

[0062] S3: Extract APK features through decompilation and perform preliminary processing on these features.

[0063] In order to extract features, the present invention uses the Apktool tool to decompile the APK file to obtain the Manifest.xml file containing the basic information of the APK. The Manifest.xml file contains the permission information of the APK. It is necessary to read the file and save the permission features to the corresponding txt; in order to delete the redundant fields in the permission features, first read the txt file corresponding to each APK that saves the permission information, use the common string replace method to replace the "android.permission." and "com.android.launcher.permission." fields with empty and convert the remaining permission information to lowercase; in order to obtain the API call information in the control flow graph, the present invention uses the androguard related command line to implement it. First, you need to install the androguard package, and then use the command line "androguard cg target APK path -o input output directory / graph.gml" obtains the GML file containing the control flow graph information of the APK file and saves them one by one; reads the API call information in the GML file, which contains the information of nodes and edges in the control flow graph. In order to extract the node information in the edge, first use the read_gml method to instantiate the GML file, and then set the pattern corresponding to the regular expression to "L([^;]+);->([^()]+)\(", traverse all the nodes on the edge, if the pattern matches, the source node and the target node are stored separately and correspond one to one.

[0064] S4-A: Use text embedding technology combined with machine learning clustering algorithm to achieve feature filtering.

[0065] In order to facilitate text embedding of each single feature, it is necessary to integrate all permissions and API calls into one file, such as adding permission features of all samples to the file, using the append method and checking whether the feature field already exists in the file. When verifying whether the feature field exists in the file, the file needs to be read again. In order to reduce time complexity, the read file needs to be saved using set. The same is true for API call features. It is necessary to append all APK's API call features to the same file as the permission features and determine whether they already exist; in order to filter the feature fields using machine learning clustering methods, the features must first be converted into a vector form that the machine can understand. First, you need to configure the torch and transformers environment, then load the bert-base-uncased pre-trained model and parameters, and then read the saved feature collection file into a list. In order to convert semantic features into vector representations, it is necessary to use the tokenizer method to encode the features and input them into the BERT model, and then take out the vectorized representation of the BERT output; in order to facilitate the deletion of the features corresponding to the noise vector after clustering, it is necessary to integrate the saved feature set and the output embedding into the csv file one by one; to cluster these features, it is necessary to first read the csv file in S4-3 and read a column of the feature vector using the read_csv method. The advantage of using this method is that it can reduce time complexity. At the same time, it is necessary to import the corresponding dependent packages, such as the sklearn-related python package of the K-Means algorithm. Then, these feature vectors are used as input to implement clustering using the K-Means algorithm. During the clustering process, it is recommended to set the k value to 2. After clustering, we determine the noise threshold based on these distances by calculating the distance from each data point to the cluster center. We set the specific content of the threshold by setting S as a feature vector set with a mean of μ and a standard deviation of σ, which can be expressed as:

[0066]

[0067] According to the Threshold, feature vectors exceeding the threshold are regarded as noise, and the features corresponding to the feature vectors are deleted. When extracting APK features, the features are extracted based on the remaining features. If the feature to be extracted is not in the remaining features, it is not extracted.

[0068] S4-B: Encode the API call features to obtain a brief relational representation of the API call features.

[0069] The source node and target node information retained in step S3 are read and read as a triple format of "(source_node, invoke, target_node)"; a mapping table is established to read all nodes into a csv file, which contains two columns, one of which represents the node name and the other represents the node number. The number is randomly generated using the random library and the file is read each time it is generated so that it cannot be repeated, and the edges of similar calls will be numbered with approximate numbers; when extracting features, the established mapping table is read, the semantic API calls that were originally to construct triples are mapped to numbers, and the relationship "invoke" is modified to "[invoke]", and finally "(", ")" are modified to "[SEP]". The above modifications are all for the purpose of making the model better understand the features.

[0070] S5: Build an obfuscated malware detection model that combines the BERT pre-trained model with relative position Self-Attention and TextCNN.

[0071] BERT is trained on a large corpus, which makes it very effective in Android malware detection and can be used for fine-tuning on binary classification tasks. The BERT architecture consists of multiple stacked Transformer encoders, each of which contains a self-attention layer. We chose to use the BERT-base-uncased model, which includes a 12-layer Transformer encoder with 12 attention heads, a hidden layer size of 768, and a total of 110 million parameters. In order to build the BERT pre-trained model, you need to first configure the correct torch and transformers environment and load the model. This invention aims to achieve malware classification tasks and chooses binary cross entropy as the loss function during training:

[0072]

[0073] Among them, L represents the loss function, L represents the number of samples, yi represents the true label of the i-th sample, and pi represents the probability that the model predicts that the i-th sample is a positive class.

[0074] When designing the feature vector after BERT embedding, a self-attention mechanism is added to focus on the relative position information in the sequence, as shown in the following formula:

[0075] First, define the relative position encoding matrix R. Then, use the relative position encoding to calculate the query and key:

[0076] Q'=Q+QR

[0077] K'=K+KR

[0078] Among them, QR and KR are obtained by linearly transforming the relative position encoding matrix R with the query and key:

[0079] QR=Wqr·Rq

[0080] KR=Wkr·Rk

[0081] Wqr and Wkr are learnable linear transformation parameters, and Rq and Rk are relative position encodings related to the query and key. Next, the attention score needs to be calculated using the query and key with relative position encoding:

[0082]

[0083] Then, the mask matrix is ​​applied to the attention scores:

[0084] MaskedAttentionScores=AttentionScores⊙M

[0085] Apply the softmax function to the masked attention scores to obtain attention weights with relative position encoding:

[0086] AttentionWeights=softmax(MaskedAttentionScores)

[0087] Finally, these attention weights are used to calculate the context vector:

[0088] Context = AttentionWeights·V

[0089] BERT performs better in classifying sentences with cryptic expressions, while TextCNN is better at capturing key features. Combining BERT with TextCNN not only takes advantage of Transformer's powerful contextual understanding ability, but also takes advantage of CNN's ability to capture local features. Integrating Self-Attention and TextCNN into BERT requires first creating a self-attention mechanism class, in which the acquisition of relative position information needs to be added. Then, TextCNN and average pooling layers are added to the BERT model class, where the input of TextCNN is the output of BERT and the input of the average pooling layer is the output of TextCNN. In order to obtain as many features as possible, it is recommended to set the maximum sequence length to 512. These embedded representations are then input into TextCNN to capture local features through a layer of convolution operations. Regarding the parameter settings of TextCNN, the number of convolution kernels needs to be set to 2, the size to 2x2, the sequence_length to 12, and the in_channels to 768. In the present invention, the use of the average pooling layer can reduce the impact of noise and take into account the impact of all API calls in the area. Finally, the full connection layer is used for classification.

[0090] S6: Input the preprocessed features into the built model for training so that the model can identify obfuscated malware.

[0091] The model parameter information configured in step S5 is saved, and then the deep learning model combining BERT pre-trained model, relative position Self-Attention and TextCNN is used for training. The present invention is optimized and adjusted during the training process, and the recommended parameters are finally obtained as shown in Table 1. After comparing different parameter tests, it is found that the detection obfuscated malware model uses a binary cross loss function, a batch size of 32, a defined learning rate of 1e-5, and a training round of 20.

[0092] Table 1. Training parameters of EfficientNet v2 network

[0093]

[0094]

[0095] In order to make the dataset simulation scenario of the present invention more realistic, the present invention randomly divides the extracted features into a training set and a test set with a ratio of 8:2, and then randomly selects the sample features in the dataset for uploading and training. After multiple rounds of training, the gradient of the obfuscated malware detection model is obtained.

[0096] S7: Repeat multiple rounds of training to finally obtain a detection model for obfuscated Android malware. The evaluation indicators of the model are Accuracy, Precision, Recall and F1-score. The specific formula is:

[0097]

[0098] Among them, TP (true positive examples) is the number of samples predicted by the model to be positive examples and are actually positive examples; TN (true negative examples) is the number of samples predicted by the model to be negative examples and are actually negative examples; FP (false positive examples) is the number of samples predicted by the model to be positive examples but are actually negative examples; FN (false negative examples) is the number of samples predicted by the model to be negative examples but are actually positive examples.

[0099] Accuracy, Precision, Recall, and F1-score are important indicators used to evaluate model performance in the field of machine learning. Accuracy measures the accuracy of the model's predictions of all samples; Precision focuses on the proportion of samples predicted by the model as positive that are actually positive, reflecting the reliability of the prediction of positive examples; Recall focuses on the proportion of all true positive samples correctly predicted by the model, measuring the model's ability to find all true positive samples; and F1-score is the harmonic mean of Precision and Recall, which is used to balance the trade-off between the two and provides a comprehensive way to evaluate model performance.

[0100] The method provided by the present invention has the following advantages or beneficial technical effects:

[0101] Android malware is on the rise, posing a serious security threat to users' privacy and property. Code obfuscation, as an adversarial analysis technique, is increasingly undermining the effectiveness of learning-based detectors. Many methods have low accuracy or are even ineffective in detecting obfuscated malware. To address this challenge, this paper proposes a novel detection method based on code semantics and text embedding, combining permissions with the semantic features of API calls in control flow graphs, and utilizing an enhanced pre-trained model BERT. Then, this paper designs a self-attention mechanism that relies on relative positioning, emphasizing the interdependence and spatial relationship between features. Based on the optimized feature description, this paper determines the optimal combination of BERT and other network models and achieves robust obfuscated malware detection.

[0102] The above is an example of the best implementation of the present invention, and the parts not described in detail are common knowledge of ordinary technicians in the field. The protection scope of the present invention shall be based on the content of the claims, and any equivalent transformation based on the technical enlightenment of the present invention is also within the protection scope of the present invention.

Claims

1. A detection method for obfuscated Android malicious applications based on code semantics and text embedding, comprising the following steps: Step 1: Establish a dataset. The collected dataset contains APK installation applications of Android malware and benign software. Step 2: Obfuscate the Android malware in the data set to form an obfuscated malware data set. The obfuscated malware is added to the source data set in step 1 and divided into a training set, a validation set, and a test set. The training set and the validation set are used for training, and the test set is used for testing. Step 3: Extract features from the APK in the dataset, extract the API call features in its permissions and control flow chart, and perform preliminary processing on its characters after feature extraction; Step 4: Use text embedding technology to convert the processed features into vectors that can be input into the machine learning clustering algorithm, and then set a threshold to remove noise features for feature filtering; Step 5: Convert the API call features in the control flow graph into triples and map the entities therein. Finally, perform preliminary processing on the symbols before inputting them into the model. Step 6. Build a pre-trained model BERT for Android malware detection, and combine it with the Self-Attention mechanism and TextCNN deep learning model for extracting relative position relationships. As a language model that has been pre-trained with a large amount of corpus, BERT has extraordinary capabilities in processing text data. The input of the improved BERT model is the samples processed by steps 4 and 5, as well as the configuration of the model architecture and hyperparameters. During the training process, the model adapts to the training data through loss calculation and multiple iterations of learning, so as to perform good detection results on the validation set. The output includes a BERT classifier that can detect obfuscated Android malicious applications, which is used to predict the category of each sample; Step 7: Using the classifier trained in step 6, we apply it to the test set samples processed in steps 4 and 5. Each sample in the test set passes through the forward propagation of the model, and the predicted probability distribution corresponding to different categories is generated using the feature representation and attention mechanism learned in step 6. The output predicted probability distribution is used to analyze the classification accuracy of the model for each sample in the test set.

2. According to the method for detecting obfuscated Android malicious applications based on code semantics and text embedding according to claim 1, the step 2 specifically comprises the following steps: Step 2-1: Use the Obfuscapk tool to confuse the malware in the dataset. The obfuscation strategy combines the four obfuscation strategies of Renaming, CallIndirection, Reflection, and Encryption. Step 2-2: Add the successfully obfuscated malware to the source dataset and divide it into a training set, a validation set, and a test set.

3. According to the method for detecting obfuscated Android malicious applications based on code semantics and text embedding according to claim 1, the step 3 specifically comprises the following steps: Step 3-1, use Apktool to decompile the APK file, and obtain the permission android:name information in the Manifest.xml file of the original APK file as the permission feature of the APK file; Step 3-2, delete the fields containing "android.permission." and "com.android.launcher.permission." in the extracted permission features; Step 3-3, configure and use the androguard tool to extract the control flow graph of the APK file, and finally obtain a GML file containing the control flow graph information of the APK; Step 3-4: read the GML file containing the control flow graph information of each APK, set the regular expression pattern to "L([^;]+);->([^()]+)\(", and extract the API call information in the GML file that matches the pattern.

4. According to the method for detecting obfuscated Android malicious applications based on code semantics and text embedding according to claim 1, the step 4 specifically comprises the following steps: Step 4-1: Integrate the extracted permissions and API call features of each APK into a set without duplicate features; Step 4-2: Input the features in the feature set into BERT for embedding in turn to convert the code semantic features into vector representations; Step 4-3: Create a new set to store the features after BERT embedding, and the feature vectors of this set must correspond one-to-one with the unembedded features of step 4-2; Step 4-4: Use the set in step 4-3 as the input of the machine learning K-Means algorithm to perform feature clustering, and finally output the clustering result; Step 4-5: After obtaining the clustering result, set a threshold to delete the noise feature and the original code semantic feature corresponding to the feature vector, and finally use the denoised feature set as a filter.

5. According to the method for detecting obfuscated Android malicious applications based on code semantics and text embedding according to claim 1, the step 5 specifically comprises the following steps: Step 5-1, converting the extracted API call features into triples according to the directed edges of the control flow graph, where the format of the triples is "(entity 1-relationship-entity 2)"; Step 5-2, add all entity features to the mapping table in sequence, so that related entities are mapped to approximate but unequal numbers; Step 5-3: Map all triple entities to numbers by reading the mapping table, and set the "relationship" in the triple to the [invoke] field; Step 5-4: Replace the "(", ")" symbols with [SEP] so that each triple can be understood by the model as a sentence.

6. According to the method for detecting obfuscated Android malicious applications based on code semantics and text embedding according to claim 1, the step 6 specifically comprises the following steps: Step 6-1. Import the required libraries, including Torch and Transformers modules; Step 6-2, define a TextCNN class, which contains one-dimensional convolution and average pooling of the input vector; Step 6-3, define a class for the Self-Attention layer, which includes the calculation method for obtaining relative position information and the initialization of the weight matrix; Step 6-4: Use the BERT pre-trained model as the base model, add the self-attention mechanism of relative position information and the TextCNN deep learning model to the output of the model. Finally, build a complete model through global average pooling, full connection and output layers; Step 6-5: Configure the model using appropriate loss functions and evaluation metrics and prepare for training; Step 6-6: Take the samples of the training set and validation set processed by steps 4 and 5, as well as the model architecture and hyperparameter configuration as input, and iterate 20 times in the BERT+Self-Attention+TextCNN model for training. The loss function uses the binary cross entropy loss function, each batch is 32, and the learning rate is defined as 1e-5, and the training epochs is 20; Step 6-7: Save the trained model to evaluate the detector’s performance on the test set.

7. According to the method for detecting obfuscated Android malicious applications based on code semantics and text embedding according to claim 1, the step 7 specifically comprises the following steps: Step 7-1: Use the obfuscated malware detection model trained in step 6 to predict the data of the test set, and use the samples of the test set processed in steps 4 and 5 as input; Step 7-2: Review the samples that the model misclassified. Based on these samples, we can help understand the situations in which the model is prone to errors and provide directions for improvement.

Images