An Android malware detection method based on multi-view learning

Abstract

The application provides an Android malware detection method based on multi-view learning, and belongs to the technical field of Android malware detection. The method comprises the following steps: 1, decompiling the Android application to be detected, extracting the function call relationship, opcode sequence and permission information, constructing the function call graph and extracting the sensitive behavior subgraph; 2, using the pre-trained code representation model CodeBERT to perform semantic coding on the method-level opcode sequence, and fusing the permission features to generate the node semantic vector; 3, constructing a multi-view graph neural network, generating multi-view input through a feature mask enhancement strategy, introducing a multi-hop adaptive attention mechanism to realize dynamic aggregation of multi-hop neighborhood information, and simultaneously adopting a multi-channel coding structure for learning complementary graph representation; 4, fusing the multi-channel node representation, constructing a relationship matrix through key-value mapping, and generating a graph-level representation through convolution and pooling, and finally inputting a classification model to realize Android malware detection.

Description

Technical Field

[0001] This invention relates to Android malware detection technology, specifically to an Android malware detection method based on multi-view learning. Background Technology

[0002] With the rapid development of mobile internet and smart terminals, the Android operating system, thanks to its openness and excellent device adaptability, has become the most widely used mobile operating platform. However, while its massive user base and open ecosystem promote application innovation, they also provide favorable conditions for the spread of malware. In recent years, with the continuous growth in the number of Android malware, its attack methods have gradually exhibited complex characteristics such as code obfuscation, polymorphic variants, and cross-component collaboration, posing a serious threat to user privacy, security, and system stability. Therefore, how to achieve efficient and accurate detection of Android malware has become an important research issue in the field of mobile information security.

[0003] Traditional Android malware detection methods based on signature-based and heuristic rules achieve high accuracy in detecting known malicious samples, but they heavily rely on manual rule construction and signature database updates, making them less adaptable to unknown variants, zero-day attacks, and code obfuscation techniques. Dynamic behavior analysis-based methods can capture more realistic execution characteristics during program execution, but these methods typically rely on sandbox environments, resulting in high runtime overhead and low detection efficiency, making them unsuitable for large-scale application scenarios. In recent years, machine learning and deep learning methods have been widely applied in Android malware detection, achieving some progress in static analysis scenarios by automatically learning feature representations from large-scale data. Regarding feature representation, existing research has used methods such as TF-IDF, Word2Vec, and Doc2Vec to represent opcode sequences. However, these methods often rely on word frequency statistics or local contextual information, making it difficult to fully capture deep semantic dependencies in opcode sequences and lacking the ability to effectively utilize program structure information, thus limiting their ability to characterize complex malicious behaviors.

[0004] To overcome the aforementioned problems, researchers have gradually introduced graph representation learning methods to represent Android applications as function call graphs, control flow graphs, or program dependency graphs, explicitly describing the call and dependency relationships between program components and achieving a structured representation of program behavior. Furthermore, graph neural networks are introduced on top of graph structures, effectively capturing high-order structural dependencies between nodes by aggregating node neighborhood information layer by layer, thereby improving the ability to represent complex program behavior. Among various graph representation forms, function call graphs are widely used in Android malware detection tasks because they can characterize the call relationships between functions with lower computational overhead and contain key API information.

[0005] Although graph representation learning methods have achieved certain results in Android malware detection, there are still key shortcomings: (1) Node features mostly use opcode frequency or shallow embedding, which makes it difficult to capture deep contextual semantic information and limits the expression of complex malicious behavior; (2) Malicious behavior usually involves multi-hop call paths across functions. Traditional methods rely on stacked multi-layer graph neural networks for multi-hop neighborhood information fusion, which easily leads to oversmoothing and makes node representations tend to be homogenized, thereby reducing the ability to distinguish long-range dependencies; (3) Most methods only perform graph representation learning based on a single view, which makes it difficult to characterize program behavior from multiple structural scales and multiple semantic perspectives, resulting in insufficient robustness when facing code obfuscation and structural disturbances.

[0006] Therefore, there is an urgent need for an Android malware detection method that can enhance node semantic representation capabilities, improve multi-hop dependency fusion capabilities, and achieve multi-view graph representation learning. Based on this, this invention proposes an Android malware detection method OMVDroid (based on multi-view learning). M ulti- V iew Graph Learning with O pc2Vec forAn droid(Malware Detection) First, a function call graph centered on sensitive APIs is constructed, and Opc2Vec (Opcode-to-Vector) is used to semantically encode the opcode sequences within functions, while simultaneously generating node semantic features based on permission information. Then, a multi-hop adaptive attention mechanism is introduced to weightedly fuse neighborhood features with different hop counts, thereby enhancing the expressive power of cross-function call relationships. Second, a multi-view graph neural network structure is constructed to learn and fuse multi-channel features of graph data to capture complementary structural and semantic information from different views. Simultaneously, convolution and pooling operations are performed on the fused multi-channel graph representation to achieve graph-level feature extraction. Finally, the obtained graph-level representation is input into a classification model to detect Android malware. Extensive comparative experiments demonstrate that the proposed multi-view method can more accurately detect Android malware and maintain good robustness under code obfuscation and variant evolution conditions. Summary of the Invention

[0007] To address the shortcomings of existing Android malware detection methods, such as insufficient utilization of opcode semantic information, inadequate expression of cross-function call relationships, and limitations in single-view representation during the characterization of complex program behavior, this invention proposes an Android malware detection method based on multi-view learning. This method integrates program structure information and opcode semantic information, and introduces a multi-hop adaptive information integration mechanism and a multi-view feature fusion strategy to achieve efficient detection of complex malicious behaviors.

[0008] This invention provides an Android malware detection method based on multi-view learning, comprising:

[0009] Step 1: Decompile the Android application, extract function call relationships, opcode sequences and permission information, construct a function call graph and extract sensitive behavior subgraphs;

[0010] Step 2: Use the pre-trained code representation model CodeBERT to semantically encode the method-level opcode sequence and fuse it with permission features to generate node semantic vectors;

[0011] Step 3: Construct a multi-view graph neural network, generate multi-view inputs through a feature masking enhancement strategy, and introduce a multi-hop adaptive attention mechanism to achieve dynamic aggregation of multi-hop neighborhood information. At the same time, a multi-channel coding structure is used to learn complementary graph representations.

[0012] Step 4: The multi-channel node representations are fused, a relation matrix is ​​constructed through key-value mapping, and a graph-level representation is generated through convolution and pooling. Finally, the representation is input into the classification model to achieve Android malware detection.

[0013] Firstly, the specific steps of step 1 above are as follows:

[0014] Step 1.1: Use the static analysis tool Androguard to decompile the APK file and extract function call relationships, opcode sequences, and permission information;

[0015] Step 1.2: Based on the API-permission mapping relationship provided by PSCount and Axplorer, identify function calls related to sensitive permissions and treat them as a set of sensitive APIs. Using each sensitive API as the center, use breadth-first search to extract context neighbor nodes of a fixed depth and construct a sensitive API subgraph to reduce the complexity of the graph structure and highlight key behaviors.

[0016] Step 1.3 integrates all sensitive API subgraphs into a complete function call graph representation, where nodes represent functions and edges represent function call relationships. Each node is initialized with preliminary features, including permissions and opcode sequences, to provide basic input for subsequent semantic encoding and graph representation learning.

[0017] Secondly, the specific steps of step 2 above are as follows:

[0018] Step 2.1: For each function node, decompile the DEX file to obtain Smali code, extract the complete Dalvik opcode sequence from the method body, and construct a discrete opcode token sequence according to the execution order;

[0019] Step 2.2: Use the pre-trained code representation model CodeBERT to perform contextual semantic encoding on the opcode sequence, mapping the discrete instruction sequence into a continuous vector representation;

[0020] Step 2.3: Strengthen the semantic information of key opcodes through gating attention pooling to form an input representation that is highly discriminative and robust to node behavior.

[0021] Thirdly, the specific steps of step 3 above are as follows:

[0022] Step 3.1 In multi-view graph representation learning, a feature masking enhancement strategy is introduced to randomly mask the node features of each graph encoding channel to simulate feature loss and noise interference.

[0023] Step 3.2: A multi-hop adaptive attention mechanism is adopted to perform weighted fusion of neighborhood features with different numbers of hops in the graph neural network, so that the model can adaptively select the optimal neighborhood perception range.

[0024] Step 3.3: Complementary feature learning is achieved through a multi-channel graph structure. Different channels independently learn node representations under different feature perturbation intensities and neighborhood perception conditions, thereby constructing a multi-view graph representation to fully capture the multi-scale structure and semantic characteristics of nodes and graphs.

[0025] Fourthly, the specific steps of step 4 above are as follows:

[0026] Step 4.1: Construct an intra-channel relation matrix by key-value mapping for the node representations of all channels to preserve the global statistical associations between nodes, and apply two-dimensional convolution and pooling operations to the multi-channel relation matrix to obtain a unified graph-level embedding vector.

[0027] Step 4.2: Input the graph-level embedding vector into the classifier for discrimination to achieve Android malware detection.

[0028] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0029] 1. This invention employs a CodeBERT-based opcode semantic encoding method to perform deep semantic representation of the opcode sequence of each function in an Android application, and integrates API permission information to form function-level node semantic features. Compared with existing methods based on statistical frequency or shallow embedding representation, CodeBERT can more accurately characterize the micro-behavioral patterns within functions, while combining function call graph structures to achieve macro-behavioral modeling, realizing a global and local joint representation of complex malicious behaviors.

[0030] 2. Existing multi-layer GNNs are prone to oversmoothing when aggregating multi-hop neighborhood information, leading to similar representations across different nodes and the loss of long-range dependency information, thus affecting the recognition of cross-function multi-hop behavior. This invention introduces a multi-hop adaptive attention mechanism in each GNN layer, dynamically integrating neighborhood information with different hop counts and assigning learnable weights, enabling node representations to adaptively capture local and long-range dependencies. Compared with existing technologies, this invention effectively alleviates the oversmoothing problem and improves the model's ability to identify malicious cross-function multi-hop behavior.

[0031] 3. Existing GNN methods typically employ single-view node representations, making it difficult to simultaneously capture the multi-scale structure and multi-dimensional semantic information of program behavior. This invention designs a multi-view GNN architecture, achieving multi-view representation of nodes through parallel channels, and combines this with a feature masking enhancement strategy to improve the model's adaptability to missing information or noise. Compared to existing single-view methods, this invention, through multi-view complementarity and feature fusion, can effectively capture structural and semantic patterns at different scales, achieving high-precision detection of Android malware. Attached Figure Description

[0032] Figure 1This is an overall flowchart of OMVDroid, an Android malware detection method based on multi-view learning.

[0033] Figure 2 This is a detailed flowchart of OMVDroid, an Android malware detection method based on multi-view learning.

[0034] Figure 3 Box plots show the precision, recall, accuracy, and F1 score of the OMVDroid method proposed in this invention compared with baseline methods such as MaMaDroid, RAMDA, MsDroid, RGDroid, and MalScan in multiple repeated experiments. These plots are used to demonstrate the performance stability of each model. In the box plots, (a) represents accuracy, (b) represents precision, (c) represents recall, and (d) represents F1 score.

[0035] Figure 4 This is a graph showing the trend of F1 scores for each method over the period from 2020 to 2024. Detailed Implementation

[0036] The present invention will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the described embodiments are only for the purpose of understanding the present invention and do not constitute any limitation thereof.

[0037] This invention aims to address Android malware detection by proposing a multi-view learning-based method to achieve efficient identification of complex malicious behaviors. For example... Figure 2 As shown, this invention provides a complete Android malware detection framework, which mainly includes three core processes: data preprocessing, semantic feature encoding, and multi-view learning. The experimental results fully verify the effectiveness of the method of this invention.

[0038] like Figure 1 As shown, the present invention provides an Android malware detection method based on multi-view learning, comprising the following steps:

[0039] Step 201: Decompile the Android application, extract function call relationships, opcode sequences and permission information, construct a function call graph and extract sensitive behavior subgraphs.

[0040] Step 2011: Use the static analysis tool Androguard to decompile the APK file and extract function call relationships, opcode sequences, and permission information;

[0041] Step 2012: Based on the API-permission mapping relationship provided by PSCount and Axplorer, identify function calls related to sensitive permissions and treat them as a set of sensitive APIs. Using each sensitive API as the center, employ breadth-first search to extract contextual neighbor nodes of a fixed depth, constructing a sensitive API subgraph to reduce graph structure complexity and highlight key behaviors;

[0042] Step 2013 integrates all sensitive API subgraphs into a complete function call graph representation, where nodes represent functions and edges represent function call relationships. Preliminary feature initialization is performed on each node, including permission and opcode sequence features, forming a node-level representation vector x.

[0043] ;

[0044] Where x is the node-level representation vector, n per The one-hot encoded vector representing the permission category, n opc This is the opcode semantic vector, where || represents the vector concatenation operation.

[0045] Step 202: Use the pre-trained code representation model CodeBERT to semantically encode the method-level opcode sequence and fuse it with permission features to generate node semantic vectors.

[0046] Step 2021 For each function node, decompile the DEX file to obtain Smali code, extract the complete Dalvik opcode sequence from the method body, and construct a discrete opcode token sequence according to the execution order to capture the execution semantics inside the method;

[0047] Step 2022: Use the pre-trained code representation model CodeBERT to perform contextual semantic encoding on the opcode sequence obtained in step 2021, mapping the discrete instruction sequence into a continuous vector matrix H.

[0048] ;

[0049] Where H is a continuous vector matrix, h n This represents the context semantic vector composed of opcodes, where n is the length of the opcode sequence, n=1, 2, 3, ... n.

[0050] CodeBERT is a Transformer-based pre-trained code representation model that learns contextual representations of sequences through a self-attention mechanism, thereby capturing dependencies between opcodes and method-level execution patterns. Compared to traditional statistical or shallow representation-based methods (such as TF-IDF, Word2Vec, Doc2Vec, and Code2Vec), CodeBERT not only captures long-distance contextual dependencies but also learns higher-level semantic features, thus more accurately characterizing the execution behavior of method-level opcode sequences. Therefore, CodeBERT is chosen for semantic encoding of opcode sequences.

[0051] Step 2023: Gated attention pooling is applied to the output semantic matrix H to enhance the key opcode information. First, the semantic representation of each opcode is filtered through a gating mechanism.

[0052] ;

[0053] Among them, h i This represents the original semantic vector of the i-th opcode. W represents the semantic vector after gating and filtering. g Let b be a trainable weight matrix. g For trainable bias terms, (·) represents the Sigmoid activation function, and ⊙ represents element-wise multiplication.

[0054] Then, the importance weights of each opcode are calculated through multi-layer perceptual attention and weighted aggregation is performed.

[0055] ,

[0056] ;

[0057] in, W is the semantic vector after gating and filtering. a b is a trainable attention weight matrix. a For trainable bias terms, Let be the transpose of the trainable attention vector, tanh be the hyperbolic tangent activation function, and e be the expression for the training vector. ᵢ and e j Let be the attention scores for the i-th and j-th opcodes, respectively, and exp(·) be an exponential function with base e, where α is the base of the natural constant. i Let Σ be the attention weight for the i-th opcode. j This represents a normalized summation of attention scores for all opcodes, where j is the summation index, ranging from 1 to n, and n is the length of the opcode sequence.

[0058] Finally, a linear projection is performed on the weighted aggregated vector to obtain the method-level opcode semantic vector z.

[0059] ;

[0060] Where z is the semantic vector of the method-level opcode. For the semantic vector after gating and filtering, α i W is the attention weight for the i-th opcode. p Let b be a trainable linear projective weight matrix. p For trainable bias terms, Σ i This represents a weighted summation of all opcode semantic vectors, where i is the summation index, ranging from 1 to n, n is the opcode sequence length, and ϕ(·) is the non-linear activation function. Finally, residual connections and layer normalization are combined to enhance training stability.

[0061] The gated attention mechanism employs a combined approach of "gating filtering + attention weighting." On one hand, it utilizes the gating structure to adaptively filter irrelevant or redundant opcodes; on the other hand, it uses the attention mechanism to highlight instructions more critical for malicious behavior detection, thereby improving the discriminative power of the method-level representation. Compared to average pooling or max pooling, this method can more precisely represent the contribution of different opcodes to the overall semantics, and is therefore used for feature aggregation of opcode sequences.

[0062] Step 203: Construct a multi-view graph neural network, generate multi-view inputs through a feature masking enhancement strategy, and introduce a multi-hop adaptive attention mechanism to achieve dynamic aggregation of multi-hop neighborhood information. At the same time, a multi-channel coding structure is used to learn complementary graph representations.

[0063] Step 2031: Perform random masking enhancement on node features in each graph encoding channel to simulate feature loss and noise interference;

[0064] Specifically, a mask matrix is ​​constructed from the node feature matrix X. ,in Let be the mask matrix corresponding to the i-th channel, with values ​​of 0 or 1, used to indicate whether node features are preserved. Further, the perturbed node feature representation is generated through element-wise multiplication. .

[0065] ;

[0066] in, Let X represent the perturbation node feature matrix of the i-th channel, X be the original node feature matrix, and ⊙ denote element-wise multiplication. Different channels use different mask rates to form multiple semantic views, thereby improving the robustness of feature representation.

[0067] Step 2032: Within each channel, multi-layer GraphSAGE graph convolution is used to propagate the node features. The node representation update formula is:

[0068] ;

[0069] in, This represents the representation of node v in the i-th channel and the l-th layer. Let N(v) represent the feature representation vector of node v after updating in the i-th channel and at the (l+1)-th layer, where N(v) represents the set of neighboring nodes of node v, and u represents any one of the neighboring nodes of node v. This indicates that u belongs to the set of neighboring nodes of node v. This represents the representation of neighbor node u in the i-th channel and the l-th layer, where AGG(·) is the neighborhood aggregation function. Let be the trainable weight matrix of the i-th channel and the l-th layer, and σ(·) be the ReLU activation function. By stacking L layers of convolution, neighborhood representation sets with different hop counts are obtained. H (L,i) This represents the node feature matrix output by the Lth layer convolution of the i-th channel.

[0070] Furthermore, the representations of different hop counts are dynamically fused. Let S be the cumulative feature representation after the fusion in the l-th step. (l,i) Initially S (1,i) = H (1,i) For the l-th jump feature H (l,i) Attention weights are calculated and weighted fusion is performed.

[0071] ;

[0072] in, Let be the node representation matrix of the i-th channel after fusion at layer l+1. H represents the cumulative multi-hop fusion features over time. (l,i) This represents the node feature representation of the i-th channel in the l-th layer of GraphSAGE. and , respectively, represent the attention weights for the current skipped feature and the historical cumulative feature, and ⊙ represents element-wise multiplication. This mechanism enables the model to adaptively select the optimal information reception depth based on node features, enhancing its ability to model long-range dependencies.

[0073] Step 2033: Construct M parallel graph encoding channels and independently learn node representations under different feature perturbation intensities and neighborhood awareness conditions. In the output stage of each channel, the hop count adaptive fusion representation is weighted and combined with the final layer convolutional output to obtain the channel-level node representation.

[0074] ;

[0075] in, S is an adjustable fusion coefficient. (L,i) H is the final representation after adaptive hopping number fusion for the i-th channel. (L,i) C is the output of the last layer graph convolution for the i-th channel. (i) This represents the node-level representation matrix of the final output of the i-th channel.

[0076] Finally, the outputs of all M channels are integrated to form a multi-view node representation set.

[0077] ;

[0078] in, Let C represent the set of node representations output by M graph encoding channels. (i) Let represent the node representation matrix of the output of the i-th graph-coded channel, where i∈{1,2,…,M} represents the channel index and M represents the number of graph-coded channels.

[0079] Step 204: The multi-channel node representations are fused, a relation matrix is ​​constructed through key-value mapping, and a graph-level representation is generated through convolution and pooling. Finally, the representation is input into the classification model to achieve Android malware detection.

[0080] Step 2041 performs key-value mapping on the node representation of each graph encoding channel, transforming the variable-sized node set into a fixed-size graph-level representation. Specifically, it first maps the node representation to the key space and value space through linear projection to obtain the key representation. Sum value representation Based on this, construct the channel relationship matrix R. (i) .

[0081] ;

[0082] Among them, K (i) Let be the key representation matrix for the i-th channel. Let R be the matrix representing the normalized values ​​of the i-th channel, T be the matrix transpose operation, and R be the matrix representation. (i) Let be the relation matrix for the i-th channel.

[0083] The relation matrices of all channels are stacked to form a multi-channel relation tensor, which is then input into a two-dimensional convolutional network for processing. High-order interaction features across channels and semantic subspaces are extracted through convolution and pooling to obtain a unified graph-level embedding vector h. G ;

[0084] Step 2042: embed the graph-level embedding vector h GInput is processed by a classifier to detect Android malware.

[0085] This invention primarily targets Android malware detection tasks. In this embodiment, 21,501 APK samples were collected from the Android application repository AndroZoo, including 10,845 benign applications and 10,656 malicious applications from 2017 to 2024. Table 1 shows the distribution of APK samples by year.

[0086] Table 1 shows the distribution of samples from each year in the Android application dataset used in the experimental stage of this invention:

[0087] ;

[0088] To verify the effectiveness of the proposed CodeBERT-based opcode semantic encoding method in terms of feature representation capability, comparative experiments were conducted based on the aforementioned dataset. The method was compared with the TF-IDF method based on word frequency statistics, the Word2Vec-CBOW method based on the continuous bag-of-words model, the Word2Vec-SkipGram method based on the skip character model, the Doc2Vec-PV-DM method based on distributed memory, the Doc2Vec-PV-DBOW method based on the distributed bag-of-words model, and the Code2Vec method based on the abstract syntax tree path. The experimental results are shown in Table 2.

[0089] Table 2 compares the detection performance (%) of different code embedding methods:

[0090] ;

[0091] To verify the detection performance of the proposed Android malware detection method OMVDroid based on multi-view representation, five representative existing methods were selected for comparative experiments, including: the MaMaDroid-pkg method based on API call sequence packet-level abstraction, the MaMaDroid-fml method based on API call sequence family-level abstraction, the RAMDA method based on variational autoencoder, the MsDroid method based on sensitive API behavior subgraphs, the RGDroid method based on functional subgraph partitioning, and the MalScan method based on centrality analysis. The precision, recall, accuracy, and F1 score of the experimental results are shown in Table 3. Figure 3Box plots show the results of various methods under repeated experiments. Experimental results show that the OMVDroid method based on multi-view representation outperforms the comparative methods in all evaluation metrics, proving the high accuracy of the proposed method in malware detection tasks. At the same time, the box plots show that the performance distribution of OMVDroid is more concentrated and the fluctuation range is smaller, proving the high stability of the proposed method in multiple experiments.

[0092] Table 3 compares the malware detection performance (%) of OMVDroid and the baseline method:

[0093] ;

[0094] To verify the robustness and generalization ability of the proposed OMVDroid method in complex scenarios, a time evolution experiment was designed. The experiment used samples from 2017–2019 as the training set, and tested the model on data from 2020–2024. The AUT metric was used to evaluate the model's performance stability over time series.

[0095] ;

[0096] in, This represents the time stability index calculated based on the function f under the condition of a time series length of N, where f is the performance index function of the model on the test set in different years (e.g., precision, recall, accuracy, F1 score), N represents the total number of test years, f(k) represents the performance index value of the model on the test set in the k-th year, and f(k+1) represents the performance index value of the model in the (k+1)-th year. The summation operator is used to accumulate the performance mean across all adjacent year intervals. `k` is the summation index variable, ranging from `k∈{1,2,…,N-1}`. The AUT value is the average of the model's performance mean across consecutive years, ranging from 0 to 1. A value closer to 1 indicates a more stable performance over the time series. The AUT evaluation results for each method in the time evolution experiment are shown in Table 4. Figure 4 The trends of F1 values ​​for each method are shown from 2020 to 2024.

[0097] Table 4 shows the robustness evaluation results (%) of each method in the Android evolution scenario for the AUT:

[0098] ;

[0099] Furthermore, this invention also designed code obfuscation experiments, using the Obfuscapk tool to generate three typical obfuscation samples: class renaming, code rearrangement, and reflection, to evaluate the detection performance of each method under different obfuscation strategies. The detection performance results of each method under the three obfuscation scenarios are shown in Table 5. Experimental results show that the OMVDroid method proposed in this invention has strong robustness under both time evolution and code obfuscation complex scenarios. Table 5 shows the robustness evaluation (%) of each method under different code obfuscation strategies:

[0100] ;

[0101] In summary, this invention proposes an Android malware detection method based on multi-view learning. By integrating CodeBERT semantic embedding, function call graph structure representation, multi-hop adaptive attention mechanism, and multi-channel graph representation learning, a highly robust and generalizable malware detection framework is constructed. Experimental results show that this method outperforms existing baseline methods in terms of detection accuracy, recall, F1 score, and temporal evolution stability. Furthermore, it exhibits superior robustness in code obfuscation and cross-temporal scenarios, demonstrating significant application value.

Claims

1. An Android malware detection method based on multi-view learning, characterized in that, The steps include the following: Step 1: Decompile the Android application, extract function call relationships, opcode sequences and permission information, construct a function call graph and extract sensitive behavior subgraphs; Step 2: Use the pre-trained code representation model CodeBERT to semantically encode the method-level opcode sequence and fuse it with permission features to generate node semantic vectors; Step 3: Construct a multi-view graph neural network, generate multi-view inputs through a feature masking enhancement strategy, and introduce a multi-hop adaptive attention mechanism to achieve dynamic aggregation of multi-hop neighborhood information. At the same time, a multi-channel coding structure is used to learn complementary graph representations. Step 4: The multi-channel node representations are fused, a relation matrix is ​​constructed through key-value mapping, and a graph-level representation is generated through convolution and pooling. Finally, the representation is input into the classification model to achieve Android malware detection.

2. The method according to claim 1, characterized in that, The specific implementation of step 1 includes the following steps: Step 1.1: Use the static analysis tool Androguard to decompile the APK file and extract function call relationships, opcode sequences, and permission information; Step 1.2: Based on the API-permission mapping relationship provided by PSCount and Axplorer, identify function calls related to sensitive permissions and treat them as a set of sensitive APIs. Using each sensitive API as the center, use breadth-first search to extract context neighbor nodes of a fixed depth and construct a sensitive API subgraph to reduce the complexity of the graph structure and highlight key behaviors. Step 1.3 integrates all sensitive API subgraphs into a complete function call graph representation, where nodes represent functions and edges represent function call relationships. Each node is initialized with preliminary features, including permissions and opcode sequences, to provide basic input for subsequent semantic encoding and graph representation learning.

3. The method according to claim 1, characterized in that, The specific implementation of step 2 includes the following steps: Step 2.1: For each function node, decompile the DEX file to obtain Smali code, extract the complete Dalvik opcode sequence from the method body, and construct a discrete opcode token sequence according to the execution order; Step 2.2: Use the pre-trained code representation model CodeBERT to perform contextual semantic encoding on the opcode sequence, mapping the discrete instruction sequence into a continuous vector representation; Step 2.3: Strengthen the semantic information of key opcodes through gating attention pooling to form an input representation that is highly discriminative and robust to node behavior.

4. The method according to claim 1, characterized in that, The specific implementation of step 3 includes the following steps: Step 3.1 In multi-view graph representation learning, a feature masking enhancement strategy is introduced to randomly mask the node features of each graph encoding channel to simulate feature loss and noise interference. Step 3.2: A multi-hop adaptive attention mechanism is adopted to perform weighted fusion of neighborhood features with different numbers of hops in the graph neural network, so that the model can adaptively select the optimal neighborhood perception range. Step 3.3: Complementary feature learning is achieved through a multi-channel graph structure. Different channels independently learn node representations under different feature perturbation intensities and neighborhood perception conditions, thereby constructing a multi-view graph representation to fully capture the multi-scale structure and semantic characteristics of nodes and graphs.

5. The method according to claim 1, characterized in that, The specific implementation of step 4 includes the following steps: Step 4.1: Construct an intra-channel relation matrix by key-value mapping for the node representations of all channels to preserve the global statistical associations between nodes, and apply two-dimensional convolution and pooling operations to the multi-channel relation matrix to obtain a unified graph-level embedding vector. Step 4.2: Input the graph-level embedding vector into the classifier for discrimination to achieve Android malware detection.

Images