A Machine Learning Malware Detection Method Based on Privilege Features and Taint Features

Abstract

This paper discloses a machine learning malware detection method based on privilege features and taint features. This method improves the existing taint analysis-based detection scheme based on privilege features, and can achieve high classification results while using less data volume. By expanding the multi-dimensional calculation of feature values, a feature value table based on privilege features, taint source features, and taint sink features is constructed, and a Transformer is introduced to analyze and detect it. This is a good implementation of malware detection based on the Android platform.

Description

Technical Field

[0001] The present invention relates to a machine learning malware detection method based on privilege features and taint features, and belongs to the technical field of information security. Background Art

[0002] With the rapid development of mobile devices, the security problems of application software have become increasingly prominent. Even applications downloaded from official app stores may have many problems. These applications may access some sensitive information, such as the location of the device, contacts, call records, and IMEI (International Mobile Equipment Identity). In addition, social-related application programs and bank-related application programs also collect and store a large amount of sensitive data and private information, such as chat records in social software, bank passwords in bank-related application programs, etc. The consequences of these behaviors, whether intentional or unintentional, are unpredictable. The leakage of sensitive data from popular application programs has been widely recognized.

[0003] Mobile operating systems, such as Android, use a permission system to restrict the permissions of application programs to ensure the integrity of Android application programs obtained and some other related security mechanisms, such as accessing and filtering sensitive data. However, the existing systems still do not solve the security threats introduced by Android application programs.

[0004] For malware detection, many researchers divide it into static analysis and dynamic analysis. Static taint analysis first constructs a function call graph based on bytecode files; then extracts metadata to identify sensitive information; finally, identifies possible leakage paths through propagation pollution analysis of the call graph. However, due to insufficient context analysis, there is a high false positive rate. Dynamic analysis is to detect and observe during the running process of the program in a simulated environment or a real environment, either based on behavior analysis or based on taint analysis, to determine whether there is a malicious behavior tendency in the running process of the application program. However, dynamic analysis as a service running will inevitably occupy additional memory and resources of the system, reducing the performance of the mobile phone, and when the dynamic monitoring program is attacked, it will expose sensitive information and leak higher-level permissions. Therefore, aiming at the problems of time-consuming, memory-intensive of dynamic taint analysis and insufficient features of static taint analysis, the present invention proposes a malware detection scheme based on permission features and taint features, and uses a deep learning algorithm to effectively improve the results of malware detection and classification. Summary of the Invention

[0005] The technical problem to be solved by the present invention is: to provide a machine learning malware detection method based on privilege features and taint features, which combines permission features and taint features to protect the privacy information of users.

[0006] The present invention adopts the following technical solutions to solve the above technical problems: A machine learning malware detection method based on privilege features and taint features of the present invention is a lightweight context-based Android malware detection solution, which extends the multi-dimensional calculation of feature values and constructs a feature value table based on privilege features, taint source features, and taint sink features. Among them, the feature extraction stage includes the following steps:

[0007] Step 1: Unzip the APK file to obtain the AndroidMainfest.xml file;

[0008] Step 2: Decompile the AndroidMainfest.xml file and extract the permission information from it;

[0009] Step 3: Use FlowDroid to extract sink features, source features, and path features;

[0010] The feature preprocessing and calculation stage includes the following steps:

[0011] Step 4: Calculate the frequency of occurrence of each permission to obtain a feature value table for a single permission;

[0012] Step 5: Calculate the overall permission feature value of a single program according to Step 4;

[0013] Step 6: Calculate the feature values of sink features, source features, and path features. When the leakage path is 0, the calculation of the feature values of Source features and Sink features is the same as that of the permission feature values; when the leakage path is not 0, the feature values of Source and Sink are affected by the Path feature value. For each additional Path, the corresponding feature values of Source and Sink increase proportionally by P.

[0014] Step 7: Use a deep learning algorithm for detection and classification.

[0015] As a preferred solution of the present invention, the proportion P described in Step 6 is 10%.

[0016] As a preferred solution of the present invention, in Step 4, calculate the frequency of occurrence of each permission to obtain a feature value table for a single permission; the specific process is as follows:

[0017] First, extract the M types of permissions with the highest frequency of occurrence from N Android malware; calculate the frequency of occurrence of each permission, multiply the frequency by 100 as the feature value of each permission to obtain a feature value table for a single permission, and record the feature value as:

[0018]

[0019] As a preferred embodiment of the present invention, in step 5, calculating the overall permission eigenvalue of a single program is carried out as follows:

[0020] Based on the permissions extracted from a single Android application itself, calculate according to the eigenvalues given in the eigenvalue table, and then obtain the permission eigenvalue of the Android application. The calculation formula is as follows:

[0021]

[0022] Where refers to the existence of the i-th characteristic permission. 0 indicates that the permission characteristic does not exist, and 1 indicates that the permission characteristic exists. represents the eigenvalue of the i-th characteristic permission.

[0023] As a preferred embodiment of the present invention, in step 6, the Source feature, Sink feature, and Path feature are very important. When a Path appears, it means there is a possibility of data leakage, which will increase the risk level of the Android application by one level. And for each additional possible leakage path, the possibility of data leakage is greater, and the risk of the program is also higher. Therefore, the V permission and V Source values are affected by V Path ; Take the number of discovered leakage paths as the eigenvalue of the Path feature.

[0024] The Source feature is the set of all Sources obtained from taint analysis. It is the interface for introducing untrusted data and the APIs called when the APP accesses dangerous permissions. We will quantify the extracted Source feature to obtain the Source feature value of the measured Android application.

[0025] The Sink feature is the set of all Sinks obtained from taint analysis. It is the call of sensitive APIs that may cause privacy leakage. We will quantify the extracted Sink feature to obtain the Sink feature value of the measured Android application.

[0026] The Path feature is the set of all reachable paths from the Source set to the Sink set. The existence of such one or more paths indicates the possibility of data leakage in the measured Android application. We will quantify the extracted Path feature.

[0027] Calculate the eigenvalue of the sink feature and the source feature as follows:

[0028] When V PathWhen V = 0, that is, in the premise of no leakage found, the eigenvalue calculations of the Source feature and the Sink feature are the same as those of the permission. From the extraction of the Source feature and the Sink feature, it is found that the number of Sink features is more than that of the Source. The Source feature selects N source features, while the Sink feature selects N sink features, where N sink is greater than or equal to 2N source ;

[0029] When V Path = 0, the formula for calculating the Source feature value is as follows:

[0030]

[0031] where represents the existence of the i-th Source feature value. 0 means the Source feature does not exist, and 1 means the Source feature exists. represents the eigenvalue of the i-th Source feature.

[0032] The calculation of the Sink feature value is the same as that of the Source feature value, and the formula is as follows:

[0033]

[0034] where represents the existence of the i-th Sink feature value. 0 means the Sink feature does not exist, and 1 means the Sink feature exists. represents the eigenvalue of the i-th Sink feature.

[0035] When V Path ≠ 0, that is, when a possible leakage path appears, the eigenvalue of the Source and the Sink is affected by the Path eigenvalue. When the Path eigenvalue is 0, the calculated Source eigenvalue is denoted as V′ Source , and the Sink eigenvalue is denoted as V′ Sink . For each additional Path, the corresponding eigenvalue is increased by the ratio P. At this time, the calculation of the Source eigenvalue is as follows:

[0036] V Source = V′ Source *(1 + P * V Path )

[0037] The calculation of the Sink eigenvalue is the same as that of the Source eigenvalue, and the formula is as follows:

[0038] V Sink = V′ Sink*(1 + P * V Path )

[0039] Compared with the prior art, the present invention adopts the above technical solution and has the following technical effects:

[0040] 1. The present invention performs multi-dimensional calculations from the perspective of privilege features, taint source features, and taint convergence point features, making up for the shortcoming of high false alarm rate caused by insufficient feature dimensions.

[0041] 2. The present invention uses a deep learning algorithm, which can process code context in parallel, not only effectively improving the classification result of malware detection, but also greatly reducing the volume of the dataset. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 is a flowchart of a machine learning malware detection method based on privilege features and taint features according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0043] The following describes in detail the embodiments of the present invention. The examples of the embodiments are shown in the drawings. The embodiments described below by referring to the drawings are exemplary and are only used to explain the present invention, and should not be construed as a limitation to the present invention.

[0044] As Figure 1 shown, the present invention provides a machine learning malware detection method based on privilege features and taint features, which specifically includes the following steps:

[0045] Step 1: Unzip the APK file to obtain the AndroidMainfest.xml file;

[0046] Step 2: Decompile the AndroidMainfest.xml file and extract the permission information from it;

[0047] Step 3: Use FlowDroid to extract sink features, source features, and path features;

[0048] Step 4: Calculate the frequency of each permission occurrence to obtain a feature value table for individual permissions;

[0049] First, extract the top M permissions with the highest occurrence frequency from N Android malware. In this embodiment, N = 100 and M = 30 are selected; and calculate the frequency of each permission occurrence, multiply the frequency by 100 as the feature value of each permission, and obtain a feature value table for individual permissions. Denote the feature value as:

[0050]

[0051] Step 5: Calculate the overall permission feature value of a single program according to Step 4

[0052] Calculate according to the permissions extracted from a single Android application itself and the eigenvalues given in the eigenvalue table, and then obtain the permission eigenvalue of the Android application. The calculation formula is as follows:

[0053]

[0054] Where refers to the existence of the i-th characteristic permission. 0 indicates that the permission characteristic does not exist, and 1 indicates that the permission characteristic exists. represents the eigenvalue of the i-th characteristic permission.

[0055] Step 6: Calculate the eigenvalues of the sink feature, source feature, and path feature. When the leakage path is 0, the calculation of the eigenvalues of the Source feature and Sink feature is the same as that of the permission eigenvalue; when the leakage path is not 0, the eigenvalues of Source and Sink are affected by the Path eigenvalue. For each additional Path, the corresponding eigenvalue is increased by 10%.

[0056] The Source feature, Sink feature, and Path feature are very closely related. When there is one Path, it means there is a possibility of data leakage, which will increase the risk level of the Android application by one level. And for each additional possible leakage path, the possibility of data leakage becomes greater, and the risk of the program is also higher. Therefore, the eigenvalue V Sink and V Source values are affected by V Path . Take the number of discovered leakage paths as the eigenvalue of the Path feature. The specific process of Step 6 is as follows:

[0057] When V Path = 0, that is, when no leakage is found, the calculation of the eigenvalues of the Source feature and Sink feature is the same as that of the permission eigenvalue. From the extraction of the Source feature and Sink feature, it is found that the number of Sink features is more than that of Source. So the Source feature selects N source features, while the Sink feature selects N sink features, where N sink is greater than or equal to 2N source . In this embodiment, the Source feature selects 50 features, and the Sink feature selects 100 eigenvalues. When V Path = 0, the calculation formula of the Source eigenvalue is as follows:

[0058]

[0059] wherein represents the existence of the i-th Source eigenvalue, 0 indicates the non-existence of the Source feature, and 1 indicates the existence of the Source feature, then represents the eigenvalue of the i-th Source feature.

[0060] The calculation of the Sink eigenvalue is the same as that of the Source eigenvalue, and the formula is as follows:

[0061]

[0062] wherein represents the existence of the i-th Sink eigenvalue, 0 indicates the non-existence of the Sink feature, and 1 indicates the existence of the Sink feature, then represents the eigenvalue of the i-th Sink feature.

[0063] When V Path ≠ 0, that is, when a possible leakage path appears, the eigenvalues of Source and Sink are affected by the Path eigenvalue. When the Path eigenvalue is 0, the calculated Source eigenvalue is denoted as V′ Source , and the Sink eigenvalue is denoted as V′ Sink . For each additional Path, 10% is added to the corresponding eigenvalue. At this time, the calculation of the Source eigenvalue is as follows:

[0064] V Source = V′ Source *(1 + 10% * V Path )

[0065] The calculation of the Sink eigenvalue is the same as that of the Source eigenvalue, and the formula is as follows:

[0066] V Sink = V′ Sink *(1 + 10% * V Path )

[0067] Step 7, use a deep learning algorithm for detection and classification.

[0068] By adopting a deep learning algorithm, the code can be processed in parallel, which not only effectively improves the classification result of malware detection but also greatly reduces the volume of the dataset.

[0069] The above embodiments are only used to illustrate the technical idea of the present invention, and the protection scope of the present invention cannot be limited thereby. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention fall within the protection scope of the present invention.

Claims

1. A machine learning malware detection method based on privilege features and taint features, characterized in that, It includes the following steps: Step 1: Decompress the APK file to obtain the AndroidMainfest.xml file; Step 2: Decompile the AndroidMainfest.xml file and extract the permission information from it; Step 3: Use FlowDroid to extract sink features, source features, and path features; Step 4: Calculate the frequency of each permission occurrence to obtain the eigenvalue table of a single permission; Step 5: Calculate the overall permission eigenvalue of a single program according to Step 4; Step 6: Calculate the eigenvalues of sink features, source features, and path features. When the leakage path is 0, the calculation of the eigenvalues of Source features and Sink features is the same as that of the permission eigenvalues; when the leakage path is not 0, the eigenvalues of Source and Sink are affected by the Path eigenvalue. For each additional Path, the corresponding eigenvalues of Source and Sink increase proportionally by P; Step 7: Use deep learning algorithms for detection and classification.

2. The machine learning malware detection method based on privilege features and taint features according to claim 1, characterized in that The proportion P mentioned in Step 6 is 10%.

3. The machine learning malware detection method based on privilege features and taint features according to claim 1, wherein In Step 4, calculate the frequency of each permission occurrence to obtain the eigenvalue table of a single permission; the specific process is as follows: First, extract the M permissions with the highest occurrence frequencies from N Android malware; calculate the frequency of each permission occurrence, multiply this frequency by 100 as the eigenvalue of each permission, obtain the eigenvalue table of a single permission, and denote the eigenvalue as:

4. The machine learning malware detection method based on privilege features and taint features according to claim 1, wherein In Step 5, calculate the overall permission eigenvalue of a single program, and the specific process is as follows: According to the permissions extracted from a single Android application itself, calculate according to the eigenvalues given in the eigenvalue table, and then obtain the permission eigenvalue of the Android application. The calculation formula is as follows: Among them, refers to the existence of the i-th feature permission, where 0 indicates the non-existence of the permission feature and 1 indicates the existence of the permission feature. represents the feature value of the i-th feature permission.

5. The machine learning malware detection method based on privilege features and taint features according to claim 1, characterized in that In Step 6, calculate the eigenvalues of sink features, source features, and path features, and the specific process is as follows: Take the number of discovered leakage paths as the eigenvalue of the Path feature; When V Path = 0, that is, on the premise that no leakage is detected, the eigenvalue calculations of the Source feature and the Sink feature are the same as those of the permission. The Source feature selects N source features, while the Sink feature selects N sink features, where N sink is greater than or equal to 2N source ; When V Path = 0, the calculation formula for the Source eigenvalue is as follows: Among them, represents the existence of the i-th Source eigenvalue. 0 indicates the non-existence of the Source feature, and 1 indicates the existence of the Source feature. represents the eigenvalue of the i-th Source feature; The calculation of the Sink eigenvalue is the same as that of the Source eigenvalue, and the formula is as follows: Among them, represents the existence of the i-th Sink eigenvalue. 0 indicates the absence of this Sink feature, and 1 indicates the presence of this Sink feature. represents the eigenvalue of the i-th Sink feature; When V Path ≠ 0, that is, when there is a possible leakage path, the eigenvalues of Source and Sink are affected by the eigenvalue of Path. Denote the eigenvalue of Source calculated when the eigenvalue of Path is 0 as V′ permission , and denote the eigenvalue of Sink as V′ Source . For each additional Path, increase the corresponding eigenvalue by 10%. At this time, the eigenvalue of Source is calculated as follows: V Source = V' Source *(1 + 10% * V Path ) The calculation of the Sink eigenvalue is the same as that of the Source eigenvalue, and the formula is as follows: V Sink = V' Sink *(1 + 10% * V Path ).

Images