Android malicious application classification method based on graph convolution

Abstract

The method for classifying malicious Android applications based on graph convolution relates to the field of information technology. The steps of the present invention include: 1) decompiling APK files; 2) extracting the calling relationship of malicious code program blocks and the instruction distribution characteristics of malicious code program blocks; 3) selecting key program blocks according to the importance associated with the malicious code program blocks; 4) performing dimensionality reduction and nonlinear transformation on the instruction distribution characteristics of the malicious code program blocks; 5) fusing the embedded features of the malicious code program block calling relationship graph with the transformed malicious code program block instruction distribution characteristics; 6) establishing a graph convolutional neural network model; 7) sorting and filtering nodes; 8) using the convolutional neural network to classify malware into families; the present invention constructs a graph based on the calling relationship and program block characteristics, makes full use of the graph features to establish a graph neural network model to identify malicious applications and classify them, and effectively improves the recognition accuracy.

Description

Technical Field

[0001] The present invention relates to the field of information technology. Background Art

[0002] Android is a free and open source operating system developed by Google and the Open Handset Alliance. It is mainly used in mobile devices such as smartphones and tablets. With the rapid development of mobile Internet, the number of Android terminal users has increased significantly, and malicious applications have gradually become rampant. In addition to the well-known Trojans and viruses, there are also ransomware, advertising and spyware. Mobile malware detection has become a hot issue in the field of network security.

[0003] At present, malware detection mainly includes static and dynamic methods. Static analysis mainly extracts the permissions, API sequences, codes and other features of Android programs, while dynamic analysis technology requires simulating the program's real machine operation and capturing the software's behavioral features as the basis for analysis. Compared with dynamic analysis, static analysis has the characteristics of fast analysis speed and less resource consumption. There are mainly detection methods based on signatures and detection methods based on machine learning.

[0004] The malware detection method based on signature code mainly extracts the signature code of the target software to be detected and matches it with the known malware signature code recognition library. If the match is successful, the target software is defined as malware, otherwise it is normal software. Common signature codes mainly include digital signatures of Android applications, common API functions and sensitive permissions of malware, etc.

[0005] The main principle of the detection method based on machine learning is to extract the different dimensional features of the program through analysis. Each application is represented by a multi-dimensional vector. Finally, the training set samples are trained using the machine learning classification algorithm to build a classifier to predict whether the unknown samples are malicious. Machine learning classification algorithms include: support vector machines, random forests, neural networks, etc. Common feature dimensions include permissions, components, APIs, and APP description information.

[0006] The signature-based identification method identifies by comparing with the malware signature database. This method has the characteristics of fast speed, high accuracy, and strong interpretability, but it is highly dependent on the signature database. At the same time, with the continuous emergence of new malware, the library needs to be constantly updated, which consumes a lot of manpower and time costs, and it is easy to change the signature through techniques such as obfuscation, thereby bypassing malicious detection.

[0007] The machine learning-based algorithm uses feature extraction to represent malware in the form of multi-dimensional vectors, and then trains a classifier for identification. This method can quickly discover variant applications of known malicious families, and can perform in-depth feature analysis to screen important features. However, this method only analyzes the static information of the program and ignores the calling relationship between software programs.

[0008] The present invention proposes a malicious application identification method based on graph convolution. The Dalvik bytecode is obtained by decompiling the APK file, and the Dalvik bytecode is divided into program blocks according to the execution order of Dalvik instructions. Each program block has different instructions, and there is a calling relationship between program blocks. A graph convolutional neural network model is established to classify malicious applications. Prior art

[0009] Dalvik is a virtual machine designed by Google specifically for the Android operating system. It has been deeply optimized. Davilk bytecode has only two types: basic types and reference types. Objects and arrays are both reference types. The description of bytecode types in Davilk is consistent with the descriptor rules in JVM.

[0010] Dalvik bytecode has its own set of instructions, similar to assembly language. A Dalvik instruction contains the corresponding opcode and operand. The Dalvik instructions in a function can be divided into basic blocks according to their execution order. Each basic block consists of several Dalvik instructions. Dalvik bytecode has 244 different instructions. Smali files store Dalvik bytecode. Smali supports annotations, debugging information, and line number information. Smali supports the basic features of Java and is generally used for reverse engineering of Android programs.

[0011] The article "Android Native Code Control Flow Graph Extraction Method Based on Symbolic Execution" published in the Journal of Network and Information Security, Vol. 3, No. 7, July 2017. The article proposes a method to use symbolic substitution method to execute Dalvik bytecode to extract program call graph and instruction distribution characteristics within program blocks. Summary of the invention

[0012] In view of the shortcomings of the prior art, the present invention provides an Android malicious application classification method based on graph convolution, which includes: 1) decompiling APK files; 2) extracting the calling relationship of malicious code blocks and the instruction distribution characteristics of malicious code blocks; 3) selecting key blocks according to the importance associated with malicious code blocks; 4) performing dimensionality reduction and nonlinear transformation on the instruction distribution characteristics of malicious code blocks; 5) fusing the embedded features of the malicious code block calling relationship graph with the transformed malicious code block instruction distribution characteristics; 6) establishing a graph convolutional neural network model; 7) sorting and filtering nodes; 8) using the convolutional neural network to classify malware into families;

[0013] The specific implementation steps of the Android malicious application classification method based on graph convolution are as follows:

[0014] 1) Decompile the APK file

[0015] Use the tool apktool to decompile the Android application to get the Smali intermediate code;

[0016] 2) Extract the calling relationship of the malicious code program block and the instruction distribution characteristics of the malicious code program block

[0017] Smali files store Dalvik bytecodes, and the known malicious code library is used to compare the Smali intermediate code to find the malicious code; the symbolic substitution method is used to execute based on Dalvik bytecode to extract the program call relationship, clarify the call relationship between malicious code program blocks and non-malicious code program blocks, mark and number malicious code program blocks, mark and number non-malicious code program blocks that have a direct call relationship with malicious code; mark and number non-malicious code program blocks that have an indirect call relationship with malicious code; Dalvik bytecode has 244 different instructions, and the instruction distribution characteristics of the malicious code program block are determined based on the instructions in the malicious code program block;

[0018] 3) Select key program blocks based on the importance associated with the malicious code program blocks;

[0019] Calculate the importance of each program block to the malicious code family: ;

[0020] ;

[0021] TF-IDF=TF*IDF;

[0022] in is the number of times block i appears in malicious family j, is the sum of the number of occurrences of all program blocks in j types of files, is the total number of malicious applications, is the number of malicious applications that contain program block i;

[0023] After calculating the importance of each program block to the malicious code family, the importance ranking is in the top three quarters as the threshold, and the program blocks that are ranked outside the top three quarters of the importance ranking to the malicious code family are removed to form a malicious code program block call relationship graph;

[0024] 4) Dimensionality reduction and nonlinear transformation of the malicious code block instruction distribution characteristics

[0025] Dalvik bytecode has 244 different instructions. The instruction distribution feature of the malicious code block is a 244-dimensional vector e i ;

[0026] Perform dimension reduction and nonlinear transformation on the distribution characteristics of malicious code program block instructions: ;

[0027] Where E i is the transformed malicious code block instruction distribution feature, the vector dimension is 100, W is the transformation weight parameter matrix, obtained through model training, g is the activation function, which is used to perform nonlinear transformation on the feature and enhance the expression ability of the model. Here, the RELU activation function is used, and the function expression is: F(x)=max(0, x);

[0028] 5) Fusion of embedded features of malicious code block call relationship graph and transformed malicious code block instruction distribution features

[0029] Each node in the malicious code block call relationship graph is embedded with a multidimensional vector G i Represents, as a graph embedding feature, the vector dimension i is the same as the instruction distribution transformation feature E i ; Use I i represents the fusion feature, ,in , is the weight parameter obtained through model training; I i The dimension of the feature fusion matrix I is N*d, where N is the number of program block nodes and d is the dimension of node embedding;

[0030] 6) Build a graph convolutional neural network model

[0031] The adjacency matrix of the malicious code block call relationship graph is A, then A ij Indicates that there is a calling relationship between program block i and program block j, and the corresponding position value is 1. If there is no calling relationship, the corresponding position is 0. Define the degree of the node in the malicious code program block call relationship graph as D, and the degree of the node represents the number of connections associated with the target node;

[0032] For graph feature extraction, we use a multi-layer neural network structure. For each layer, we use the mapping function to calculate; H1 is the graph embedding expression of the lth layer, H0 represents the initialization node expression matrix of the 0th layer, that is, the feature fusion matrix I; f is a nonlinear function; the graph convolution network can be regarded as a recursive calculation of multiple graph convolutions, and the nonlinear function of each layer can be expressed as:

[0033] in, , E N is the N-dimensional identity matrix, and is added to the identity matrix to add self-connection; is the in-degree matrix of all program block nodes, is the activation function, and the function expression is: ;

[0034] 7) Sorting and filtering nodes

[0035] Sort the node embeddings according to the inner product value of the embedding vector and select the first 50 nodes with similar values;

[0036] 8) Convolutional neural network for malware family classification;

[0037] A convolutional neural network model is established, and the 50 nodes obtained after screening are embedded in the matrix for convolution calculation, and then connected to the fully connected layer to classify malicious applications.

[0038] Beneficial Effects

[0039] Applications in the same malicious family always have many common features and similar behaviors. Most malware are derivative variants of known malicious families. The present invention considers the program similarity of malicious families, extracts program blocks of malicious code, constructs a graph based on call relationships and program block features, and fully utilizes graph features to establish a graph neural network model to identify malicious applications and classify them, effectively improving the accuracy of recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0041] Embodiment 1

[0042] See also Figure 1The Android malicious application classification method based on graph convolution provided by the present invention includes: S01 decompiling APK files; S02 extracting the calling relationship of malicious code program blocks and the instruction distribution characteristics of malicious code program blocks; S03 selecting key program blocks according to the importance associated with the malicious code program blocks; S04 performing dimensionality reduction and nonlinear transformation on the instruction distribution characteristics of the malicious code program blocks; S05 fusing the embedded features of the malicious code program block calling relationship graph with the transformed malicious code program block instruction distribution characteristics; S06 establishing a graph convolutional neural network model; S07 sorting and filtering nodes; S08 using the convolutional neural network to classify malware into families;

[0043] The specific implementation steps of the Android malicious application classification method based on graph convolution are as follows:

[0044] S01) Decompile APK file

[0045] Use the tool apktool to decompile the Android application to get the Smali intermediate code;

[0046] S02) Extract the calling relationship of the malicious code program block and the instruction distribution characteristics of the malicious code program block

[0047] Smali files store Dalvik bytecodes, and the known malicious code library is used to compare the Smali intermediate code to find the malicious code; the symbolic substitution method is used to execute based on Dalvik bytecode to extract the program call relationship, clarify the call relationship between malicious code program blocks and non-malicious code program blocks, mark and number malicious code program blocks, mark and number non-malicious code program blocks that have a direct call relationship with malicious code; mark and number non-malicious code program blocks that have an indirect call relationship with malicious code; Dalvik bytecode has 244 different instructions, and the instruction distribution characteristics of the malicious code program block are determined based on the instructions in the malicious code program block;

[0048] S03) selecting a key program block according to the importance associated with the malicious code program block;

[0049] Calculate the importance of each program block to the malicious code family: ;

[0050] ;

[0051] TF-IDF=TF*IDF;

[0052] in is the number of times block i appears in malicious family j, is the sum of the number of occurrences of all program blocks in j types of files, is the total number of malicious applications, is the number of malicious applications that contain program block i;

[0053] After calculating the importance of each program block to the malicious code family, the importance ranking is in the top three quarters as the threshold, and the program blocks that are ranked outside the top three quarters of the importance ranking to the malicious code family are removed to form a malicious code program block call relationship graph;

[0054] S04) Perform dimension reduction and nonlinear transformation on the distribution characteristics of malicious code program blocks and instructions

[0055] Dalvik bytecode has 244 different instructions. The instruction distribution feature of the malicious code block is a 244-dimensional vector e i ;

[0056] Perform dimension reduction and nonlinear transformation on the distribution characteristics of malicious code program block instructions: ;

[0057] Where E i is the transformed malicious code block instruction distribution feature, the vector dimension is 100, W is the transformation weight parameter matrix, obtained through model training, g is the activation function, which is used to perform nonlinear transformation on the feature and enhance the expression ability of the model. Here, the RELU activation function is used, and the function expression is: F(x)=max(0, x);

[0058] S0 5) Fusion of embedded features of malicious code block call relationship graph and transformed malicious code block instruction distribution features

[0059] Each node in the malicious code block call relationship graph is embedded with a multidimensional vector G i Represents, as a graph embedding feature, the vector dimension i is the same as the instruction distribution transformation feature E i ; Use I i represents the fusion feature, ,in , is the weight parameter obtained through model training; I i The dimension of the feature fusion matrix I is N*d, where N is the number of program block nodes and d is the dimension of node embedding;

[0060] S06) Build a graph convolutional neural network model

[0061] The adjacency matrix of the malicious code block call relationship graph is A, then A ij Indicates that there is a calling relationship between program block i and program block j, and the corresponding position value is 1. If there is no calling relationship, the corresponding position is 0. Define the degree of the node in the malicious code program block call relationship graph as D, and the degree of the node represents the number of connections associated with the target node;

[0062] For graph feature extraction, we use a multi-layer neural network structure. For each layer, we use the mapping function to calculate; H1 is the graph embedding expression of the lth layer, H0 represents the initialization node expression matrix of the 0th layer, that is, the feature fusion matrix I; f is a nonlinear function; the graph convolution network can be regarded as a recursive calculation of multiple graph convolutions, and the nonlinear function of each layer can be expressed as:

[0063] in, , E N is the N-dimensional identity matrix, and is added to the identity matrix to add self-connection; is the in-degree matrix of all program block nodes, is the activation function, and the function expression is: ;

[0064] S07) Sorting and filtering nodes

[0065] Sort the node embeddings according to the inner product value of the embedding vector and select the first 50 nodes with similar values;

[0066] S08) Convolutional neural network for malware family classification;

[0067] A convolutional neural network model is established, and the 50 nodes obtained after screening are embedded in the matrix for convolution calculation, and then connected to the fully connected layer to classify malicious applications.

Claims

1. The Android malicious application classification method based on graph convolution is characterized by include: 1) Decompile the APK file; 2) extracting the calling relationship of the malicious code program block and the instruction distribution characteristics of the malicious code program block; 3) Select key program blocks according to the importance associated with the malicious code program blocks; 4) Perform dimensionality reduction and nonlinear transformation on the malicious code program block instruction distribution features; 5) Fusion the embedded features of the malicious code program block call relationship graph with the transformed malicious code program block instruction distribution features; 6) Establish a graph convolutional neural network model; 7) Sort and filter nodes; 8) Convolutional neural network classifies malware families; The specific implementation steps of the Android malicious application classification method based on graph convolution are as follows: 1) Decompile the APK file Use the tool apktool to decompile the Android application to get the Smali intermediate code; 2) Extract the calling relationship of the malicious code program block and the instruction distribution characteristics of the malicious code program block Smali files store Dalvik bytecodes, and the known malicious code library is used to compare the Smali intermediate code to find the malicious code; the symbolic substitution method is used to execute Dalvik bytecodes to extract the program call relationship, clarify the call relationship between malicious code blocks and non-malicious code blocks, mark and number malicious code blocks, mark 566556 and number non-malicious code blocks that have direct call relationships with malicious code; mark and number non-malicious code blocks that have indirect call relationships with malicious code; Dalvik bytecode has 244 different instructions, and the instruction distribution characteristics of malicious code blocks are determined based on the instructions in the malicious code blocks; 3) Select key program blocks according to the importance associated with the malicious code program blocks; calculate the importance of each program block to the malicious code family: TF-IDF=TF*IDF; Where n ij is the number of times block i appears in malicious family j, is the total number of occurrences of all program blocks in type j files, |D| is the total number of malicious applications, |{j:t i ∈d j }| is the number of malicious applications that contain program block i; After calculating the importance of each program block to the malicious code family, the importance ranking is in the top three quarters as the threshold, and the program blocks that are ranked outside the top three quarters of the importance ranking to the malicious code family are removed to form a malicious code program block call relationship graph; 4) Perform dimensionality reduction and nonlinear transformation on the distribution characteristics of malicious code program blocks Dalvik bytecode has 244 different instructions. The instruction distribution feature of the malicious code block is a 244-dimensional vector e i ; Perform dimension reduction and nonlinear transformation on the distribution characteristics of malicious code program blocks: i = g(We i ); Where E i is the transformed malicious code block instruction distribution feature, the vector dimension is 100, W is the transformation weight parameter matrix, obtained through model training, g is the activation function, which is used to perform nonlinear transformation on the feature and enhance the expression ability of the model. Here, the RELU activation function is used, and the function expression is: F(x)=max(0,x); 5) The embedded features of the malicious code block call relationship graph are fused with the transformed malicious code block instruction distribution features. Each node in the malicious code block call relationship graph is embedded with a multidimensional vector G. i Representation, as a graph embedding feature; Use I i represents the fusion feature, I i =αE i +βG i , where α and β are weight parameters obtained through model training; I i The dimension of the feature fusion matrix I is N*d, where N is the number of program block nodes and d is the dimension of node embedding; 6) Build a graph convolutional neural network model The adjacency matrix of the malicious code block call relationship graph is A, then A ij Indicates that there is a calling relationship between program block i and program block j, and the corresponding position value is 1. If there is no calling relationship, the corresponding position is 0. Define the degree of the node in the malicious code program block call relationship graph as D, and the degree of the node represents the number of connections associated with the target node; A multi-layer neural network structure is used for graph feature extraction. For each layer, a mapping function H is used. 1+1 =f(H1,A); H1 is the graph embedding expression of the lth layer, H0 represents the initialization node expression matrix of the 0th layer, that is, the feature fusion matrix I; f is a nonlinear function; the graph convolution network is regarded as a recursive calculation of multiple graph convolutions, and the nonlinear function of each layer can be expressed as: in, E N It is the N-dimensional identity matrix, and is added to the identity matrix to add self-connection; is the in-and-out degree matrix of all program block nodes, σ is the activation function, and the function expression The formula is: 7) Sorting and filtering nodes Sort the node embeddings according to the inner product value of the embedding vector and select the first 50 nodes with similar values; 8) Convolutional neural network for malware family classification; A convolutional neural network model is established, and the 50 nodes obtained after screening are embedded in the matrix for convolution calculation, and then connected to the fully connected layer to classify malicious applications.

Images