A dynamic depth analysis engine construction method based on genetic evolutionary algorithm
By combining genetic evolution algorithms and dynamic analysis, and optimizing UI event triggering and feature data processing, the problem of low code coverage and malicious behavior triggering rate in Android malware detection has been solved, achieving more efficient malware detection.
Patent Information
- Application Number
- CN202210882153.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-07-26
- Publication Date
- 2026-08-25
- Estimated Expiration
- 2042-07-26
AI Technical Summary
Existing dynamic analysis technologies have low code coverage and malicious behavior trigger rates in Android malware detection, resulting in low efficiency and wasted resources.
By combining genetic evolution algorithms with dynamic analysis, UI information is captured at the UI level to generate a list of UI event triggers. Then, neural network models and genetic evolution algorithms are used for feedback adjustment to optimize the injected event list, thereby improving code coverage and the trigger rate of malicious behavior.
It improves code coverage and malicious behavior trigger rate for Android malware detection, enhances detection efficiency, and reduces resource consumption.
Smart Images
Figure CN115221067B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a method for testing Android malware in software analysis. Specifically, it describes a method for constructing a dynamic deep analysis engine based on a genetic evolution algorithm. This method captures UI-related information from the tested Android APK at the UI level, injects UI-triggered events into the tested Android APK based on this information, and finally uses the dynamic feature data of the tested Android APK, combined with a neural network model and the genetic evolution algorithm, to achieve classification of the tested Android APK and dynamic improvement of code coverage. Background Technology
[0002] With the continuous development of internet technology, the Android operating system, due to its open-source nature and scalability, has gradually become one of the most widely used operating systems for mobile terminals and IoT devices in China and even the world. Surveys show that 85% of mobile phones worldwide use Android as their operating system. Beyond smartphones, Android OS and its branches such as Android TV, Android Auto, and Android Go have also become mainstream choices for smart home systems, in-vehicle systems, and underlying IoT device operating systems. This has led to a surge in Android malware, whose threat to the internet is rapidly increasing. Statistics show that from June 2016 to March 2020, the total number of newly added Android malware samples reached 482,576 per month. Meanwhile, the Canadian Cyber Security Institute concluded through its capture of Android malware that nearly 12,000 new instances of Android malware are created every day. Of all malware, Android-based malware accounts for as much as 46%, and this proportion is still growing.
[0003] In the detection and classification of Android malware, researchers typically employ two analysis methods: dynamic analysis and static analysis. Dynamic analysis does not require disassembling the malware; configuration and environment-related information (such as variable values, system configurations, and program input) is generated during runtime. Therefore, compared to static analysis, dynamic analysis is closer to actual user scenarios. Dynamic analysis is more efficient when studying packaged malware because most malware unpacks itself during execution and places its original code into main memory; some malware even downloads critical code only after execution. Furthermore, common anti-static analysis detection methods such as fuzzing and polymorphism cannot prevent malware from escaping dynamic analysis. Combining dynamic analysis with machine learning, big data, and principal component analysis can significantly improve the accuracy of malware detection results, reduce manual costs, and enhance the practicality of malware analysis systems. However, dynamic analysis inevitably suffers from high analysis time costs and low malicious behavior trigger rates for complex malware with large code volumes. Therefore, the difficulty in efficiently triggering malicious behavior due to complex malware structures has become a bottleneck problem in dynamic analysis.
[0004] In conclusion, dynamic analysis has received widespread attention from researchers in Android malware analysis, and to some extent compensates for the shortcomings of static detection analysis. However, previous research shows that dynamic analysis technology still has the following problems:
[0005] 1. Dynamic data features in dynamic analysis are often mixed with a large number of normal system operation data features. The way redundant sequence information is processed greatly affects the efficiency and accuracy of dynamic analysis.
[0006] 2. As the amount of software code gradually increases, the code coverage of dynamic analysis has decreased, and the trigger rate for malicious behavior has decreased. This sometimes makes it impossible to obtain malicious data streams from the software, affecting the accuracy of the system and easily causing false alarms.
[0007] 3. The dynamic analysis system itself will also consume a certain amount of system resources, which will lead to a waste of resources if the malicious behavior of the malware cannot be triggered correctly. Summary of the Invention
[0008] The purpose of this invention is to provide a method for constructing a dynamic deep analysis engine based on a gene evolution algorithm, which solves the problems of low code coverage and low malicious behavior triggering rate in existing dynamic analysis technologies.
[0009] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0010] A method for constructing a dynamic deep analysis engine based on a gene evolution algorithm, combining dynamic analysis with the gene evolution algorithm, includes the following steps:
[0011] Step 1: Capture the UI hierarchy of the Android application under test to obtain UI component information and thus UI hierarchy information.
[0012] Step 2: Implement the triggering of specified UI events by injecting event functions.
[0013] Step 3: Capture the dynamic behavior feature data of the software and use a neural network model to achieve dynamic detection of malicious behavior.
[0014] Step 4: Use a genetic evolution algorithm to generate and filter the event function sequence, and adjust the injected event functions through feedback.
[0015] In the above technical solution, the specific steps of step 1 are as follows:
[0016] The UIautomator tool captures UI-related information at the UI level of the Android APK under test and generates a list of UI components.
[0017] In the above technical solution, the specific steps of step 2 are as follows:
[0018] The obtained UI hierarchy information is used in conjunction with a gene evolution algorithm to generate multiple sets of parent generation trigger event lists, and each set of trigger event lists is dynamically injected. The specific steps are as follows:
[0019] Step A1: Based on the obtained UI hierarchy information, determine the types of triggering events that the application can accept, and further randomly generate multiple lists of injection events of the same length;
[0020] Step A2: Use UIautomator to inject trigger events into the list of injected events obtained in step A1. Different lists of trigger events correspond to a new round of dynamic execution.
[0021] In the above technical solution, the specific steps for each round of dynamic operation in step A2 include:
[0022] Step B1: Perform preprocessing analysis on the APK to obtain its basic API information and method list;
[0023] Step B2: Listen to and record the API and method calls during application runtime, and obtain the list of APIs and methods called during runtime;
[0024] Step B3: Treat each different API call as a state, and the process of calling another API as a state transition. There are n different APIs in the entire application, so generate an n-order matrix A, where the element a... ij Matrix A represents the statistical probability of the state transition from state i to state j in the entire API call list, while matrix A is the generated state transition matrix. The state transition matrix is calculated as feature data based on the API call list obtained in step B2.
[0025] Step B4: Input the state transition matrix obtained in step B3 as feature data into the model, and use SVM to determine the degree of suspicion of the software.
[0026] In the above technical solution, step 3 specifically involves the following steps:
[0027] Step 3.1: Monitor the dynamic operation of the Android APK under test and obtain its runtime characteristic data, including runtime logs, code trigger rate, and exception trigger rate.
[0028] Step 3.2: Process the feature data obtained in Step 3.1 and input it into the neural network model to determine the degree of suspicion of the tested Android APK.
[0029] In the above technical solution, step 4 specifically involves the following steps:
[0030] Step C1: Based on the list of methods called obtained in B2, calculate the proportion of the methods called to the total number of methods, and obtain the code coverage corresponding to each group of trigger event lists;
[0031]
[0032] Where B(x) i B(T) represents the number of methods called during runtime, and B(T) represents the total number of methods obtained from the analysis.
[0033] Step C2: Calculate the difference value between each group of method call lists, combine it with the code coverage obtained in step C1, filter out the method call lists whose difference value and code coverage meet the threshold, and determine their corresponding trigger event list;
[0034]
[0035]
[0036] Where V k (x i j) indicates whether the methods corresponding to the same position in the two sets of method call lists are the same, and sets the V at each position. k (x iThe sum of j) is the difference value f. sim ;
[0037] Step C3: Combine the code coverage obtained in Step C1 with the difference value obtained in Step C2 to evaluate the trigger event list, retain the trigger event list that meets the threshold, and randomly replace some of the trigger events in these trigger event lists. Also, swap some of the trigger events in different trigger event lists. The new trigger event list obtained after the above operations will be used together with the retained trigger event list as input for a new round of dynamic operation.
[0038] Compared with the prior art, the advantages of the present invention are as follows:
[0039] I. This invention captures and processes APK UI-level information and generates a list of triggerable functions. Then, it combines a gene evolution algorithm with APK dynamic feature data to iteratively generate an injection function list with higher code coverage and malicious behavior triggering rate. This method mines and integrates the relationship information between dynamic feature data and the injection function list, represents it reasonably, and realizes feedback adjustment from feature data to the injection event list, iteratively generating a descendant injection event list. While improving code coverage and malicious behavior triggering rate, it also realizes the cyclic linkage between dynamic test results and injection events. Attached Figure Description
[0040] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0041] Figure 1 This is a schematic diagram of a dynamic deep analysis engine model based on a gene evolution algorithm. Detailed Implementation
[0042] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0043] This invention dynamically adjusts the APK injection trigger event list in dynamic analysis using a genetic evolution algorithm. It considers the dynamic feature data generated during APK runtime and uses the relevant information between this feature data and the injection trigger event list to provide dynamic feedback on the generation of injection trigger events. Our contribution lies in combining the genetic evolution algorithm with dynamic detection of Android malware, thereby improving the code coverage and malicious behavior trigger rate of Android malware detection. Specifically:
[0044] UI Information Acquisition: Obtaining APK UI Layer Information via UIautomator
[0045] UI event triggering: Using the obtained UI hierarchy information and a genetic evolution algorithm, multiple sets of parent generation trigger event lists are generated, and each set of trigger event lists is dynamically injected. The specific steps are as follows:
[0046] Step A1: Based on the obtained UI hierarchy information, determine the types of triggering events that the application can accept, and further randomly generate multiple lists of injection events of the same length;
[0047] Step A2: Use UIautomator to inject trigger events into the list of injected events obtained in step A1. Different lists of trigger events correspond to a new round of dynamic execution.
[0048] Software dynamic feature processing and transformation based on neural network models: For each round of dynamic execution, it is necessary to acquire the feature data generated by the APK during dynamic execution for training the neural network model and judging the APK's suspiciousness. The dynamic feature data will also be used in the gene evolution algorithm. The specific steps of each round include:
[0049] Step B1: Perform preprocessing analysis on the APK to obtain its basic API information and method list;
[0050] Step B2: Listen for and record API and method calls during application runtime, and obtain a list of APIs and methods called during the runtime.
[0051] Step B3: Treat each different API call as a state, and the process of calling another API as a state transition. Assuming there are n different APIs in the entire application, generate an n-order matrix A, where the element a ij Let A represent the statistical probability of the state transition from state i to state j in the entire list of API calls, and let A be the generated state transition matrix. Based on the API call list obtained in step B2, the state transition matrix is calculated as feature data.
[0052] Step B4: Input the state transition matrix obtained in step B3 as feature data into the model, and use SVM to determine the degree of suspicion of the software.
[0053] UI event sequence generation and feedback regulation based on gene evolution algorithm: This involves using a gene evolution algorithm to regulate the feedback of injected trigger events. The specific steps are as follows:
[0054] Step C1: Based on the list of methods called obtained in B2, calculate the proportion of the methods called to the total number of methods, and obtain the code coverage corresponding to each group of trigger event lists.
[0055]
[0056] Where B(x) i B(T) represents the number of methods called during runtime, and B(T) represents the total number of methods obtained from the analysis.
[0057] Step C2: Calculate the difference value between each group of method call lists, combine it with the code coverage obtained in step C1, filter out the method call lists with better difference values and code coverage, and determine their corresponding trigger event lists.
[0058]
[0059]
[0060] Where V k (x i j) indicates whether the methods corresponding to the same position in the two sets of method call lists are the same, and sets the V at each position. k (x i The sum of j) is the difference value f. sim ;
[0061] Step C3: Combine the code coverage obtained in Step C1 with the difference value obtained in Step C2 to evaluate the trigger event list, retain the trigger event list with good performance, and randomly replace some trigger events in these trigger event lists. Also, swap some trigger events in different trigger event lists. The new trigger event list obtained after the above operations will be used together with the retained trigger event list as input for a new round of dynamic operation.
[0062] The specific process of constructing a dynamic deep analysis engine based on the gene evolution algorithm is as follows: First, using the UIautomator tool, UI-related information is captured at the UI level of the Android APK under test, generating a list of UI components. Next, the generated list of UI components and related UI component information are used to determine the types of UI trigger events that the Android APK under test can accept, generating a trigger event list. After generating the trigger event list, the gene evolution algorithm is used to randomly generate multiple sets of parent injection event lists of the same length based on the trigger event list, with each injection event being randomly generated according to the trigger event list. Then, the UIautomator tool is used to inject trigger events into the Android APK under test according to the parent injection event lists. Finally, the dynamic operation of the Android APK under test is monitored to obtain its runtime characteristic data, including runtime logs, code trigger rate, and exception trigger rate. The obtained characteristic data is processed and input into a neural network model to determine the suspiciousness level of the Android APK under test. The obtained feature data, including information such as code coverage and exception triggering rate, will be used as input to the gene evolution algorithm along with the parent injection event list. The gene evolution algorithm will generate the offspring injection event list and provide feedback on the generation probability of different injection events during the adjustment process.
[0063] The existing model is a one-way process of triggering -> acquiring features -> determining, where the triggering is completely random. We use a genetic evolution algorithm to improve the triggering step, making the whole process a loop-optimized model for injecting events: the genetic evolution algorithm generates a list of injection events -> triggering -> acquiring features -> determining -> the genetic evolution algorithm determines based on code coverage to generate a better-performing list of injection events -> triggering -> acquiring features -> determining -> the genetic evolution algorithm determines based on code coverage to generate a better-performing list of injection events.
Claims
1. A method for constructing a dynamic deep analysis engine based on a gene evolution algorithm, characterized in that... The combined application of dynamic analysis and gene evolution algorithms includes the following steps: Step 1: Capture the UI hierarchy of the Android application under test to obtain UI component information and thus UI hierarchy information; Step 2: Implement the triggering of specified UI events by injecting event functions; Step 3: Capture dynamic behavior feature data of the software and use a neural network model to achieve dynamic detection of malicious behavior; Step 4: Use a genetic evolution algorithm to generate and filter event function sequences, and adjust the injected event functions through feedback; The specific steps of step 4 are as follows: Step C1: Based on the list of methods called obtained in B2, calculate the proportion of methods called to the total number of methods, and obtain the code coverage corresponding to each group of triggering event lists; in This represents the number of methods called during runtime. The total number of methods obtained from the representative analysis; Step C2: Calculate the difference value between each group of method call lists, combine it with the code coverage obtained in step C1, filter out the method call lists whose difference value and code coverage meet the threshold, and determine their corresponding trigger event list; in This indicates whether the methods corresponding to the same position in the two sets of method call lists are the same, and sets each position... The sum and the difference value ; Step C3: Combine the code coverage obtained in Step C1 with the difference value obtained in Step C2 to evaluate the trigger event list, retain the trigger event list that meets the threshold, and randomly replace some of the trigger events in these trigger event lists. Also, swap some of the trigger events in different trigger event lists. The new trigger event list obtained after the above operations will be used as input for a new round of dynamic operation together with the retained trigger event list.
2. The method for constructing a dynamic deep analysis engine based on a gene evolution algorithm according to claim 1, characterized in that, The specific steps of step 1 are as follows: The UIautomator tool captures UI-related information at the UI level of the Android APK under test and generates a list of UI components.
3. The method for constructing a dynamic deep analysis engine based on a gene evolution algorithm according to claim 2, characterized in that, The specific steps of step 2 are as follows: The obtained UI hierarchy information is used in conjunction with a gene evolution algorithm to generate multiple sets of parent generation trigger event lists, and each set of trigger event lists is dynamically injected. The specific steps are as follows: Step A1: Based on the obtained UI hierarchy information, determine the types of triggering events that the application can accept, and further randomly generate multiple lists of injection events of the same length; Step A2: Use UIautomator to inject trigger events into the list of injected events obtained in step A1. Different lists of trigger events correspond to a new round of dynamic execution.
4. The method for constructing a dynamic deep analysis engine based on a gene evolution algorithm according to claim 3, characterized in that, The specific steps for each round of dynamic operation in step A2 include: Step B1: Perform preprocessing analysis on the APK to obtain its basic API information and method list; Step B2: Listen to and record the API and method calls during application runtime, and obtain the list of APIs and methods called during runtime; Step B3: Treat each different API call as a state, and the process of calling another API as a state transition. There are n different APIs in the entire application, so generate an n-order matrix A, where the elements... Representing state Transition state This state transition is the statistical probability of the entire API call list, and matrix A is the generated state transition matrix. Based on the API call list obtained in step B2, the state transition matrix is calculated as feature data. Step B4: Input the state transition matrix obtained in step B3 as feature data into the model, and use SVM to determine the degree of suspicion of the software.
5. The method for constructing a dynamic deep analysis engine based on a gene evolution algorithm according to claim 3, characterized in that, The specific steps of step 3 are as follows: Step 3.1: Monitor the dynamic operation of the Android APK under test and obtain its runtime characteristic data, including runtime logs, code trigger rate, and exception trigger rate. Step 3.2: Process the feature data obtained in Step 3.1 and input it into the neural network model to determine the degree of suspicion of the tested Android APK.