Android malicious apk detection method based on regular extreme learning machine

Abstract

The application provides an Android malicious APK detection method based on a regular extreme learning machine, and the method comprises the following steps: step 1, classifying sample application sets APK according to function categories to obtain M sample subsets of different function categories; step 2, extracting first type feature attributes from the application list AndroidManifest.xml file of the sample subsets, extracting second type feature attributes according to the.smali file of the sample subsets, and constructing a basic feature matrix R; step 3, screening out a common feature set as a feature subset X; step 4, performing model training based on an extreme learning machine algorithm to obtain an initial classification detection model; and step 5, extracting an application program to be detected APK, and detecting whether the application program to be detected is a malicious application program by using the classification detection model. The application can quickly and efficiently detect malicious application programs threatening the information security of the Android system.

Description

A method for detecting malicious Android APKs based on regular expression extreme learning machines. Technical Field

[0001] This invention relates to the field of malicious application detection technology, specifically, to a method for detecting malicious Android APKs based on regular expression extreme learning machines. The method and medium for detecting malicious Android APKs based on regular expression extreme learning machines are also described. Background Technology

[0002] With the widespread adoption and development of mobile (smart) terminals, various apps have become an indispensable part of people's work and lives, leading to a multitude of data security issues. These include malicious billing, privacy theft, and remote control, all of which seriously threaten the information security of mobile terminals. Malicious applications can obtain phone numbers, collect user IMEI codes and system version numbers, send text messages, collect personal photos, access location information, and other private data, and then upload this data to the network, causing privacy leaks. Therefore, research into Android system information security technology has become crucial.

[0003] In today's increasingly severe cybersecurity landscape, the security of mobile devices has garnered widespread attention. While mobile devices bring convenience, they also pose significant security threats, making research into mobile device information security an urgent priority. To safeguard mobile device information security and address the ever-emerging malicious applications, researchers both domestically and internationally have conducted a series of studies on Android applications, primarily employing static analysis methods or dynamic detection methods.

[0004] Currently, most static analysis methods detect applications by extracting application permissions and program interfaces from the application manifest. This method suffers from low detection efficiency and accuracy due to insufficient consideration of influencing factors. Dynamic analysis methods, on the other hand, often struggle to simulate a suitable environment to trigger all malicious functions of an application, and cannot predict the time required for malicious behavior to be triggered. Therefore, proposing a technique that can quickly and efficiently detect malicious applications that threaten the information security of the Android system has significant theoretical and practical value.

[0005] In order to solve the above problems, people have been seeking an ideal technological solution. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings of existing technologies by providing a method for detecting malicious Android APKs based on a regular expression extreme learning machine.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0008] The first aspect of this invention provides a method for detecting malicious Android APKs based on a regular expression extreme learning machine, the method comprising the following steps:

[0009] Step 1: Obtain a sample application set APK, and classify the sample application set APK according to functional categories to obtain M sample subsets with different functional categories;

[0010] Step 2: Extract the first type of feature attributes from the AndroidManifest.xml file of the application manifest of the sample subset, extract the second type of feature attributes from the .smali file of the sample subset, and construct the basic feature matrix R based on the first type of feature attributes and the second type of feature attributes;

[0011] The first type of feature attributes includes hardware components, system permissions, application components, and intent filters, while the second type of feature attributes is API call feature identifiers.

[0012] Step 3: Use the information gain algorithm to score the basic feature matrix R to obtain the first score result of the basic feature matrix; filter the basic feature matrix R according to the first score result to obtain the first feature matrix F;

[0013] The basic feature matrix is ​​scored using the Fisher Score algorithm to obtain a second score result for the basic feature matrix; the basic feature matrix R is then filtered based on the second score result to obtain a second feature matrix I;

[0014] The first feature matrix F and the second feature matrix I are subjected to intersection processing, and the common features are selected as the feature subset X.

[0015] Step 4: Using the feature subset X as the input vector and the sample application identifier corresponding to each sample subset as the output vector, train the model based on the Extreme Learning Machine algorithm to obtain the initial classification and detection model; wherein, the sample application identifier is used to indicate whether the sample application is a malicious application.

[0016] The initial classification and detection model is optimized using regularization terms to obtain the first classification and detection model;

[0017] The first classification and detection model was repeatedly trained using the five-fold cross-validation method to obtain a classification and detection model.

[0018] Step 5: Extract the application APK to be detected, and use the classification detection model obtained in Step 4 to detect whether the application to be detected is a malicious application or a safe application.

[0019] A second aspect of the present invention provides an Android malicious APK detection device based on a regular expression extreme learning machine, comprising a memory, a processor, and an Android malicious APK detection program based on a regular expression extreme learning machine stored in the memory and executable on the processor. When the Android malicious APK detection program based on a regular expression extreme learning machine is executed by the processor, it implements the steps of the Android malicious APK detection method based on a regular expression extreme learning machine as described above.

[0020] A third aspect of the present invention provides a readable storage medium having instructions stored thereon, which, when executed by a processor, implement the steps of the Android malicious APK detection method based on regularity extreme learning machine as described above.

[0021] The beneficial effects of this invention are as follows:

[0022] 1) To address the diverse range of applications, this invention proposes an Android malicious APK detection method based on regular expression extreme learning machine, which is used to maintain the information security of the Android system through the malicious application detection process. The method involves static analysis of the application's .apk file to extract feature attributes, including hardware components, application components, system permissions, intent filters, and API call feature identifiers, and then using machine learning methods to detect malicious applications, thereby quickly and efficiently detecting malicious applications that threaten the information security of the Android system.

[0023] 2) This invention introduces a regularization term to optimize the calculation formula of the output weights, thereby effectively preventing overfitting during training and improving the accuracy of the classification and detection module;

[0024] 3) This invention uses the information gain algorithm and the Fisher Score algorithm to score the constructed basic feature matrix, and then filters the feature sets of each according to the scoring results to initially remove redundant features. Then, the feature sets obtained by the two methods are intersected to filter out the common feature set as the feature subset, and further remove redundant features, effectively improving the accuracy of the feature subset, and thus improving the accuracy of the output weights and the classification detection model. Attached Figure Description

[0025] Figure 1 is a flowchart of the Android malicious APK detection method based on regular extreme learning machine of the present invention;

[0026] Figures 2 and 3 are schematic diagrams of constructing the basic feature matrix R based on static reverse analysis according to the present invention;

[0027] Figure 4 is a flowchart of the feature subset X acquisition process of the present invention;

[0028] Figure 5 is a flowchart of the detection process of the application to be detected based on the Extreme Learning Machine algorithm of the present invention.

[0029] Figure 6 is a flowchart of the classification and detection model obtained by the five-fold cross-validation method of the present invention;

[0030] Figure 7 is a structural schematic diagram of the Extreme Learning Machine structure of the present invention. Detailed Implementation

[0031] The technical solution of the present invention will be further described in detail below through specific embodiments.

[0032] APK, short for Android application package, is an application package file format used by the Android operating system for distributing and installing mobile applications and middleware; APKs are decompiled using the decompilation tool apktool to obtain .smail files.

[0033] An APK file contains compiled code files (.dex files), file resources, assets, certificates, and a manifest file (AndroidManifest.xml). The AndroidManifest.xml file contains hardware component characteristic attributes, system permission characteristic attributes, application component characteristic attributes, and intent filter characteristic attributes. The attribute values ​​of these characteristic attributes are either 1 or 0, where 1 indicates that the current sample application APK contains the corresponding characteristic attribute, and 0 indicates that the current sample application APK does not contain the corresponding characteristic attribute.

[0034] Example 1

[0035] Figure 1 shows a flowchart of an Android malicious APK detection method based on regular expression extreme learning machine. The Android malicious APK detection method based on regular expression extreme learning machine includes the following steps:

[0036] Step 1: Obtain a set of sample application APKs, and classify the set of sample application APKs according to their functional categories to obtain M sample subsets with different functional categories; wherein, the set of sample application APKs contains a total of n sample applications;

[0037] Step 2: Perform static reverse fine-grained analysis on each sample subset. Extract the first type of feature attributes from the AndroidManifest.xml file of the application manifest of the sample subset, extract the second type of feature attributes from the .smali file of the sample subset, and construct the basic feature matrix R based on the first type of feature attributes and the second type of feature attributes.

[0038] The first type of feature attributes includes hardware components, system permissions, application components, and intent filters, while the second type of feature attributes is API call feature identifiers.

[0039] Step 3: Use the information gain algorithm to score the basic feature matrix R to obtain the first score result of the basic feature matrix; filter the basic feature matrix R according to the first score result to obtain the first feature matrix F;

[0040] The basic feature matrix is ​​scored using the Fisher Score algorithm to obtain a second score result for the basic feature matrix; the basic feature matrix R is then filtered based on the second score result to obtain a second feature matrix I;

[0041] The first feature matrix F and the second feature matrix I are subjected to intersection processing, and the common features are selected as the feature subset X.

[0042] Step 4: Using the feature subset X as the input vector and the sample application identifier corresponding to each sample subset as the output vector, train the model based on the Extreme Learning Machine algorithm to obtain the initial classification and detection model; wherein, the sample application identifier is used to indicate whether the sample application is a malicious application.

[0043] The initial classification and detection model is optimized using regularization terms to obtain the first classification and detection model;

[0044] The first classification and detection model was repeatedly trained using the five-fold cross-validation method to obtain a classification and detection model.

[0045] Step 5: Extract the application APK to be detected, and use the classification detection model obtained in Step 4 to detect whether the application to be detected is a malicious application or a safe application.

[0046] It is understandable that malicious applications of different functional categories have different characteristic attributes, so they need to be classified. The functional categories are divided into malicious billing, malicious promotion and advertising, privacy theft, installation package theft, remote control, etc., according to the attack methods of malicious applications.

[0047] In step 2, for N different functional categories, the feature attributes of all functional categories are placed in a basic feature matrix R;

[0048] During the classification and detection training, the model parameters have been intelligently calculated based on the feature attributes and categories of different functional categories of applications, making the classification and detection model obtained in step 4 suitable for detecting applications of various functional categories; therefore, when detecting whether the application to be detected is a malicious application in step 5, it is not necessary to confirm the functional category of the application to be detected.

[0049] As shown in Figure 2, in one specific embodiment, step 2 includes the following steps:

[0050] Step 2.1: Use the decompilation tool apktool to batch process each sample subset to obtain the AndroidManifest.xml file and .smali file for each sample subset; wherein, the sample subset is the apk file under different functional categories in the sample application set apk;

[0051] Step 2.2: Parse the AndroidManifest.xml file of the sample subset using the DOM method. According to the structural hierarchy of the AndroidManifest.xml file, obtain the attribute values ​​of the first type of feature attributes from the second-level nodes, the third-level nodes, and the fourth-level nodes in sequence; wherein, the attribute values ​​of the second type of feature attributes include 4 n×1 vectors.

[0052] Access the .smali files of the sample subset sequentially and extract the attribute values ​​of the second type of feature attributes; where the attribute values ​​of the second type of feature attributes are an n×1 vector;

[0053] Step 2.3: Add the attribute values ​​of the first type of feature attribute and the attribute values ​​of the second type of feature attribute to the preset feature attribute set AttrsList as the basic feature matrix R;

[0054] Wherein, the set of feature attributes is The basic feature matrix n is the total number of sample applications in the sample application set apk, with each row corresponding to one sample application and each column corresponding to a feature attribute;

[0055] Step 2.4: Obtain the sample application identifiers corresponding to each sample subset and store them in a preset application set apkList; wherein, the application set apkList is an n×1 vector, and the application set... t n,1 The sample application identifier indicates whether the nth sample application is a malicious application.

[0056] For example, t n,1 =1 indicates that the nth sample application is a malicious application, tn,1 =0 indicates that the nth sample application is a secure application.

[0057] As shown in Figure 3, in another specific embodiment, step 2 includes the following steps:

[0058] Step 201: Use the decompilation tool apktool to batch process each sample subset to obtain the AndroidManifest.xml file and .smali file for each sample subset;

[0059] Step 202: Parse the AndroidManifest.xml file of the sample subset using the DOM method. According to the structural hierarchy of the AndroidManifest.xml file, obtain the attribute values ​​of the first type of feature attributes from the second-level node, the third-level node, and the fourth-level node in sequence, and mark the attribute values ​​of the first type of feature attributes as attribute vectors R1, R2, R3, and R4, respectively.

[0060] The .smali files of the sample subset are accessed sequentially to extract the attribute values ​​of the second type of feature attributes, and these attribute values ​​are labeled as attribute vector S5; where, n is the total number of sample applications in the sample application set apk;

[0061] Step 203: Based on the attribute vectors R1, R2, R3, R4 and S5, find the union of the attribute vectors to construct the basic feature matrix R;

[0062] It can be understood that the basic feature matrix R = the union of attribute sets R1, R2, R3, R4, S5 and T; wherein, the basic feature matrix The first column of the basic feature matrix R is attribute vector R1, the second column of the basic feature matrix R is attribute vector R2, the third column of the basic feature matrix R is attribute vector R3, the fourth column of the basic feature matrix R is attribute vector R4, and the fifth column of the basic feature matrix R is attribute vector S5.

[0063]

[0064] Step 204: Obtain the sample application identifier corresponding to each sample subset and label it as an attribute vector T, where, t n,1 The sample application identifier indicates whether the nth sample application is a malicious application.

[0065] Specifically, attribute vector R1 stores hardware component feature attributes extracted from the AndroidManifest.xml file, attribute vector R2 stores system permission feature attributes extracted from the AndroidManifest.xml file, attribute vector R3 stores application component feature attributes extracted from the AndroidManifest.xml file, attribute vector R4 stores intent filter feature attributes extracted from the AndroidManifest.xml file, and attribute vector S5 stores API feature identifier feature attributes extracted from the .smail file.

[0066] It should be noted that the basic feature matrix R represents the union of five major categories of feature attributes, and T represents the set of flags indicating whether the corresponding application is a malicious application. When the number of APKs is large (e.g., more than 1000), there may be redundancy in the sample attributes. It is necessary to represent the feature description of each APK under the same functional category in the same vector space and perform feature subset filtering. If the number of samples does not exceed 1000, filtering is not required.

[0067] It should be noted that each row in the basic feature matrix R corresponds to the attribute value of a sample application. In step 3, the information gain algorithm and the Fisher Score algorithm are used to score each row (the attribute value of a sample application) in the basic feature matrix R, remove redundant sample applications, and obtain the feature subset X, as shown in Figure 4. Therefore, the number of columns in the feature subset X is the same as the number of columns in the basic feature matrix R, the number of rows N in the feature subset X is less than or equal to the number of rows in the basic feature matrix R, and the number of rows in the basic feature matrix R is equal to the total number n of sample applications in the sample application set apk.

[0068] Specifically, step 3 includes the following steps:

[0069] Step 3.1: Use the information gain algorithm to score the attribute values ​​in the basic feature set R using the following formula:

[0070] Ig(R i R ij )=H(R i )-H(R i |R ij )

[0071]

[0072]

[0073] Among them, H(R) i H(R) represents the information entropy of the i-th feature set in the basic feature set R. i |R ij ) represents the i-th feature set in feature R ij Conditional entropy under condition lg(R) i R ij ) indicates that the i-th feature set is in feature R ij The first rating result, R ij This represents the value of the element in the i-th row and j-th column of the basic feature set R;

[0074] Step 3.2: Based on the first scoring result, filter the basic feature matrix, and select the feature attributes ranked in the top A from the basic feature matrix R to form the first feature matrix F;

[0075] Step 3.3: Use the Fisher Score algorithm to score the attribute values ​​in the basic feature set R using the following formula:

[0076]

[0077]

[0078]

[0079] Among them, S i R′ represents the second score result corresponding to the i-th feature set in the basic feature set R. ij R' represents the average value of the i-th feature in the basic feature set R in the j-th class of samples, where the j-th class of samples includes the n1-n2 sample applications. i Represents the average value of the i-th feature set in the basic feature set R corresponding to all functional categories; (R′) ij -R′ i ) 2 Represents the inter-class variance among the i-th feature sets in the basic feature set R; (R ij -R′ ij ) 2 This represents the intra-class variance among the i-th feature sets in the basic feature set R;

[0080] Step 3.4: Based on the second scoring result, filter the basic feature matrix and select the feature attributes ranked in the top B from the basic feature matrix R to form the second feature matrix I;

[0081] Step 3.5: Select the common feature matrix properties in the first feature matrix F and the second feature set I as the feature subset X; wherein the feature subset X is a matrix of size N×5.

[0082] It is understood that the matrix sizes of the first feature set F and the second feature set I can be set to be the same or different.

[0083] It should be noted that in step 4, the detection model is trained based on the Extreme Learning Machine algorithm to obtain an initial classification detection model. To prevent overfitting during training, step 54 introduces a regularization term to optimize the initial classification detection model, resulting in a first classification detection model. To improve the generalization ability of the model, step 4 also uses five-fold cross-validation to repeat step 4.2 to train the first classification detection model, obtaining an optimized classification detection model. This effectively improves the accuracy of the classification detection model, thereby improving the accuracy of Android malicious APK detection.

[0084] Furthermore, step 4 includes the following steps:

[0085] Step 4.1: Using the feature subset X (size N×5) obtained in Step 4 as the input vector, and the sample application identifier vector Y (size N×1, N≤n) corresponding to the feature subset X as the output vector, the following formula is used:

[0086] Hβ=Y

[0087]

[0088]

[0089]

[0090] The initial classification and detection model can be obtained as follows:

[0091] β=(H T H) -1 H T Y

[0092] Where β represents the output weight matrix of the model (of size N×1), H represents the intermediate vector generated based on the feature subset X, g represents the activation function (such as the sigmoid function, step function, radial basis function), and N represents the number of sample applications corresponding to the attribute values ​​in the feature subset X; w i The i-th element x in the feature subset X represents the i-th element x. i The connection weight vector between the i-th node and the Extreme Learning Machine structure (the structure shown in Figure 7), bi This represents the bias vector corresponding to the i-th hidden layer in the Extreme Learning Machine architecture (the architecture shown in Figure 7);

[0093] This represents the value of the element in the i-th row and 1-th column of the output weight matrix β (the output weight of the L-th output node). The element value in the i-th row and 1-th column of the sample application identifier vector Y corresponding to the feature subset X represents the sample application identifier (the attribute flag of the sample application);

[0094] Step 4.2: Based on the output weight vector β obtained in Step 4.1, the first target regularization coefficient γ1 is obtained using the following formula with a regularization term:

[0095]

[0096]

[0097]

[0098]

[0099]

[0100] Where minE represents the performance index, ||β|| 2 The norm of the output weight matrix β of the model is represented by γ, where γ represents the regularization coefficient, and ||ε|| 2 Let ε represent the training error and the square of the norm of matrix ε. i Let β represent the training error and the i-th element in matrix ε. i This represents the i-th element in the output weight matrix β from step 4.1, y. i This represents the i-th element of the sample application identifier vector Y corresponding to the feature subset X;

[0101] β represents the output weight matrix of the model in step 4.1. i ε represents the i-th element in the output weight matrix β in step 4.1; ε represents the training error sum matrix (of size N×1). i Let represent the i-th element in the training error sum matrix ε (corresponding to the training error sum of the i-th sample application); Y represents the sample application identifier vector (of size N×1) corresponding to the feature subset X. i ω represents the i-th element of the sample application identifier vector Y corresponding to the feature subset X; iWith b i With the parameter ω in step 4.1 i and b i They represent the same meaning;

[0102] The initial classification detection model is optimized based on the first target regularization coefficient γ1 to obtain a first classification detection model. The formula corresponding to the first classification detection model is as follows:

[0103]

[0104] in, γ1 represents the optimized output weight vector estimate, γ1 represents the regularization coefficient corresponding to the minimum value of performance index E, and I represents the identity matrix (size 5×5).

[0105] Step 4.3: Repeat step 4.2 using five-fold cross-validation to train the model. Use the regularization coefficient that minimizes the performance metric E as the second objective regularization coefficient γ2. Based on the second objective regularization coefficient γ2 and the first classification and detection model, obtain the classification and detection model:

[0106]

[0107] Wherein, ω in step 4.1 i and b i It is a randomly set constant, the value of i is 1≤i≤N, n1 and n2 are integers greater than or equal to 1, n2>n1, and the value of N is 1≤N≤n.

[0108] It is understood that the initial classification and detection model obtained by training the model based on the Extreme Learning Machine algorithm in step 4.1 has the advantages of simple structure, strong generalization ability, and short learning time, and can achieve good prediction results.

[0109] In step 4.2, when optimizing the initial classification and detection model using regularization terms, the regularization coefficient γ is preset to 0, and then increased or decreased by a factor of 10 to obtain different performance indices E. Based on the magnitude of the performance indices E, after determining the appropriate order of magnitude of the regularization coefficient γ, the regularization coefficient γ is further fine-tuned (e.g., ±0.01) until the minimum value of the performance indices E is obtained (the corresponding regularization coefficient γ is taken as the first target regularization coefficient γ1).

[0110] Therefore, regularization can constrain parameters, thereby preventing overfitting during the calculation process, avoiding overfitting to noisy data in sample applications, and thus improving the accuracy of classification and detection models.

[0111] It should be noted that by repeating step 4.2 using the five-fold cross-validation method for model training, the value of the regularization coefficient when the performance index E is at its minimum is used as the second objective regularization coefficient γ2. The classification and detection model is obtained based on the second objective regularization coefficient γ2, which is beneficial to improving the generalization ability of the classification and detection model.

[0112] As shown in Figure 6, step 4.3 includes the following steps:

[0113] Step 4301: Randomly and evenly group the sample application set apk into five groups;

[0114] Step 4302: Select one set as the test set and the rest as the training set, and train the model based on the regularized extreme learning machine algorithm.

[0115] Step 4303: Perform model training five times in a loop to obtain five performance indicators E. Sort the five performance indicators and the regularization coefficient corresponding to the minimum value of the performance indicator is the second target regularization coefficient γ2.

[0116] Substituting the second objective regularization coefficient γ2 into the following equation, we obtain the new estimated value of the output weight vector:

[0117]

[0118] The above formula can be used as a classification and detection model.

[0119] Example 2

[0120] Based on Example 1, this example provides a specific implementation method:

[0121] (1) Assume there are 100 sample applications, which contain sample subsets of 8 different functional categories;

[0122] (2) After executing step 2:

[0123] Extract the first and second type feature attributes of the sample application, and construct a basic feature matrix R of 100 rows and 5 columns.

[0124] application collection

[0125] It can be understood that the first row of the feature attribute set [r] 1，1 r 1，2 r 1，3 r 1，4 s 1，5 ] and the first line of the application collection [t 1，1], corresponding to the first sample application; ... and so on, up to the 100th row of the feature attribute set [r 100，1 r 100，2 r 100，3 r 100，4 s 100，5 ] and the 100th line of the application collection [t 100，1 ], corresponding to the 100th sample application;

[0126] It should be noted that the feature attribute set AttrsList and the application set apkList are matrices composed of 1s and 0s. A 1 in the feature attribute set AttrsList indicates that the current sample application apk contains the corresponding feature attribute, and a 0 in the feature attribute set AttrsList indicates that the current sample application apk does not contain the corresponding feature attribute. A 1 in the application set apkList indicates that the current sample application is a malicious application, and a 0 in the application set apkList indicates that the current sample application is a safe application.

[0127] (3) Taking A as 10, B as 15, and a total of sample applications as an example, after executing step 3:

[0128] The 100 rows of feature attributes in the basic feature matrix R are scored using the formula in step 3.1. The first feature set in the basic feature matrix R (corresponding to the first row in the basic feature matrix R) is in feature R. 1j The formula for calculating the first score result is:

[0129] Ig(R1, R) 1j )=H(R1)-H(R1|R 1j )

[0130]

[0131]

[0132] And so on, to obtain the first score result for the nth feature set;

[0133] The top 10 rows with the highest scores in the basic feature matrix R are selected to form the first feature matrix F (a new matrix in which all elements are from the original basic feature matrix R); wherein, the first feature matrix F is a 10-row, 5-column matrix;

[0134] The 100 rows of feature attributes in the basic feature matrix R are scored using the formula in step 3.3. The second score result corresponding to the first feature set in the basic feature matrix R is as follows:

[0135]

[0136]

[0137]

[0138] And so on, to obtain the second score result for the nth feature set;

[0139] The top 15 rows with the highest scores in the basic feature matrix R are selected to form the second feature set I; wherein the second feature matrix I is a 15-row, 5-column matrix.

[0140] The feature attributes corresponding to the common sample applications in the first feature set matrix F and the second feature matrix I are selected to obtain a 9-row, 5-column feature subset X.

[0141] (4) After executing step 4.1, the initial classification and detection model can be obtained as follows:

[0142] β=(H T H) -1 H T Y

[0143] Where H is a 9x5 matrix, Y is a 9x1 matrix, and β is a 9x1 matrix;

[0144] And so on,

[0145] After performing step 4.2, the first classification detection model can be obtained as follows:

[0146]

[0147] Where H is a 9x5 matrix, H T H is a 5x9 matrix. T H is a 5x5 matrix, and I is a 5x5 identity matrix; ( The inverse of is a 5x5 matrix, and Y is a 9x1 matrix. It is a 5x1 matrix;

[0148] Execute step 4.3, repeat step 4.2 using five-fold cross-validation to train the model and further optimize the first objective regularization coefficient γ1. Specifically, randomly and evenly group the data into 5 APK sets, substitute them into step 4.2 to obtain 5 performance metrics E, select the minimum value among the 5 performance metrics E, and use the corresponding regularization coefficient as the second objective regularization coefficient γ2. Substitute the optimized regularization coefficient into the first classification and detection model to obtain a new... Based on the new The final classification and detection model is obtained by combining the second objective regularization coefficient γ2.

[0149]

[0150] The final classification and detection model is used to determine whether the application to be detected is a malicious application, and in the final classification and detection model, γ2 and H are known, H varies according to the application apk to be detected, and Y is the output value.

[0151] Example 3

[0152] Based on the technology of the above embodiments, this embodiment provides a specific implementation method, as shown in Figure 5;

[0153] Step 5 of the Android malicious APK detection method based on regular extreme learning machine includes the following steps:

[0154] Step 5.1: Extract the application APK to be tested, filter out the first type of feature attributes and the second type of feature attributes in the application APK to be tested, and generate the test feature matrix R' of the application to be tested; wherein, the test feature matrix R' is a 1×5 matrix;

[0155] Step 5.2: Generate a new intermediate vector H based on the feature matrix R' of the application to be detected. Combine the new intermediate vector H, the second objective regularization coefficient γ2, and the output weight vector estimate obtained in step 4.3. Obtain the application identifier of the application to be detected;

[0156] If the application identifier of the application to be tested is 1, it means that the application to be tested is a malicious application; if the application identifier of the application to be tested is 0, it means that the application to be tested is a safe application.

[0157] It should be noted that when using the classification detection model obtained in step 4.3 to detect malicious Android APKs, γ2 and γ2 in this classification detection model are... Y is known, while Y is unknown; in actual testing, Y corresponds to the application identifier of the application to be tested.

[0158] Example 4

[0159] This embodiment provides a specific implementation of an Android malicious APK detection device based on a regular expression extreme learning machine. It includes a memory, a processor, and an Android malicious APK detection program based on a regular expression extreme learning machine stored in the memory and executable on the processor. When the Android malicious APK detection program based on a regular expression extreme learning machine is executed by the processor, it implements the steps of the Android malicious APK detection method based on a regular expression extreme learning machine as described in Embodiments 1, 2, and / or 3.

[0160] This embodiment also provides a specific implementation of a readable storage medium storing instructions that, when executed by a processor, implement the steps of the Android malicious APK detection method based on regular extreme learning machine as described in Embodiments 1, 2 and / or 3.

[0161] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0162] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0163] In the embodiments provided in this application, it should be understood that the disclosed systems and devices can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of the modules described above is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0164] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0165] If the integrated modules described above are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms.

[0166] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them; although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications can still be made to the specific implementation of the present invention or equivalent substitutions can be made to some technical features without departing from the spirit of the technical solutions of the present invention, and all such modifications and substitutions should be covered within the scope of the technical solutions claimed in the present invention.

Claims

1. A method for detecting malicious Android APKs based on regular expression extreme learning machines, characterized in that, Includes the following steps: Step 1: Obtain a sample application set of APKs and classify them according to functional categories to obtain M sample subsets with different functional categories; Step 2: Extract a first type of feature attribute from the AndroidManifest.xml file of the sample subsets and extract a second type of feature attribute from the .smali file of the sample subsets. Construct a basic feature matrix R based on the first type of feature attribute and the second type of feature attribute; wherein, the first type of feature attribute includes hardware components, system permissions, application components, and intent filters, and the second type of feature attribute is API call feature identifier; Step 3: Use the information gain algorithm to score the basic feature matrix R to obtain a first score result of the basic feature matrix; filter the basic feature matrix R according to the first score result to obtain a first feature matrix F; and use Fisher's algorithm to obtain the first feature matrix F. The Score algorithm scores the basic feature matrix to obtain a second score result for the basic feature matrix; the basic feature matrix R is filtered according to the second score result to obtain a second feature matrix I; the intersection of the first feature matrix F and the second feature matrix I is processed to filter out common features as feature subset X; Step 4, using the feature subset X as the input vector and the sample application identifier corresponding to each sample subset as the output vector, the model is trained based on the Extreme Learning Machine algorithm to obtain an initial classification detection model; wherein, the sample application identifier is used to indicate whether the sample application is a malicious application; the initial classification detection model is optimized using a regularization term to obtain a first classification detection model; the first classification detection model is repeatedly trained using the five-fold cross-validation method to obtain a classification detection model; Step 4 includes the following steps: Step 4.1, using the feature subset X obtained in Step 4 as the input vector and the sample application identifier vector Y corresponding to the feature subset X as the output vector, the following formula is used: The initial classification and detection model can be obtained as follows: in, The output weight matrix of the model is represented by H, the intermediate vector generated based on the feature subset X is represented by g, the activation function is represented by N, and the number of sample applications corresponding to the attribute values ​​in the feature subset X is represented by N. The i-th element x in the feature subset X represents the i-th element x. i The connection weight vector between the i-th node and the extreme learning machine structure. This represents the bias vector corresponding to the i-th hidden layer in the Extreme Learning Machine structure; Step 4.2, based on the output weight vector obtained in Step 4.1 The first target regularization coefficient is obtained using the following formula with regularization terms. ： in, Indicates performance metrics, Represents the output weight matrix of the model The square of the norm, Represents the regularization coefficient. Represents training error and matrix The square of the norm, Represents training error and matrix The i-th element in This represents the output weight matrix in step 4.

1. The i-th element in This represents the i-th element of the sample application identifier vector Y corresponding to the feature subset X; based on the first target regularization coefficient... The initial classification detection model is optimized to obtain a first classification detection model, and the formula corresponding to the first classification detection model is as follows: in, This represents the optimized output weight vector estimate. This represents the regularization coefficient corresponding to the minimum value of the performance index E. Represent the identity matrix; Step 4.3, repeat step 4.2 using five-fold cross-validation to train the model, and use the regularization coefficient that minimizes the performance index E as the second objective regularization coefficient. According to the second objective regularization coefficient Step 5: Obtain the classification detection model; extract the application to be detected (APK), and use the classification detection model obtained in Step 4 to detect whether the application to be detected is a malicious application or a safe application.

2. The method for detecting malicious Android APKs based on regular extreme learning machines according to claim 1, characterized in that, Step 2 includes the following steps: Step 2.1, using the decompilation tool apktool to batch process each sample subset to obtain the AndroidManifest.xml file and .smali file for each sample subset; Step 2.2, parsing the AndroidManifest.xml file of the sample subset using the DOM method, and according to the structural hierarchy of the AndroidManifest.xml file, sequentially obtaining the attribute values ​​of the first type of feature attributes from the second-level nodes, third-level nodes, and fourth-level nodes; sequentially accessing the .smali file of the sample subset to extract the attribute values ​​of the second type of feature attributes; Step 2.3, adding the attribute values ​​of the first type of feature attributes and the attribute values ​​of the second type of feature attributes to a preset feature attribute set AttrsList as the basic feature matrix R; wherein, the basic feature matrix R Where n is the total number of sample applications in the sample application set apk, each row corresponds to one sample application, and each column corresponds to a feature attribute; Step 2.4, obtain the sample application identifier corresponding to each sample subset and store it in the preset application set apkList; wherein, the application set , t n,1 The sample application identifier indicates whether the nth sample application is a malicious application.

3. The method for detecting malicious Android APKs based on regular expression extreme learning machine according to claim 1, characterized in that, Step 2 includes the following steps: Step 201, using the decompilation tool apktool to batch process each sample subset to obtain the AndroidManifest.xml file and .smali file for each sample subset; Step 202, parsing the AndroidManifest.xml file of the sample subset using the DOM method, and according to the structural hierarchy of the AndroidManifest.xml file, sequentially obtaining the attribute values ​​of the first type of feature attributes from the second-level nodes, third-level nodes, and fourth-level nodes, and marking the attribute values ​​of the first type of feature attributes as attribute vectors R1, R2, R3, and R4 respectively; sequentially accessing the .smali file of the sample subset, extracting the attribute values ​​of the second type of feature attributes, and marking the attribute values ​​of the second type of feature attributes as attribute vector S5; wherein, Where n is the total number of sample applications in the sample application set apk; Step 203, construct the basic feature matrix R by finding the union of the attribute vectors R1, R2, R3, R4, and S5; wherein, the basic feature matrix R The first column of the basic feature matrix R is attribute vector R1, the second column is attribute vector R2, the third column is attribute vector R3, the fourth column is attribute vector R4, and the fifth column is attribute vector S5; Step 204: Obtain the sample application identifier corresponding to each sample subset and mark it as attribute vector T, where, , t n,1 The sample application identifier indicates whether the nth sample application is a malicious application.

4. The Android malicious APK detection method based on regular expression extreme learning machine according to claim 3, characterized in that, Step 3 includes the following steps: Step 3.1, using the information gain algorithm to score the attribute values ​​in the basic feature set R using the following formula: in, This represents the information entropy of the i-th feature set in the basic feature set R. Indicates that the i-th feature set is in the feature Conditional entropy under the given condition, lg( This indicates that the i-th feature set is in the feature The first rating result is below. Let represent the element value at the i-th row and j-th column in the basic feature set R; Step 3.2: Filter the basic feature matrix according to the first scoring result, selecting the top A-ranked feature attributes from the basic feature matrix R to form the first feature matrix F; Step 3.3: Use the Fisher Score algorithm to score the attribute values ​​in the basic feature set R using the following formula: in, This represents the second score result corresponding to the i-th feature set in the basic feature set R. This represents the average value of the i-th feature in the basic feature set R in the j-th class of samples, where the j-th class of samples includes the i-th feature. To the A sample application, This represents the average value of the i-th feature set in the basic feature set R corresponding to all functional categories; This represents the inter-class variance among the i-th feature sets in the basic feature set R; Let represent the intra-class variance between the i-th feature set in the basic feature set R; Step 3.4: Filter the basic feature matrix according to the second scoring result, and select the feature attributes ranked in the top B from the basic feature matrix R to form the second feature matrix I; Step 3.5: Select the common feature matrix in the first feature matrix F and the second feature set I as the feature subset X; wherein, the feature subset X is a matrix of size N×5.

5. The method for detecting malicious Android APKs based on regular expression extreme learning machine according to claim 1, characterized in that, Step 5 includes the following steps: Step 5.1, extract the application APK to be detected, filter out the first type of feature attributes and the second type of feature attributes in the application APK to be detected, and generate the test feature matrix R' of the application to be detected; Step 5.2, generate a new intermediate vector H based on the test feature matrix R' of the application to be detected, and combine the new intermediate vector H with the second target regularization coefficient. And the output weight vector estimate obtained in step 4.3 The system obtains the application identifier of the application to be detected. If the application identifier of the application to be detected is 1, it means that the application to be detected is a malicious application; if the application identifier of the application to be detected is 0, it means that the application to be detected is a safe application.

6. An Android malicious APK detection device based on regular expression extreme learning machine, characterized in that: The method includes a memory, a processor, and an Android malicious APK detection program based on a regular expression extreme learning machine, which is stored in the memory and can run on the processor. When the Android malicious APK detection program based on a regular expression extreme learning machine is executed by the processor, it implements the steps of the Android malicious APK detection method based on a regular expression extreme learning machine as described in any one of claims 1-5.

7. A readable storage medium having instructions stored thereon, characterized in that: When executed by the processor, this instruction implements the steps of the Android malicious APK detection method based on regular extreme learning machine as described in any one of claims 1-5.

Images