Method and system for identifying android escape software based on function call and conditional features
By generating function call graphs and conditional features, and combining BERT and GNN algorithms to generate feature vectors, the false positive and false negative problems of Android escape software detection in existing technologies are solved, and accurate detection is achieved under obfuscated conditions.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- UNIV OF ELECTRONICS SCI & TECH OF CHINA
- Filing Date
- 2022-07-26
- Publication Date
- 2026-07-24
AI Technical Summary
Existing technologies cannot accurately detect Android escape software, and traditional methods rely on manual feature extraction, leading to false positives and false negatives. Static obfuscation techniques cause detection failures.
By generating function call graphs and function condition features, conditional information of API call points is extracted, and BERT and GNN algorithms are used for embedding to generate feature vectors. These vectors are then input into a machine learning model for training, thereby enabling the detection of Android escape software.
It achieves accurate detection of Android escape software under obfuscated conditions, avoiding false positives and false negatives, and improving detection accuracy.
Smart Images
Figure CN115329330B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a method for identifying Android escape software in software analysis. Specifically, it provides a method and system for identifying Android escape software based on function call graphs and function condition features. This method obtains API call relationships and condition judgment information from the tested Android APK through static analysis, vectorizes the APK information through comprehensive feature representation and feature fusion, and finally combines machine learning algorithms to achieve escape detection of the tested Android APK. Background Technology
[0002] The Android operating system has achieved widespread adoption globally, currently used in 2.5 billion mobile devices, and by the second quarter of 2021, Android's global market share had reached 83.8%. With Android's rapid global market expansion, it has also become a primary target for malicious actors to implant malware. The CIC estimates that nearly 12,000 new instances of Android malware are detected daily. While researchers have developed numerous automated methods for detecting Android malware, the techniques for evading static and dynamic detection are constantly evolving. Escape malware, capable of adjusting its operating strategy according to the environment, has emerged, rendering traditional malware detection methods ineffective and unable to promptly block its spread. This seriously infringes upon users' legitimate rights and even causes significant losses to users and society. Therefore, the detection and classification of Android software exhibiting escape behavior has become an urgent problem to solve.
[0003] In the detection and classification of Android escape software, scholars typically employ two analysis methods: dynamic analysis and static analysis. Dynamic analysis can capture dynamic information during program execution, such as system calls and sensitive API calls. However, because escape software has the ability to detect its runtime environment, if it detects a dynamic analysis environment, it will hide its malicious behavior, execute normal software functions, or crash and exit. This necessitates that dynamic analysis replicate its runtime environment as closely as possible to a real device to detect malicious behavior. Static analysis analyzes program code through methods such as disassembly, extracting overall program characteristics for analysis without requiring the program to run. Traditional static analysis of escape software primarily relies on feature matching, manually extracting certain fields. If an APK uses these fields, it is considered escape software. This approach leads to numerous false positives for benign software, as many programs also call sensitive features for security purposes, and it also causes some malicious software that evades static detection to go undetected. Therefore, these methods generally suffer from the following technical problems:
[0004] 1. Over-reliance on manually extracted features can lead to a large number of APKs escaping detection if too few features are collected, while an excessive number of features can result in many benign APKs being detected as having escape behavior.
[0005] 2. Using techniques such as static obfuscation can replace a large number of features or character information, making it impossible to find these information during feature matching, thus leading to detection failure. Summary of the Invention
[0006] The purpose of this invention is to provide a method and system for identifying Android escape software based on function call graphs and function condition features, solving the problem that existing technologies cannot accurately detect escape software or rely too much on manual feature extraction and feature matching.
[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0008] A method for identifying Android escape software based on function call graphs and function condition features includes the following steps:
[0009] Step 1: Decompile the Android APK file under test to obtain the APIs called in the Android APK under test, extract the feature API list to match the characteristics contained in the test APK, and generate a function call graph. Here, Android APK refers to the Android installation package, API refers to the application programming interface, and the feature API list refers to the APIs in the Android code that involve sensitive permissions and manually extracted escape characteristics, which may include strings or function names.
[0010] Step 2: Extract the conditional information surrounding each API call point in the call graph that is related to the API;
[0011] Step 3: Generate the feature vector for each feature API node based on the information from the call graph and the conditional statements;
[0012] Step 4: Compress the information of the feature APIs involved and merge them into the feature vector of the APK;
[0013] Step 5: Input the feature vector and escape information of each APK into the machine learning classification model for training to achieve APK escape detection.
[0014] Furthermore, the specific steps of step 1 are as follows:
[0015] Step 1.1: First, based on the sensitive API information provided by the Android official website and some fields and method features related to escape behavior extracted from manually analyzed samples, a feature API set is prepared.
[0016] Step 1.2: Decompile the test APK using the Androguard tool to obtain all methods in the APK, match them with the feature API set selected in Step 1.1 to obtain the feature APIs used by the test APK, and then trace the call chain of these feature APIs.
[0017] Furthermore, the specific steps of step 2 are as follows:
[0018] For the feature API call chain generated in step 1, use Androguard to decompile each API involved in the call chain to obtain the conditional statements related to the call point.
[0019] Furthermore, the specific steps of step 3 are as follows:
[0020] The BERT text embedding algorithm is used to embed all conditional statements of each feature API, generating a 768-dimensional vector. Then, the graph embedding algorithm GNN is used to embed the graph structure information of the function call graph, generating a 300-dimensional vector containing graph structure information. This results in two feature vectors, which are then concatenated into a 1068-dimensional vector for representing a feature API.
[0021] Furthermore, the specific steps of step 4 are as follows:
[0022] The feature vectors of each matched feature API node are aggregated. This patent uses an averaging method for aggregation to obtain a vector representation of the APK.
[0023] Furthermore, the specific steps of step 5 are as follows:
[0024] By using the vector representation of the APK as input to a machine learning algorithm for training, an escape detection model is obtained. This model can then be used to test whether a new APK exhibits escape behavior.
[0025] A system for identifying Android escape software based on function call graphs and function condition features includes:
[0026] Feature API Selection Module: Decompiles the Android APK file under test to obtain all APIs called in the Android APK under test. Based on the sensitive APIs in the Android system and the manually selected APIs or feature strings, the information in the test APK is matched to obtain the features involved in this APK, which are called feature APIs. These may include two types: sensitive APIs and feature strings.
[0027] Function call chain module: Analyzes the selected feature APIs to determine which API calls them, thereby generating a function call chain;
[0028] Conditional Statement Feature Module: After decompiling the API, extract the conditional information of all if and elseif statements related to the call point in the call graph;
[0029] Embedding module: performs graph embedding on the call graph generated by the feature API and text embedding on the conditional statement using the BERT pre-trained model. The two sets of embedding information are concatenated to form a feature vector, which is used to represent the information of a feature API.
[0030] Feature compression module: Compresses all relevant feature API vectors into a unified vector. This patent uses an averaging calculation method.
[0031] Classification module: Based on the feature API calls of Android APK, a call graph and conditional feature statements are constructed, and machine learning is used to detect, train and classify the labeled Android APK.
[0032] Furthermore, the specific implementation of the feature API selection module is as follows:
[0033] First, there is a list of sensitive APIs and key APIs or feature strings obtained from manually analyzed samples, which form the feature APIs used later;
[0034] Then, the Android APK under test is decompiled using the default decompilation tool DAD in Androguard. The information that matches the above-mentioned feature APIs in the test APK is filtered out by regular expression matching and used as the starting point of the function call graph.
[0035] Furthermore, the specific implementation of the function call chain module is as follows:
[0036] Using the function call and called information generated in Androguard, we can determine which other functions call the feature API and generate a complete function call chain recursively.
[0037] Furthermore, the specific implementation of the conditional statement feature module is as follows:
[0038] When generating function call chains, a bracket matching algorithm is used to extract all if, else if, and else statements of each method as conditional feature statements, and the conditional statements containing the call points are analyzed and recorded.
[0039] Furthermore, the specific implementation of the embedded module is as follows:
[0040] The GNN algorithm is used to embed the function call chain graph, resulting in a vector embedding of the entire graph. A sentence embedding model is then used to semantically embed conditional statements, yielding sentence vectors.
[0041] Furthermore, the specific implementation of the feature compression module is as follows:
[0042] The embedding vector of the call chain graph for each feature API is concatenated with the embedding vector generated by the conditional statement to obtain the vector of each feature API. The vectors of all feature APIs are summed and averaged to obtain a one-dimensional vector. This vector is the vector corresponding to the APK and is used for training the classification model.
[0043] Compared with the prior art, the advantages of the present invention are as follows:
[0044] I. The method proposed in this invention can match manually selected features to obtain the string information and system-sensitive API information used by the test APK. Each feature is vectorized, and these vectors are summed and averaged to obtain the APK vector. This APK representation can aggregate feature strings and system-sensitive API information, providing a more comprehensive description of the sample features. It avoids misjudgments caused by simply relying on matching strings after obfuscation techniques. In this method, since the features used include system-sensitive APIs, this type of method cannot be obfuscated. Therefore, the call graph information and conditional statement information of these APIs can also be used to mine whether the APK contains escape behavior.
[0045] Second, this invention can not only trace the API call chain, but also the string call situation. Therefore, compared with simple string matching, the string in this invention combines its call graph and condition statement information to obtain its corresponding feature information, which is more complete and will not determine that it is an escaped APK just because this string is used. Attached Figure Description
[0046] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0047] Figure 1 This is a flowchart illustrating the process of the present invention, which includes a feature API extraction module, a function call chain module, a condition extraction module, graph embedding, text embedding, feature fusion module, and classification module. Feature API extraction obtains the features used for test samples from a large feature list. The diagram shows the process of call chain processing and condition extraction for one of the features, followed by graph embedding and word embedding. After processing all feature APIs, feature fusion is performed, resulting in a vector for each API. This vector is then input into the classifier to identify escaped samples.
[0048] Figure 2This is an example call graph of feature AP1 in the Android sample of the embodiment. In the graph, the getRunningAppProcesses point is the feature API matched in step one, which is also the starting point of this graph. Points ea, a, and b are the methods involved in the call process, and onPostExecute and handleMessage are the endpoints of the call process. It can be seen that starting from the getRunningAppProcesses method, method b calls getRunningAppProcesses, method a calls b, method ea calls a, method onPostExecute calls ea, and method handleMessage calls a. Detailed Implementation
[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0050] This invention performs information mining on Android APKs by comprehensively analyzing both call relationships and conditional relationships. It not only reveals the relationships between APIs but also the transition information between these call relationships. Our contribution lies in not only utilizing manually collected feature information but also further mining call relationships and conditional information based on these features. This provides a richer representation of the Android APK, enabling accurate identification of escape behavior even when the APK is obfuscated. Specifically:
[0051] A method for identifying Android escape software based on function call graphs and function condition features includes the following steps:
[0052] Step 1: Decompile the Android APK file under test to obtain the APIs called in the Android APK under test, extract the feature API list to match the characteristics contained in the test APK, and generate a function call graph. Here, Android APK refers to the Android installation package, API refers to the application programming interface, and the feature API list refers to the APIs in the Android code that involve sensitive permissions and manually extracted escape characteristics, which may include strings or function names.
[0053] The specific steps are as follows:
[0054] Step 1.1: First, based on the sensitive API information provided by the Android official website and some fields and method features related to escape behavior extracted from manually analyzed samples, a feature API set is prepared.
[0055] Table 1. List of Partial Feature APIs
[0056] android.telephony.TelephonyManager.getLine1Number android.telephony.TelephonyManager.getNetworkCountryIso android.telephony.TelephonyManager.getNetworkType (?i)([a-z0-9]+|)(e|si)mulator generic armeabi goldfish
[0057] Step 1.2: Decompile the test APK using the Androguard tool to obtain all methods in the APK, match them with the feature AP1 set selected in Step 1.1 to obtain the feature APIs used by the test APK, and then trace the call chain of these feature APIs.
[0058] Step 2: Extract the conditional information surrounding each API call point in the call graph that is related to the API;
[0059] The specific steps are as follows:
[0060] For the feature API call chain generated in step 1, use Androguard to decompile each API involved in the call chain to obtain the conditional statements related to the call point.
[0061] Step 3: Generate the feature vector for each feature API node based on the information from the call graph and the conditional statements;
[0062] The specific steps are as follows:
[0063] The text embedding algorithm is used to embed all conditional control statements of each feature API. Then, the graph embedding algorithm is used to embed the graph structure information of the function call graph, generating two vector features. These two feature vectors are concatenated to represent a feature API.
[0064] Step 4: Compress the information of the feature APIs involved and merge them into the feature vector of the APK;
[0065] The specific steps are as follows:
[0066] The feature vectors of each matched feature API node are aggregated. This patent uses an averaging method for aggregation to obtain a vector representation of the APK.
[0067] Step 5: Input the feature vector and escape information of each APK into the machine learning classification model for training to achieve APK escape detection.
[0068] The specific steps are as follows:
[0069] By using the vector representation of the APK as input to a machine learning algorithm for training, an escape detection model is obtained. This model can then be used to test whether a new APK exhibits escape behavior.
[0070] Example
[0071] Android sample 1caa31272daabb43180e079bca5e23c1, according to step 1, matches the APK containing the system API android.app.ActivityManager.getRunningAppProcesses(), and generates a call chain starting from the getRunningAppProcesses method, such as... Figure 2 As shown; according to step 2, while generating the call chain, conditional statements such as if are extracted. In this example, when the ea method calls the a method, four conditional statements are involved, as shown in rows 1 to 4 of Table 2. When the hand1eMessage method calls the a method, one conditional statement is involved, as shown in row 5 of Table 2. According to step 3, the call chain graph structure information is embedded using the GNN graph neural network algorithm to obtain a 300-dimensional vector. Then, the conditional statements extracted in step 3 are embedded using BERT, and the average is calculated to obtain a 768-dimensional vector. This 300-dimensional vector and the 768-dimensional vector are concatenated to obtain a 1068-dimensional vector. The feature vector is used to represent the getRunningAppProcesses method. According to step 4, the above steps only apply to one feature method, but may also include other features. Thus, each feature is represented by a 1068-dimensional vector. These vectors are averaged to obtain a 1068-dimensional vector, which is used to represent the Android sample 1caa31272daabb43180e079bcaSe23c1. According to step 5, each Android sample corresponds to a 1068-dimensional vector and an escape label. A machine learning algorithm is used to train and classify the sample to obtain a model that can achieve escape detection.
[0072] Table 2 Conditional Statements
[0073]
Claims
1. A method for identifying Android escape software based on function call graphs and function conditional features, characterized in that, Includes the following steps: Step 1: Decompile the Android APK file under test to obtain the APIs called in the Android APK under test, extract the feature API list to match the features contained in the test APK, and generate a function call graph for the feature APIs used by the test APK. Here, Android APK refers to the Android installation package, API refers to the application programming interface, and the feature API list refers to the APIs in the Android code that involve sensitive permissions and manually extracted escape features, including strings or function names. Step 2: Extract the conditional information of if and else if statements around each API call point in the call graph that are related to the API; Step 3: Generate the feature vector for each feature API node based on the information from the call graph and the conditional statements; The specific steps of step 3 are as follows: use a text embedding algorithm to embed all condition control statements of each feature API, and then use a graph embedding algorithm to embed the graph structure information of the function call graph, generating two vector features respectively. These two feature vectors are then concatenated for the representation of a feature API. Step 4: Compress the information of the feature APIs involved and merge them into the feature vector of the APK; Step 5: Input the feature vector and escape information of each APK into the machine learning classification model for training to achieve APK escape detection.
2. The method for identifying Android escape software based on function call graphs and function condition features according to claim 1, characterized in that, The specific steps of step 1 are as follows: Step 1.1: First, based on the sensitive API information provided by the Android official website and some fields and method features related to escape behavior extracted from manually analyzed samples, a feature API set is prepared. Step 1.2: Decompile the test APK using the Androguard tool to obtain all methods in the APK, match them with the feature API set selected in Step 1.1 to obtain the feature APIs used by the test APK, and then trace the call chain of these feature APIs used by the test APK.
3. The method for identifying Android escape software based on function call graphs and function condition features according to claim 2, characterized in that, The specific steps of step 2 are as follows: For the feature API call chain generated in step 1, use Androguard to decompile each API involved in the call chain to obtain the conditional statements related to the call point.
4. The method for identifying Android escape software based on function call graphs and function condition features according to claim 3, characterized in that, The specific steps of step 4 are as follows: The feature vectors of each matched feature API node are aggregated using an averaging method to obtain a vector representation of the APK.
5. The method for identifying Android escape software based on function call graphs and function condition features according to claim 4, characterized in that, The specific steps of step 5 are as follows: By using the vector representation of the APK as input to a machine learning algorithm for training, an escape detection model is obtained. This model can then be used to test whether a new APK exhibits escape behavior.
6. A system for identifying Android escape software based on function call graphs and function condition features, characterized in that, include: Feature API Selection Module: Decompiles the Android APK file under test to obtain all APIs called in the Android APK under test. Based on the sensitive APIs in the Android system and the manually selected APIs or feature strings, the information in the test APK is matched to obtain the features involved in this APK, which are called feature APIs. These include two types: sensitive APIs and feature strings. Function call chain module: Analyzes the selected feature APIs to determine which API calls them, thereby generating a function call chain; Conditional Statement Feature Module: After decompiling the API, extract the conditional information of all if and else if statements related to the call point in the call graph; Embedding module: performs graph embedding on the call graph generated by the feature API and text embedding on the conditional statements, and concatenates the two sets of embedding information to form a feature vector, which is used to represent the information of a feature API; Feature compression module: Compresses all relevant feature API vectors into a single vector using an averaging method; Classification module: Based on the feature API calls of Android APK, a call graph and conditional feature statements are constructed, and machine learning is used to detect, train and classify the labeled Android APK.
7. A system for identifying Android escape software based on function call graphs and function condition features according to claim 6, characterized in that, The specific implementation of the feature API selection module is as follows: First, there is a list of sensitive APIs and key APIs or feature strings obtained from manually analyzed samples, which form the feature APIs used later; Then, the Android APK under test is decompiled using the default decompilation tool DAD in Androguard. The information that matches the above-mentioned feature APIs in the test APK is filtered out by regular expression matching and used as the starting point of the function call graph.
8. A system for identifying Android escape software based on function call graphs and function condition features according to claim 6, characterized in that, The specific implementation of the function call chain module is as follows: Using the function call and called information generated in Androguard, we can determine which other functions call the feature API and generate a complete function call chain recursively.
9. A system for identifying Android escape software based on function call graphs and function condition features according to claim 7, characterized in that, The specific implementation of the conditional statement feature module is as follows: When generating function call chains, all if, else if, and else statements of each method are extracted as conditional feature statements using a bracket matching algorithm, and the conditional statements containing call points are analyzed and recorded. The specific implementation of the embedded module is as follows: The GNN algorithm is used to embed the function call chain graph to obtain the vector embedding of the whole graph, and the sentence embedding model is used to perform semantic embedding of the conditional statement to obtain the sentence vector. The feature compression module is specifically implemented as follows: The embedding vector of the call chain graph for each feature API is concatenated with the embedding vector generated by the conditional statement to obtain the vector of each feature API. The vectors of all feature APIs are summed and averaged to obtain a one-dimensional vector. This vector is the vector corresponding to the APK and is used for training the classification model.