An Android malware detection method based on stacked integration technology
By generating a balanced dataset, filtering key features, and fusing multiple learners, the problems of sample imbalance and feature redundancy in Android malware detection are solved, thereby improving detection accuracy and generalization ability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-10-08
- Publication Date
- 2026-03-17
AI Technical Summary
Existing Android malware detection methods suffer from problems such as imbalanced samples, redundant features, and weak generalization performance of single models, resulting in poor detection results.
A balanced dataset is generated using a hybrid sample generation method. Features are selected by information entropy gain value, dimensionality is reduced by principal component analysis, and an AM-Stacking malware detection model is established. The detection results of multiple base learners are fused using K-fold cross-validation and attention mechanism.
It achieves more accurate detection of Android malware, improves the detection accuracy and generalization ability of the model, and solves the problems of sample imbalance and feature redundancy.
Smart Images
Figure CN115577357B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer security technology, specifically relating to an Android malware detection method based on stacked integration technology. Background Technology
[0002] Android, a smartphone operating system developed by Google, holds over 85% market share in recent years and has gradually penetrated other manufacturing sectors. However, Android's open-source nature has allowed a large number of malware programs to infiltrate the market, leading to a series of threats and challenges, including privacy breaches, data theft, and cyber espionage, causing significant financial losses to users. Therefore, malware detection has become a pressing issue and a hot topic in the field of computing security.
[0003] Existing methods for malware detection can be broadly categorized into two types: static detection and dynamic detection. Static detection identifies malware before application execution, while dynamic detection performs malware detection tasks at runtime. Because dynamic malware detection methods are time-consuming, costly, and struggle to detect multi-path malware, most researchers have proposed static detection methods.
[0004] In recent years, traditional Android malware detection models have primarily used features extracted from software configuration files and code files as training samples. Malware feature extraction often involves manual selection, resulting in the loss of significant original information and consequently poor model detection performance, hindering further improvements in accuracy. Secondly, traditional malware detection models typically employ a single model, which limits their robustness, accuracy, and generalization ability.
[0005] The existing technical problem is:
[0006] 1. In the field of malware detection, there are relatively few malware samples, which leads to an imbalance in the data ratio between normal software samples and malware samples, causing the model's detection performance to fail to meet expectations.
[0007] 2. Some malware has many features, which can lead to feature redundancy and high computational complexity of the model. Therefore, it is particularly important to efficiently filter malware features and reduce the dimensionality of the filtered features for malware detection.
[0008] 3. In malware detection, a single detection model is prone to getting stuck in local optima during training, resulting in weak generalization performance and poor detection results. How to integrate the advantages of multiple single models to form a detection model that excels in all aspects is obviously a problem worth studying. Summary of the Invention
[0009] To address the aforementioned technical problems, this invention proposes an Android malware detection method based on stacked integration technology, comprising the following steps:
[0010] S1: Obtain Android software APK data samples with normal and malicious software labels from mobile terminals;
[0011] S2: Use a hybrid sample generation method to generate malware samples. Construct a sample dataset with a balanced number of malware samples and normal software samples based on the obtained Android software APK data samples with normal and malware labels and the generated malware samples.
[0012] S3: Analyze each software sample in the sample dataset to obtain the software features of each software sample;
[0013] S4: Calculate the information entropy gain value of each software feature, determine the contribution of each software feature to the detection of malware based on the magnitude of the information entropy gain value, and extract the top k features with the largest contribution.
[0014] S5: Use principal component analysis to perform deep dimensionality reduction on the extracted top k features to obtain a key feature set, and divide the key feature set into a training set and a test set;
[0015] S6: Establish an AM-Stacking malware detection model, which includes: a first-layer base learner KNN, LR, RF, and a second-layer meta-learner GBDT;
[0016] S7: The training set is divided into multiple training sets using the K-fold cross-validation method. The first-layer base learners KNN, LR, and RF of the AM-Stacking malware detection model are trained according to the multiple training sets to obtain the training parameters of the three base learners under different training sets and the generated new training subsets.
[0017] S8: Use the new training subset generated by the base learner to train the second-layer meta-learner GBDT of the AM-Stacking malware detection model, and obtain the training parameters of the meta-learner GBDT.
[0018] S9: Based on the training parameters of the base learner under different training sets, the test dataset is detected separately, and the detection results are weighted and integrated using the attention mechanism to obtain a new test dataset.
[0019] S10: Based on the training parameters of the obtained meta-learner GBDT, the meta-learner GBDT is tuned. The new test dataset is then input into the tuned meta-learner GBDT for further detection, and malware is detected.
[0020] Preferably, a hybrid sample generation method is used to generate malware samples, as follows:
[0021]
[0022] Among them, M new Let m represent the number of new malware samples, G represent the generative adversarial network, and z represent the noise vector generated by the boundary synthesis minority class oversampling technique. M i The boundary sample is represented. M represents i A K-nearest neighbor sample, where δ represents a random number between 0 and 1.
[0023] Preferably, the information entropy gain value of each software feature is calculated and expressed as:
[0024] IG(F i )=H(S * )-H(S * |F i )
[0025] Among them, IG(F i ) represents the i-th feature F i Information gain value, H(S) * ) represents the information entropy of the entire prediction system. k represents the number of categories in the system. Represents variable S * Possible values, Representing variables The probability, H(S*|F i () represents the conditional information entropy when each feature is used alone as a classification feature. Value(F i ) represents the i-th feature F i All possible values, P(Value(F) i )) represents the probability that the i-th feature takes a certain value.
[0026] Preferably, principal component analysis is used to perform deep dimensionality reduction on the extracted top k features, as shown below:
[0027] The extracted first k features are transformed into vector form. Each feature vector is centered, and a covariance matrix is constructed based on the centered feature vectors. The covariance matrix is then decomposed into eigenvalues and sorted in descending order of eigenvalues. The feature vectors corresponding to the first k eigenvalues are taken, and the first k feature vectors are mapped to a k-dimensional sample feature matrix. The sample features in the sample feature matrix are then combined to form a key feature set.
[0028] Preferably, each feature vector is centered, as follows:
[0029]
[0030] Among them, X i This represents the centered eigenvector. Let represent the i-th feature vector selected by comparing the information entropy gain value of each software feature, and μ represent the average value of the centered feature vector. n represents the number of eigenvectors. It represents a vector consisting of all the feature values that the i-th feature can take.
[0031] Preferably, the training set is partitioned using the K-fold cross-validation method, as follows:
[0032]
[0033] Among them, D train(i) This indicates that the training set D train The i-th data subset D i The training subset obtained after discarding, D valid(i) For the i-th training subset D i The corresponding validation set.
[0034] Preferably, the training parameters of the three base learners and the resulting new training subsets under different training sets are represented as follows:
[0035] P mi =LM m (D train(i) ),(i=1,2...,5),(m=1,2,3)
[0036]
[0037] Among them, P mi LM represents the training parameters obtained after training the m-th base learner through the i-th training subset. m This represents the m-th base learner. This indicates that the m-th base learner is trained according to the parameters P. miVerify the new training subset obtained from the i-th validation set.
[0038] Preferably, the second-layer meta-learner GBDT is trained to obtain the training parameters of the GBDT meta-learner, which are expressed as follows:
[0039]
[0040] Where P′ represents the meta-learner learning from the new training subset. The training parameters obtained after training, LM represents the meta-learner.
[0041] Preferably, S9 specifically includes:
[0042]
[0043] Among them, Test i This represents the new test set obtained by summing the precision of each base learner. This indicates that each base learner performs different training parameters on the same test set D. test The predicted result, β i Let q represent the attention mechanism weight score of each base learner, and q represent the query vector. This indicates that each base learner detects the test set D under different training parameters. test The resulting dataset is collectively referred to as attSum(), which represents the precision-weighted summation function in the attention mechanism.
[0044] Preferably, the new test dataset is input into the hyperparameter-tuned meta-learner GBDT for further detection, and malware is detected, represented as:
[0045] R = P′(Test)
[0046] Where R represents the final detection result, Test represents the new test set obtained by the first base learner through precision-weighted summation, and P′ represents the training parameters of the meta-learner.
[0047] The beneficial effects of this invention are as follows: This invention acquires data, equalizes the acquired data with malware samples and normal software samples, extracts features from the equalized data, filters and reduces the dimensionality based on the information entropy gain value of each feature, fuses multiple models with good classification performance through stacked ensemble, uses K-fold cross-validation to divide the dataset, introduces an attention mechanism, and combines equalized data samples with the hybrid feature processing method IG-PCA, which can more accurately detect the presence of malware. Attached Figure Description
[0048] Figure 1 This is an overall flowchart of the present invention;
[0049] Figure 2 This is a schematic diagram of the BS-GAN used for equalizing data samples in this invention;
[0050] Figure 3 This is a schematic diagram of IG-PCA for extracting key features in this invention;
[0051] Figure 4 This is a schematic diagram of the stacking model of the present invention. Detailed Implementation
[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0053] An Android malware detection method based on stacked integration technology, such as Figure 1 As shown, it includes:
[0054] S1: Obtain Android software APK data samples with normal and malicious software labels from mobile terminals;
[0055] S2: Use a hybrid sample generation method to generate malware samples. Construct a sample dataset with a balanced number of malware samples and normal software samples based on the obtained Android software APK data samples with normal and malware labels and the generated malware samples.
[0056] S3: Analyze each software sample in the sample dataset to obtain the software features of each software sample;
[0057] S4: Calculate the information entropy gain value of each software feature, determine the contribution of each software feature to the detection of malware based on the magnitude of the information entropy gain value, and extract the top k features with the largest contribution.
[0058] S5: Use principal component analysis to perform deep dimensionality reduction on the extracted top k features to obtain a key feature set, and divide the key feature set into a training set and a test set;
[0059] S6: Establish an AM-Stacking malware detection model, which includes: a first-layer base learner KNN, LR, RF, and a second-layer meta-learner GBDT;
[0060] S7: The training set is divided into multiple training sets using the K-fold cross-validation method. The first-layer base learners KNN, LR, and RF of the AM-Stacking malware detection model are trained according to the multiple training sets to obtain the training parameters of the three base learners under different training sets and the generated new training subsets.
[0061] S8: Use the new training subset generated by the base learner to train the second-layer meta-learner GBDT of the AM-Stacking malware detection model, and obtain the training parameters of the meta-learner GBDT.
[0062] S9: Based on the training parameters of the base learner under different training sets, the test dataset is detected separately, and the detection results are weighted and integrated using the attention mechanism to obtain a new test dataset.
[0063] S10: Based on the training parameters of the obtained meta-learner GBDT, the meta-learner GBDT is tuned. The new test dataset is then input into the tuned meta-learner GBDT for further detection, and malware is detected.
[0064] Data can be obtained from publicly available data websites or by directly querying publicly available datasets of cybersecurity malware. The required data samples are Android software APKs with tags on the mobile terminal.
[0065] In malware detection, the number of samples from legitimate software and malware often differs significantly, leading to an imbalanced data set and consequently poor model performance. To address the correlation and distribution of samples, a hybrid sample generation method, BS-GAN, is proposed. BS-GAN combines Borderline-SMOTE (Borderline Synthetic Minority Class Oversampling) with Generative Adversarial Networks (GANs). Figure 2 As shown, a noise vector is generated using boundary synthesis minority class oversampling technique and input into the GAN network to obtain new malicious samples, thereby alleviating the imbalance of data samples.
[0066] First, this invention generates noise vectors using a boundary synthesis minority class oversampling technique. Assume the entire sample set is S, the malware sample set is M, and the normal software sample set is T, where M = {M1, M2, ..., M}. i ,…}, T={T1, T2,…, T i , ...}.
[0067] The distance M from each malicious sample is calculated using the K-nearest neighbor method. i The formula for calculating the K most recent samples is as follows:
[0068]
[0069] Among them, Y i and M i These are two samples in space, and dist(M,Y) represents the Euclidean distance between these two samples.
[0070] Suppose that K′ in the K nearest neighbors are normal samples, where 0 ≤ K′ ≤ K. If K / 2 ≤ K′ ≤ K, this malicious sample is called a danger sample. Since danger samples are more easily misclassified, this algorithm only performs new sample synthesis on randomly selected danger samples, resulting in the following noise vector:
[0071]
[0072] Among them, M i It is the selected boundary sample. It is M i A K-nearest neighbor sample, where δ is a random number between 0 and 1.
[0073] Then, the present invention inputs the generated noise vector into a generative adversarial network (GAN) to generate a new malicious sample M through the generator G. new for:
[0074]
[0075] Among them, M new Let m represent the number of new malware samples, G represent the generative adversarial network, and z represent the noise vector generated by the boundary synthesis minority class oversampling technique.
[0076] As is well known, manually selected basic features often suffer from insufficient expressive power, while directly using all features leads to feature redundancy. To more effectively filter out key features, this invention introduces a hybrid feature processing method, IG-PCA, to learn the interrelationships between multiple features and the contribution of each feature to malware detection. Figure 3 As shown, by screening the software samples from multiple aspects, the goal of identifying multiple key features can be achieved.
[0077] Information entropy gain is a statistical measure that visually represents the ability of a particular attribute or feature to distinguish a class of data samples. When calculating the information entropy gain of a software feature, firstly, it's necessary to calculate the overall information content of the data samples when all software samples share the same feature. Then, it's necessary to calculate the overall information content when each software sample has a different feature. Finally, the difference between the two calculations is the information entropy gain value of the desired feature. A larger information entropy gain value indicates a greater contribution to the classification of data samples. Therefore, the magnitude of the information entropy gain value can be used to determine the contribution of each software feature to the detection of malware.
[0078] First, in this invention, the information gain value of each feature is calculated using information entropy, and the top K features with the largest information gain are extracted. Assume that the equalized data sample is S. * , will S * Integrate all the features to obtain the entire feature set, denoted as F = {F1, F2, ..., F}. i ...}, and then calculate the information gain of each feature based on the information entropy. The specific process is as follows:
[0079] Step 1: Calculate the information entropy H(S) of the entire prediction system using the formula for information entropy. * ):
[0080]
[0081] Where: k represents the number of categories in the system, This represents the possible values of variable S*. Representing variables The probability of.
[0082] Step 2: Calculate the conditional information entropy of each feature when used alone as a classification feature. The calculation formula is...
[0083]
[0084] Wherein: F i Let Value(F) represent the i-th feature. i P(Value(F)) represents all possible values of the i-th feature. i )) represents the probability that the i-th feature takes a certain value.
[0085] Step 3: Calculate the information gain value for each feature. Based on the magnitude of the gain value, select the primary features. The information gain of a feature can be defined as:
[0086] IG(F i )=H(S * )-H(S * |Fi )
[0087] Among them, IG(F i ) represents the i-th feature F i Information gain value, H(S) * The information entropy of the entire prediction system is represented by ), and k represents the number of categories in the system. Represents variable S * Possible values, Representing variables The probability, H(S) * |F i Value(F) represents the conditional information entropy when each feature is used alone as a classification feature. i ) represents the i-th feature F i All possible values, P(Value(F) i )) represents the probability that the i-th feature takes a certain value.
[0088] In practice, the main features extracted using the information entropy method still have high dimensionality, leading to excessively high detection complexity in the model. Therefore, in this invention, principal component analysis is also used for deep dimensionality reduction of the extracted main feature set.
[0089] Principal component analysis is used to perform deep dimensionality reduction on the extracted top k features, which is expressed as:
[0090] The extracted first k features are transformed into vector form. Each feature vector is centered, and a covariance matrix is constructed based on the centered feature vectors. The covariance matrix is then decomposed into eigenvalues and sorted in descending order of eigenvalues. The feature vectors corresponding to the first k eigenvalues are taken, and the first k feature vectors are mapped to a k-dimensional sample feature matrix. The sample features in the sample feature matrix are then combined to form a key feature set.
[0091] To eliminate the influence of dimensions on covariance, each eigenvector needs to be centered. The centering of each eigenvector is represented as:
[0092]
[0093] Among them, X i This represents the centered eigenvector. Let represent the i-th feature vector selected by comparing the information entropy gain value of each software feature, and μ represent the average value of the centered feature vector. n represents the number of eigenvectors. It represents a vector consisting of all the feature values that the i-th feature can take.
[0094] Based on the centered data samples, we can obtain the covariance matrix Q of the feature samples as follows:
[0095]
[0096] Where n represents the number of eigenvectors, and X represents the centered eigenvector matrix. T Let X be the transpose of X.
[0097] Next, perform eigenvalue decomposition on the covariance matrix Q, and sort the eigenvalues in descending order. Extract the eigenvectors A = (α1, α2, α3, ..., α4) corresponding to the first k eigenvalues. k Through mapping, n-dimensional feature samples can be mapped to k-dimensional feature samples. The mapping process of the k-dimensional sample feature matrix X′ can be represented as:
[0098] X′=A T X
[0099] Where X′ represents the mapped k-dimensional sample feature matrix, A T X represents the transpose of the eigenvectors corresponding to the first k selected eigenvalues, and X represents the centered eigenvector matrix.
[0100] Finally, the key feature set for identifying malware samples can be selected as follows:
[0101] The training set is partitioned using the K-fold cross-validation method, as follows:
[0102]
[0103] Among them, D train(i) This indicates that the training set D train The i-th data subset D i The training subset obtained after discarding, D valid(i) For the i-th training subset D i The corresponding validation set.
[0104] In malware detection, traditional single detection models are prone to getting stuck in local optima during training, resulting in weak generalization performance and poor detection results. Therefore, this invention addresses this issue by employing a model fusion approach. It utilizes the concept of ensemble models, combining multiple high-performing classification models through stacking to achieve malware detection and thus overcome some shortcomings of traditional detection models. The main idea of stacking is to use a single learner to integrate the classification results of different learners, ensuring learner diversity through the differences between them. In this invention, a two-layer learner approach is primarily used to classify unknown software datasets, such as... Figure 4 As shown:
[0105] In the Stacking model, the learner in the first layer is called the base learner, and the learner in the second layer is called the meta-learner. For the input dataset, it is first divided into a training set (D...). train ) and test set (D test Then, the two learners need to be trained and their parameters tuned using the training dataset. If the base learner and meta learner are trained simultaneously using the partitioned training set, the Stacking model will have an excessively high risk of fitting due to repeated learning using the training feature dataset, which in turn leads to inaccurate detection of malware.
[0106] Preferably, the training parameters of the three base learners and the resulting new training subsets under different training sets are represented as follows:
[0107] P mi =LM m (D train(i) ),(i=1,2...,5),(m=1,2,3)
[0108]
[0109] Among them, P mi LM represents the training parameters obtained after training the m-th base learner through the i-th training subset. m This represents the m-th base learner. This indicates that the m-th base learner is trained according to the parameters P. mi Verify the new training subset obtained from the i-th validation set.
[0110] Preferably, the second-layer meta-learner GBDT is trained to obtain the training parameters of the GBDT meta-learner, which are expressed as follows:
[0111]
[0112] Where P′ represents the meta-learner learning from the new training subset. The training parameters obtained after training, LM represents the meta-learner.
[0113] Preferably, S9 specifically includes:
[0114]
[0115] Among them, Test i This represents the new test set obtained by summing the precision of each base learner. This indicates that each base learner performs different training parameters on the same test set D. test The predicted result, β iLet q represent the attention mechanism weight score of each base learner, and q represent the query vector. This indicates that each base learner detects the test set D under different training parameters. test The resulting dataset is collectively referred to as attSum(), which represents the precision-weighted summation function in the attention mechanism.
[0116] Preferably, the new test dataset is input into the hyperparameter-tuned meta-learner GBDT for further detection, and malware is detected, represented as:
[0117] R = P′(Test)
[0118] Where R represents the final detection result, Test represents the new test set obtained by the first base learner through precision-weighted summation, and P′ represents the training parameters of the meta-learner.
[0119] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A method for detecting Android malware based on stacked integration technology, characterized in that, Comprise: S1: obtain Android software APK data samples with normal and malicious software labels from a mobile terminal; S2: generate malware samples using a hybrid sample generation method, and construct a malware sample and normal software sample balanced sample dataset based on the obtained Android software APK data samples with normal and malicious software labels and the generated malware samples; S3: parse each software sample in the sample dataset to obtain software features of each software sample; S4: calculate the information entropy gain value of each software feature, judge the contribution of each software feature to detecting malicious software according to the size of the information entropy gain value, and extract the top k features with the largest contribution; S5: use principal component analysis to perform deep dimension reduction on the extracted top k features to obtain a key feature set, and divide the key feature set into a training set and a test set; S6: establish an AM-Stacking malware detection model, wherein the AM-Stacking malware detection model comprises a first layer of base learners KNN, LR, and RF, and a second layer of meta learners GBDT; S7: divide the training set using K-fold cross-validation method to obtain multiple training sets, train the first layer base learners KNN, LR, and RF of the AM-Stacking malware detection model according to the divided multiple training sets, and obtain the training parameters of the three base learners under different training sets and the generated new training subsets; S8: train the second layer meta learner GBDT of the AM-Stacking malware detection model using the new training subsets generated by the base learners to obtain the training parameters of the meta learner GBDT; S9: detect the test data set according to the training parameters of the base learners under different training sets, and use the attention mechanism to divide and integrate the detected results to obtain a new test data set; S10: adjust the parameters of the meta learner GBDT according to the obtained training parameters of the meta learner GBDT, input the new test data set into the adjusted meta learner GBDT for further detection, and detect the malicious software.
2. The Android malware detection method based on stacked integration technology according to claim 1, characterized in that, The hybrid sample generation method is used to generate malware samples, which is represented as: wherein M new represents a new malware sample, m represents the number of new malware samples, G represents a generative adversarial network, z represents a noise vector generated by a boundary synthesis minority oversampling technique, M i represents a boundary sample, represents a K-nearest neighbor sample of M i , and δ represents a random number between 0 and 1.
3. The Android malware detection method based on stacked integration technology according to claim 1, characterized in that, The information entropy gain value of each software feature is calculated, which is represented as: IG(F i ) = H(S * ) - H(S * |F i ) Among them, IG(F i ) represents the i-th feature F i Information gain value, H(S) * ) represents the information entropy of the entire prediction system. k represents the number of categories in the system. Represents variable S * Possible values, Representing variables The probability, H(S) * |F i () represents the conditional information entropy when each feature is used alone as a classification feature. Represents the i-th feature F i All possible values, P(Value(F) i )) represents the probability that the i-th feature takes a certain value.
4. The Android malware detection method based on stacked integration technology according to claim 1, characterized in that, The principal component analysis is used to perform deep dimension reduction on the extracted top k features, which is represented as: The extracted top k features are converted into vector form features, each feature vector is centralized, and a covariance matrix is constructed according to the centralized feature vectors. The covariance matrix is subjected to eigenvalue decomposition, sorted in descending order of eigenvalues, and the top k eigenvectors are taken. The top k eigenvectors are mapped to a k-dimensional sample feature matrix, and the sample features in the sample feature matrix form a key feature set.
5. The Android malware detection method based on stacked integration technology according to claim 4, characterized in that, Each feature vector is centralized, which is represented as: where X i represents the centralized feature vector, represents the i-th feature vector selected by comparing the information entropy gain value of each software feature, and μ represents the average value of the centralized feature vector, n represents the number of feature vectors, represents a vector composed of all feature values that the i-th feature can take.
6. The Android malware detection method based on stacked integration technology according to claim 1, characterized in that, The training set is divided using K-fold cross-validation method, which is represented as: wherein D train(i) represents the training set D train The i-th data subset D i The training subset D valid(i) is the validation set corresponding to the i-th training subset D i .
7. The Android malware detection method based on stacked integration technology according to claim 1, characterized in that, The training parameters of the three base learners under different training sets and the generated new training subsets are represented as: P mi = LM m (D train(i) ), (i = 1, 2..., 5), (m = 1, 2, 3) where P mi denotes the training parameters obtained by the mth base learner after training by the ith training subset, LM m denotes the mth base learner, denotes the mth base learner according to the training parameters P mi verifies the new training subset obtained by the ith validation set.
8. The Android malware detection method based on stacked integration technology according to claim 1, characterized in that, The second layer meta-learner GBDT is trained to obtain training parameters of the meta-learner GBDT, denoted as: wherein P' represents the meta-learner through the new training subset the training parameters obtained after training, LM represents the meta-learner.
9. The Android malware detection method based on stacked integration technology according to claim 1, characterized in that, The S9 specifically comprises: where Test i denotes the new test set obtained by precision weighted sum of each base learner, denotes the same test set D test predicted result, β i denotes the attention mechanism weight score of each base learner, q denotes the query vector, denotes the same test set D test obtained data set, and attSum() denotes the precision weighted sum function in the attention mechanism.
10. The Android malware detection method based on stacked integration technology according to claim 1, characterized in that, The new test data set is input into the meta-learner GBDT after parameter adjustment for further detection, and malicious software is detected, denoted as: R = P'(Test) Wherein, R represents the final detection result, Test represents a new test set obtained by precision weighted summation of the first layer base learner, and P' is the training parameter of the meta-learner.