Android malware adversarial sample detection method based on the concept of mobile target defense

Abstract

This invention discloses an Android malware adversarial sample detection method based on the concept of mobile target defense. The method includes: a heterogeneous model pool, diversified adversarial training, optimal ensemble learning, and a dynamic update trigger. The heterogeneous model pool is designed for Android software, aiming to provide a heterogeneous orthogonal foundational model for subsequent adversarial training and ensemble learning. The diversified adversarial training is designed for Android malware, generating corresponding detection models for different types of adversarial sample attacks. The optimal ensemble learning is designed for all adversarial detection models, aiming to form a detection capability against all types of adversarial samples. The dynamic update trigger is based on the detection results, updating the construction process of the heterogeneous model pool, diversified adversarial training, and optimal ensemble learning through a mixture of periodic and event-driven triggers. Through the technical solution of this disclosed example, mainstream Android malware adversarial samples can be detected, improving the security of the Android platform.

Description

Technical Field

[0001] This invention relates to a detection technology for adversarial samples of malicious application software under the Android operating system, belonging to the field of malicious program detection technology. Background Technology

[0002] With the increasing popularity of the Android system, while it has attracted developers to create diverse and powerful mobile applications, it has also become a breeding ground for a large number of malware attacks. Millions of malicious Android software packages are added globally each year, constantly causing large-scale privacy breaches and economic losses. Detecting and analyzing malware on the Android platform is a crucial task in ensuring the security of the Android system.

[0003] In recent years, with the popularity and application of artificial intelligence technology, research on Android malware detection has increased significantly. Most studies utilize machine learning methods to train malware detectors to identify malicious Android software instances, achieving high detection accuracy and effectiveness. However, recent research indicates that these machine learning-based malware detectors are highly vulnerable to adversarial attacks. Malware authors can inject perturbations into malware programs, allowing them to evade detectors while maintaining their malicious functionality. Therefore, accurately detecting adversarial examples of Android malware has become a challenging task.

[0004] Currently, there are three main detection methods for adversarial examples: defensive distillation, adversarial training, and ensemble learning. Defensive distillation reduces the sensitivity of machine learning methods to small perturbations, thus mitigating the negative impact of adversarial examples targeting a specific model. However, it severely impacts detector performance when facing black-box attacks that can generate highly transferable adversarial examples. Adversarial training retrains the classifier by filling the original dataset with labeled adversarial malware samples. However, the performance improvement of this method is limited by the similarity of adversarial examples in the training and testing datasets, and it cannot guarantee detection performance against other types of adversarial attacks. Ensemble learning achieves better detection results by integrating the outputs of multiple sub-classifiers, but this method relies on the performance of the sub-classifiers; when multiple misclassified sub-classifiers exist, good detection capabilities cannot be guaranteed. Furthermore, all of the above methods are static and deterministic defense deployment methods, giving attackers a significant time advantage over defenders. Attackers can continuously detect and analyze the deployed detection system, thereby constructing new adversarial examples capable of escaping detection.

[0005] In recent years, adversarial example detection methods based on the mobile target defense (MTB) concept have been proposed in the field of image classification. However, due to the significant differences between images and Android software, existing methods cannot be directly applied to the detection of adversarial examples of Android malware. Furthermore, current MTB-based methods suffer from the following shortcomings: First, current MTB techniques select sub-models subjectively, failing to optimize the ensemble learning process. Second, existing methods perform poorly when dealing with highly transferable adversarial examples, lacking the broad capability to detect all types of adversarial examples. Finally, existing methods only employ one or a few techniques based on the MTB concept, failing to fully leverage the advanced nature and security of the MTB concept, leaving the possibility that some carefully designed adversarial examples by attackers may bypass detection. Summary of the Invention

[0006] To address the above problems, this invention proposes an Android malware adversarial sample detection method based on the concept of mobile target defense. First, a heterogeneous model pool is constructed. Then, diverse adversarial training is performed on the basic models within the model pool. By optimizing the ensemble learning process and global dynamic updates, a long-term, comprehensive detection capability for all types of adversarial samples is achieved. The technical solution disclosed in this invention can accurately detect current mainstream Android malware adversarial samples, thereby effectively improving the security of the Android platform.

[0007] This invention adopts the following technical solution: an Android malware adversarial sample detection method based on the concept of mobile target defense, the method comprising the following steps:

[0008] Step 1: Construct a heterogeneous model pool.

[0009] Step 2: Diverse combat training,

[0010] Step 3: Optimize ensemble learning.

[0011] Step 4: Hybrid dynamic updates.

[0012] The specific details of the steps are as follows:

[0013] Step (1) Extract features from Android software containing tags and randomly select data samples according to a certain proportion to divide them into training set, validation set and test set; according to the obtained training set and validation set, randomly divide them into m equal parts (m is greater than or equal to 3), and use m machine learning algorithms to train m heterogeneous basic detection models of Android malware based on the equally divided training set and validation set to complete the construction of the heterogeneous basic detection model pool;

[0014] Step (2) Based on the m basic detection models generated in step (1) and their corresponding m training sets, inject n different adversarial perturbations (n ​​greater than or equal to 1) into each training set of data labeled as malware, forming m*n malicious perturbation data; based on the generated m*n malicious perturbation data and the m machine learning algorithms and m validation sets used in step (1), for each machine learning algorithm, use adversarial training to generate n adversarial detection models, generating a total of m*n adversarial detection models;

[0015] Step (3) Based on the test subset obtained in step (1), generate adversarial samples for the data marked as malware to form an adversarial sample test subset; based on the m*n adversarial detection models generated in step (2), sort the adversarial sample detection performance of the models from high to low using the generated adversarial sample test set to obtain the three adversarial detection models with the highest detection performance; based on the three adversarial detection models with the highest detection performance, use an ensemble learning method to generate an ensemble detection model;

[0016] Step (4) Based on the integrated detection model obtained in step (3), the dynamic update trigger is used for monitoring. When the number of monitoring times reaches the threshold, the current count of the trigger is cleared, and steps (1) to (3) are repeated.

[0017] In step 1, the heterogeneous model pool construction method, this paper provides a model pool containing multiple heterogeneous basic detection models, as detailed below:

[0018] Step (1.1) For Android software containing benign and malicious tags, extract the binary features of the Android software using the publicly available Androguard tool to form the feature vector of the Android software;

[0019] Step (1.2) involves randomly sampling the Android software feature vectors obtained in step (1.1) using a preset ratio (e.g., 6:2:2) to form training, validation, and test sets respectively.

[0020] Step (1.3) involves randomly sampling the training set, validation set, and test set obtained in step (1.2) to divide the data sets into m equal parts, resulting in m training subsets, m validation subsets, and m test subsets.

[0021] Step (1.4) For the m training subsets obtained in step (1.3), use m different machine learning algorithms to train the m training subsets through the publicly available TensorFlow platform and the Scikit-learn library of the Python platform.

[0022] Step (1.5) Based on the m validation subsets obtained in step (1.3), for the training process in step (1.4), the GridSearchCV function in the Scikit-learn library of the Python platform is used to systematically traverse multiple model parameter combinations, determine the parameters with the best detection effect, and generate m heterogeneous Android software basic detection models.

[0023] Step 2: Diversified adversarial training methods. This paper provides several Android software adversarial example detection models that can detect different types of adversarial examples, as follows:

[0024] Step (2.1) targets the Android software basic detection model obtained in step (1.5) and performs various adversarial attacks on the detection model using the secml.adv.attacks function in the publicly available Python platform SecML library;

[0025] Step (2.2) uses the objective_function function in the publicly available Python platform SecML library to evaluate the adversarial attack effect of step (2.1), sorts the attack effects from high to low, selects the top n adversarial sample attacks, and saves the n malicious adversarial perturbation data generated by them;

[0026] Step (2.3) repeats steps (2.1) and (2.2) m times to obtain m*n malicious counter-disturbance data.

[0027] Step (2.4) For the malicious adversarial perturbation data obtained in step (2.3), set its label as malicious software and add it to the training subset respectively to generate m*n adversarial training subsets;

[0028] Step (2.5) For the new training subset obtained in step (2.4), the m*n adversarial training subsets are retrained using the machine learning algorithms adopted in step (1.4) through the publicly available TensorFlow platform and the Scikit-learn library of the Python platform.

[0029] Step (2.6) Based on the m verification subsets obtained in step (1.3), for each data in the verification subset labeled as malicious, the n adversarial sample attack methods selected in step (2.2) are used to attack through the secml.adv.attacks function in the publicly available Python platform SecML library, generating m*n adversarial verification subsets;

[0030] Step (2.7) Based on the m*n adversarial verification subsets obtained in step (2.6), for the training process in step (2.5), the GridSearchCV function in the Scikit-learn library of the Python platform is used to systematically traverse multiple model parameter combinations, determine the parameters with the best detection effect, and generate m*n Android software adversarial detection models.

[0031] Step 3: Optimizing the ensemble learning method. This paper provides an Android software adversarial example ensemble detection model that can detect all types of mainstream adversarial examples, as detailed below:

[0032] Step (3.1) For the 1 test subset obtained in step (1.3), the n adversarial sample attack methods selected in step (2.2) are used to attack the data through the secml.adv.attacks function in the publicly available Python platform SecML library, and n adversarial sample data are obtained. These data are then merged to generate a 1 adversarial test subset.

[0033] Step (3.2) For the m test subsets obtained in step (1.3), repeat step (3.1) m times to obtain m adversarial test subsets.

[0034] Step (3.3) involves dividing the m*n Android software adversarial detection models obtained in step (2.7) into m categories based on their respective basic detection model types, with each category containing n Android software adversarial detection models.

[0035] Step (3.4) For n Android software adversarial detection models of the same category, sort them from low to high according to the magnitude of the model loss function, and select the adversarial detection model with the smallest loss value in this type.

[0036] Step (3.5) For m different types of adversarial detection models, repeat step (3.4) m times to obtain m different categories of optimal Android software adversarial detection models;

[0037] Step (3.6) For the m Android software adversarial detection models obtained in step (3.5), the m adversarial test subsets obtained in step (3.2) are used to test the detection accuracy. The models are sorted from high to low accuracy and the three adversarial detection models with the highest detection accuracy are selected.

[0038] Step (3.7) For the three adversarial detection models obtained in step (3.6), by arbitrarily selecting one of the m test subsets obtained in step (1.3), three test results are output respectively;

[0039] Step (3.8) determines the final output result based on the three test results output in step (3.7) according to the majority voting rule, and integrates the three adversarial detection models to generate an integrated detection model.

[0040] Step 4: Hybrid Dynamic Update Method. This paper provides a hybrid dynamic trigger updater based on detection period and error event, as detailed below:

[0041] Step (4.1) For the integrated detection model obtained in step (3.8), set a counter to count the number of times the model detects Android software in real time; at the same time, when the detection result of one sub-model is inconsistent with the detection results of the other two sub-models, it is recorded as an error detection event, and another counter is set to count the number of error events in the model detecting Android software in real time.

[0042] Step (4.2) compares the number of detections obtained in step (4.1) with a preset threshold. If the number exceeds the threshold, the architecture is dynamically updated, and the counter set in step (4.1) for counting the number of model detections is cleared. For the number of error events obtained in step (4.1), compare the number with a preset error threshold. If the number exceeds the threshold, the architecture is dynamically updated, and the counts of the two counters in steps (4.1) and (10.1) are cleared. Otherwise, return to step (4.1).

[0043] Compared with the prior art, the present invention has the following advantages:

[0044] (1) This invention proposes an Android malware adversarial sample attack detection method based on the idea of ​​mobile target defense. This invention is based on the idea of ​​mobile target defense and has the advantages of method transparency, high scalability and easy deployment. Its dynamic basic model has dynamism and heterogeneity. The adversarial detection model formed by adding different adversarial perturbations has diversity. Furthermore, it forms a redundant ensemble classifier through ensemble learning. This will greatly weaken the inherent advantages of malware authors in terms of time and cost, break the current unequal status quo of easy attack and difficult defense in Android security, and has important significance for detecting the performance of adversarial samples of Android platform malware.

[0045] (2) Before constructing the heterogeneous model pool, this invention first divides the training data into shards. The number of Android software in each shard is fixed, and multiple heterogeneous detection algorithms are trained using their respective shards, making the construction method simple. Each resulting basic detection model is generated based on completely orthogonal training data, achieving mutual isolation between models. This significantly reduces the possibility of attackers launching transferable adversarial attacks. Even if an attacker obtains knowledge of one or more basic models in the model pool, it will be difficult to achieve the same attack effect on the remaining models, ensuring the robustness of the models.

[0046] (3) Before constructing the ensemble classifier, this invention first ranks the performance of diverse adversarial detection models. First, it optimizes the selection of adversarial detection models generated by the same type of basic model. Then, it selects the best adversarial detection models by ranking the detection capabilities of cross-type models and performs ensemble learning. This ensures the heterogeneity of sub-models during the ensemble process, makes full use of the characteristics of ensemble learning to enhance detection performance, and improves the accuracy of detecting adversarial samples of mainstream Android malware.

[0047] (4) This invention uses dynamic update triggers to dynamically update the overall detection architecture. By combining periodic triggering with error detection threshold triggering, the training data is re-divided, and the base model and adversarial model are retrained. By dynamically updating the detection architecture and model, the logical model configuration is dynamically changed, which changes the attack target of adversarial sample attacks and improves the initiative of the defender in the process of detecting adversarial samples. Attached Figure Description

[0048] Figure 1 A framework diagram for an Android malware adversarial sample detection method based on the concept of mobile target defense is presented.

[0049] Figure 2 This is an architecture diagram of an Android malware adversarial sample detection system based on the concept of mobile target defense. Detailed Implementation

[0050] Based on the steps described above, this section implements some examples in conjunction with the technical solution steps described in the instruction manual.

[0051] Example 1:

[0052] A method for detecting adversarial sample attacks on Android malware using the publicly available Android software dataset Drebin.

[0053] The method includes the following steps:

[0054] Step 1: Construct a heterogeneous model pool.

[0055] Step 2: Diverse combat training,

[0056] Step 3: Optimize ensemble learning.

[0057] Step 4: Hybrid dynamic updates;

[0058] Step 1, the construction of the heterogeneous model pool, is as follows: The publicly available Android software dataset Drebin is selected. Binary features of the selected Android software are extracted using the publicly available Androguard tool to form feature vectors. These vectors are then randomly divided into training, validation, and test sets using a preset ratio of 6:2:2. Based on the obtained training and validation sets, each set is randomly divided into 5 equal parts. Using the publicly available TensorFlow platform and the Scikit-learn library on the Python platform, five different machine learning algorithms—Support Vector Machine (SVM), K-Nearest Neighbor (KNN), Decision Tree (DT), Logistic Regression (LR), and Multi-Layer Perceptron (MLP)—are trained on the equally divided training and validation sets to obtain five heterogeneous basic detection models for Android malware, thus completing the construction of the heterogeneous basic detection model pool.

[0059] Step 2: Diverse adversarial training, specifically as follows: Based on the five generated basic detection models and their corresponding five training sets, various adversarial attacks are performed on the SVM detection models using the secml.adv.attacks function from the publicly available Python platform SecML library. These attacks include CAttackEvasionPGD, CAttackEvasionPGDLs, CAttackEvasionPGDExp, CAttackEvasionCleverhans, CFoolboxBasicIterative, CFoolboxL2CarliniWagner, and CFoolbox... Eleven adversarial attack methods, including L2DDN, CFoolboxDeepfool, CFoolboxEAD, and CFoolboxFGM, were evaluated. The effectiveness of these eleven methods was assessed, and the attack success rates were ranked from highest to lowest. The top four adversarial attack methods were selected, and four different adversarial perturbations were injected into each training set of data labeled as malware, resulting in 5*4 sets of malicious perturbation data. Based on the five machine learning algorithms used, the five validation sets, and the 5*4 sets of malicious perturbation data, four adversarial detection models were generated for each of the SVM, KNN, DT, LR, and MLP algorithms, resulting in a total of 5*4 adversarial detection models.

[0060] Step 3: Optimization of ensemble learning, specifically as follows: Based on the test subset obtained in Step 1, the data marked as malware is attacked using the secml.adv.attacks function in the publicly available Python platform SecML library with CFoolboxDeepfool, CAttackEvasionPGDExp, CAttackEvasionPGDLs, and CFoolboxFGM attacks to generate an adversarial sample test subset; Based on the 5*4 adversarial detection models generated in Step 2, the adversarial sample detection performance of the models is sorted from high to low using the generated adversarial sample test set to obtain the three adversarial detection models with the highest detection performance; Based on the three adversarial detection models with the highest detection performance, an ensemble learning method is used to generate an ensemble detection model;

[0061] Step 4: Hybrid dynamic update, specifically as follows: Based on the integrated detection model obtained in step 3, the dynamic update trigger performs monitoring. The preset detection count threshold is 1000, and the preset error event count threshold is 400. When the monitoring count reaches the threshold, the current count of the trigger is cleared, and steps 1 to 3 are repeated.

[0062] Specifically, the method for constructing a model pool containing multiple heterogeneous detection models in step 1 is as follows:

[0063] Step (1.1) Select the publicly available Android software dataset Drebin, select 47,770 Android software items with benign labels and 5,615 Android software items with malicious labels, and extract the binary features of the selected Android software using the publicly available Androguard tool to form a total of 53,385 feature vectors of Android software.

[0064] Step (1.2) involves randomly sampling the 53,385 Android software feature vectors obtained in step (1.1) in a preset ratio of 6:2:2 to form a training set containing 32,031 feature vectors, a validation set containing 10,677 feature vectors, and a test set containing 10,677 feature vectors.

[0065] Step (1.3) involves randomly sampling the training set, validation set, and test set obtained in step (1.2) to divide the dataset into 5 equal parts, resulting in 5 training subsets, 5 validation subsets, and 5 test subsets.

[0066] Step (1.4) For the five training subsets obtained in step (1.3), five different machine learning algorithms are selected from the publicly available TensorFlow platform and the Scikit-learn library of the Python platform to train the five training subsets respectively. These algorithms include Support Vector Machine (SVM), K-Nearest Neighbor (KNN), Decision Tree (DT), Logistic Regression (LR), and Multi-Layer Perceptron (MLP).

[0067] Step (1.5) uses the 5 validation subsets obtained in step (1.3) to systematically iterate through various model parameter combinations to determine the parameters with the best detection performance, based on the training process in step (1.4). Specifically, the penalty hyper-parameter for the SVM algorithm is set to 0.1, the leaf size for the KNN algorithm is set to 30 and Euclidean distance is used to calculate the distance, the minimum number of samples per slice for the DT algorithm is set to 2, the penalty parameter for the LR algorithm is set to 1 and the maximum number of iterations is 100, and the MLP algorithm has two fully connected layers (each containing 160 neurons) and uses the ReLU function as the activation function. Based on these parameters, 5 heterogeneous Android software basic detection models are generated and combined to form a heterogeneous detection model pool.

[0068] Regarding step 2: the method for constructing diverse adversarial detection models, the details are as follows:

[0069] Step (2.1) targets the basic detection model of Android software obtained in step (1.5) (e.g., the basic detection model based on the SVM algorithm), and performs various adversarial attacks on the SVM detection model using the secml.adv.attacks function in the publicly available Python platform SecML library. These include 11 adversarial attack methods such as CAttackEvasionPGD, CAttackEvasionPGDLs, CAttackEvasionPGDExp, CAttackEvasionCleverhans, CFoolboxBasicIterative, CFoolboxL2CarliniWagner, CFoolboxL2DDN, CFoolboxDeepfool, CFoolboxEAD, and CFoolboxFGM.

[0070] Step (2.2) uses the objective_function function in the publicly available Python platform SecML library to evaluate the effectiveness of a total of 11 adversarial attack methods implemented in step (2.1), sorts the attack success rates from high to low, and selects the top 4 adversarial sample attacks, namely CFoolboxDeepfool, CAttackEvasionPGDExp, CAttackEvasionPGDLs, and CFoolboxFGM, and saves the 4 malicious adversarial perturbation data generated by them;

[0071] Step (2.3) Repeat steps (2.1) and (2.2) for KNN algorithm, DT algorithm, LR algorithm and MLP algorithm respectively, to obtain a total of 5*4 malicious adversarial perturbation data.

[0072] Step (2.4) For the malicious adversarial perturbation data obtained in step (2.3), set its label as malware, and add the four malicious adversarial perturbation data generated by the SVM algorithm, KNN algorithm, DT algorithm, LR algorithm and MLP algorithm to their respective training subset slices, generating a total of 5*4 adversarial training subsets;

[0073] Step (2.5) For the new training subset obtained in step (2.4), the Scikit-learn library of the publicly available TensorFlow platform and Python platform is used to retrain the 5*4 adversarial training subsets using the machine learning algorithms SVM, KNN, DT, LR and MLP used in step (1.4).

[0074] Step (2.6) Based on the 5 verification subsets obtained in step (1.3), for each verification subset of data labeled as malicious, the 4 adversarial sample attack methods selected in step (2.2) are used to perform CFoolboxDeepfool, CAttackEvasionPGDExp, CAttackEvasionPGDLs, and CFoolboxFGM attacks through the secml.adv.attacks function in the publicly available Python platform SecML library, generating 5*4 adversarial verification subsets;

[0075] Step (2.7) is based on the 5*4 adversarial validation subsets obtained in step (2.6). Following the training process in step (2.5), the GridSearchCV function from the Scikit-learn library in Python is used to systematically iterate through various model parameter combinations to determine the parameters with the best detection performance. Specifically, the penalty hyper-parameter for the SVM algorithm against CFoolboxDeepfool and CFoolboxFGM attacks is set to 0.1, and the penalty hyper-parameter for the adversarial model against CAttackEvasionPGDExp and CAttackEvasionPGDLs attacks is set to 1. The leaf size for the KNN algorithm against the CFoolboxDeepfool attack is set to 30, and the leaf size for the adversarial model against CAttackEvasionPGDExp, CAttackEvasionPGDLs, and CFoolboxFGM attacks is set to 30. The size is set to 50, and all adversarial models use Euclidean distance to calculate distance. For the DT algorithm, the minimum number of samples per slice for the CFoolboxDeepfool and CFoolboxFGM attacks is set to 2, and the minimum number of samples per slice for the CAttackEvasionPGDExp and CAttackEvasionPGDLs attacks is set to 5. For the LR algorithm, the penalty parameter for the CFoolboxDeepfool attack is set to 1, and the penalty parameter for the CAttackEvasionPGDExp, CAttackEvasionPGDLs, and CFoolboxFGM attacks is set to 0.1. The maximum number of iterations for all adversarial models is set to 100. For the MLP algorithm, the model parameters for the above four adversarial attacks are set to two fully connected layers (each containing 160 neurons) and the ReLU function is used as the activation function. Based on the above parameter settings, a total of 5*4 Android software adversarial detection models are generated.

[0076] Regarding step 3: the method for constructing an ensemble detection model for adversarial examples in Android software that can detect all mainstream types of adversarial examples, the details are as follows:

[0077] Step (3.1) For one of the five test subsets obtained in step (1.3), the four adversarial sample attack methods selected in step (2.2) are used to perform CFoolboxDeepfool, CAttackEvasionPGDExp, CAttackEvasionPGDLs and CFoolboxFGM attacks using the secml.adv.attacks function in the publicly available Python platform SecML library, resulting in four adversarial sample data. These data are then merged to generate one adversarial test subset.

[0078] Step (3.2) involves repeating step (3.1) five times for the five test subsets obtained in step (1.3) to obtain a total of five adversarial test subsets.

[0079] Step (3.3) takes the 5*4 Android software adversarial detection models obtained in step (2.7) and divides them into 5 categories according to their basic detection model type: adversarial models of SVM algorithm, adversarial models of KNN algorithm, adversarial models of DT algorithm, adversarial models of LR algorithm, and adversarial models of MLP algorithm. Each category contains 4 different Android software adversarial detection models.

[0080] Step (3.4) For the four Android software adversarial detection models of the same category, sort them from low to high according to the magnitude of the model loss function, and select the adversarial detection model with the smallest loss value in this type.

[0081] Step (3.5) repeats step (3.4) 5 times for 5 different types of adversarial detection models to obtain 5 different categories of optimal Android software adversarial detection models, namely, the adversarial model of SVM algorithm against CAttackEvasionPGDLs attack, the adversarial model of KNN algorithm against CAttackEvasionPGDExp attack, the adversarial model of DT algorithm against CFoolboxFGM attack, the adversarial model of LR algorithm against CAttackEvasionPGDExp attack, and the adversarial model of MLP algorithm against CFoolboxDeepfool attack;

[0082] Step (3.6) uses the five adversarial detection models of Android software obtained in step (3.5) and the five adversarial test subsets obtained in step (3.2) to test the detection accuracy using the metrics.accuracy_score() function in the Scikit-learn library of the Python platform. The models are sorted from high to low accuracy and the three adversarial detection models with the highest detection accuracy are selected as the adversarial model of MLP algorithm against CFoolboxDeepfool attack, DT algorithm against CFoolboxFGM attack, and SVM algorithm against CAttackEvasionPGDLs attack.

[0083] Step (3.7) For the three adversarial detection models obtained in step (3.6), by arbitrarily selecting one of the five test subsets obtained in step (3.1), three test results are output respectively;

[0084] Step (3.8) determines the final output result based on the three test results output in step (3.7) according to the majority voting rule, and integrates the three adversarial detection models to generate an integrated detection model.

[0085] Regarding step 4: the hybrid dynamic update triggering method based on detection cycle and error event, the details are as follows:

[0086] Step (4.1) For the integrated detection model obtained in step (3.8), set a counter to count the number of times the model detects Android software; at the same time, when the detection result of one sub-model is inconsistent with the detection results of the other two sub-models, it is recorded as an error detection event, and another counter is set to count the number of error events detected by the model in Android software.

[0087] Step (4.2) compares the number of detections obtained in step (4.1) with a preset threshold of 1000. If the number exceeds the threshold, the architecture is dynamically updated, and the count of the detection counter set in step (4.1) is cleared and the counter is reset to 0. For the number of error events obtained in step (4.1), compares the number of error events with a preset error threshold of 400. If the number exceeds the threshold, the architecture is dynamically updated, and the count of the two counters in step (4.1) is cleared at the same time. Otherwise, return to step (4.1).

[0088] It should be noted that the above embodiments are not intended to limit the scope of protection of the present invention. Equivalent transformations or substitutions made based on the above technical solutions all fall within the scope of protection of the claims of the present invention.

Claims

1. An Android malware adversarial sample detection method based on the concept of mobile target defense, characterized by: The detection method includes the following steps: Step 1: Construct a heterogeneous model pool. Step 2: Diverse combat training, Step 3: Optimize ensemble learning. Step 4: Hybrid dynamic update, Step 1: Construction of the heterogeneous model pool, specifically as follows: extract features from Android software containing tags, and randomly sample data according to a certain proportion, dividing them into training set, validation set and test set; based on the obtained training set and validation set, randomly divide them into m equal parts, where m is greater than or equal to 3, and use m machine learning algorithms to train m heterogeneous basic detection models of Android malware based on the equally divided training set and validation set, thus completing the construction of the heterogeneous basic detection model pool; Step 2: Diverse adversarial training, specifically as follows: Based on the generated m basic detection models and their corresponding m training sets, inject n different adversarial perturbations into the data labeled as malware in each training set, where n is greater than or equal to 1, forming m*n malicious perturbation data sets; Based on the m machine learning algorithms used, the m validation sets, and the m*n malicious perturbation data sets, for each machine learning algorithm, use adversarial training to generate n adversarial detection models, generating a total of m*n adversarial detection models; Step 3: Optimize ensemble learning, specifically as follows: Based on the test subset obtained in Step 1, generate adversarial samples from the data labeled as malware, forming an adversarial sample test subset; based on the m*n adversarial detection models generated in Step 2, sort the models' adversarial sample detection performance from high to low using the generated adversarial sample test set, and obtain the three adversarial detection models with the highest detection performance; based on the three adversarial detection models with the highest detection performance, use an ensemble learning method to generate an ensemble detection model; Step 4: Hybrid dynamic update, as follows: Based on the integrated detection model obtained in Step 3, the dynamic update trigger performs monitoring. When the number of monitoring times reaches the threshold, the current count of the trigger is cleared, and Steps 1 to 3 are repeated.

2. The Android malware adversarial sample detection method based on the mobile target defense concept according to claim 1, characterized in that, Step 1, heterogeneous model pool construction, is carried out as follows: Step (1.1) Extract the binary feature vector of Android software containing benign and malicious tags; Step (1.2) involves randomly sampling the Android software feature vectors obtained in step (1.1) at a preset ratio to form training sets, validation sets, and test sets respectively. Step (1.3) Based on the training set, validation set and test set obtained in step (1.2), the above data sets are divided into m equal parts to obtain m training subsets, m validation subsets and m test subsets; Step (1.4) For the m training subsets obtained in step (1.3), select m different machine learning algorithms to train the m training subsets; Step (1.5) Based on the m validation subsets obtained in step (1.3), for the training process in step (1.4), iterate through multiple model parameter combinations, determine the optimal parameters, and generate m basic detection models for Android software.

3. The Android malware adversarial sample detection method based on the mobile target defense concept according to claim 1, characterized in that, Step 2: Diverse adversarial training, the specific process is as follows: Step (2.1) involves performing various adversarial sample attacks on the Android software basic detection model obtained in step (1.5); Step (2.2) evaluates the adversarial attack effect of step (2.1), sorts the attack effects from high to low, selects the top n adversarial sample attacks, and saves the n malicious adversarial perturbation data generated by them. Step (2.3) repeats steps (2.1) and (2.2) m times to obtain m*n malicious counter-disturbance data; Step (2.4) For the m*n malicious adversarial perturbation data obtained in step (2.3), set their labels as malicious software and add them to the training subsets respectively to generate m*n adversarial training subsets; Step (2.5) For the new training subset obtained in step (2.4), the machine learning algorithm used in step (1.4) is selected to retrain the m*n adversarial training subsets respectively. Step (2.6) Based on the m verification subsets obtained in step (1.3), for each data in the verification subset labeled as malicious, the n adversarial sample attack methods selected in step (2.2) are used to attack it, generating m*n adversarial verification subsets; Step (2.7) Based on the m*n adversarial verification subsets obtained in step (2.6), for the training process in step (2.5), traverse the model parameter combinations, determine the optimal parameters, and generate m*n Android software adversarial detection models.

4. The Android malware adversarial sample detection method based on the mobile target defense concept according to claim 1, characterized in that, Step 3, optimizing ensemble learning, is as follows: Step (3.1) For the 1 test subset obtained in step (1.3), attack it using the n adversarial sample attack methods selected in step (2.2) to obtain n adversarial sample data, and merge them to generate 1 adversarial test subset; Step (3.2) For the m test subsets obtained in step (1.3), repeat step (3.1) m times to obtain m adversarial test subsets; Step (3.3) repeats steps (3.1) and (3.2) m times to obtain m*n malicious counter-disturbance data; Step (3.4) involves classifying the m*n Android software adversarial detection models obtained in step (2.7) into m categories based on their respective basic detection model types, with each category containing n Android software adversarial detection models. Step (3.5) For n adversarial detection models of the same category, sort them from low to high according to the size of the model loss function, and select the adversarial detection model with the smallest loss value in this type. Step (3.6) For m different types of adversarial detection models, repeat step (3.5) m times to obtain m optimal adversarial detection models; Step (3.7) For the m optimal adversarial detection models obtained in step (3.6), the accuracy of the m adversarial test subsets obtained in step (3.2) is tested. The models are sorted from high to low and the three sub-models with the highest detection performance are selected. Step (3.8) For the three adversarial detection models obtained in step (3.7), by arbitrarily selecting one of the m test subsets obtained in step (1.3), three test results are output respectively; Step (3.9) determines the final output result based on the three test results output in step (3.8) according to the majority voting rule, integrates the three adversarial detection models, and generates an integrated detection model.

5. The Android malware adversarial sample detection method based on the mobile target defense concept according to claim 1, characterized in that, Step 4: Hybrid dynamic update, the specific process is as follows: Step (4.1) For the integrated detection model obtained in step (3.9), set a counter to count the number of detections of the model in real time; at the same time, when the result of one sub-model is inconsistent with the other two sub-models, it is recorded as an error detection event, and another counter is set to count the number of error events that occur in the model in real time. Step (4.2) compares the number of detections obtained in step (4.1) with a preset threshold. If the number exceeds the threshold, the architecture is dynamically updated, and the counter count of the number of detections recorded in step (4.1) is cleared. For the number of error events obtained in step (4.1), compare the number with a preset error threshold. If the number exceeds the threshold, the architecture is dynamically updated, and the count of the two counters in step (4.1) is cleared. Otherwise, return to step (4.1).

Images