Android Malware Detection Method and System Based on Multi-Dimensional Visualization Analysis

Abstract

The present invention provides an Android malware detection method and system based on multi-dimensional visual analysis, including: selecting three types of feature files from the Android application installation package Apk file; converting them into binary sequences and respectively mapping them in three channels of an RGB image; inputting the RGB image into a lightweight convolutional neural network for training to generate a detection model. This method has simple preprocessing, avoids the redundant reverse engineering of traditional static analysis and the large overhead of dynamic analysis. The texture features of different files in the generated RGB image are mutually mapped, and the feature information covered by each pixel point is more comprehensive, and the image has strong interpretability. This method can not only improve the detection efficiency but also maintain a high accuracy rate.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically, to an Android malware detection method and system based on multi-dimensional visualization analysis. Background Art

[0002] With the rapid development of the network, large-scale automated attacks by malware have become the main form of network attacks. This not only brings great troubles to ordinary users, but also causes non-negligible losses to enterprises and government departments. A variety of software has come to the market, and among them, there are also many malware threatening the privacy security of users. As the most popular mobile operating system in China at present, the Android operating system has a large user base. At the same time, the Android operating system is an open-source operating system, and developers can directly upload application programs to the market for users to use without any review. This also means that more users are facing the threat of malware.

[0003] Currently, malware detection methods mainly include static analysis and dynamic detection techniques. Static analysis mainly uses the static structure and code of the program itself to determine whether it is malicious, which involves related techniques such as decompilation, static system calls, reverse analysis, and pattern matching. Although the static method can accurately capture the static characteristics of malware, due to the single type of features, techniques such as obfuscation or shelling can allow malware to escape detection, resulting in a decline in the detection effect. Dynamic detection mainly detects and monitors malicious behaviors through a mobile phone monitoring program. However, dynamic analysis requires the malware to run completely before making a judgment, so the detection timeliness of malware is relatively poor. More importantly, attackers can make the malware avoid detection by the detection software.

[0004] Patent document CN111523117A discloses an Android malware detection and malicious code location system and method, and its implementation solution is as follows: taking normal and malicious samples as original data, using Androguard to extract the application instruction bytecode, simulating the API sequences that may appear during program operation through static extraction, constructing an API sequence data set, and then training a classifier for malware detection based on a deep learning model to achieve automatic malware detection. At the same time, an attention mechanism is introduced to locate the malicious code segments in the applications detected as malicious, and finally output in the form of an analysis report.

[0005] However, with the sharp increase in the number of malware and the gradual diversification and complexity of its types, the existing malware detection technologies are inefficient. Traditional static analysis of Android malware requires decompilation and reverse engineering, which is cumbersome and vulnerable to code obfuscation or encryption technologies, resulting in inaccurate static analysis detection results. Dynamic analysis requires repeated execution of code in a secure virtual environment, which is time-consuming and consumes a large amount of memory resources. Therefore, researchers need more diverse detection technologies to deal with the unpredictable variants and the increasing number of malware. Summary of the Invention

[0006] Aiming at the defects in the prior art, the purpose of the present invention is to provide an Android malware detection method and system based on multi-dimensional visual analysis.

[0007] An Android malware detection method based on multi-dimensional visual analysis provided by the present invention includes:

[0008] Step S1: Construct an Android software database;

[0009] Step S2: Extract feature files from the database;

[0010] Step S3: Perform visual preprocessing on the feature files to generate RGB images;

[0011] Step S4: Input the RGB images into a lightweight convolutional neural network for training to generate a detection model;

[0012] Step S5: Determine whether the detection effect of the detection model meets the standard. If so, classify the malware or determine the family attributes of the malware. If not, trigger Step S4.

[0013] Preferably, the Android software database includes: apk installation packages of benign software and malware;

[0014] The feature files include multiple files.

[0015] Preferably, Step S3 includes:

[0016] Step S3.1: Generate binary sequences for the extracted feature files respectively;

[0017] Step S3.2: Compare the sequence lengths of the binary sequences and supplement all the sequence lengths to the same length;

[0018] Step S3.3: Cut the binary sequences into arrays with 8-bit binary as single elements;

[0019] Step S3.4: Decimalize each single element in the array to generate corresponding decimal elements;

[0020] Step S3.5: Map the decimal elements one by one to corresponding channels in the RGB image for the pixel points;

[0021] Step S3.6: Merge the channels to generate a complete RGB image.

[0022] Preferably, the lightweight convolutional neural network uses depthwise separable convolutions, including: depthwise convolution and pointwise convolution;

[0023] The number of parameters and the computational amount of the depthwise separable convolution are The calculation formulas are as follows:

[0024]

[0025]

[0026] where P1 and P2 respectively represent the number of parameters of the depthwise separable convolution and the standard convolution, C1 and C2 respectively represent the computational amount of the depthwise separable convolution and the standard convolution, D k ×D k represents the convolution kernel size, D F ×D F represents the feature map size, and M and N respectively represent the number of input channels and output channels.

[0027] Preferably, Step S4 includes:

[0028] Step S4.1: Cut the RGB image into images of a set size to obtain a malicious software feature image dataset;

[0029] Step S4.2: Divide the data into a training set and a test set and perform annotation;

[0030] Step S4.3: Input the training set into the lightweight convolutional neural network for training and test it with the test set to obtain a detection model.

[0031] According to an Android malicious software detection system based on multi-dimensional visualization analysis provided by the present invention, it includes:

[0032] Module M1: Build an Android software database;

[0033] Module M2: Extract feature files from the database;

[0034] Module M3: Perform visual preprocessing on the feature files to generate RGB images;

[0035] Module M4: Input the RGB image into a lightweight convolutional neural network for training to generate a detection model;

[0036] Module M5: Determine whether the detection effect of the detection model meets the standard. If so, classify the malware or determine the family attributes of the malware; if not, trigger Module M4.

[0037] Preferably, the Android software database includes: apk installation packages of benign software and malware;

[0038] The feature file includes multiple files.

[0039] Preferably, Module M3 includes:

[0040] Module M3.1: Generate binary sequences from the extracted feature files respectively;

[0041] Module M3.2: Compare the sequence lengths of the binary sequences and supplement all the sequence lengths to the same length;

[0042] Module M3.3: Cut the binary sequences into arrays with 8-bit binary as single elements respectively;

[0043] Module M3.4: Decimalize the single elements in the array respectively to generate corresponding decimal elements;

[0044] [[ID=2i7]]Module M3.5: Map the decimal elements one by one to the corresponding channels in the RGB image for the pixel points;

[0045] Module M3.6: Merge the channels to generate a complete RGB image.

[0046] Preferably, the lightweight convolutional neural network uses depthwise separable convolutions, including: depthwise convolution and pointwise convolution;

[0047] The number of parameters and the computational amount of the depthwise separable convolution are The calculation formulas are as follows respectively:

[0048]

[0049]

[0050] Among them, P1 and P2 represent the number of parameters of the depthwise separable convolution and the standard convolution respectively, C1 and C2 represent the computational amount of the depthwise separable convolution and the standard convolution respectively, D k ×D k represents the convolution kernel size, D F ×D F represents the feature map size, and M and N represent the number of input channels and output channels respectively.

[0051] Preferably, module M4 includes:

[0052] Module M4.1: Cut the RGB image into images of a set size to obtain a malware feature image dataset;

[0053] Module M4.2: Divide the data into a training set and a test set and perform annotation;

[0054] Module M4.3: Input the training set into a lightweight convolutional neural network for training and test with the test set to obtain a detection model.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] 1. Although the visualization preprocessing of the present invention is simple, it avoids the redundant reverse engineering of traditional static analysis and the large overhead of dynamic analysis. At the same time, the texture features of different files in the generated RGB images are mutually mapped, and the feature information covered by each pixel point is more comprehensive, and the image interpretability is strong.

[0057] 2. The present invention trains by inputting the RGB image into a lightweight convolutional neural network, reducing the memory occupancy and improving the training speed.

[0058] 3. The present invention detects malware by adopting Apk file preprocessing, binary file imaging, and training a deep learning model, avoiding reverse engineering and code execution, effectively improving the detection efficiency, and also ensuring the accuracy of the detection result. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] By reading the detailed description of the non-limiting embodiments with reference to the following drawings, other features, objects, and advantages of the present invention will become more apparent:

[0060] Figure 1 It is a flowchart of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0061] The present invention will be described in detail below with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but do not limit the present invention in any form. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present invention, several changes and improvements can still be made. These all belong to the protection scope of the present invention.

[0062] The present invention takes the Android application installation package Apk file as the main detection object, and realizes the efficient detection of Android malware through three steps: Apk file preprocessing, binary file imaging, and training a deep learning model.

[0063] According to an Android malware detection method based on multi-dimensional visual analysis provided by the present invention, as Figure 1 shown, it includes:

[0064] Step S1: Construct an Android software database; the Android software database includes: apk installation packages of benign software and malware.

[0065] Step S2: Extract feature files from the database; the feature files include multiple files. Specifically, functions in zip and os in python can be used to batch extract feature files in the apk installation package. The feature files include: classes.dex, resources.arsc, and AndroidManifest.xml files in the apk installation package, and the three feature files are stored in a folder.

[0066] Step S3: Perform visual preprocessing on the feature files to generate RGB images.

[0067] Specifically, first, generate binary sequences from the extracted feature files respectively; read the classes.dex file to generate a binary sequence; read the resources.arsc file to generate a binary sequence; read the AndroidManifest.xml file and implement binary conversion through python to generate a binary sequence. Then, compare the sequence lengths of the binary sequences, and use the longest sequence as the standard to pad zeros at the end of the other two to make the three sequences of the same length; then, cut the binary sequences into arrays with 8-bit binary as single elements, and decimalize each 8-bit binary element in the array to generate corresponding decimal elements; taking the classes.dex file as an example, cut the sequence generated by the classes.dex file into an array with 8-bit binary as single elements, and decimalize each 8-bit binary element in the array to generate decimal elements with a value range of (0, 255). Each element in the array corresponds to a pixel point and is mapped to the R channel in the RGB image; similarly, the sequence generated by cutting the resources.arsc file is mapped to the G channel in the RGB image, and the sequence generated by cutting the AndroidManifest.xml file is mapped to the B channel in the RGB image. Finally, merge the channels to generate a complete RGB image. The python PIL library can be used to sequentially merge the decimal elements with the same array index into an array and put it into a list, and finally merge the R, G, and B channels to generate a complete feature image.

[0068] Step S4: Input the RGB image into a lightweight convolutional neural network for training to generate a detection model.

[0069] Specifically, cut the RGB image into images of a set size, for example, images of 224×224 size, to obtain an Android malware feature image dataset; randomly divide the obtained Android malware feature image dataset into a training set and a test set, and perform annotation; then input the training set into the MobileNet V2 network model for training; after testing with the test set, a detection model is obtained, and this detection model is a network model with an identification accuracy rate between 95% and 99%.

[0070] Among them, the lightweight convolutional neural network model MobileNet V2 uses depthwise separable convolutions, including: depthwise convolution and pointwise convolution; specifically, build the lightweight convolutional neural network MobileNet V2 on a cloud server using the tensorflow 2.1 neural network framework; MobileNet V2 uses depthwise separable convolutions, which are composed of depthwise convolution (DepthwiseConvolution, DW) and pointwise convolution (Pointwise Convolution, PW). This convolution can greatly reduce the number of parameters and the amount of computation, about Reduce the memory occupancy ratio and improve the training speed. The calculation formulas are as follows respectively:

[0071]

[0072]

[0073] Among them, P1 and P2 respectively represent the number of parameters of depthwise separable convolution and standard convolution, C1 and C2 respectively represent the amount of computation of depthwise separable convolution and standard convolution, D k ×D k represents the convolution kernel size, D F ×D F represents the feature map size, and M and N respectively represent the number of input channels and output channels.

[0074] Step S5: Determine whether the detection effect of the detection model meets the standard. If so, classify the malware or determine the family attribute of the malware; if not, trigger Step S4. Collect unknown Android software from the network, use the recognition model for detection, and determine whether the software is malware or determine the family attribute of the malware.

[0075] Embodiment 2

[0076] The present invention also provides an Android malware detection system based on multi-dimensional visual analysis. Those skilled in the art can implement the Android malware detection system based on multi-dimensional visual analysis by executing the step process of the Android malware detection method based on multi-dimensional visual analysis. That is, the Android malware detection method based on multi-dimensional visual analysis can be understood as the preferred implementation manner of the Android malware detection system based on multi-dimensional visual analysis.

[0077] An Android malware detection system based on multi-dimensional visual analysis provided by the present invention includes:

[0078] Module M1: Construct an Android software database; the Android software database includes: apk installation packages of benign software and malware.

[0079] Module M2: Extract feature files from the database; the feature files include multiple files.

[0080] Module M3: Perform visual preprocessing on the feature files to generate RGB images; Module M3 includes: Module M3.1: Generate binary sequences from the extracted feature files respectively; Module M3.2: Compare the sequence lengths of the binary sequences and supplement all the sequence lengths to the same length; Module M3.3: Cut the binary sequences into arrays with 8-bit binary as single elements respectively; Module M3.4: Decimalize the single elements in the arrays respectively to generate corresponding decimal elements; Module M3.5: Map the decimal elements one by one to the corresponding channels in the RGB image; Module M3.6: Merge the channels to generate a complete RGB image.

[0081] Module M4: Input the RGB image into a lightweight convolutional neural network for training to generate a detection model; the lightweight convolutional neural network uses depthwise separable convolutions, including: depthwise convolution and pointwise convolution;

[0082] The number of parameters and the computational amount of the depthwise separable convolution are The calculation formulas are as follows respectively:

[0083]

[0084]

[0085] where P1 and P2 respectively represent the number of parameters of the depthwise separable convolution and the standard convolution, and C1 and C2 respectively represent the computational amount of the depthwise separable convolution and the standard convolution, and D k ×D kDenote the convolution kernel size as D F × D F Denote the feature map size, where M and N respectively represent the number of input channels and output channels.

[0086] Module M4 includes: Module M4.1: Cut the RGB image into images of a set size to obtain a malware feature image dataset; Module M4.2: Divide the data into a training set and a test set and perform annotation; Module M4.3: Input the training set into a lightweight convolutional neural network for training and test it with the test set to obtain a detection model.

[0087] Module M5: Determine whether the detection effect of the detection model meets the standard. If so, classify the malware or determine the family attributes of the malware; if not, trigger Module M4.

[0088] Those skilled in the art know that in addition to implementing the systems, devices, and their respective modules provided by the present invention in the form of pure computer-readable program codes, the method steps can be logically programmed to enable the systems, devices, and their respective modules provided by the present invention to be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers, etc. to implement the same program. Therefore, the systems, devices, and their respective modules provided by the present invention can be regarded as a kind of hardware component, and the modules included therein for implementing various programs can also be regarded as the structures within the hardware component; the modules for implementing various functions can also be regarded as both software programs for implementing the method and the structures within the hardware component.

[0089] The specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. Without conflict, the embodiments of the present application and the features in the embodiments can be combined arbitrarily with each other.

Claims

1. An Android malware detection method based on multi-dimensional visual analysis, characterized in that, Including: Step S1: Construct an Android software database; Step S2: Extract feature files from the database; Step S3: Perform visual preprocessing on the feature files to generate RGB images; Step S4: Input the RGB images into a lightweight convolutional neural network for training to generate a detection model; Step S5: Determine whether the detection effect of the detection model meets the standard. If so, classify malicious software or determine the family attributes of malicious software; If not, trigger Step S4; Step S3 includes: Step S3.1: Generate binary sequences from the extracted feature files respectively; Step S3.2: Compare the sequence lengths of the binary sequences and supplement all sequence lengths to the same length; Step S3.3: Cut the binary sequences into arrays with 8-bit binary as single elements; Step S3.4: Decimalize the single elements in the arrays respectively to generate corresponding decimal elements; Step S3.5: Map the decimal elements one-to-one to the pixel points as the corresponding channels in the RGB image; Step S3.6: Merge the channels to generate a complete RGB image; The lightweight convolutional neural network uses depthwise separable convolutions, including: depthwise convolution and pointwise convolution; The number of parameters and computational complexity of depthwise separable convolution are The calculation formulas are as follows: Among them, P1 and P2 respectively represent the number of parameters of depthwise separable convolution and standard convolution, C1 and C2 respectively represent the computational amounts of depthwise separable convolution and standard convolution, D k ×D k represents the convolution kernel size, D F ×D F represents the feature map size, and M and N respectively represent the numbers of input channels and output channels.

2. The Android malware detection method based on multi-dimensional visual analysis according to claim 1, wherein The Android software database includes: apk installation packages of benign software and malicious software; The feature files include multiple files.

3. The Android malware detection method based on multi-dimensional visualization analysis according to claim 1, wherein Step S4 includes: Step S4.1: Cut the RGB images into images of a set size to obtain a malicious software feature image dataset; Step S4.2: Divide the dataset into a training set and a test set and perform annotation; Step S4.3: Input the training set into a lightweight convolutional neural network for training and test it with the test set to obtain a detection model.

4. An Android malware detection system based on multi-dimensional visual analysis, characterized in that, Including: Module M1: Data warehouse module, which constructs an Android software database; Module M2: Feature preprocessing module, which extracts feature files from the database; Module M3: Image generation module, which performs visual preprocessing on the feature files to generate RGB images; Module M4: Detection model module, which inputs the RGB images into a lightweight convolutional neural network for training to generate a detection model; Module M5: Determine whether the detection effect of the detection model meets the standard. If so, classify malicious software or determine the family attributes of malicious software; If not, trigger Module M4; Module M3 includes: Module M3.1: Generate binary sequences from the extracted feature files respectively; Module M3.2: Compare the sequence lengths of the binary sequences and supplement all sequence lengths to the same length; Module M3.3: Cut the binary sequences into arrays with 8-bit binary as single elements; Module M3.4: Decimalize the single elements in the arrays respectively to generate corresponding decimal elements; Module M3.5: Map the decimal elements one-to-one to the pixel points as the corresponding channels in the RGB image; Module M3.6: Merge the channels to generate a complete RGB image; The lightweight convolutional neural network uses depthwise separable convolutions, including: depthwise convolution and pointwise convolution; The number of parameters and computational complexity of depthwise separable convolution are The calculation formulas are as follows: Among them, P1 and P2 respectively represent the number of parameters of depthwise separable convolution and standard convolution, C1 and C2 respectively represent the computational amount of depthwise separable convolution and standard convolution, D k ×D k represents the convolution kernel size, D F ×D F represents the feature map size, and M and N respectively represent the number of input channels and output channels.

5. The Android malware detection system based on multi-dimensional visualization analysis according to claim 4, wherein The Android software database includes: apk installation packages of benign software and malicious software; The feature file includes multiple files.

6. The Android malware detection system based on multi-dimensional visualization analysis according to claim 4, characterized in that, Module M4 includes: Module M4.1: Cut the RGB image into images of a set size to obtain a malicious software feature image dataset; Module M4.2: Divide the dataset into a training set and a test set, and perform annotation; Module M4.3: Input the training set into a lightweight convolutional neural network for training and test it with the test set to obtain a detection model.

Images