Iot malware detection method, system, device and medium

Abstract

This disclosure provides an IoT malware detection method, system, device, and medium, belonging to the field of data identification technology. Specifically, it includes: user devices and edge servers collaboratively training a neural network using user data, and selecting trusted devices to participate in model training using a trust evaluation mechanism; constructing a hybrid user-edge framework, deploying the feature generation module and privacy attention module of the trained neural network as feature extractors on the user device, and deploying the malware classifier of the trained neural network on the edge server; extracting features from the user device, adding attention and Laplacian noise to the features to obtain intermediate features, and uploading these intermediate features to the edge server; the edge server receiving the intermediate features, performing malware classification, and transmitting the classification results back to the user device. This disclosure improves malware detection efficiency while effectively protecting user security and privacy.

Description

Technical Field

[0001] This disclosure relates to the field of data identification technology, and in particular to a method, system, device and medium for detecting Internet of Things (IoT) malware. Background Technology

[0002] Currently, with the continuous development of the Internet of Things (IoT), a large number of IoT devices benefit from the Android platform. While IoT devices provide convenient services to users, cybercriminals exploit vulnerabilities in these devices to launch malware attacks and attempt to prevent users from uninstalling or deleting them. Many third-party IoT applications are designed for specific scenarios, such as healthcare, surveillance, and autonomous driving systems. These applications are deployed directly on IoT devices by third-party vendors with minimal security verification. When malware infiltrates personal computers, corporate servers, enterprise or national servers, personally stored private information and company trade secrets will be completely exposed, resulting in substantial direct economic losses. The losses caused by the leakage of national strategic data resources are incalculable. This necessitates the development of more effective malware detection technologies.

[0003] Traditional centralized detection schemes rely on a single attack detection entity (e.g., a centralized cloud responsible for training and testing), making the training and retraining of models extremely challenging. Furthermore, the back-and-forth communication introduces other problems, such as high communication overhead and data transmission latency, especially when dealing with geographically distributed IoT devices that generate massive amounts of data. Therefore, there is a strong need for distributed detection solutions, extending malware detection systems to the edge computing paradigm. This pushes computing resources closer to the network edge than the cloud, meeting the growing demand for high computing power and low latency. Security providers can then protect users from malware infections on the network.

[0004] While machine learning is practical and essential for malware detection, several key challenges remain. Malware detection on user devices often faces a dilemma: either (1) traditional shallow learning models used on user devices (e.g., Linear Discriminant Analysis (LDA)) have limited learning capabilities when modeling complex functions, resulting in low system accuracy, or (2) directly uploading Android Packages (APKs) to edge servers for high-performance model training can significantly increase communication overhead and lead to user privacy breaches. How to leverage massive IoT applications to build effective and accurate detection models remains a crucial research question.

[0005] However, application privacy information (such as application programming interface (API) calls and permission configurations) may be leaked during data upload, posing a potential threat. Attackers could use the exposed private information to infer a user's interest in targeted advertising. Furthermore, based on this sensitive information, attackers could even generate adversarial examples to evade detection.

[0006] It is evident that there is an urgent need for an efficient, accurate, and secure method for detecting IoT malware. Summary of the Invention

[0007] In view of this, the present disclosure provides an IoT malware detection method, system, device and medium, which at least partially solves the problems of poor detection efficiency, accuracy and security in the prior art.

[0008] In a first aspect, embodiments of this disclosure provide a method for detecting malicious software in the Internet of Things (IoT), including:

[0009] Step 1: User devices and edge servers use user data to collaboratively train the neural network, and use a trust evaluation mechanism to select trusted devices to participate in model training;

[0010] Step 2: Construct a hybrid user-edge framework, deploy the feature generation module and privacy attention module of the trained neural network as feature extractors on user devices, and deploy the malware classifier of the trained neural network on edge servers;

[0011] Step 3: Extract features from the user device, add attention and Laplacian noise to the features to obtain intermediate features, and upload them to the edge server;

[0012] Step 4: The edge server receives the intermediate features, performs malware classification, and sends the classification results back to the user's device.

[0013] According to a specific implementation of an embodiment of this disclosure, step 1 specifically includes:

[0014] Step 11: The edge server filters trusted devices. When a device is ready to participate in training, it first establishes a connection with the nearest edge server. Then, the edge server checks whether the device exists in the current system's list of trusted devices. If it does, the edge server authorizes the device to participate in training; otherwise, the edge server evaluates the device.

[0015] Step 12: For user device D that newly joins the network to participate in model training, real-name registration is performed and a corresponding ID number is assigned. Before user device D with an ID number participates in model training, the edge server verifies the identity of the user device.

[0016] Step 13: User device D submits device performance configuration information to the edge server. The edge server determines whether the device's capabilities meet the performance requirements for model training based on the configuration information.

[0017] Step 14: Before the edge server S interacts with the user device D, the edge server S first queries the behavior evaluation value of the user device D, and decides whether to allow the user device D to participate in its model training based on the behavior evaluation value. The behavior evaluation value is an indirect evaluation value calculated based on all historical interactions between the user device D and the edge server.

[0018] Step 15: After the model training is completed, the edge server S evaluates the user device D, and then uses the evaluation result as the direct evaluation value to update the behavior evaluation value of the user device D.

[0019] According to a specific implementation of this disclosure, the formula for calculating the behavior evaluation value is as follows:

[0020] BE=αDV SD +βIV SD

[0021] Here, α and β are adaptive parameters that satisfy α + β = 1. When β > α, edge server S focuses on historical interaction experience; when β < α, edge server S focuses on interaction experience with the current user device. Edge server S directly provides the direct evaluation value DV after user device D participates in model training. SD ;

[0022] Indirect Assessment Value IV SD This is the evaluation value given by the edge server that has an interaction history with user device D. The calculation formula is:

[0023]

[0024] in, DV iD Let T(t) represent the direct evaluation value of edge server i to user device D, and n represent the total number of edge servers that have an interaction history with user device D. i ) represents the time decay factor, δ is a predefined parameter, and t i DV iD Generation time, where t represents the current time.

[0025] According to a specific implementation of an embodiment of this disclosure, step 3 specifically includes:

[0026] Step 31: Use the disassembler ApkTool to obtain Dalvik code from the APK of the unknown application, and then use the Pscout tool to obtain a set of sensitive APIs SAS = {a1, a2, ..., a...}i} and a set of permissions {p1, p2, ..., p i};

[0027] Step 32: Calculate the sensitive APIa based on the TF-IDF principle. i The degree of malice, and its relation to calling sensitive APIs. i The percentage of malware is positively correlated with all calls to sensitive APIs. i The percentage of applications with malicious intent is negatively correlated, and the formula for calculating its maliciousness is:

[0028]

[0029] Among them, P m (a i ) indicates a call to a sensitive API. i Percentage of malware, Num m and Num b N represents the total number of malicious and benign software programs, respectively. m (a i ) and N b (a i ) respectively represent calling sensitive APIs. i The number of malicious and benign software programs;

[0030] Step 33: Create a function call graph from the APK, wherein the function call graph description includes methods and calls;

[0031] Step 34: Retain the sensitive API nodes and their adjacent nodes in the function call graph, remove other normal nodes, and generate a set of sensitive subgraphs (MSGs). Each sensitive subgraph in the sensitive subgraph set has an MSG. i The formula for calculating the degree of malice is:

[0032]

[0033] Among them, SSA (MSG) i ) represents the sensitive subgraph MSG i The set of sensitive APIs in the document;

[0034] Step 35: Add an adaptive weight to the malice level of each sensitive subgraph:

[0035]

[0036] Among them, v i Representing the sensitive subgraph MSG i The number of nodes in the function call graph, where n represents the number of sensitive subgraphs extracted from the function call graph;

[0037] Step 36: Generate sub-map feature vectors FV based on the sensitive sub-map set MSGs. s ={I(MSG1)·md(MSG1), I(MSG2)·md(MSG2),..., I(MSG n )·md(MSG n Then, based on the number of each permission in the application software and its corresponding location, a permission feature vector FV is generated. p ={P1, P2, ..., P m}, and merge the two feature vectors to obtain FV={I(MSG1)·md(MSG1), I(MSG2)·md(MSG2), ..., I(MSG n )·md(MSG n P1, P2, ..., P m};

[0038] Step 37: Add an attention mechanism and Laplacian noise to the feature vector to obtain the intermediate features FV′={f1,f2,...,f i} and upload it to the edge server.

[0039] According to a specific implementation of an embodiment of this disclosure, step 4 specifically includes:

[0040] Step 41: The edge server receives intermediate features from the user equipment and reconstructs the obfuscated input stream from the scrambled intermediate features.

[0041] Step 42: The reconstructed features are fed into a pre-trained malware classifier to infer whether the software under test is malicious, and the classification result is sent back to the user device.

[0042] Secondly, embodiments of this disclosure provide an Internet of Things (IoT) malware detection system, comprising:

[0043] The training module is used by user devices and edge servers to collaboratively train neural networks using user data, and utilizes a trust evaluation mechanism to select trusted devices to participate in model training.

[0044] The building module is used to construct a hybrid user-edge framework, deploying the pre-trained neural network's feature generation module and privacy attention module as feature extractors to user devices, and deploying the pre-trained neural network's malware classifier to edge servers;

[0045] The extraction module is used to extract features from the user device, add attention and Laplacian noise to the features to obtain intermediate features, and then upload them to the edge server.

[0046] The detection module is used by the edge server to receive intermediate features, classify malware, and then send the classification results back to the user device.

[0047] Thirdly, embodiments of this disclosure also provide an electronic device, the electronic device comprising:

[0048] At least one processor; and,

[0049] The memory is communicatively connected to the at least one processor; wherein,

[0050] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the IoT malware detection method in the first aspect or any implementation thereof.

[0051] Fourthly, embodiments of this disclosure also provide a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the IoT malware detection method in the first aspect or any implementation thereof.

[0052] Fifthly, embodiments of this disclosure also provide a computer program product, which includes a computing program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions that, when executed by a computer, cause the computer to perform the IoT malware detection method in the first aspect or any implementation thereof.

[0053] The IoT malware detection scheme in this embodiment includes: Step 1, user devices and edge servers collaboratively train a neural network using user data, and select trusted devices to participate in model training using a trust evaluation mechanism; Step 2, constructing a hybrid user-edge framework, deploying the feature generation module and privacy attention module of the trained neural network as feature extractors on the user device, and deploying the malware classifier of the trained neural network on the edge server; Step 3, extracting features from the user device, adding attention and Laplacian noise to the features to obtain intermediate features, and uploading them to the edge server; Step 4, the edge server receives the intermediate features, performs malware classification, and transmits the classification results back to the user device.

[0054] The beneficial effects of the embodiments of this disclosure are as follows: the solution of this disclosure can decompose large and complex deep neural networks and deploy malware detection to user devices and edge servers, thereby improving the efficiency of malware detection while effectively protecting user security and privacy. Attached Figure Description

[0055] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 A flowchart illustrating an IoT malware detection method provided in this embodiment of the disclosure;

[0057] Figure 2 A schematic diagram illustrating the implementation process of an IoT malware detection method provided in this embodiment of the disclosure;

[0058] Figure 3 A schematic diagram of a trust assessment process provided in this disclosure embodiment;

[0059] Figure 4 This is a schematic diagram of a hybrid user-edge framework provided in an embodiment of the present disclosure;

[0060] Figure 5 This is a schematic diagram of the structure of an Internet of Things (IoT) malware detection system provided in an embodiment of this disclosure;

[0061] Figure 6 A schematic diagram of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0062] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0063] The following specific examples illustrate the implementation of this disclosure. Those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0064] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0065] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0066] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0067] This disclosure provides a method for detecting IoT malware, which can be applied to the detection of IoT malware in network security scenarios.

[0068] See Figure 1 This is a flowchart illustrating an IoT malware detection method provided in an embodiment of this disclosure. Figure 1 and Figure 2 As shown, the method mainly includes the following steps:

[0069] Step 1: User devices and edge servers use user data to collaboratively train the neural network, and use a trust evaluation mechanism to select trusted devices to participate in model training;

[0070] Furthermore, step 1 specifically includes:

[0071] Step 11: The edge server filters trusted devices. When a device is ready to participate in training, it first establishes a connection with the nearest edge server. Then, the edge server checks whether the device exists in the current system's list of trusted devices. If it does, the edge server authorizes the device to participate in training; otherwise, the edge server evaluates the device.

[0072] Step 12: For user device D that newly joins the network to participate in model training, real-name registration is performed and a corresponding ID number is assigned. Before user device D with an ID number participates in model training, the edge server verifies the identity of the user device.

[0073] Step 13: User device D submits device performance configuration information to the edge server. The edge server determines whether the device's capabilities meet the performance requirements for model training based on the configuration information.

[0074] Step 14: Before the edge server S interacts with the user device D, the edge server S first queries the behavior evaluation value of the user device D, and decides whether to allow the user device D to participate in its model training based on the behavior evaluation value. The behavior evaluation value is an indirect evaluation value calculated based on all historical interactions between the user device D and the edge server.

[0075] Step 15: After the model training is completed, the edge server S evaluates the user device D, and then uses the evaluation result as the direct evaluation value to update the behavior evaluation value of the user device D.

[0076] Furthermore, the formula for calculating the behavioral assessment value is as follows:

[0077] BE=αDV SD +βIV SD

[0078] Here, α and β are adaptive parameters that satisfy α + β = 1. When β > α, edge server S focuses on historical interaction experience; when β < α, edge server S focuses on interaction experience with the current user device. Edge server S directly provides the direct evaluation value DV after user device D participates in model training. SD ;

[0079] Indirect Assessment Value IV SD This is the evaluation value given by the edge server that has an interaction history with user device D. The calculation formula is:

[0080]

[0081] in, DV iD Let T(t) represent the direct evaluation value of edge server i to user device D, and n represent the total number of edge servers that have an interaction history with user device D. i ) represents the time decay factor, δ is a predefined parameter, and t i DV iD Generation time, where t represents the current time.

[0082] In specific implementation, such as Figure 3As shown, user devices and edge servers can collaboratively train neural networks using user data, and utilize a trust evaluation mechanism to select trusted devices to participate in model training. The specific steps are as follows:

[0083] Step 11: Before model training, the edge server filters trusted devices. When a device is ready to participate in training, it first establishes a connection with the nearest edge server. Then, the edge server checks whether the device exists in the current system's list of trusted devices (e.g., existing historical interactions). If it exists, the edge server authorizes the device to participate in training; if it does not exist, the edge server evaluates the device (identity evaluation, performance evaluation, and behavior evaluation).

[0084] Step 12: For user device D newly joining the network to participate in model training, real-name registration is performed to ensure the authenticity and uniqueness of the user device's identity in the edge network, and a unique ID number is assigned. Then, the system saves the evaluation information. Before user device D with the ID number participates in model training, the edge server will authenticate the user device to verify whether the user device's physical identity matches the ID number.

[0085] Step 13: User device D submits its device performance configuration information to the edge server. The edge server then determines whether the device's capabilities meet the performance requirements for model training based on this configuration information. Four representative attribute parameters—CPU, Memory, Disk, and Online-time—were selected as the parameters for the edge server to select user devices.

[0086] Step 14: Before the edge server S interacts with the user device D, the edge server S first queries the behavior evaluation value of the user device D and decides whether to allow the user device D to participate in its model training based on the behavior evaluation value. The behavior evaluation value of the user device can be measured by all its historical interactions with the edge server. The higher the behavior evaluation value, the less malicious behavior the user device exhibits in its interactions with all edge servers. Otherwise, it means that the user device frequently exhibits malicious behavior during its interactions with the edge server. The initial behavior evaluation value is set to 0.3, and the minimum threshold for behavior evaluation is 0.2. Only when the behavior evaluation value of user device D is greater than 0.2 can it participate in the model training of the edge server S.

[0087] Step 15: After model training is complete, the edge server S evaluates user device D and then uses its evaluation value as the direct evaluation value to update the behavior evaluation value of user device D. The behavior evaluation value can be calculated as follows:

[0088] BE=αDV SD +βIV SD

[0089] Here, α and β are adaptive parameters that satisfy α + β = 1. When β > α, the edge server S focuses more on the historical interaction experience; conversely, when β < α, the edge server S focuses more on the interaction experience with the current user device. The edge server S can directly provide the direct evaluation value DV after the user device D participates in the model training. SD Indirect assessment value IV SD The evaluation value given by the edge server that has an interaction history with user device D can be calculated as follows:

[0090]

[0091] in, DViD represents the direct evaluation value of edge server i to user device D, n represents the total number of edge servers that have an interaction history with user device D, and T(t) represents the total number of edge servers that have an interaction history with user device D. i ) is the time decay factor, defined as a measure of the freshness of the evaluation value, and δ is a predefined parameter used to adjust the time decay factor T(t). i The influence of ) t i DV iD The generation time, where t represents the current time, will be assigned a higher weight to the latest evaluation value in historical interactions.

[0092] Step 2: Construct a hybrid user-edge framework, deploy the feature generation module and privacy attention module of the trained neural network as feature extractors on user devices, and deploy the malware classifier of the trained neural network on edge servers;

[0093] In practical implementation, a hybrid user-edge framework is constructed as follows: Figure 4 As shown, the trained neural network's feature generation module and privacy attention module are then deployed as feature extractors to user devices, and the trained neural network's malware classifier is deployed to edge servers. The specific steps are as follows:

[0094] Step 21: After pre-training, the feature generation module and the privacy attention module are deployed to the user device. The feature generation module extracts features from the original data, while the privacy attention module adds an attention mechanism and Laplacian noise to the extracted features.

[0095] Step 22: After pre-training, the malware classifier is deployed to the edge server to infer intermediate features uploaded from user devices.

[0096] Step 3: Extract features from the user device, add attention and Laplacian noise to the features to obtain intermediate features, and upload them to the edge server;

[0097] Based on the above embodiments, step 3 specifically includes:

[0098] Step 31: Use the disassembler ApkTool to obtain Dalvik code from the APK of the unknown application, and then use the Pscout tool to obtain a set of sensitive APIs SAS = {a1, a2, ..., a...} i} and a set of permissions {p1, p2, ..., p i};

[0099] Step 32: Calculate the sensitive APIa based on the TF-IDF principle. i The degree of malice, and its relation to calling sensitive APIs. i The percentage of malware is positively correlated with all calls to sensitive APIs. i The percentage of applications with malicious intent is negatively correlated, and the formula for calculating its maliciousness is:

[0100]

[0101] Among them, P m (a i ) indicates a call to a sensitive API. i Percentage of malware, Num m and Num b N represents the total number of malicious and benign software programs, respectively. m (a i ) and N b (a i ) respectively represent calling sensitive APIs. i The number of malicious and benign software programs;

[0102] Step 33: Create a function call graph from the APK, wherein the function call graph description includes methods and calls;

[0103] Step 34: Retain the sensitive API nodes and their adjacent nodes in the function call graph, remove other normal nodes, and generate a set of sensitive subgraphs (MSGs). Each sensitive subgraph in the sensitive subgraph set has an MSG. i The formula for calculating the degree of malice is:

[0104]

[0105] Among them, SSA (MSG) i ) represents the sensitive subgraph MSG i The set of sensitive APIs in the document;

[0106] Step 35: Add an adaptive weight to the malice level of each sensitive subgraph:

[0107]

[0108] Among them, v i Representing the sensitive subgraph MSG i The number of nodes in the function call graph, where n represents the number of sensitive subgraphs extracted from the function call graph;

[0109] Step 36: Generate sub-map feature vectors FV based on the sensitive sub-map set MSGs. s ={I(MSG1)·md(MSG1), I(MSG2)·md(MSG2),..., I(MSG n )·md(MSG n Then, based on the number of each permission in the application software and its corresponding location, a permission feature vector FV is generated. P ={P1, P2, ..., P m}, and merge the two feature vectors to obtain FV={I(MSG1)·md(MSG1), I(MSG2)·md(MSG2), ..., I(MSG n )·md(MSG n P1, P2, ..., P m};

[0110] Step 37: Add an attention mechanism and Laplacian noise to the feature vector to obtain the intermediate features FV′={f1,f2,...,f i} and upload it to the edge server.

[0111] In practice, when it is necessary to detect a user device, features can be extracted from the user device. After adding attention and Laplacian noise to the features, intermediate features are obtained and then uploaded to the edge server. The specific steps are as follows:

[0112] Step 31: Use the disassembler ApkTool to obtain Dalvik code from the APK of the unknown application, and then use the Pscout tool to obtain a set of sensitive APIs SAS = {a1, a2, ..., a...} 8910 a 8911} and a set of permissions {p1, p2, ..., p 455 There are a total of 8911 sensitive APIs and 455 permissions available.

[0113] Step 32, drawing inspiration from TF-IDF, calculate the sensitive API a. i The degree of malice, and its relation to calling sensitive APIs. i The percentage of malware is positively correlated with all calls to sensitive APIs. i The percentage of applications with malicious intent is negatively correlated. Its maliciousness can be calculated as:

[0114]

[0115] Among them, P m (a i ) indicates a call to a sensitive API. i Percentage of malware, Num m and Num b N represents the total number of malicious and benign software programs, respectively. m (a i ) and N b (a i ) respectively represent calling sensitive APIs a i The number of malicious and benign software programs.

[0116] Step 33: Use the tools Androguard and the graphical visualization software (Gephi) to create a function call graph (FCG) from the APK. The FCG contains methods (as nodes) and calls (as edges), which contain the structural information needed to describe the behavior of the app.

[0117] Step 34: In the function call graph, retain the sensitive API nodes and their adjacent nodes, and remove other normal nodes to generate a set of sensitive subgraphs (MSGs). Each sensitive subgraph in the sensitive subgraph set has an MSG. i The degree of malice can be calculated as follows:

[0118]

[0119] Among them, SSA (MSG) i ) represents the sensitive subgraph MSG i The set of sensitive APIs in the document.

[0120] Step 35: Add an adaptive weight to the malice level of each sensitive sub-graph, which can be calculated as follows:

[0121]

[0122] Among them, v i Representing the sensitive subgraph MSG i The number of nodes, where n represents the number of MSGs extracted from FCG.

[0123] Step 36: Sensitive submap sets (MSGs) can generate submap feature vectors (FVs). s ={I(MSG1)·md(MSG1), I(MSG2)·md(MSG2),..., I(MSG n )·md(MSG n Then, based on the number of each permission in the application software and its corresponding location, a permission feature vector FV is generated. p ={P1, P2, ..., P mFinally, the two feature vectors are merged to obtain FV = {I(MSG1)·md(MSG1), I(MSG2)·md(MSG2), ..., I(MSG...}. n )·md(MSG n P1, P2, ..., P m}

[0124] Step 37: Add an attention mechanism and Laplacian noise to the feature vector to obtain the intermediate features FV′={f1,f2,...,f i} and upload it to the edge server.

[0125] Step 4: The edge server receives the intermediate features, performs malware classification, and sends the classification results back to the user's device.

[0126] Based on the above embodiments, step 4 specifically includes:

[0127] Step 41: The edge server receives intermediate features from the user equipment and reconstructs the obfuscated input stream from the scrambled intermediate features.

[0128] Step 42: The reconstructed features are fed into a pre-trained malware classifier to infer whether the software under test is malicious, and the classification result is sent back to the user device.

[0129] In practice, an attention mechanism and Laplacian noise are added to the feature vector to obtain intermediate features. The edge server can then receive these intermediate features for malware classification and transmit the classification results back to the user device. The specific steps are as follows:

[0130] Step 41: The edge server receives intermediate features from the user device and reconstructs the obfuscated input stream from the scrambled intermediate features, which are useful inferences specific to malware detection.

[0131] Step 42: The reconstructed features are fed into a pre-trained malware classifier to infer whether the software under test is malicious, and the result is returned to the user device.

[0132] The IoT malware detection method provided in this embodiment decomposes large and complex deep neural networks and deploys malware detection to user devices and edge servers, thereby improving malware detection efficiency while effectively protecting user security and privacy.

[0133] For a corresponding method embodiment, see [link to relevant documentation]. Figure 5 This disclosure also provides an Internet of Things (IoT) malware detection system 50, comprising:

[0134] Training module 501 is used for user devices and edge servers to collaboratively train neural networks using user data, and to select trusted devices to participate in model training using a trust evaluation mechanism.

[0135] Module 502 is used to build a hybrid user-edge framework, deploying the feature generation module and privacy attention module of the trained neural network as feature extractors to user devices, and deploying the malware classifier of the trained neural network to edge servers;

[0136] The extraction module 503 is used to extract features from the user device, add attention and Laplacian noise to the features to obtain intermediate features and upload them to the edge server.

[0137] The detection module 504 is used by the edge server to receive intermediate features, classify malware, and transmit the classification results back to the user device.

[0138] Figure 5 The system shown can execute the contents of the above method embodiments. For the parts not described in detail in this embodiment, please refer to the contents recorded in the above method embodiments, and they will not be repeated here.

[0139] See Figure 6 This disclosure also provides an electronic device 60, which includes at least one processor and a memory communicatively connected to the at least one processor. The memory stores instructions executable by the at least one processor, which, when executed, enables the at least one processor to perform the IoT malware detection method described in the foregoing method embodiments.

[0140] This disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the IoT malware detection method in the foregoing method embodiments.

[0141] This disclosure also provides a computer program product, which includes a computing program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions that, when executed by a computer, cause the computer to perform the IoT malware detection method in the foregoing method embodiments.

[0142] The following is for reference. Figure 6The diagram illustrates a structural schematic of an electronic device 60 suitable for implementing embodiments of the present disclosure. The electronic devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0143] like Figure 6 As shown, electronic device 60 may include a processing unit (e.g., central processing unit, graphics processor, etc.) 601, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. RAM 603 also stores various programs and data required for the operation of electronic device 60. Processing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0144] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 60 to communicate wirelessly or wiredly with other devices to exchange data. Although an electronic device 60 with various devices is shown in the figure, it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0145] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the methods of embodiments of this disclosure.

[0146] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0147] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0148] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, enable the electronic device to perform the relevant steps of the above method embodiments.

[0149] Alternatively, the aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, enable the electronic device to perform the relevant steps of the above method embodiments.

[0150] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0151] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0152] The units described in the embodiments of this disclosure can be implemented in software or in hardware.

[0153] It should be understood that the various parts of this disclosure can be implemented in hardware, software, firmware, or a combination thereof.

[0154] The above description is merely a specific embodiment of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A method for detecting malicious software in the Internet of Things (IoT), characterized in that, include: Step 1: User devices and edge servers use user data to collaboratively train the neural network, and use a trust evaluation mechanism to select trusted devices to participate in model training. Step 2: Construct a hybrid user-edge framework, deploy the feature generation module and privacy attention module of the trained neural network as feature extractors to user devices, and deploy the malware classifier of the trained neural network to edge servers; Step 3: Extract features from the user device, add attention and Laplacian noise to the features to obtain intermediate features, and upload them to the edge server; Step 3 specifically includes: Step 31: Use the disassembler ApkTool to obtain Dalvik code from the APK of the unknown application, and then use the Pscout tool to obtain a set of sensitive APIs. and a set of permissions ; Step 32: Calculate the sensitive APIs based on the TF-IDF principle. The degree of malice, and its relation to calling sensitive APIs. The percentage of malware is positively correlated with all calls to sensitive APIs. The percentage of applications with malicious intent is negatively correlated, and the formula for calculating its maliciousness is: in, Indicates calling a sensitive API The percentage of malware, and These represent the total number of malicious and benign software programs, respectively. and These respectively represent calls to sensitive APIs. The number of malicious and benign software programs; Step 33: Create a function call graph from the APK, wherein the function call graph includes methods and calls; Step 34: Retain the sensitive API nodes and their adjacent nodes in the function call graph, remove other normal nodes, and generate a set of sensitive subgraphs (MSGs). Each sensitive subgraph in the MSGs... The formula for calculating the degree of malice is: in, Representing sensitive subgraphs The collection of sensitive APIs in the document; Step 35: Add an adaptive weight to the malice level of each sensitive subgraph: in, Representing sensitive subgraphs Number of nodes This indicates the number of sensitive subgraphs extracted from the function call graph; Step 36: Generate sub-graph feature vectors based on the sensitive sub-graph set MSGs. Then, a permission feature vector is generated based on the number of each permission in the application software and its corresponding location. And merge the two feature vectors to obtain ; Step 37: Add attention mechanism and Laplacian noise to the feature vector to obtain intermediate features. And upload it to the edge server; Step 4: The edge server receives the intermediate features, performs malware classification, and sends the classification results back to the user's device.

2. The method according to claim 1, characterized in that... Step 1 specifically includes: Step 11: The edge server filters trusted devices. When a device is ready to participate in training, it first establishes a connection with the nearest edge server. Then, the edge server checks whether the device exists in the current system's list of trusted devices. If it does, the edge server authorizes the device to participate in training; otherwise, the edge server evaluates the device. Step 12: For user device D that newly joins the network to participate in model training, real-name registration is performed and a corresponding ID number is assigned. Before user device D with the ID number participates in model training, the edge server verifies the identity of the user device. Step 13: User device D submits device performance configuration information to the edge server. The edge server determines whether the device's capabilities meet the performance requirements for model training based on the configuration information. Step 14: Before the edge server S interacts with the user device D, the edge server S first queries the behavior evaluation value of the user device D, and decides whether to allow the user device D to participate in its model training based on the behavior evaluation value. The behavior evaluation value is an indirect evaluation value calculated based on all historical interactions between the user device D and the edge server. Step 15: After the model training is completed, the edge server S evaluates the user device D, and then uses the evaluation result as the direct evaluation value to update the behavior evaluation value of the user device D.

3. The method according to claim 2, characterized in that... The formula for calculating the behavioral assessment value is as follows: in, and For adaptive parameters, satisfying ,when At that time, edge server S focuses on historical interaction experience, when At this time, edge server S focuses on the interactive experience with the current user device. After user device D participates in model training, edge server S directly provides a direct evaluation value. ; Indirect evaluation value This is the evaluation value given by the edge server that has an interaction history with user device D. The calculation formula is: in, , Let represent the direct evaluation value of edge server i for user device D, and n represent the total number of edge servers that have an interaction history with user device D. The time decay factor, For a predefined parameter, express Generation time, Indicates the current time.

4. The method according to claim 1, characterized in that... Step 4 specifically includes: Step 41: The edge server receives intermediate features from the user equipment and reconstructs the obfuscated input stream from the scrambled intermediate features; Step 42: The reconstructed features are fed into a pre-trained malware classifier to infer whether the software under test is malicious, and the classification result is sent back to the user device.

5. An Internet of Things (IoT) malware detection system, used to execute the IoT malware detection method according to any one of claims 1 to 4, characterized in that, include: The training module is used by user devices and edge servers to collaboratively train neural networks using user data, and utilizes a trust evaluation mechanism to select trusted devices to participate in model training. The building module is used to construct a hybrid user-edge framework, deploying the pre-trained neural network's feature generation module and privacy attention module as feature extractors to user devices, and deploying the pre-trained neural network's malware classifier to edge servers; The extraction module is used to extract features from the user device, add attention and Laplacian noise to the features to obtain intermediate features, and then upload them to the edge server. The detection module is used by the edge server to receive intermediate features, classify malware, and then send the classification results back to the user device.

6. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which enables the at least one processor to perform the IoT malware detection method according to any one of claims 1-4.

7. A non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the Internet of Things malware detection method according to any one of claims 1-4.

Images