An android malware detection method based on graph neural network of meta-path embedding

Abstract

The application relates to an Android malware detection method based on a meta-path embedding graph neural network, which comprises the following steps: extracting static features to obtain API and Permission; constructing a heterogeneous graph; defining a meta-path and embedding each APP node; calculating the weight of each meta-path; and obtaining the classification result of the APP; the method is characterized in that the RotatE encoder is used to embed each meta-path, the features of the intermediate nodes on the meta-path are aggregated, the features of the destination nodes themselves are also considered, and more information beneficial to malware detection is obtained, so that the method can exceed the accuracy rate of other methods trained by using a large number of samples by using a small number of samples; meanwhile, the application defines a lambda parameter to limit the number of meta-paths and reduce system resource consumption.

Description

Technical Field

[0001] This invention relates to a graph neural network-based method for detecting Android malware, which belongs to the field of network security technology. Background Technology

[0002] With its massive user base and vast number of devices, along with a wealth of applications, Android has become the most popular mobile operating system thanks to its scalability and openness. However, this has also led to a sharp increase in the number of malicious software programs targeting Android, posing serious security risks to Android devices and exposing Android users to threats such as privacy theft, data breaches, and spam.

[0003] In recent years, the rapid development of graph neural networks has inspired many other fields, especially heterogeneous graph neural networks that contain different types of nodes and edges. In the field of Android malware detection, modeling the extracted static features and the APP as nodes, defining the relationships between nodes and establishing connections between them, and then using graph neural networks to solve related problems is a good option.

[0004] In the paper "HAWK: Rapid Android Malware Detection Through Heterogeneous Graph Attention Networks", Hei et al. modeled the relationship between Android entities and behaviors as a heterogeneous information network, using its rich semantic metastructure to represent implicit high-order relationships. However, this method has the following shortcomings: (1) This method only obtains the neighbor nodes of the APP node through the metapath, ignoring the features of the intermediate nodes on the metapath and the information of the metapath itself; (2) This method also discards the features of the target node itself, only aggregating the features of its neighbor nodes; the above two points are indispensable for the Android malware detection problem. Summary of the Invention

[0005] To address the aforementioned problems, the technical problem to be solved by this invention is to provide a graph neural network-based Android malware detection method that can obtain the features of intermediate nodes on the meta-path and the features of the meta-path itself by encoding the meta-path, and simultaneously aggregate the features of the destination node itself into the meta-path instance to obtain more malware-related feature information, thereby enabling more accurate malware detection.

[0006] To solve the above problems, the technical solution adopted by the present invention is as follows:

[0007] The present invention provides an Android malware detection method based on meta-path embedding, comprising the following steps:

[0008] Step 1: Use the APK analysis tool Androguard to decompile the Android APK file, extract static features, and obtain the API and Permission information;

[0009] Step 2: Combine the API and Permission obtained in Step 1 with the APP as three types of nodes, construct edges by defining the relationships between nodes, and then generate an adjacency matrix based on the inclusion relationship between APP and API and Permission to construct a heterogeneous graph.

[0010] Step 3: Define meta-paths and embed each APP node: Under each meta-path, for each neighboring node, extract λ specific meta-paths between them, and then encode the extracted meta-paths using the RotatE encoder. The encoded meta-paths and the APP node together form a homogeneous graph and are fed into the graph attention network model to obtain the embedding representation of the APP node under this meta-path.

[0011] Step 4: Calculate the weight of each meta-path, and then multiply the APP embedding obtained in Step 3 with the corresponding meta-path weights and sum them to obtain the final APP embedding representation.

[0012] Step 5: Feed the APP embedding representation obtained in Step 4 into a linear SVM classifier to obtain the classification result of the APP.

[0013] In step three of this invention, a parameter λ is defined during the extraction of meta-paths. λ represents the maximum number of intermediate nodes between two APP nodes after extraction for each type of meta-path, or the maximum number of such meta-paths between two APP nodes after extraction.

[0014] In step two of this invention, the RotatE encoder is used to encode nodes and edges sequentially according to the sequence of meta-paths to obtain the embedding representation of each meta-path. Then, all the obtained meta-path embedding representations are used as new neighbor nodes and APP nodes and input together into the graph attention network model to obtain the node-level embedding of the APP node. The specific steps are as follows:

[0015] S301. Given a specific metapath P(v, u) = (t0, t1, ..., t2), ... n ), t0=u, t n =v, where v is the destination node to be aggregated, and u is the neighbor node based on the meta-path. The specific encoding formula is as follows:

[0016]

[0017]

[0018]

[0019] In the formula: h i Represents the characteristics of node i; o i Indicates from t0 to t i The embedding representation of this metapath; r i It is R i relation vectors, R i Represents node t i-1 and node t i The relationship between them; ⊙ is the Hadama product, h p(v,u) This is the embedded representation of this meta-path; o n Indicates from t0 to t n The embedding representation of this meta-path; n+1 represents the number of nodes on this meta-path;

[0020] S302. Input all the meta-path embeddings obtained in step S301 as new neighbor nodes and APP nodes into the graph attention network model, and use the following formula to complete the embedding of the APP node under this type of meta-path:

[0021]

[0022] In the formula: GAT represents the embedding of node v under metapath p, and G represents the graph attention network model. p This represents a homogeneous graph consisting of metapath embeddings and APP nodes under metapath p.

[0023] This invention calculates the weight for each meta-path in step four, and then multiplies and sums the embedding of the APP node under each meta-path with the corresponding weight to obtain the final embedding representation of the APP node; the specific steps are as follows:

[0024] S401. Calculate the weight of each metapath using the following two formulas:

[0025]

[0026]

[0027] In the formula: |V| represents the number of APP nodes, q T It is the transpose of the regular q, where V represents the set of APP nodes, q is the attention vector, M is the weight matrix, b is the bias vector, and β is the bias vector. p Let p represent the weight of the metapath p, where P is the set of metapath types, and exp represent an exponential function with base e.

[0028] S402. After obtaining the weight of each meta-path, multiply and sum the APP embedding representation under each meta-path obtained in step three with the corresponding meta-path weight, and fuse the embeddings under different meta-paths to obtain the final embedding. The specific formula is as follows:

[0029]

[0030] The positive effects achieved by adopting the above technical solution are as follows: The method of the present invention embeds each meta-path by using the RotatE encoder, aggregates the features of intermediate nodes on the meta-path, and also takes into account the features of the destination node itself, thereby obtaining more information that is conducive to malware detection. Therefore, the method of the present invention can achieve higher accuracy than other methods that use a large number of samples for training with a small number of samples. At the same time, the present invention limits the number of meta-paths by defining the λ parameter, thereby reducing the consumption of system resources. Attached Figure Description

[0031] Figure 1 This is a flowchart of the present invention;

[0032] Figure 2 This is a schematic diagram illustrating the definition structure of parameter λ in this invention;

[0033] Figure 3 This is a schematic diagram of the APP node embedding process structure of the present invention. Detailed Implementation

[0034] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0035] like Figure 1-3 As shown, the present invention discloses a graph neural network-based method for detecting Android malware using meta-path embedding, comprising the following steps:

[0036] Step 1: Use the APK analysis tool Androguard to decompile 2000 benign APK files and 2000 malicious APK files, extract static features, and obtain the API and Permission of all APKs;

[0037] Step 2: Combine the API and Permission obtained in Step 1 with the APP as three types of nodes, and define the relationships between the four types of nodes: APP—API: APP has API; APP—Permission: APP owns Permission; API—APP: API is contained by APP; Permission—APP: Permission is owned by APP; then generate an adjacency matrix based on the containment relationships between APP and API / Permission: For the adjacency matrix of APP and API, the number of rows is the number of APPs, and the number of columns is the number of APIs. If APP i Has API j If the value in row i is 1 and the value in column j is 0, then the adjacency matrix of API and Permission is the same; construct a heterogeneous graph based on the adjacency matrix.

[0038] Step 3: Define two types of meta-paths: APP—API—APP and APP—Permission—APP. Embed each APP node: Under each meta-path, for each neighboring node, extract λ specific meta-paths between them, and then encode these specific meta-paths using the RotatE encoder. Combine the encoded meta-paths with the APP node to form a homogeneous graph and feed it into the graph attention network model to obtain the embedding representation of the APP node under this type of meta-path.

[0039] The specific steps are as follows:

[0040] S31: Define the parameter λ to be 10, indicating that the maximum number of meta-paths between two APP nodes after extraction is 10 for each meta-path. For each meta-path: First, extract all specific meta-paths. For each neighbor node, if the number of meta-paths between the APP node and this neighbor node is less than or equal to 10, then select all of them; if it is greater than 10, randomly select 10 from them.

[0041] S32: Encode all selected specific meta-paths by using the RotatE encoder to encode nodes and edges sequentially according to the meta-path sequence, thereby obtaining the embedding representation of the meta-path; given a specific meta-path P(v, u) = (t0, t1, ..., t... n ), t0=u, t n =v, where v is the destination node to be aggregated, and u is the neighbor node based on the meta-path. The specific encoding formula is as follows:

[0042]

[0043]

[0044]

[0045] In the formula: o i Indicates from t0 to t i The embedding representation of this metapath; r i It is R i relation vectors, R i Represents node t i-1 and node t i The relationship between them; ⊙ is the Hadama product, h p(v,u) This is the embedded representation of this meta-path; o n Indicates from t0 to t n The embedding representation of this metapath; n+1 represents the number of nodes on this metapath; h i Let represent the characteristics of node i, and h represent the characteristics of node i, so... and h u Let t0 and u represent the features of nodes respectively; similarly, o i and o i-1 As mentioned above;

[0046] S33: Embed all the meta-paths obtained in step S32 as new neighbor nodes for the APP node. Input these neighbor nodes and the APP node together into the graph attention network model, and use the following formula to complete the embedding of the APP node under this type of meta-path:

[0047]

[0048] In the formula: GAT represents the embedding of node v under metapath p, and G represents the graph attention network model. p This represents a homogeneous graph consisting of metapath embeddings and APP nodes under metapath p. For each APP node, node-level embeddings are performed to obtain the embedding representation under each metapath. Each APP node will then receive an embedding set:

[0049] Step 4: Calculate the weight of each meta-path, and then multiply and sum the node-level APP embedding obtained in Step 3 with the corresponding meta-path weight to obtain the final APP embedding representation.

[0050] The specific steps are as follows:

[0051] S41: Calculate the weight of each metapath using the following two formulas:

[0052]

[0053]

[0054] In the formula: |V| represents the number of APP nodes, q T It is the transpose of the regular q, where V represents the set of APP nodes, q is the attention vector, M is the weight matrix, b is the bias vector, and β is the bias vector. p Let represent the weight of metapath p, where P is the set of metapath types, and exp represent an exponential function with base e; a total of two metapath weights are obtained: v ∈ V represents each node in V;

[0055] S42: After obtaining the weight of each meta-path, multiply and sum the APP embedding representation under each meta-path obtained in step three with the corresponding meta-path weight, and fuse the embeddings under different meta-paths to obtain the final APP node embedding. The specific formula is as follows:

[0056]

[0057] Step 5: Feed all the APP embedding representations obtained in Step 4 into a linear SVM classifier for training to obtain the APP classification results.

[0058] In this embodiment, the downloaded benign APK files and malicious APK files are divided into training, validation, and test sets in a 1:1:8 ratio. Specific APK files are transformed into abstract vector representations and fed into a classifier for training, ultimately achieving an accuracy of 99%. This invention encodes specific meta-paths, aggregating more information, and achieves or even surpasses the results of other methods that require a large number of samples with only a small number of samples. Furthermore, this invention limits the number of meta-paths by defining the λ parameter, reducing system resource consumption.

[0059] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for Android malware detection based on meta-path embedding graph neural network, characterized in that, The following steps are adopted: Step one, using APK analysis tool androguard to decompile the Android APK file, extract static features, get API and Permission; Step two, API and Permission obtained in step one are taken as three types of nodes together with APP, and edges are constructed by defining the relationship between nodes, then an adjacency matrix is generated according to the inclusion relationship between APP, API and Permission, and a heterogeneous graph is constructed; Step three, define meta path, and embed each APP node: under each meta path, for each neighbor node, extract λ specific meta paths between them, then use RotatE encoder to encode the extracted meta paths, and input the encoded meta paths and the APP node into the graph attention network model to obtain the embedding representation of the APP node under this meta path; The RotatE encoder encodes the nodes and edges in sequence according to the sequence of the meta path, obtains the embedding representation of each meta path, and then inputs all the obtained meta path embedding representations as new neighbor nodes and APP nodes into the graph attention network model to obtain the node-level embedding of the APP node; The specific steps are as follows: S301. Given a specific meta-path is the destination node to be aggregated, and u is the neighbor node based on the meta-path, and the specific encoding formula is as follows: （1） （2） （3） In the formula: Represents a node i Features; Indicates from The embedded representation of this metapath; yes relation vectors, Represents a node and nodes The relationship between them; It is the product of Hadamah. This is the embedded representation of this meta-path; Indicates from The embedding representation of this meta-path; n+1 represents the number of nodes on this meta-path; S302. Input all the meta path embedding representations obtained in step S301 as new neighbor nodes and APP nodes into the graph attention network model, and complete the embedding of the APP node under this meta path using the following formula: （4） In the formula: represents a node under the meta-path embedding, GAT represents a graph attention network model, represents a meta-path embedding and a homogeneous graph composed of APP nodes under the meta-path ; Step four, calculate the weight of each meta path, then multiply and accumulate the APP embedding obtained in step three and the corresponding meta path weight to obtain the final APP embedding representation; Step five, input the APP embedding representation obtained in step four into the linear SVM classifier to obtain the classification result of the APP.

2. The method of claim 1, wherein the method is based on a meta-path embedding-based graph neural network Android malware detection method. In step three, the λ parameter is defined in the meta path extraction process, λ represents the maximum number of intermediate nodes between two APP nodes after extraction under each meta path, or the maximum number of this meta path between two APP nodes after extraction.

3. The method of claim 1, wherein the method further comprises: Calculate the weight of each meta path in step four, then multiply and accumulate the embedding of the APP node under each meta path and the corresponding weight to obtain the final embedding representation of the APP node; The specific steps are as follows: S401. Calculate the weight of each meta path by the following two formulas: （5） （6） In the formula: denotes the number of APP nodes, , denotes the node under the meta-path , denotes the APP node set, is the attention vector, is the weight matrix, is the bias vector, respectively denotes the weight of the meta-path p and the meta-path i , denotes the weight of the normalized meta-path , is the meta-path category set, and exp denotes the exponential function with base e, tanh denotes the hyperbolic tangent function; S402. After obtaining the weight of each meta path, multiply and accumulate the APP embedding representation under each meta path obtained in step three and the corresponding meta path weight to obtain the final embedding, and the specific formula is as follows: （7） In the formula: denotes a node fuses the final embedding obtained from the embeddings under different meta-paths.

Images