A malware detection method and system

Abstract

The present application provides a kind of malware detection method and system, the detection method includes: client is according to preset first rule to the feature extraction of software to be detected, generates the feature vector of software to be detected;In preset carrier picture, embeds preset perturbation parameter and the feature vector of software to be detected, generates embedding picture, wherein, a carrier picture corresponds to a perturbation parameter;The embedding picture is sent to preset picture classification model, and accepts the classification result of embedding picture by picture classification model;According to the classification result obtained and preset mapping relationship judges whether software to be detected is malicious software.The present application can make attacker difficult to detect behavior or obtain the data in detection behavior, so as to be unable to carry out targeted attack, effectively improve the reliability and security of Android malware detection service.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a malware detection method and system. BACKGROUND

[0002] With the rapid development of mobile Internet, mobile devices such as mobile phones gradually become the main tool for people to surf the Internet, and most mobile devices use the Android operating system. However, the openness, vulnerability and imperfect application market review mechanism of the Android operating system also lead to the large breeding and wide spread of malware. In order to cope with a large number of malware, many mobile phone and network service providers begin to provide online Android malware detection services.

[0003] However, at the same time, these detection services are also threatened by attackers, mainly malware makers. For example: attackers will intercept data transmitted during detection, use these data to disguise and optimize their own software by means of adversarial samples, so that the software can escape detection, and the detection model becomes unreliable and has vulnerabilities. SUMMARY

[0004] Therefore, it is necessary to provide a new malware detection method and system, which can make it difficult for attackers to detect or obtain data in the detection behavior, so as to effectively improve the reliability and security of Android malware detection services.

[0005] Specifically, the present application discloses a malware detection method, comprising the following steps:

[0006] The client extracts features of the software to be detected according to a preset first rule, and generates a feature vector of the software to be detected;

[0007] The preset disturbance parameters and the feature vector of the software to be detected are embedded on the preset carrier picture to generate an embedded picture, wherein one carrier picture corresponds to one disturbance parameter;

[0008] The embedded picture is sent to a preset picture classification model, and the classification result of the embedded picture by the picture classification model is accepted;

[0009] According to the mapping relationship between the obtained classification result and the preset mapping relationship, it is judged whether the software to be detected is malware.

[0010] Further, the client extracts features of the software to be detected according to a preset first rule, and generates a feature vector of the software to be detected, comprising:

[0011] The client extracts features of the software to be detected according to a preset first rule, and splices the extracted features into a feature vector after numerical value processing.

[0012] Further, the first preset rule comprises at least one of extracting sensitive permission features, sensitive action features and sensitive application programming interfaces.

[0013] Further, the preset disturbance parameter and the feature vector of the software to be detected are embedded on the preset carrier picture to generate an embedded picture, comprising:

[0014] The preset disturbance parameter is added to each pixel point of the preset carrier picture, and a dimension data of the feature vector of the software to be detected corresponding to each preset position is added to the corresponding preset position, so as to generate the embedded picture.

[0015] Further, the preset disturbance parameter and the feature vector of the software to be detected are embedded on the preset carrier picture to generate an embedded picture, comprising:

[0016] The neighborhood standard deviation δ obtained by each pixel point i on the preset carrier picture is compared with a preset threshold t, and all positions with δ>t are selected to obtain a high-frequency region:

[0017]

[0018]

[0019] wherein, x i represents a pixel value of each pixel point i, C R represents a neighborhood with pixel point i as the center and R as the radius, N R is the number of pixel points in the high-frequency region, is an average pixel value;

[0020] The high-frequency region is set as a disturbance limiting region, and a plurality of positions are selected from the high-frequency region, each position corresponding to a dimension data of the feature vector of the software to be detected;

[0021] The dimension data and the preset disturbance parameter are added to the corresponding positions of the carrier picture, so as to generate the embedded picture.

[0022] Further, the dimension data and the preset disturbance parameter are added to the corresponding positions of the carrier picture, specifically comprising that the dimension data, the preset disturbance parameter and the carrier picture need to perform the following mathematical operation:

[0023] X=tanh(G+M⊙W+V)

[0024] Wherein, X represents an embedded picture, G represents a carrier picture, V represents a matrix converted by a feature vector of the software to be detected, wherein the elements corresponding to the dimension of the feature vector of the software to be detected take the dimension data as the value, and the rest of the elements take 0 as the value; W represents a matrix corresponding to a preset perturbation parameter; M is a 0 / 1 matrix, wherein the area corresponding to the preset position of the carrier picture is 1, and the rest is 0; ⊙ refers to the operation of multiplying M and W at the corresponding positions to limit the perturbation in the preset area; and the tanh() function is a normalization function.

[0025] In a second aspect, the application discloses a malware detection system, comprising a client and a server, wherein:

[0026] The client is configured to perform feature extraction on the software to be detected according to a preset first rule to generate a feature vector of the software to be detected, embed a preset perturbation parameter and the feature vector of the software to be detected on a preset carrier picture to generate an embedded picture, wherein different carrier pictures correspond to different perturbation parameters, send the embedded picture to a preset picture classification model, and accept the classification result of the embedded picture by the picture classification model, and determine whether the software to be detected is malware according to the obtained classification result and a preset mapping relationship.

[0027] The server comprises a first server and a second server, and the first server is configured to provide the client with a first rule, a second rule, a carrier picture and a mapping relationship, wherein:

[0028] The first rule is used for the client to perform feature extraction on the software to be detected.

[0029] The second rule is used for the client to embed a preset perturbation parameter and a feature vector of the software to be detected on a preset carrier picture to generate an embedded picture.

[0030] The mapping relationship is preset and used for determining whether the software to be detected is malware, wherein:

[0031] Y = Map(Y * )

[0032] Wherein, Y * represents a classification label output by the picture classification model, Y represents a label indicating whether it is malware, Map represents a mapping relationship, one carrier picture corresponds to one perturbation parameter, one perturbation parameter mapping relationship and one second rule.

[0033] The second server is configured to receive the embedded picture sent by the client, obtain a classification result according to the preset perturbation parameter and the feature vector by using a preset picture classification model, and output the classification result to the client.

[0034] Further, the preset perturbation parameter is obtained by training a second server according to picture classification model related data provided by the second server, and a training loss function used is as follows:

[0035]

[0036] Wherein, p represents a probability value of a preset picture classification model for an output category y corresponding to an input X i , t i is a symbol function, which is 1 when y i is a label category, and 0 otherwise; and epsilon norm W is a regularization term, epsilon is a regularization coefficient, and W is a parameter optimized by minimizing the loss function.

[0037] In a third aspect, the application further discloses a client, which comprises a feature extraction unit, an embedded picture generation unit, a communication unit and a judgment unit, wherein:

[0038] The feature extraction unit is connected with the embedded picture generation unit and is configured to perform feature extraction on the software to be detected according to a preset first rule, and generate a feature vector of the software to be detected;

[0039] The embedded picture generation unit is further connected with the communication unit and is configured to embed the preset perturbation parameter and the feature vector of the software to be detected on a preset carrier picture to generate an embedded picture, wherein different carrier pictures correspond to different perturbation parameters;

[0040] The communication unit is further connected with the judgment unit and is configured to send the embedded picture to a preset picture classification model and accept a classification result of the embedded picture by the picture classification model;

[0041] The judgment unit is configured to judge whether the software to be detected is malicious software according to the obtained classification result and a preset mapping relationship.

[0042] In a fourth aspect, the application further discloses a server, which comprises a first server and a second server, and the first server is configured to provide a first rule, a second rule, a carrier picture and a mapping relationship to a client, wherein:

[0043] The first rule is configured to perform feature extraction on the software to be detected by the client;

[0044] The second rule is configured to embed the preset perturbation parameter and the feature vector of the software to be detected on the preset carrier picture to generate the embedded picture, wherein one carrier picture corresponds to one perturbation parameter;

[0045] The mapping relationship is preset and is configured to judge whether the software to be detected is malicious software, wherein:

[0046] Y = Map (Y *)

[0047] wherein Y * represents a classification label output by the picture classification model, Y represents a label of whether it is malware, Map represents a mapping relationship, one carrier picture corresponds to one perturbation parameter, one perturbation parameter mapping relationship, one second rule;

[0048] The second server is configured to receive the embedded picture sent by the client, obtain a classification result according to the preset perturbation parameter and the feature vector by using the preset picture classification model, and output the classification result to the client.

[0049] Based on the above technical solution, the present application has the following beneficial effects compared with the prior art:

[0050] The present application discloses a malware detection method, in the use process, the client only needs to extract the vector feature of the software to be detected and embed it into the carrier picture to generate an embedded picture, send the embedded picture to the pre-trained classification model server and get the classification result, and then map the result to get the detection result of the software. In this detection method, the information transmitted is only the embedded picture and the picture classification result. For these two kinds of information, it is difficult for the attacker to realize the relevance to malware detection, thereby reducing the probability of the attacker discovering the detection service. Moreover, this carrier process also hides the feature information of the malware well, so that even if the attacker obtains the transmitted information, he cannot reverse the original feature extracted, and cannot use it to disguise his own software to escape detection.

[0051] In addition, the present application embeds the vector feature of the software to be detected into the carrier picture, which has very small calculation amount and can be ignored, and does not increase the overhead of the client. In addition, in terms of security, the server can regularly update the carrier picture and the corresponding perturbation for the client, so that the information transmitted in the network during detection can change constantly, which can more effectively hide the detection behavior, reduce the probability of being discovered by the attacker, and effectively improve the reliability and security of the Android malware detection service. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 is a flowchart of a malware detection method in embodiment one;

[0053] Figure 2 is a flowchart of step S02 in embodiment one;

[0054] Figure 3 is a working process schematic diagram of steps S01-S03 in embodiment one;

[0055] Figure 4 is a working process schematic diagram of steps S01-S04 in embodiment one;

[0056] Figure 5 is a flow chart of step S02' of another embodiment of the malware detection method in embodiment two;

[0057] Figure 6 is a structural schematic diagram of a malware detection method in embodiment three. DETAILED DESCRIPTION

[0058] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0059] Embodiment one

[0060] The present application discloses a malware detection method, which combines Figure 1 as shown, comprising the following steps:

[0061] S01, the client extracts features of the software to be detected according to a preset first rule, and generates a feature vector of the software to be detected.

[0062] The client extracts features of the software to be detected according to a preset first rule, and splices the extracted features into a feature vector after numerical processing. In some embodiments, the first preset rule includes at least one of extracting sensitive permission features, sensitive action features, and sensitive application programming interfaces (APIs).

[0063] Specifically, for example, in some embodiments, 147 sensitive permissions can be selected from the permissions defined by Google (the main developer of the Android system), 126 typical sensitive action features can be selected from the actions defined by the official, and finally 106 sensitive APIs can be selected from the APIs that can be called by the software to be detected. The extraction results of the above three can be numerized and spliced to obtain a 379-dimensional feature vector. For Android software, both software permissions and action features can be read from the manifest file Android-Manifest.xml provided by the Android software, and API calls can be read from the smali file obtained by decompiling the APK installation package.

[0064] S02, embedding a preset perturbation parameter and a feature vector of the software to be detected on a preset carrier picture to generate an embedded picture, wherein one carrier picture corresponds to one perturbation parameter.

[0065] After the feature is extracted, the client embeds the feature into a carrier picture by a specific embedding method, which is a picture irrelevant to the Android malware feature (the carrier picture can be any picture, and the present application has no special requirements for it). The embedded carrier picture can be distinguished from other non-embedded carrier pictures. The embedding method and the carrier picture are trained and provided by the malware detection service provider (referred to as the first server in the present application), and the training process can be referred to the relevant description below.

[0066] Specifically, in some embodiments, in combination with Figure 2 As shown in the preset carrier picture, the preset disturbance parameter and the feature vector of the software to be detected are embedded to generate an embedded picture, which specifically includes:

[0067] S201, the preset disturbance parameter is added to each pixel point of the preset carrier picture.

[0068] A carrier picture corresponds to only one disturbance parameter, and the carrier picture and the corresponding disturbance parameter can be effective for all extracted vectors.

[0069] S202, select several preset positions on the preset carrier picture, and add a dimension data of the feature vector of the software to be detected corresponding to each preset position to the corresponding preset position, thereby generating an embedded picture.

[0070] Specifically, the dimension data and the preset disturbance parameter are added to the corresponding position of the carrier picture, which specifically includes that the dimension data, the preset disturbance parameter and the carrier picture need to perform the following mathematical operation:

[0071] X=tanh (G+W+V) (1)

[0072] Wherein, X represents the embedded picture, G represents the carrier picture, V represents the matrix converted by the feature vector of the software to be detected, wherein the elements corresponding to the dimension of the feature vector of the software to be detected take the dimension data, and the other elements take 0; W represents the matrix corresponding to the preset disturbance parameter; the tanh() function is a normalization function.

[0073] The so-called embedding process, i.e. finding a number of positions on the carrier picture, each position corresponding to a dimension of the feature vector of the software to be detected, and implementing the embedding process by increasing or decreasing the pixel value at the position. In some embodiments, the perturbation parameter is generally small, assuming that the elements of the matrix corresponding to the perturbation parameter are 0.02 (the perturbation parameter involved in this embodiment is a parameter that needs to be optimized by model training); the dimension data of the feature vector will be larger, such as 0.5, so the pixel value of the corresponding position of the carrier picture needs to be increased by 0.02+0.5. In this embodiment, the data embedded here will be normalized to the range [-1, 1]. By analogy, the feature vector of a software to be detected can be completely embedded into a carrier picture.

[0074] S03, sending the embedded picture to a preset picture classification model and accepting the classification result of the picture classification model on the embedded picture.

[0075] For the convenience of understanding, the related content of steps S01-S03 is shown in the following table. Figure 3

[0076] S04, judging whether the software to be detected is malicious software according to the obtained classification result and a preset mapping relationship.

[0077] The preset picture classification model is provided by a third-party server, which is referred to as a second server in this embodiment. The first server obtains the related data of the picture carrier classification model of the second server for training by previously negotiating with the second server. The picture classification model of this embodiment only focuses on the embedded perturbation parameter and feature vector, and does not focus on the carrier picture itself, i.e. the picture classification model classifies the embedded picture according to the perturbation parameter and feature vector, such as picture classification results A, B, C, etc., and then obtains the detection result through the mapping relationship previously given by the malicious software service provider (the first server), such as "A" corresponding to "benign software" and "B" corresponding to "malicious software". In this embodiment, the picture classification can be real trees, vehicles, flowers, or other types. The result of the picture classification is focused on by the client (user), and the client needs to judge whether the software to be detected is malicious software according to the picture classification result and the pre-defined mapping relationship. As for what type of picture the picture classification result is represented by the first server and the second server, the client does not need to focus on it.

[0078] It can be understood that the picture classification result and the software maliciousness can be a many-to-one relationship, i.e. the mapping relationship is that A / B output by the picture classification model can all correspond to "benign software", and C / D / E output by the picture classification model can all correspond to "malicious software".

[0079] ​For the convenience of understanding the working principle of the embodiments of the present application, the content of the disturbance parameter is described in more detail.

[0080] In some embodiments, according to the basic principle of adversarial reprogramming, the picture classification model can also perform tasks other than picture classification, such as malware detection tasks, by adding disturbance parameters and iterative optimization. In specific implementation, it is necessary to set the loss function optimization to maximize the probability of correct output results, so that the disturbance parameters obtained after several rounds of iterative optimization can make the picture embedded with the disturbance parameters and the feature vector as the input of the picture classification model, and then complete the task of malware detection through the mapping relationship after obtaining the classification result.

[0081] Specifically, the mapping relationship is pre-set to determine whether the software to be detected is malware.

[0082] Y = Map (Y * ) (2)

[0083] Wherein, Y * represents the classification label output by the picture classification model, Y represents the label of whether it is malware, and Map represents the mapping relationship. One carrier picture corresponds to one disturbance parameter, one mapping relationship and one rule for generating embedded pictures.

[0084] In some embodiments, the pre-set disturbance parameter is obtained by training the picture classification model related data provided by the second server according to the first server. The training loss function used is as follows:

[0085]

[0086] Wherein, p represents the probability value of the pre-set picture classification model for the output category y i corresponding to the input X, t i is a symbol function, which is 1 when y i is the label category, and 0 otherwise; ε‖W‖ is a regularization term, ε is a regularization coefficient, and W is the parameter optimized by minimizing the loss function.

[0087] For the convenience of understanding, Figure 4 the main working content of the malware detection method of the present application is illustrated.

[0088] The application discloses a malware detection method. In the use process, the client only needs to extract the vector features of the software to be detected and embed the vector features into a carrier picture to generate an embedded picture, send the embedded picture to a pre-trained classification model server, obtain a classification result, and then perform result mapping to obtain the detection result of the software. In the detection method, only the embedded picture and the picture classification result are transmitted. Attackers are difficult to realize the relevance of the two kinds of information to the malware detection, so that the probability of the attackers discovering the detection service is reduced. Moreover, the feature information of the malware is also well hidden in the carrier process, so that even if the attackers obtain the transmitted information, the original features extracted by the attackers cannot be reversely deduced, and the attackers cannot use the original features to disguise their own software to escape detection.

[0089] In addition, the application has a small calculation amount in the process of embedding the vector features of the software to be detected into the carrier picture, and the calculation amount can be ignored, so that the overhead of the client is not increased. In addition, in terms of security, the server can regularly update the carrier picture and the corresponding disturbance for the client, so that the information transmitted in the network during detection can be changed, so that the detection behavior can be more effectively hidden, and the probability of being discovered by the attackers is reduced.

[0090] Embodiment two

[0091] For step S02, in order to improve the concealment after embedding and prevent being discovered, the present example proposes a non-global embedding idea, and only a limited area (also referred to as a high-frequency area) in the carrier picture is set for feature vector embedding and disturbance parameter addition. Specifically, for the selection of the high-frequency area, the standard deviation in the neighborhood can be used for measurement. Specifically, in combination with FIG. 2, the present step includes: Figure 5

[0092] S201', the neighborhood standard deviation δ obtained by each pixel point i is compared with a preset threshold t on a preset carrier picture, the positions of all δ>t are selected to obtain a high-frequency area, and the formula for calculating δ is as follows:

[0093]

[0094]

[0095] wherein x i represents the pixel value of each pixel point i, C R represents a neighborhood with the pixel point i as the center and R as the radius, N R is the number of pixel points in the high-frequency area, is the average pixel value.

[0096] In some embodiments, wherein C R ​8-neighborhood with pixel i as the center and radius R is denoted. The 8-neighborhood mentioned here is for a certain pixel, which refers to the set of four adjacent pixels above, below, left and right of the pixel and four pixels diagonally adjacent to the pixel. The pixel values mentioned here are normalized to the range [-1, 1]. After obtaining the delta for each position, a threshold t is set, and all positions with delta > t constitute the high-frequency region R H .

[0097] S202', set the high-frequency region as the limit region of the disturbance, and select a number of positions from the high-frequency region, each position corresponding to a dimension data of the feature vector of the software to be detected.

[0098] That is, a number of positions equal to the dimension of the vector are randomly selected from the high-frequency region to form the embedding region R T , and each position corresponds to a dimension.

[0099] S203', add the dimension data and the preset disturbance parameter to the positions corresponding to the carrier picture to generate the embedded picture.

[0100] Specifically, the dimension data, the preset disturbance parameter and the carrier picture need to perform the following mathematical operations:

[0101] X = tanh (G + M o W + V) (6)

[0102] Where X represents the embedded picture, G represents the carrier picture, V represents the matrix converted from the feature vector of the software to be detected, wherein the elements corresponding to the dimension of the feature vector of the software to be detected take the dimension data, and the remaining elements take 0; W represents a matrix corresponding to the preset disturbance parameter; M is a 0 / 1 matrix, wherein the elements in the region corresponding to the preset position of the carrier picture are 1, and the remaining elements are 0; o refers to the operation of multiplying M and W at corresponding positions to limit the disturbance in the preset region; and the tanh() function is a normalization function.

[0103] The other steps of the embodiment of the application are the same as those of embodiment one, and the feature vector embedding and disturbance parameter adding are performed only in the high-frequency region, which can reduce the size and visibility of the focus region and further improve the concealment compared with embodiment one.

[0104] Embodiment three

[0105] The application further discloses a malware detection system, which combines Figure 6 The system comprises a client 10 and a server 20.

[0106] The client 10 can be a mobile phone, a computer, a smart wearable device, etc. In some embodiments, the client 10 includes a feature extraction unit 101, an embedded picture generation unit 102, a communication unit 103, and a judgment unit 104, wherein:

[0107] The feature extraction unit 101 is connected to the embedded picture generation unit 102 and is configured to perform feature extraction on the to-be-detected software according to a preset first rule to generate a feature vector of the to-be-detected software.

[0108] The client extracts features of the to-be-detected software according to the first preset rule, and splices the extracted features into a feature vector after numerical processing. In some embodiments, the first preset rule includes at least one of extracting sensitive permission features, sensitive action features, and sensitive application programming interface (API).

[0109] The embedded picture generation unit 102 is also connected to the communication unit 103 and is configured to embed a preset perturbation parameter and a feature vector of the to-be-detected software on a preset carrier picture to generate an embedded picture, wherein different carrier pictures correspond to different perturbation parameters.

[0110] Specifically, the embedded picture generation unit 102 is configured to add the preset perturbation parameter to each pixel point of the preset carrier picture. One carrier picture corresponds to only one perturbation parameter, and this carrier picture and the corresponding perturbation parameter can be effective for all extracted vectors. The embedded picture generation unit 102 is also configured to select a plurality of preset positions on the preset carrier picture, add a dimension data of the feature vector of the to-be-detected software corresponding to each preset position to the corresponding preset position, and thus generate an embedded picture.

[0111] The communication unit 103 is also connected to the judgment unit 104 and is configured to send the embedded picture to a preset picture classification model and accept a classification result of the embedded picture by the picture classification model.

[0112] The judgment unit 104 is configured to determine whether the to-be-detected software is malicious software according to the obtained classification result and a preset mapping relationship.

[0113] The specific working content of the client 10 can refer to Embodiment One and Embodiment Two, which will not be described here.

[0114] The server includes a first server 21 and a second server 22. The first server 21 is configured to provide a first rule, a second rule, a carrier picture, and a mapping relationship to the client 10, wherein:

[0115] The first rule is used by the client 10 to extract features of the to-be-detected software.

[0116] The second rule is used for the client 10 to embed the preset perturbation parameter and the feature vector of the software to be detected on the preset carrier picture to generate an embedded picture.

[0117] The mapping relationship is preset and is used to determine whether the software to be detected is malicious software.

[0118] Y = Map(Y * ) (2)

[0119] Wherein, Y * represents a classification label output by the picture classification model, Y represents a label of whether it is malicious software, Map represents a mapping relationship, one carrier picture corresponds to one perturbation parameter, one mapping relationship and one second rule.

[0120] The second server 22 is configured to receive the embedded picture sent by the client 10, obtain a classification result according to the preset perturbation parameter and the feature vector by using the preset picture classification model, and output the classification result to the client 10.

[0121] The preset perturbation parameter mentioned in the embodiment is obtained by training the picture classification model related data provided by the second server 22 according to the first server 21, and the training loss function used is as follows:

[0122]

[0123] Wherein, p represents the probability value of the output category y i corresponding to the input X of the preset picture classification model, t i is a symbol function, which is 1 when y i is a label category, and 0 otherwise; ε‖W‖ is a regularization term, ε is a regularization coefficient, and W is a parameter optimized by minimizing the loss function.

[0124] The working principles of the first server 21 and the second server 22 can also refer to Embodiment 1, which will not be repeated here.

[0125] In the embodiment of the present application, the first server 21 can pack the first rule (feature extraction method), the second rule (embedding method of perturbation parameter and feature vector), and the carrier picture and the corresponding mapping relationship into a program package for the client 10 to download. After the user downloads the program package at the client 10, the user can extract the feature vector of the software to be detected at the client 10, embed the perturbation parameter and the feature vector into the carrier picture to generate an embedded picture, and then send the embedded picture to the picture classification model provided by the second server 22 to obtain a classification result, and then obtain the detection result of the software according to the returned classification result combined with the mapping relationship. The calculation amount of the embedding process is only a linear operation on a matrix of the same size as the picture, which can be ignored and does not increase the overhead of the user end. In addition, in terms of security, the user can regularly update the carrier picture and the corresponding perturbation, so that the information transmitted in the network during detection can change constantly, which can more effectively hide the detection behavior and reduce the probability of being discovered by attackers.

[0126] The first server of the embodiment of the present application needs to negotiate with the second server on the provision scheme of the picture classification model to ensure that the parameters of the classification model can be used for training of the perturbation parameter. In order to enhance security, the first server can regularly provide update services for the client, and the updated content is only the new carrier picture and the corresponding perturbation parameter, which is very convenient to implement.

[0127] In addition, the difference from the prior art also includes at least: the first server in the framework does not need to perform complex server setup and provide malware detection models, and these processes are realized by relying on the second server; and the second server does not need to additionally spend energy to add and maintain new functions to provide detection services. In addition, in the traditional method, if the data transmitted in the network is found and intercepted, it will be used by the attacker, so that the attacker can use methods such as adversarial samples and the like to make his own software able to deceive the detector; and in the present application, since the embedded picture can maintain a high degree of similarity before embedding, the data is not easy to be found and intercepted, and even if it is intercepted, it is difficult to know the embedding process of the data, so that the data before embedding cannot be deduced, and it is also difficult to make targeted attacks, thereby ensuring the reliability and security of the detection service.

[0128] The embodiment of the present application can only obtain the carrier picture and the picture classification result transmitted in the network for the attacker, and the attacker is difficult to realize the relevance of the two kinds of information with the malware detection, thereby reducing the probability of the attacker discovering the detection service. Moreover, the carrier process also better hides the feature information of the malware, so that the attacker cannot reverse the extracted original features even if the transmitted information is obtained, and cannot use the original features to disguise the software to escape detection, thereby effectively improving the reliability and security of the Android malware detection service.

[0129] In the detailed description above, various features are grouped together in single embodiments for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting a necessity to more features than are expressly identified as essential in each claim. Rather, such disclosure is intended to be illustrative of the many possible combinations in which the claimed subject matter is practiced. Thus, the claims are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate preferred embodiment.

[0130] The above description includes one or more examples of the embodiments. Of course, describing all possible combinations of components or methods for describing the above embodiments is impossible, but one of ordinary skill in the art should recognize that various embodiments can be further combined and arranged. Therefore, the embodiments described herein are intended to cover all such changes, modifications, and variations falling within the scope of the appended claims. In addition, with respect to the term "comprise" used in the specification or claims, the coverage is similar to the term "include", as explained in the interpretation of "include" as a transitional phrase in the claims. In addition, the use of any one term "or" in the specification or claims is intended to mean "non-exclusive or".

Claims

1. A malware detection method, characterized in that: The following steps are involved: The client extracts features of the software to be detected according to a preset first rule and generates a feature vector of the software to be detected; The neighborhood standard deviation of each pixel i is obtained on the preset carrier image With preset threshold Compare, select all The high-frequency area is obtained at the position of The formula is as follows: in, represents the pixel value of each pixel i, Indicates that the radius is centered at pixel i. Neighborhood, is the number of pixels in the high-frequency area, is the average pixel value; The high-frequency area is set as the restricted area of ​​disturbance, and several positions are selected from the high-frequency area, each position corresponding to a dimension of the feature vector of the software to be tested; Add the dimension data and the preset perturbation parameters to the corresponding positions of the carrier image to generate an embedded image, where one carrier image corresponds to one perturbation parameter; Send the embedded image to the preset image classification model and receive the classification result of the image classification model on the embedded image; Determine whether the software to be detected is malware based on the obtained classification results and the preset mapping relationship.

2. The malware detection method according to claim 1, wherein: The client extracts features of the software to be detected according to a preset first rule to generate a feature vector of the software to be detected, including: The client extracts features of the software to be detected according to the preset first rule, digitizes the extracted features, and then splices them into feature vectors.

3. The malware detection method according to claim 1, wherein: The preset first rule includes: extracting at least one of sensitive permission features, sensitive action features, and sensitive application programming interfaces.

4. The malware detection method according to claim 1, wherein: Embed the preset perturbation parameters and the feature vector of the software to be tested on the preset carrier image to generate an embedded image, including: Add the preset perturbation parameters to each pixel of the preset carrier image; Select several preset positions on the preset carrier image, correspond each preset position to a dimension data of the feature vector of the software to be detected, and add the dimension data to the corresponding preset position to generate an embedded image.

5. The malware detection method according to claim 4, wherein: Add the dimension data and the preset perturbation parameters to the corresponding position of the carrier image. Specifically, the following mathematical operations need to be performed on the dimension data, the preset perturbation parameters, and the carrier image: Among them, X represents the embedded picture, Indicates the carrier image, The matrix represents the transformed eigenvector of the software to be detected, where the elements corresponding to the eigenvector dimensions of the software to be detected are dimensional data, and the remaining elements are 0; Represents the matrix corresponding to the preset disturbance parameters; It is a 0 / 1 matrix, where the corresponding high frequency area is 1 and the rest are 0; refers to and Perform the multiplication operation of the corresponding position to limit the disturbance to the high-frequency area; The function is a normalization function.

6. A malware detection system, characterized in that: Includes client and server, including: The client is used to extract features of the software to be detected according to the preset first rule and generate a feature vector of the software to be detected; it is also used to obtain the neighborhood standard deviation of each pixel i on the preset carrier image. With preset threshold Compare, select all The high-frequency area is obtained at the position of The formula is as follows: in, represents the pixel value of each pixel i, Indicates that the radius is centered at pixel i. Neighborhood, is the number of pixels in the high-frequency area, is the average pixel value; The high-frequency area is set as the restricted area of ​​disturbance, and several positions are selected from the high-frequency area, each position corresponding to a dimension of the feature vector of the software to be tested; Add the dimension data and the preset perturbation parameters to the corresponding positions of the carrier image to generate an embedded image, where one carrier image corresponds to one perturbation parameter; It is also used to send the embedded image to a preset image classification model and receive the classification result of the embedded image by the image classification model; it is also used to determine whether the software to be detected is malware based on the obtained classification result and the preset mapping relationship; The server includes a first server and a second server, wherein the first server is configured to provide the first rule, the second rule, the carrier image, and the mapping relationship to the client, wherein: The first rule is used by the client to extract features of the software to be detected; The second rule is used by the client to embed the preset perturbation parameters and the feature vector of the software to be detected into a preset carrier image to generate an embedded image; The mapping relationship is pre-set and is used to determine whether the software to be detected is malware, wherein: in, Represents the classification label output by the image classification model, A label indicating whether it is malware. Represents a mapping relationship, where a carrier image corresponds to a perturbation parameter, a mapping relationship, and a second rule; The second server is used to receive the embedded image sent by the client, use a preset image classification model to obtain a classification result according to preset perturbation parameters and feature vectors, and output the classification result to the client.

7. The malware detection system according to claim 6, wherein: The preset disturbance parameters are obtained by training the first server based on the image classification model-related data provided by the second server. The training loss function used is as follows: in, Indicates the preset image classification model for input Corresponding output category The probability value of is a sign function, When it is a label category, it is 1, otherwise it is 0; is the regularization term, is the regularization coefficient, Parameters optimized to minimize the loss function.

8. A client, characterized in that: It includes a feature extraction unit, an embedded image generation unit, a communication unit, and a judgment unit, wherein: A feature extraction unit, connected to the embedded image generation unit, is used to extract features of the software to be detected according to a preset first rule and generate a feature vector of the software to be detected; The embedded image generation unit is also connected to the communication unit and is used to generate the neighborhood standard deviation of each pixel i on the preset carrier image. With preset threshold Compare, select all The high-frequency area is obtained at the position of The formula is as follows: in, represents the pixel value of each pixel i, Indicates that the radius is centered at pixel i. Neighborhood, is the number of pixels in the high-frequency area, is the average pixel value; The high-frequency area is set as the restricted area of ​​disturbance, and several positions are selected from the high-frequency area, each position corresponding to a dimension of the feature vector of the software to be tested; Add the dimension data and the preset perturbation parameters to the corresponding positions of the carrier image to generate an embedded image, where one carrier image corresponds to one perturbation parameter; The communication unit is also connected to the judgment unit and is used to send the embedded image to the preset image classification model and receive the classification result of the embedded image by the image classification model; The judging unit is used to judge whether the software to be detected is malicious software according to the obtained classification result and the preset mapping relationship.

9. A server, characterized in that: The server includes a first server and a second server, wherein the first server is configured to provide the first rule, the second rule, the carrier image, and the mapping relationship to the client, wherein: The first rule is used by the client to extract features of the software to be detected; The second rule is used by the client to calculate the neighborhood standard deviation of each pixel i on the preset carrier image. With preset threshold Compare, select all The high-frequency area is obtained at the position of The formula is as follows: in, represents the pixel value of each pixel i, Indicates that the radius is centered at pixel i. Neighborhood, is the number of pixels in the high-frequency area, is the average pixel value; The high-frequency area is set as the restricted area of ​​disturbance, and several positions are selected from the high-frequency area, each position corresponding to a dimension of the feature vector of the software to be tested; Add the dimension data and the preset perturbation parameters to the corresponding positions of the carrier image to generate an embedded image, where one carrier image corresponds to one perturbation parameter; The mapping relationship is pre-set and is used to determine whether the software to be detected is malware, wherein: in, Represents the classification label output by the image classification model, A label indicating whether it is malware. Represents a mapping relationship, where a carrier image corresponds to a perturbation parameter, a perturbation parameter mapping relationship, and a second rule; The second server is used to receive the embedded image sent by the client, use a preset image classification model to obtain a classification result according to preset perturbation parameters and feature vectors, and output the classification result to the client.

Images