Android malicious application detection method based on global heterogeneous graph

Abstract

The application discloses an Android malicious application detection method based on a global heterogeneous graph. The method firstly performs sensitive API call identification, then takes the sensitive APIs and APKs in the dataset as two important nodes in the heterogeneous graph, and constructs a global heterogeneous graph according to the call relationship. In the graph, there are mainly two types of edges. By calculating the weights of the APK-API and API-API edges, the API call feature information of the global and local perspectives is supplemented on the graph. Finally, the APK nodes on the global heterogeneous graph are trained through a graph neural network based on neighbor sampling, and a model that can be used for malicious application detection is obtained. The application can guarantee high detection rate while maintaining high detection efficiency. In addition, the neighbor sampling strategy solves the problem that the heterogeneous graph cannot be generalized to the application samples that do not appear during training when used for Android application detection, and satisfactory performance can be maintained in actual application scenarios.

Description

Technical Field

[0001] This invention relates to Android malicious application detection technology, and in particular to an Android malicious application detection method based on a global heterogeneous graph. Background Technology

[0002] Currently, with the widespread use of smartphones and mobile networks, tens of thousands of Android malicious software programs appear on major app store platforms every day. Even automated malware generation tools have emerged, causing the number of malicious Android applications to grow at an alarming rate, exhibiting diverse malicious characteristics that are difficult to guard against. Android malicious application detection can analyze software applications to determine whether they exhibit malicious behavior beyond normal functions, thereby alerting or preventing users from installing and using them. This is of great significance in reducing users' financial losses and privacy leaks. Therefore, how to efficiently and accurately detect Android malicious applications has become an important research topic in the field of software security.

[0003] Researchers can parse rich content from samples of Android software applications, making feature construction a crucial step in the malicious application detection process. Over the years, researchers have fully utilized their creativity and imagination in feature construction, employing various methods. These include sequence-type features, such as permission features, API features, and bytecode features, as well as graph features abstracted into high-level structures, such as control flow graphs, function call graphs, and data flow graphs. Typically, researchers use application functions and basic statement blocks as key nodes to construct an independent graph containing complex information for an Android application. Building upon this, graph feature mining has expanded in several directions, such as subgraph feature mining and methods for constructing heterogeneous graphs based on multiple Android samples. Furthermore, some researchers utilize the binary features of bytecode files to convert Android applications into grayscale and RGB images and use computer vision methods to solve the problem.

[0004] MaMaDroid (Onwuzurike L, Mariconti E, Andriotis P, et al. MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (Extended Version)[J]. ACM Transaction on Information and System Security, 2019(2).) is a static analysis-based system that abstracts software API calls to their classes, packages, or families, extracts API call sequences, and constructs a Markov chain model. However, this method is a sequence-based approach and cannot accurately understand the structural information related to malicious behavior in Android applications. The method of this invention is based on a high-level graph structure, which can deeply capture the feature information in the software, and the API-based construction feature gives the method itself a certain degree of anti-obfuscation capability.

[0005] Of course, there are many other graph-based detection methods. DroidSim (Sun X, Zhongyang Y, Xin Z, et al. Detecting Code Reuse in Android Applications Using Component-Based Control Flow Graph[J]. Springer, Berlin, Heidelberg, 2014.) is a control flow graph-based method that uses a component-based CFG (CB-CFG) to extract relevant information from the bytecode of different applications. Similarly, in CB-CFG, nodes represent Android APIs, and edges represent the control flow priority relationships of the APIs. Since building a complete graph for each APK is often too complex and contains a lot of redundant information, some researchers have focused on sensitive sub-mining of graphs. DAPASA (Ming F, Liu J, Wei W, et al. DAPASA: Detecting Android Piggybacked Apps Through Sensitive Subgraph Analysis[J]. IEEE TRANSACTIONS ON INFORMATIONFORENSICS AND SECURITY, 2017, 12(8): 1772-1785.) is a method for detecting malicious applications through sensitive subgraph analysis. This method generates sensitive subgraphs to describe the most suspicious behaviors of Android applications, then constructs five features from the sensitive subgraphs to describe the calling patterns, and finally completes the detection through machine learning algorithms. HinDroid (Hou S, Ye Y, Song Y, et al. HinDroid: An Intelligent Android Malware Detection System Based on Structured Heterogeneous Information Network[C] / / the 23rd ACM SIGKDD International Conference. ACM, 2017.) is an Android malicious application detection method based on modeling APKs, APIs and their relationships using heterogeneous information networks. This method establishes three relationships: the call relationship between APK and API, the relative positional relationship between APIs (i.e., whether they coexist in the same code block), and whether APIs have the same package name and method name. Then, it measures the similarity between Android applications by calculating path-based similarity through meta-paths and performs classification using support vector machines.The drawback of this method is that the constructed feature relationships are relatively superficial, and it measures similarity based on paths in heterogeneous networks, failing to fully mine the information in the graph. Furthermore, this method analyzes all APIs, but most APIs do not differentiate between Android applications, making the solution of filtering APIs through simple feature dimensionality reduction limited. Summary of the Invention

[0006] The purpose of this invention is to provide an Android malicious application detection method based on a global heterogeneous graph.

[0007] The technical solution to achieve the purpose of this invention is as follows: Firstly, this invention provides an Android malicious application detection method based on a global heterogeneous graph, comprising the following steps:

[0008] Step 1: Generate sensitive API call identification for Android applications. The process is as follows:

[0009] Given a training sample set A containing malicious and benign Android applications, analyze the Android APIs to obtain a sensitive API candidate set S; use reverse engineering tools to decompile all Android applications into Android bytecode files, parse the smali files to obtain the system API calls in the Android applications, and match the results with the sensitive API candidate set to identify the sensitive API calls in each Android application sample.

[0010] Step 2: Construct a global heterogeneous graph based on APK and sensitive API nodes, as follows:

[0011] The graph contains two types of nodes: APK nodes and sensitive API nodes, reflecting the Android application's calls to sensitive APIs. By adjusting the weight relationships of the edges between nodes, the behavior patterns of the Android application are reflected on the graph. APK-API edge weighting algorithms and API-API edge weighting algorithms are designed to adjust the weights of edges on the global sensitive heterogeneous graph and to uncover the Android application's behavior patterns regarding APIs.

[0012] Step 3, construct a graph neural network based on neighbor sampling and train a model classifier, the process is as follows:

[0013] A graph neural network based on neighbor sampling is adopted, and the embeddings of nodes in the multi-layer network are aggregated and iteratively updated. In the global heterogeneous graph, a set of neighbor nodes is obtained by multi-level neighbor sampling based on the target node. The weights constructed in the graph for APK-API and API-API are used as the features of the neighbor APK node and the neighbor API node, respectively, to initialize the embeddings in the graph. Then, the embeddings of the target node are iteratively updated in the multi-layer network. After training, a classifier that can be used for malicious application detection is obtained.

[0014] Step 4: Identify malicious Android applications. The process is as follows:

[0015] For the Android malicious application to be predicted, sensitive API calls are identified, and then the APK node to be detected and a set of API call edges are added to the global graph. After neighbor sampling, the features are input into the classifier model obtained in step 3 to obtain a classification result.

[0016] In a second aspect, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method described in the first aspect.

[0017] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0018] Compared with existing technologies, the advantages of this invention are: (1) It comprehensively considers the API semantic information and global call graph structure information of Android applications, and has high interpretability; (2) From a global perspective, it adds the call relationship feature between APK and API to the global heterogeneous graph, and introduces the sensitivity coefficient δ to supplement the sensitivity information and reduce the interference factors of sensitive APIs that frequently appear in both benign and malicious applications; (3) From a local perspective, it obtains API embedding through a distributed embedding method, and measures the co-occurrence frequency of API pairs through the similarity of embeddings, and adds this feature to the global heterogeneous graph; (4) It uses a graph neural network algorithm based on neighbor sampling, which solves the defect of graph neural network in classifying nodes in heterogeneous graphs, and maintains an excellent detection rate through iterative aggregation.

[0019] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0020] Figure 1 This is a flowchart of the framework for detecting malicious Android applications based on a global heterogeneous graph, as described in this invention.

[0021] Figure 2 This is a schematic diagram of neighbor sampling on a global heterogeneous graph.

[0022] Figure 3 This is a schematic diagram of the training process of a graph neural network model based on neighbor sampling.

[0023] Figure 4 This is a diagram illustrating the identification of unknown malicious Android applications. Detailed Implementation

[0024] To fully leverage the advantages of graph-based structural information analysis and address the issues of low analysis efficiency in homogeneous graphs and difficulty in generalizing new samples in heterogeneous graphs, this invention proposes an Android malicious application detection method based on global heterogeneous graphs. This method can construct a heterogeneous graph with sensitive APIs and APKs as nodes, realize API-oriented dependency modeling, and employ an improved graph neural network algorithm based on a neighbor sampling strategy, achieving a detection accuracy superior to other methods. It is an algorithm with significant advantages.

[0025] Compared with homogeneous graph methods, the method of this invention is based on a global heterogeneous graph, so only one graph needs to be constructed, simplifying the process and improving efficiency. Compared with other heterogeneous graph methods, this invention is based on graph neural networks, which can better capture information in the graph and improve the fatal flaw of heterogeneous graphs entering graph neural networks, making it better suited to practical application scenarios.

[0026] The proposed method is based on heterogeneous graphs and focuses only on sensitive API calls. Therefore, the size of the global heterogeneous graph can be controlled within a certain order of magnitude, avoiding interference from a large amount of invalid information from ordinary APIs, simplifying the computation process, and optimizing model efficiency. This method constructs a heterogeneous graph with sensitive APIs and APKs as nodes, realizing API-oriented dependency modeling. Weights for APK-API and API-API edges in the graph are constructed based on call relationships and API co-occurrence patterns, respectively. A graph neural network algorithm based on an improved neighbor sampling strategy is used to embed and classify APK nodes in the graph through iterative aggregation calculations. This invention supplements the specific call relationships between APKs and APIs from a global perspective, mining local API-API features through a distributed learning algorithm. For a single APK, this is a lightweight and accurate graph construction method, maintaining high detection rate while also ensuring high detection efficiency. Finally, the neighbor sampling strategy solves the problem that heterogeneous graphs are difficult to generalize to samples not present during training when used for Android malicious application detection, maintaining satisfactory performance in practical application scenarios.

[0027] Combination Figure 1 A method for detecting malicious Android applications based on global heterogeneous graphs includes the following steps:

[0028] Step 1: Generate sensitive API call identification for Android applications. The specific steps are as follows:

[0029] Step 1.1: Given a training sample set A = {apk1, apk2, apk3, ..., apk...} containing malicious and benign Android applications. m};

[0030] Step 1.2: Analyze the Android application using two tools, SuSi and PScout, to obtain two sets of sensitive APIs. Combine the results of the two tools to form a candidate set of sensitive APIs, S = {s1, s2, s3, ..., s...}. n};

[0031] Step 1.3: Using reverse engineering tools, all Android applications are decompiled into Android bytecode files. All smali files in the smali folder are traversed, and the `.method` directive is used to locate method calls within the program. Then, the `invoke-*` directive is used to extract the APIs called within these methods. The API call results are matched against a set of sensitive APIs to further identify sensitive API calls in each Android application sample.

[0032] Step 2: Construct a global heterogeneous graph based on APK and sensitive API nodes, as follows:

[0033] Step 2.1: Construct a global heterogeneous graph to store APKs, APIs, and their dependencies. The graph contains two types of nodes: APK nodes and API nodes, with a set of nodes A∪S. Edges also have two types: APK-API and API-API, representing the call relationship and co-occurrence relationship between nodes, respectively. The definition of this global heterogeneous graph is as follows:

[0034] G = (V, E)

[0035] V = V apk ∪V api

[0036] E = E apk-api ∪E api-api

[0037] V is the set of all nodes in the global heterogeneous graph, and E is the set of all edges in the global heterogeneous graph. apk V represents the set of nodes for all Android apps in the dataset. api This represents the combination of sensitive API nodes called by all Android software in the dataset. apk-api E represents the edge between Android software and sensitive API nodes. api-api This represents the edges between nodes that are sensitive to APIs.

[0038] Step 2.2: Calculate the importance of API calls to the APK using the TF-IDF algorithm, specifically for Android application APIs. i With APK j The dependency relationships between them are defined as follows:

[0039]

[0040]

[0041] TFIDF i,j =TF i,j *IDF i

[0042] TFIDF i,j API i With APK j Dependency weights between them, n i,j Indicates APK j API appears in i The number, M represents the length of the sensitive API candidate set, N represents the length of the APK data set, |{j:I i ∈K j}| indicates that it contains APIs i The number of APKs.

[0043] Considering the different distribution of APIs in benign and malicious Android applications, a sensitivity coefficient δ is introduced.

[0044]

[0045]

[0046] mc i API i The number of times it appears in malicious applications, bc i API i The number of benign applications, where N represents the total number of applications in the dataset.

[0047] In summary, combining dependency analysis between the API and the APK with sensitivity analysis of the API itself, this paper will use TF-IDF... i,j *δ i As an API i With APK j The weight of the edges between them.

[0048] Step 2.3 employs an unsupervised learning method based on the skip-gram model to obtain the embeddings of sensitive APIs. Then, the similarity of API embeddings within the same class is calculated as the weight between API-API edges, representing the co-occurrence features of a pair of APIs. To address the issue of insufficient length in the sensitive API call sequences at the solution level, ordinary API calls are also included in the training sequence corpus. API call sequences from all Android applications in the sample set are collected to obtain a corpus suitable for unsupervised learning. The semantic embeddings of sensitive APIs are obtained through training based on the skip-gram model. Similar embeddings have similar distributions in space; therefore, the cosine similarity (Similarity) between a pair of sensitive APIs is used as the weight of the edge between them. i It is a sensitive API i semantic embedding, E j It is a sensitive API j Semantic embedding.

[0049]

[0050] Step 3, construct a graph neural network based on neighbor sampling and train a model classifier, the process is as follows:

[0051] Step 3.1: Focus on the APK node that needs to be learned in the global heterogeneous graph, and sample a set of its neighboring nodes. Assume that each APK node is sampled at order k, and the number of neighbors for each sampling order is set as S1, S2, ... S... k To facilitate data processing, the algorithm employs a flexible sampling strategy; if the number of neighboring nodes of a node is less than S... i If the sampling frequency is high enough, sampling with replacement is performed, repeating the sampling process to reach the target number of samples; otherwise, sampling without replacement is performed. A total of [number] samples were taken from an APK node. There are several neighboring nodes, which may include various types, such as APK nodes and API nodes, all of which can provide information for aggregation; Figure 2 The process of sampling multiple neighbor nodes for an APK node was simulated in a simple way.

[0052] Step 3.2, define parameter k to represent the number of layers in the embedded network, which is the number of hops of neighboring nodes that each vertex can aggregate. Each additional layer allows for the aggregation of information from neighboring nodes in more distant layers. W iLet represent the weights corresponding to the i-th layer of the network, where i ranges from [1, k]. In each layer, the APK node v in the global heterogeneous graph needs to have its neighbor nodes aggregated across k layers. Assuming the current layer is the i-th layer, for an APK node v to be learned and a sampled set of its neighbor nodes N(v), an iterative process is required to aggregate information and update each node. This paper uses an average aggregation strategy. For each neighbor node u∈N(v), the representation vector obtained at the end of the previous layer's iteration is first averaged to obtain the aggregated embeddings of all neighbor nodes in the current layer. Then the representation vector of node v obtained in the previous layer. Aggregate and embed with neighboring nodes of the current layer The data is concatenated using the network weight matrix W. i After performing forward propagation with the activation function σ, the representation vector of the APK node v in the i-th layer of the network is obtained. The specific formula is as follows:

[0053]

[0054]

[0055] For APK nodes, the edge weight relationship between the node and API nodes is used as a feature to initialize the node's embedding. For API nodes, the co-occurrence frequency relationship between them is measured by calculating their similarity to other API nodes, and this series of data is then treated as a feature of API nodes to initialize the embedding of this type of node. All API nodes in the graph appear as neighbor nodes and participate in the aggregation process of multi-hop neighbor node information;

[0056] Step 3.3: In constructing the model, this invention employs a two-layer network structure and performs second-order neighbor sampling. A feature matrix, Feature = is constructed from the node to be learned v and a set of neighbor nodes N(v) obtained through second-order neighbor sampling.

[0057] in S represents the i-th neighbor node obtained by performing k-order sampling on node v. i s represents the number of nodes sampled at the i-th order. i This represents the i-th sensitive API. The feature matrix is ​​input into the network, and the current node is iteratively updated through forward propagation using an average aggregation method. Combined with... Figure 3As can be seen in the first layer of the network, the target node's embedding in the current layer is obtained first through the features of its first-order neighbors. Then, the first-order neighbors also obtain their respective embeddings in the current layer based on the features of their second-order neighbors. In the second layer of the network, the target node's embedding is aggregated again using the updated first-order neighbors to obtain the final result. During the iterative aggregation and updating process, the information of all neighboring nodes can be fully utilized. The output layer size of the last hidden layer in the network is set to the number of classification categories, and the common cross-entropy function is used as the model's loss function.

[0058]

[0059] N represents the total number of Android samples, c represents the category label, 0 represents benign, and 1 represents malicious. It is the classifier's prediction of the probability that sample i belongs to c, y i,c This indicates the actual label.

[0060] Through training, a classification model is obtained for detecting malicious Android applications;

[0061] Step 4: Detect and identify malicious Android applications. The process is as follows:

[0062] Step 4.1: Identify sensitive API calls of the malicious Android application to be detected, and then add the APK node v to be detected to the global heterogeneous graph G=(V,E). ′ And establish new edges with the sensitive API nodes in the global heterogeneous graph based on the sensitive API call relationships;

[0063] Step 4.2: Perform k-order neighbor sampling for the newly added node to obtain a set of neighbor nodes N(v ′ Then, based on the existing global heterogeneous graph, APK-API and API-API features of the nodes are constructed to obtain a feature matrix. Among them, the results of data analysis on the training dataset during API-API calls can remain unchanged, and the TF-IDF algorithm is mainly used to adjust the weights of the APK-API call features.

[0064] Step 4.3, add the new Android application sample node v ′ and its corresponding set of neighbor nodes N(v ′ By inputting the initial feature vector into the classifier model obtained in step 3.3, a classification result can be obtained. Figure 4 This will help to better understand the process.

[0065] The method of this invention was compared with four malicious application detection methods: MaMaDroid, DAPASA, DroidSim, and HinDroid. All four methods are relevant to the experiments presented in this paper. These methods are all based on API features; MaMaDroid uses Markov chain modeling for API sequences, while the others are graph-based algorithms. Specifically, DAPASA focuses on sensitive subgraph mining, DroidSim is based on homogeneous function call graphs, and HinDroid is based on heterogeneous function call graphs. Evaluation metrics included precision, recall, accuracy, and F1 score. The experimental data came from multiple benign and malicious Android application sample sets, including VirusTotal, AndroZoo, Drebin, Anzhi, and CICMalDroid, using 23,163 malicious Android samples and 20,734 benign Android samples. All samples were verified using the virtool tool. The results of the detection comparison of malicious Android applications are shown in Table 1. The experimental results show that the Android malicious application detection method based on global heterogeneous graph is superior to other methods in all evaluation indicators.

[0066] Table 1 Comparison of experimental results of different detection methods

[0067]

[0068] The above discussion is merely one embodiment of the present invention. Any equivalent modifications made based on the present invention are included within the scope of patent protection of the present invention.

Claims

1. A method for detecting malicious Android applications based on a global heterogeneous graph, characterized in that, Includes the following steps: Step 1: Generate sensitive API call identification for Android applications. The process is as follows: Given a training sample set A containing malicious and benign Android applications, analyze the Android APIs to obtain a sensitive API candidate set S; use reverse engineering tools to decompile all Android applications into Android bytecode files, parse the smali files to obtain the system API calls in the Android applications, and match the results with the sensitive API candidate set to identify the sensitive API calls in each Android application sample. Step 2: Construct a global heterogeneous graph based on APK and sensitive API nodes, as follows: The graph contains two types of nodes: APK nodes and sensitive API nodes, reflecting the Android application's calls to sensitive APIs. By adjusting the weight relationships of the edges between nodes, the behavior patterns of the Android application are reflected on the graph. APK-API edge weighting algorithms and API-API edge weighting algorithms are designed to adjust the weights of edges on the global sensitive heterogeneous graph and to uncover the Android application's behavior patterns regarding APIs. Step 3, construct a graph neural network based on neighbor sampling and train a model classifier, the process is as follows: A graph neural network based on neighbor sampling is adopted, and the embeddings of nodes in the multi-layer network are aggregated and iteratively updated. In the global heterogeneous graph, a set of neighbor nodes is obtained by multi-level neighbor sampling based on the target node. The weights constructed in the graph for APK-API and API-API are used as the features of the neighbor APK node and the neighbor API node, respectively, to initialize the embeddings in the graph. Then, the embeddings of the target node are iteratively updated in the multi-layer network. After training, a classifier that can be used for malicious application detection is obtained. Step 4: Identify malicious Android applications. The process is as follows: For the Android malicious application to be predicted, sensitive API calls are identified, and then the APK node to be detected and a set of API call edges are added to the global graph. After neighbor sampling, the features are input into the classifier model obtained in step 3 to obtain a classification result.

2. The Android malicious application detection method based on global heterogeneous graph as described in claim 1, characterized in that, The specific steps for generating sensitive API call identification for Android applications in Step 1 are as follows: Step 1.1: Given a training sample set A = {apk1, apk2, apk3, ..., apk...} containing malicious and benign Android applications. m }; Step 1.2: Analyze the Android application using two tools, SuSi and PScout, to obtain two sets of sensitive APIs. Combine the results of the two tools to form a candidate set of sensitive APIs, S = {s1, s2, s3, ..., s...}. n }; Step 1.3: Use reverse engineering tools to decompile all Android applications into Android bytecode files, traverse all smali files in the smali folder, use the .method directive to identify the methods called in the program, and then use the invoke-* directive to extract the APIs called in the methods; match the API call results with the sensitive API set to identify the sensitive API calls in each Android application sample.

3. The Android malicious application detection method based on global heterogeneous graph as described in claim 2, characterized in that, Step 2 involves constructing a global heterogeneous graph based on APK and sensitive API nodes. The specific steps are as follows: Step 2.1: Construct a global heterogeneous graph to store APKs, APIs, and their dependencies. There are two types of nodes in the graph: APK nodes and API nodes. The set of nodes is A∪S. There are two types of edges: APK-API and API-API, which represent the calling relationship and co-occurrence relationship between nodes, respectively. Step 2.2: Calculate the importance of the API to the APK call using the TFIDF algorithm, and introduce a sensitivity coefficient δ to measure the sensitivity of the API; Step 2.3: Use an unsupervised learning method based on the skip-gram model to obtain the embeddings of sensitive APIs, and then calculate the similarity of API embeddings in the same class as the weight between API-API edges to express the co-occurrence features when a pair of APIs are used.

4. The Android malicious application detection method based on global heterogeneous graph as described in claim 3, characterized in that, Step 3 involves constructing a graph neural network based on neighbor sampling and training a classifier model. The steps are as follows: Step 3.1: Focus on the APK node that needs to be learned in the global heterogeneous graph, and sample a set of neighboring nodes around it; assuming that k-order sampling is performed on each APK node, the number of neighbors for each order of sampling is set as S1, S2, ... S k A total of samples were taken from one APK node. One neighboring node; Step 3.2, define parameter k to represent the number of layers in the embedded network, i.e., the number of hops of neighboring nodes that each vertex can aggregate; each additional layer allows aggregation of information from neighboring nodes in more distant layers; W i This represents the weights corresponding to the i-th layer of the network, where i ranges from [1, k]. For APK nodes, the edge weight relationship between these nodes and API nodes is used as a feature to initialize the node embedding. For API nodes, the co-occurrence frequency relationship between them is measured by calculating their similarity to other API nodes, forming an API pair similarity matrix. This matrix data is then used as the feature of API nodes to initialize the embedding of this type of node. All API nodes in the graph appear as neighbor nodes and participate in the aggregation process of multi-hop neighbor node information. Step 3.3: A two-layer network structure is adopted and second-order neighbor sampling is performed. A feature matrix is ​​constructed by the node to be learned and its corresponding set of neighbor nodes and input into the network. The current node is iteratively updated by forward propagation through the average aggregation method. The output layer size of the last hidden layer in the network is set to the number of categories to be classified, and the cross-entropy function is used as the loss function of the model. Through training, a classification model is obtained for Android malicious application detection.

5. The Android malicious application detection method based on global heterogeneous graph as described in claim 4, characterized in that, Step 4 involves detecting and identifying malicious Android applications. The steps are as follows: Step 4.1: Identify sensitive API calls of the malicious Android application to be detected, and then add the APK node v to be detected to the global heterogeneous graph G=(V,E). ′ And establish new edges with the sensitive API nodes in the global heterogeneous graph based on the sensitive API call relationships; Step 4.2: Perform k-order neighbor sampling for the newly added node to obtain a set of neighbor nodes N(v ′ Then, based on the existing global heterogeneous graph, the APK-API and API-API features of the nodes are constructed. Step 4.3, add the new Android application sample node v ′ and its corresponding set of neighbor nodes N(v ′ By inputting the initial feature vector of the classifier model obtained in step 3.3, a classification result can be obtained.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1-5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1-5.

Images