Apk obfuscation mechanism detection method based on graph attention network and nlp word embedding model

Abstract

The application provides an apk obfuscation mechanism detection method based on a graph attention network and an NLP word embedding model, obtains an initial ICFG through static analysis on an apk to be detected; carries out normalization processing on each jimple instruction of the apk to be detected, and obtains a vector corresponding to each instruction; accumulates and averages the vectors according to corresponding dimensions to obtain a vector of each basic block, and obtains a final code attribute graph in combination with structure information of the ICFG; and obtains an obfuscation category of the apk to be detected through an obfuscation detection model trained by a basic block feature matrix and an adjacency matrix of the final code attribute graph. The jimple code block is converted into a vector through a word2vec model, the semantic information of the jimple code can be integrated to the maximum extent, and the structure information of the jimple code block is learned in combination with a GAT model, so that the precision is higher.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to an APK obfuscation mechanism detection method based on graph attention network and NLP word embedding model. Background Technology

[0002] Due to the development of code obfuscation techniques, more and more malware writers are using obfuscation to modify the malicious code of their software, making it difficult for automated malware detection tools to detect, while still retaining its malicious functionality. The use of obfuscation techniques in malware detection also increases the difficulty for technical personnel to reverse engineer malware. Therefore, detecting code obfuscation methods helps to quickly identify the obfuscation methods used in malware, facilitating software malfunction detection and reverse analysis by security reverse engineers.

[0003] An existing technical solution discloses a function-level obfuscation detection method based on graph convolutional neural networks (application number 202011521368.4). This method targets function-level obfuscation mechanisms, but its adaptability to complex obfuscation mechanisms is not high. Furthermore, this method selects statistical features from decompiled instructions during feature extraction, lacking the extraction of semantic information from the code, thus resulting in low recognition accuracy. Summary of the Invention

[0004] To address the aforementioned problems in existing technologies, this invention provides a method for detecting APK obfuscation mechanisms based on graph attention networks and NLP word embedding models. The technical problem to be solved by this invention is achieved through the following technical solution:

[0005] This invention provides a method for detecting APK obfuscation mechanisms based on graph attention networks and NLP word embedding models, including:

[0006] S100: Obtain the APK to be tested and perform flow analysis on the APK to obtain the initial inter-process control flow graph (ICFG) of the APK to be tested; the initial ICFG includes: function call graph (CG) and Jimple code blocks in each function, each Jimple code block includes multiple instructions;

[0007] S200 performs regularization on each instruction of the APK to be detected and converts the processed instructions into a vector.

[0008] S300: The vectors corresponding to each instruction are summed and averaged according to their corresponding dimensions to obtain the detection vector of each Jimple code block. The detection vectors are then introduced into the initial ICFG to obtain the final code attribute map of the APK to be detected.

[0009] S400 uses the basic block feature matrix and adjacency matrix of the final code attribute graph to perform information transfer, overall information extraction and loss processing through the trained obfuscation detection model to obtain the obfuscation category of the APK to be detected.

[0010] This invention provides an APK obfuscation mechanism detection method based on graph attention networks and NLP word embedding models. It obtains the APK to be detected and performs static analysis to obtain the initial inter-process control flow graph (ICFG). Each instruction in the APK is converted into a vector, and each vector is regularized to obtain the vector corresponding to each instruction. The vectors corresponding to each instruction are accumulated and averaged according to their corresponding dimensions to obtain the detection vector for each Jimple code block. The detection vector is then introduced into the initial ICFG to obtain the final code attribute graph of the APK. The basic block feature matrix and adjacency matrix of the final code attribute graph are used by a trained obfuscation detection model for information transfer, overall information extraction, and loss processing to obtain the obfuscation category of the APK. This invention obtains the Jimple code blocks of the APK, uses a word2vec model to convert the Jimple code blocks into vectors, which can maximize the integration of the semantic information of the Jimple code, and combines GAT to learn the structural information of the Jimple code blocks, resulting in higher accuracy compared to other neural network methods.

[0011] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0012] Figure 1 This is a flowchart illustrating the APK obfuscation mechanism detection method based on graph attention network and NLP word embedding model provided by the present invention.

[0013] Figure 2 This is an example schematic diagram of the APK obfuscation mechanism detection method based on graph attention network and NLP word embedding model provided by the present invention;

[0014] Figure 3 This is a schematic diagram of the training confusion detection model provided by the present invention. Detailed Implementation

[0015] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0016] Combination Figure 1 and Figure 2 This invention provides a method for detecting APK obfuscation mechanisms based on graph attention networks and NLP word embedding models, including:

[0017] S100: Obtain the APK to be tested and perform static analysis on the APK to obtain the initial inter-process control flow graph (ICFG) of the APK to be tested; the initial ICFG includes: function call graph (CG) and Jimple code blocks in each function, each Jimple code block includes multiple instructions;

[0018] S200 performs regularization on each instruction of the APK to be detected and converts the processed instructions into a vector.

[0019] S200 of the present invention includes:

[0020] S210 uses a pre-defined word2vec model to convert each instruction into a vector;

[0021] Since there are various NLP word embedding models, the Word2vec of this invention can be replaced by models such as Glove, FastText, and Doc2Vec.

[0022] S220, perform regularization on each vector to remove custom variable names in the Jimple code block, and obtain the code text of the Jimple code block;

[0023] It's worth noting that the Jimple code block is the code obtained after processing the APK using FlowDroid. Word2vec is a natural language processing model that is trained on input text. After training, it takes a Jimple code instruction as input and outputs a corresponding vector.

[0024] This invention, after processing with FlowDroid, can obtain an APK call graph and display the mutual call relationships between functions. Thus, this invention obtains a graph structure. After obtaining the graph structure, it is necessary to determine the vector of each node in the graph, that is, to convert the code block corresponding to each method into a vector. Furthermore, these vectors must have the same dimension; otherwise, training is impossible.

[0025] This invention performs regularization on each vector to reduce code differences introduced by user-defined variables. The regularization method involves converting all user-defined variable names to a single, identical name, thus minimizing code differences caused by these variables. This removes user-defined variable names from the Jimple code, leaving only the corresponding Jimple code. The processed code text is then fed into a word2vec file for training, allowing this invention to obtain the vector corresponding to each Jimple instruction.

[0026] S230: The code text is put into a word2vec file for training, and a vector corresponding to each instruction is obtained. All vectors have the same dimension.

[0027] S300: The vectors corresponding to each instruction are summed and averaged according to their corresponding dimensions to obtain the detection vector of each Jimple code block. The detection vectors are then introduced into the initial ICFG to obtain the final code attribute map of the APK to be detected.

[0028] S300 of the present invention includes:

[0029] S310, accumulate and average the vectors corresponding to each instruction according to their corresponding dimensions to obtain an average vector;

[0030] S320 determines the average vector as the vector for the Jimple code block.

[0031] The method used in this invention to convert instructions into vectors is word2vec. Since the number of instructions in each code block is definitely different, this invention uses word2vec to convert each instruction in each code block into a vector to achieve uniformity. After processing the code block, this invention obtains multiple vectors. Then, an averaging method is used to convert these vectors into a single vector. For example, suppose a method has two instructions, which after processing become [[1, 2, 3], [5, 6, 7]]. After averaging, it becomes ([1, 2, 3] + [5, 6, 7]) / 2 = [3, 4, 5]. Each code block is then processed accordingly. After this, the vector dimension of all functions in this invention is unified. Combining these vectors with the call graph yields a complete graph structure. The previously obtained call graph did not have the vector values ​​for each node; these vector values ​​need to be calculated. Combining the call graph with the call graph results in a complete graph structure, which can then be used for neural network training or recognition.

[0032] After obtaining the vector of the corresponding Jimple instruction, this invention will accumulate and average the vectors within each code block to obtain the vector of each code block.

[0033] S400 uses the basic block feature matrix and adjacency matrix of the final code attribute graph to perform information transfer, overall information extraction and loss processing through the trained obfuscation detection model to obtain the obfuscation category of the APK to be detected.

[0034] S400 of the present invention includes:

[0035] S410, determine the basic block feature matrix and adjacency matrix of the final code attribute graph;

[0036] S420 passes the basic block feature matrix and adjacency matrix through each layer of the trained confusion detection model, and performs dimensionality reduction, concatenation, overall information extraction, and loss processing during the transmission process to obtain the confusion category of the APK to be detected.

[0037] S420 of the present invention includes:

[0038] S421, based on the attention-related scores of each layer of the trained confusion detection model, the basic block feature matrix and adjacency matrix are passed through each layer of the trained confusion detection model, and dimensionality reduction, splicing, overall information extraction and loss processing are performed during the transmission process to obtain the probability distribution of the confusion category of the APK to be detected.

[0039] S422, Identify the obfuscation category of the APK to be detected as the obfuscation category if the obfuscation category is greater than the preset probability threshold.

[0040] The fundamental block feature matrix of the final code attribute graph is represented as X∈R N×M The adjacency matrix is ​​represented as A∈R N×N Where N represents the total number of nodes, and M represents the dimension of each node's vector. This invention uses a 5-layer GAT graph convolutional neural network, and its layer-by-layer propagation rules are as follows:

[0041]

[0042] in, This represents the vector value of the i-th node in the next layer. ij This is the attention cross-correlation score, representing the contribution of node j to node i. j represents other nodes adjacent to node i, and N represents the number of nodes adjacent to node i. Where a... ij The calculation is performed in the following manner:

[0043]

[0044]

[0045]

[0046]

[0047] Where W∈R M′×M It is a trainable matrix, and its main function is to manage h. j We transform the vector, performing a dimensionality reduction process. ⊕ represents the concatenation of vectors from two nodes, and LeakyReLU represents a non-linear activation function.

[0048] The summation of the embeddings of all nodes in a CFG gives the embedding of the entire graph.

[0049]

[0050] LSTM is used to process the graph embeddings to further extract overall information, and Dropout is added. Dropout is a commonly used regularization method that probabilistically disconnects some neurons during forward propagation and weight updates, effectively avoiding overfitting. The LSTM layer output is s∈R. k Where k is the number of obfuscation technology categories to be tested:

[0051] s = Dropout(LSTM(g)) (7);

[0052] The output of the LSTM is processed using a softmax layer, where the output of the softmax layer is y∈R. k .

[0053] y = softmax(s) (8);

[0054] In the formula, y is the probability distribution of all categories, and the classification result of the confusion technique used by the function is obtained based on y.

[0055] See Figure 2 The training process of the completed confusion detection model includes:

[0056] S010, retrieve the obfuscated APK collection from the database;

[0057] The APK collection includes: a general obfuscation collection, a renaming obfuscation collection, an encryption obfuscation collection, a reflection obfuscation collection, a code obfuscation collection, and a collection of mixed obfuscation methods.

[0058] Common obfuscation: As the name suggests, this category includes simple methods that do not actually obfuscate the APK file. However, these methods can fool some signature-based malware. These methods include: signing the APK file with a new signature, disassembling and reassembling the bytecode contained in the classes.dex file to obtain different versions of the file, etc.

[0059] Renaming Obfuscation: In software development, identifier names (variable names, function names, etc.) should be meaningful to provide good code readability and maintainability. However, such explicit names may leak functional information about the code. Furthermore, since the package name uniquely identifies an Android application, modifying it is equivalent to installing a new application into the system. Therefore, renaming techniques replace each identifier with an obscure and meaningless one. While renaming methods and fields has no impact on the normal operation of the program, renaming classes and packages is more complex because AndroidManifest.xml must be updated accordingly for the software to function correctly.

[0060] Encryption and Obfuscation: Some resources required by an APK file may be requested at runtime. These resources include native libraries or text resources of string type. These files can be encrypted and decrypted at runtime. In this case, malware analysts need to obtain the encryption key first to access the resource files, but this obfuscation method reduces the software's operating efficiency.

[0061] Reflection obfuscation: Reflection is a feature of the Java language that allows a Java class to be modified and tested at runtime. This feature is typically used to call methods of a given object. The basic principle of this technique is to query the APK executable code for calls to the APK file class, rather than calls to Android system file classes, and then check whether these calls can be made using reflection APIs. This can mask the mutual call relationships within the APK without affecting the normal operation of the code.

[0062] Code obfuscation: This type of obfuscation technique mainly affects the contents of the classes.dex file. Specific methods include deleting useful information during debugging, adding meaningless arithmetic branches, and adding new method implementations for indirect calls.

[0063] Obfuscation using multiple methods: combining two or more of the above obfuscation methods.

[0064] S020, Perform static analysis on each APK in the APK set to obtain the inter-process control flow graph (ICFG) of each APK;

[0065] The ICFG includes a function call graph (CG) and a Jimple code block within each function, with each Jimple code block containing multiple instructions.

[0066] This invention utilizes the widely used open-source software FlowDroid, a static taint analysis tool for Android applications. FlowDroid employs IFDS-based flow functions to enhance sensitivity, comprehensively models the Android lifecycle and callbacks, and generates a special main method to ensure no usable information is lost. This tool boasts high analysis accuracy and reliability. The control flow graph is constructed by obtaining the call graph and the jumple code of each function using FlowDroid.

[0067] S030, Construct the graph data structure corresponding to each APK based on its ICFG;

[0068] This invention is based on the Jimple code of each function, which is converted into vectors using the word2vec model, and then combined with the function's CG to construct the corresponding graph data structure.

[0069] S040, Build a GAT neural network model based on the graph data structure corresponding to each APK and the preset GAT neural network structure;

[0070] S050, using the GAT neural network model as the confusion detection model;

[0071] S060, Train the confusion detection model to obtain the trained confusion detection model.

[0072] This invention obtains the Jimple code block from the APK and uses the word2vec model to maximize the integration of the Jimple code's semantic information. Furthermore, it combines this with GAT to learn the Jimple code's structural information, resulting in higher accuracy compared to other neural network methods. This invention directly uses FlowDroid to obtain the Jimple code from the AndroOBFS Dataset to acquire the neural network's dataset for training. Compared to some obfuscation detection techniques, this invention omits the steps of obfuscating and labeling open-source code, making dataset acquisition more convenient and faster.

[0073] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0074] Although this application has been described herein in conjunction with various embodiments, those skilled in the art will understand and implement other variations of the disclosed embodiments by reviewing the accompanying drawings, the disclosure, and the appended claims in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality.

[0075] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for detecting APK obfuscation mechanisms based on graph attention networks and NLP word embedding models, characterized in that, include: S100, obtain the APK to be detected, and perform static analysis on the APK to be detected to obtain the initial inter-process control flow graph (ICFG) of the APK to be detected; the initial ICFG includes: function call graph (CG) and Jimple code blocks in each function, each Jimple code block including multiple instructions; S200 performs regularization on each instruction of the APK to be detected and converts the processed instructions into a vector. S300, the vectors corresponding to each instruction are summed and averaged according to their corresponding dimensions to obtain the detection vector of each Jimple code block, and the detection vectors are introduced into the initial ICFG to obtain the final code attribute map of the APK to be detected; S400, the basic block feature matrix and adjacency matrix of the final code attribute graph are processed by the trained obfuscation detection model to obtain the obfuscation category of the APK to be detected; S200 includes: S210 uses a pre-defined word2vec model to convert each instruction into a vector; S220, perform regularization on each vector to remove custom variable names in the Jimple code block, and obtain the code text of the Jimple code block; S230, The code text is put into a word2vec file for training to obtain a vector corresponding to each instruction, and all vectors have the same dimension; The S300 includes: S310, the average vector corresponding to each instruction is obtained by accumulating and averaging according to the corresponding dimension; S320, the average vector is determined as the vector of the Jimple code block.

2. The APK obfuscation mechanism detection method based on graph attention network and NLP word embedding model according to claim 1, characterized in that, The training process of the completed confusion detection model includes: S010, retrieve the obfuscated APK collection from the database; S020, Perform static analysis on each APK in the APK set to obtain the inter-process control flow graph (ICFG) of each APK; S030, Construct the graph data structure corresponding to each APK based on its ICFG; S040, Build a GAT neural network model based on the graph data structure corresponding to each APK and the preset GAT neural network structure; S050, the GAT neural network model is used as an obfuscation detection model; S060, The obfuscation detection model is trained to obtain a trained obfuscation detection model.

3. The APK obfuscation mechanism detection method based on graph attention network and NLP word embedding model according to claim 2, characterized in that, The APK collection in S010 includes: a regular obfuscation collection, a rename obfuscation collection, a cryptographic obfuscation collection, a reflection obfuscation collection, a code obfuscation collection, and a collection of obfuscations using a combination of methods.

4. The APK obfuscation mechanism detection method based on graph attention network and NLP word embedding model according to claim 2, characterized in that, The ICFG in S020 includes the function call graph CG and the Jimple code block within each function, with each Jimple code block containing multiple instructions.

5. The APK obfuscation mechanism detection method based on graph attention network and NLP word embedding model according to claim 1, characterized in that, The S400 includes: S410, determine the basic block feature matrix and adjacency matrix of the final code attribute graph; S420, the basic block feature matrix and adjacency matrix are passed through each layer of the trained confusion detection model, and dimensionality reduction, splicing, overall information extraction and loss processing are performed during the transmission process to obtain the confusion category of the APK to be detected.

6. The APK obfuscation mechanism detection method based on graph attention network and NLP word embedding model according to claim 5, characterized in that, The S420 includes: S421, based on the attention-related scores of each layer, the basic block feature matrix and adjacency matrix are passed through each layer of the trained confusion detection model, and dimensionality reduction, splicing, overall information extraction, and loss processing are performed during the transmission process to obtain the probability distribution of the confusion category of the APK to be detected. S422, the obfuscation category with a probability greater than a preset threshold is determined as the obfuscation category of the APK to be detected.

Images