Method for interpretive evaluation of malware detection models based on deep learning

Abstract

The application discloses a method for explaining and evaluating a malware detection model based on deep learning, constructs an XDeepMal framework to explain the malware detection model based on deep learning, uses a dynamic analysis tool XTracer+ to capture behaviors of an application during runtime in the XDeepMal framework, and automatically generates continuous behavior tracks of the application, then proposes a new explanation method to find exact behavior segments that affect decision making of the deep learning model, and regards identification of the key behavior segments as an optimization problem, and implements the optimization problem by using a heuristic algorithm. The application can generate more persuasive explanations for the malware detection model based on deep learning, which will greatly help security analysts to accurately understand why an application is identified as malware by the malware detection model based on deep learning.

Description

Technical Field

[0001] This invention relates to malicious detection technology using machine learning, and more specifically to an interpretation and evaluation method for a deep learning-based malware detection model. Background Technology

[0002] The LIME algorithm (Local Interpretable Model-agnostic Explanations) is a popular model interpreter used to explain the predictions of machine learning models. While complex machine learning models (such as deep neural networks or ensemble models) can provide highly accurate predictions, they are often considered "black boxes" because their internal workings are opaque to most users. LIME aims to break down this barrier, providing an intuitive explanation of model predictions.

[0003] SHAP (SHapley Additive exPlanations) is a popular model interpretation tool that provides explanations for each prediction made by a machine learning model. Its core idea is based on Shapley values, a concept from game theory. It refers to a situation where the interests of both parties in a game increase, or at least one party's interests increase while the other party's interests remain unaffected, thus increasing the overall benefit to society. It primarily studies how to distribute the benefits of cooperation when people reach a point of cooperation, i.e., the problem of benefit distribution.

[0004] The Transformer is a widely used model architecture in Natural Language Processing (NLP), first proposed by Vaswani et al. in 2017. Its main characteristic is its complete reliance on self-attention mechanisms to process the input sequence, enabling it to capture long-range dependencies within the sequence. Unlike traditional RNNs and LSTMs, the Transformer can process the entire sequence in parallel, improving efficiency. Due to its powerful performance and flexibility, the Transformer has become the foundational architecture for many modern NLP models, such as BERT and GPT.

[0005] In existing malware detection methods, Fairbanks et al. used control flow graphs as the main feature and employed the random forest algorithm for analysis.

[0006] In summary, while deep learning is widely used in Android malware detection, the lack of interpretability of deep learning-based detection models severely reduces user trust and poses a significant obstacle to their practical adoption in critical security areas. Some research has focused on revealing the principles behind model decisions; unfortunately, these efforts are often limited by feature extraction methods, with most relying primarily on static analysis to obtain approximate behavioral descriptions of applications. Therefore, establishing reliable interpretations to support deep learning-based malware detection models remains a challenging problem. Summary of the Invention

[0007] Purpose of the Invention: The purpose of this invention is to address the shortcomings of existing technologies and provide an interpretation and evaluation method for deep learning-based malware detection models. This invention uses the new framework XDeepMal to interpret deep learning-based malware detection models. This invention collects real data from multiple channels and conducts extensive experiments on the dataset to demonstrate the effectiveness and reliability of the XDeepMal framework of this invention.

[0008] Technical solution: The present invention provides an interpretation and evaluation method for a deep learning-based malware detection model, comprising the following steps:

[0009] Step 1: To avoid potential data quality bias from a single data source, collect a large number of applications from multiple sources (e.g., Google Play Store, VirusShare, Androzoo, third-party app stores) to build a dataset;

[0010] Step 2: Use XTracer+'s dynamic analysis tools to capture the dynamic behavior trajectory of each application; the execution process of XTracer+'s dynamic analysis tools is as follows:

[0011] Step 2.1: Connect the host and Android emulator via Android Debug Bridge (adb), which means using Android Asset Packaging Tool (aapt) to parse the APK file and obtain specific information (such as package name, entry point main function name);

[0012] Step 2.2: Use the adb command to install the APK file in the Android emulator, and then launch it using the obtained main function name;

[0013] Step 2.3: Start the frida-server service on the Android emulator and deploy Frida scripts to monitor critical behaviors of the target application;

[0014] Step 2.4: Execute Maxim, a high-performance Android Monkey tool based on traversal rules, to automatically generate a large number of trigger events to improve execution path coverage;

[0015] Step 2.5: Maintain synchronization with Maxim and record the triggering threads and sequences of important behaviors being tracked to generate behavioral trajectories;

[0016] Step 2.6: Uninstall the target application and remove its running traces;

[0017] Step 3: Detect malware using a Transformer-based sequence model. The Transformer-based sequence model includes a Transformer encoder and an enhanced MLPHead. The trained Transformer-based sequence model can enhance the model's ability to capture nonlinear representations while effectively preventing network degradation.

[0018] Step 4: Use an interpreter based on heuristic algorithms to determine the most critical behavioral segments. The specific determination process is as follows:

[0019] First, the preprocessed behavior sequence of the application is sent to a trained Transformer-based malware detection model for malware detection, as follows:

[0020] y = f(A)

[0021] Where f represents a detection model that takes a sequence as input and generates classification predictions for a given application. A is the input sequence, and y is the prediction score;

[0022] Then, assume A s It is a random subsequence of the input sequence A; ablate A from A. s The elements are then processed, and the ablated sequence is passed to the model to obtain the affected prediction score y. s :

[0023] y s =f(AA) s )

[0024] Where A s The evaluation function for ablation effect is as follows:

[0025] g(A s )=yy s

[0026] However, with A s With the increase in length, g(A) s It usually also increases; therefore, the maximum value of g often corresponds to a longer sequence A.s This could lead to excessively long interpretations; such results cannot be considered reliable or conclusive interpretations.

[0027] Next, regarding A s By imposing a constraint on the length of , the following objective function is formed:

[0028]

[0029]

[0030] Where C represents A s The length ratio to A should be lower than a certain threshold requirement;

[0031] To reduce the complexity of the algorithm, the constrained problem is transformed into an unconstrained problem by maximizing the Lagrange function with a fixed Lagrange multiplier λ.

[0032]

[0033] The value obtained is when A is removed. s The maximum decrease in the predicted score of category c is ultimately able to identify the subsequence of behavioral trajectories that have the most significant impact on model predictions;

[0034] Step 5: Evaluate the effectiveness of the interpreter;

[0035] Step 6: Use LIME as a benchmark method to evaluate the effectiveness of XDeelMal.

[0036] Furthermore, the XTracer+ dynamic analysis tool includes:

[0037] a) A Frida-based analytics engine used to inject JavaScript into target applications to monitor their behavior;

[0038] b) Use Python scripts to automate tasks, integrate with Frida, execute specific Hook operations, and process data collected from the target application;

[0039] c) Use Maxim to automatically generate a large number of trigger events for in-depth testing of the application.

[0040] The XTracer+ dynamic analysis tool of this invention adds a custom module for the detection range, which effectively detects APIs called by reflection and dynamically loaded permissions.

[0041] Furthermore, in step 3, the Transformer-based sequence model is based on a Transformer network. The Decoder of the Transformer network is replaced with an MLP to form an enhanced MLPHead, thereby transforming the sequence that should have been output into a classification detection result. In other words, the enhanced MLPHead of this invention performs classification operations at the top of the model, used for further processing on the feature representation after the Transformer encoder. The enhanced MLPHead introduces residual channels to enhance the model's ability to model nonlinear relationships. Finally, by adding the output of the MLP to the original input, the model's nonlinear modeling capability is enhanced, preventing the gradient vanishing problem. The Transformer encoder is used to encode the input sequence and extract feature representations. The encoder consists of multiple identical encoder layers, each containing a multi-head self-attention mechanism and a feedforward neural network. Each attention module learns to focus on information at different positions in the sequence, and finally, a weighted sum is used to obtain the final self-attention representation. The feedforward neural network performs nonlinear mapping and feature extraction on the output of the self-attention layer.

[0042] Furthermore, in step 3, when constructing the Transformer-based sequence model, it is necessary to handle sequence features of length 512 that exceed the optimal capacity of the Transformer model. The handling method is as follows:

[0043] First, actions involving continuous repetition are reduced to only one instance. Then, the first k occurrences of each call are retained, starting from the midpoint of the sequence. The sequence length can be flexibly adjusted by changing the value of k to meet the requirements of the detection model.

[0044] Furthermore, the specific steps for evaluating the effectiveness of the interpreter in step 5 are as follows:

[0045] Step 5.1, consider a value represented as x. i For applications belonging to category c (benign or malicious) of sequence features, the most critical behavioral segment is represented by I. i This represents the corresponding interpretation of the interpreter;

[0046] Step 5.2, when x i Remove this explanation I i When, it can be represented as The modified sequence features;

[0047] Step 5.3: The modified sequence features are fed into the trained Transformer-based sequence model, resulting in new predicted values ​​represented as...

[0048] Step 5.4, change this value Compared with the original sequence feature x i The predicted value y c In parallel, the degree of change in this predicted value can be used as an indicator to evaluate the explanatory power; therefore, the formula for calculating the power is as follows:

[0049]

[0050] Where y c and For the model prediction corresponding to category c, E i The greater the magnitude of the change, the greater the impact of the interpretation results on the APP classification.

[0051] Furthermore, step 6 uses LIME as a benchmark method to evaluate the effectiveness of the XDeelMal detection results in step 4. The specific method is as follows:

[0052] Step 6.1: Select the largest absolute weight value, denoted as w, for the LIME interpretation result of each application in the test set;

[0053] Step 6.2: Adjust the threshold ratio Tr∈(-100%,100%) to generate the threshold T=Tr×w;

[0054] In step 6.3, LIME interpretation results below the threshold T indicate contributions to the prediction of a malicious category, while results above the threshold T indicate contributions to the prediction of a benign category.

[0055] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0056] (1) This invention achieves a balance between maintaining a satisfactory measure of validity and a reasonable length of explanation. This balance results in more concise and reliable explanations, thereby improving the overall interpretability of the model.

[0057] (2) The XDeepMal interpretation framework of the present invention can dynamically model the continuous behavioral trajectory of the application and combine feature ablation analysis and genetic algorithm to obtain the best behavioral fragments, providing a reliable interpretation for the decision-making of deep learning malware detection models.

[0058] (3) The present invention constructs a novel dynamic analysis tool, XTracer+, which can capture the continuous runtime behavior trajectory displayed by the application.

[0059] (4) This invention proposes a novel interpreter for accurately locating key parts of the trajectory of malware detected by a deep learning model. Attached Figure Description

[0060] Figure 1This is a comprehensive overview diagram of the XDeepMal invention.

[0061] Figure 2 Flowchart of the XTracer+ constructed for this invention

[0062] Figure 3 This is a schematic diagram comparing the effects of the present invention and existing technologies. Detailed Implementation

[0063] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0064] like Figure 1 As shown, the present invention provides an interpretation and evaluation method for a deep learning-based malware detection model, comprising the following steps:

[0065] Step 1: Collect a large number of applications from multiple sources to build a dataset;

[0066] Step 2: Use XTracer+'s dynamic analysis tools to capture the dynamic behavior trajectory of each application, such as... Figure 2 The specific process shown is as follows:

[0067] Step 2.1: Connect the host and Android emulator via Android Debug Bridge, and use Android Asset Packaging Tool to parse the APK file and obtain specific information;

[0068] Step 2.2: Use the adb command to install the APK file in the Android emulator, and then start the APK file using the obtained main function name;

[0069] Step 2.3: Start the frida-server service on the Android emulator and deploy Frida scripts to monitor critical behaviors of the target application;

[0070] Step 2.4: Execute Maxim, a high-performance Android Monkey tool based on traversal rules, to automatically generate a large number of trigger events to improve execution path coverage;

[0071] Step 2.5: Maintain synchronization with Maxim and record the triggering threads and sequences of important behaviors being tracked to generate behavioral trajectories;

[0072] Step 2.6: Uninstall the target application and remove its running traces;

[0073] Step 3: Construct a Transformer-based sequence model for detecting malware, the Transformer-based sequence model including a Transformer encoder and an enhanced MLPHead;

[0074] Step 4: Use an interpreter based on heuristic algorithms to determine the most critical behavioral segments. The specific determination process is as follows:

[0075] First, the preprocessed behavioral sequence of the application is sent to a trained Transformer-based sequence model for malware detection, as follows:

[0076] y = f(A)

[0077] Where f represents a detection model that takes a sequence as input and generates classification predictions for a given application; A is the input sequence, and y is the prediction score;

[0078] Then, let's assume A first. s It is a random subsequence of the input sequence A; ablate A from A. s The elements are then processed, and the ablated sequence is passed to the model to obtain the affected prediction score y. s :

[0079] y s =f(AA) s )

[0080] Where A s The evaluation function for ablation effect is as follows:

[0081] g(A s )=yy s

[0082] Next, regarding A s By imposing a constraint on the length of , the following objective function is formed:

[0083]

[0084]

[0085] Where C represents A s The length ratio to A should be lower than a certain threshold requirement;

[0086] To reduce the complexity of the algorithm, the constrained problem is transformed into an unconstrained problem by using a fixed Lagrange multiplier λ to maximize the Lagrange function.

[0087]

[0088] Identify the subsequences of behavioral trajectories that have the most significant impact on model predictions.

[0089] In this embodiment, when constructing the Transformer-based sequence model in step 3, it is necessary to process sequence features of length 512 that exceed the optimal capacity of the Transformer model. The processing method is as follows:

[0090] First, we reduce the number of consecutively repeated actions to only one, and then retain the first k occurrences of each call, starting from the midpoint of the sequence. By adjusting the value of k, we can flexibly adjust the sequence length to meet the requirements of the detection model.

[0091] The deep learning-based malicious behavior detection method in this embodiment further includes step 5, evaluating the effectiveness of the interpretation method, the specific steps of which are as follows:

[0092] Step 5.1, consider a value represented as x. i For applications with sequence features belonging to category c, the most critical behavioral segment is represented as I. i This represents the corresponding interpretation of the interpreter; category c includes benign and malicious.

[0093] Step 5.2, when x i Remove this explanation I i When, it can be represented as Modified sequence features;

[0094] Step 5.3: The modified sequence features are fed into the trained Transformer-based sequence model, resulting in new predicted values ​​represented as...

[0095] Step 5.4, change this value Compared with the original sequence feature x i The predicted value y c In parallel, the degree of change in this predicted value is used as an indicator to evaluate the explanatory power;

[0096] Therefore, the formula for calculating effectiveness is as follows:

[0097]

[0098] Where y c and For the model prediction corresponding to category c, E i The greater the magnitude of the change, the greater the impact of the interpretation results on the APP classification.

[0099] The deep learning-based malicious behavior detection method in this embodiment further includes step 6, which uses LIME as a benchmark method to evaluate the effectiveness of the XDeelMal detection results in step 4. The specific method is as follows:

[0100] Step 6.1: Select the largest absolute weight value, denoted as w, for the LIME interpretation result of each application in the test set;

[0101] Step 6.2: Adjust the threshold ratio Tr∈(-100%,100%) to generate the threshold T=Tr×w;

[0102] In step 6.3, LIME interpretation results below the threshold T indicate contributions to the prediction of a malicious category, while results above the threshold T indicate contributions to the prediction of a benign category.

[0103] like Figure 3 As shown, the effectiveness of the method of the present invention is compared with that of the prior art (LIME) on all samples of the test set. Figure 3 The horizontal axis represents the effectiveness of the explanation results, and the vertical axis represents the number of samples that achieve different levels of effectiveness. Comparing the explanation results of LIME at different thresholds, the XDeepMal framework of this invention achieves better explanation effectiveness on a larger number of samples. Furthermore, the explanation results of both technologies were evaluated from multiple perspectives. The evaluation results show that, at different thresholds, the existing LIME technology has different average explanation result lengths. Increasing the threshold to improve effectiveness in the existing LIME technology increases the average explanation result length, leading to a decrease in the readability of the explanation results. The XDeepMal framework of this invention, however, achieves good effectiveness while maintaining a shorter average explanation result length. Compared to LIME, the explanation results of the XDeepMal framework of this invention have strong reliability on most samples, and with shorter explanation results, it achieves high effectiveness on most samples.

[0104] As demonstrated by the results of the above embodiments, the XDeepMal scheme of this invention can generate more convincing explanations for deep learning-based models (such as Transformer), which will greatly help security analysts accurately understand why an application is identified as malware by a deep learning detection model. This invention proposes a new framework, XDeepMal, for interpreting deep learning-based malware detection models, and then builds a dynamic analysis tool, XTracer+, to capture the runtime behavior of applications and automatically generate their continuous behavioral trajectories. A novel sequence reduction strategy is used to handle the sequence features of 512 labeled elements, exceeding the optimal capacity of the Transformer model. Finally, to improve the detection accuracy and performance of this invention, a new interpretation method is proposed to determine the exact behavioral segments that are crucial for the deep learning model's decision-making. The identification of the most critical segments is treated as an optimization problem and implemented using heuristic algorithms.

Claims

1. An interpretation and evaluation method for a deep learning-based malware detection model, characterized in that, Includes the following steps, Step 1: Collect a large number of applications from multiple sources to build a dataset; Step 2: Use XTracer+'s dynamic analysis tools to capture the dynamic behavior trajectory of each application. The specific process is as follows: Step 2.1: Connect the host and Android emulator via Android Debug Bridge, and use AndroidAsset Packaging Tool to parse the APK file and obtain specific information; Step 2.2: Use the adb command to install the APK file in the Android emulator, and then start the APK file using the obtained main function name; Step 2.3: Start the frida-server service on the Android emulator and deploy Frida scripts to monitor critical behaviors of the target application; Step 2.4: Execute Maxim, a high-performance Android Monkey tool based on traversal rules, to automatically generate a large number of trigger events to improve execution path coverage; Step 2.5: Maintain synchronization with Maxim and record the triggering threads and sequences of important behaviors being tracked to generate behavioral trajectories; Step 2.6: Uninstall the target application and remove its running traces; Step 3: Construct a Transformer-based sequence model for detecting malware, the Transformer-based sequence model including a Transformer encoder and an enhanced MLPHead; Step 4: Use an interpreter based on heuristic algorithms to determine the most critical behavioral segments. The specific determination process is as follows: First, the preprocessed behavioral sequence of the application is sent to a trained Transformer-based sequence model for malware detection, as follows: y = f(A) Where f represents a detection model that takes a sequence as input and generates classification predictions for a given application; A is the input sequence, and y is the prediction score; Then, let's assume A first. s It is a random subsequence of the input sequence A; ablate A from A. s The elements are then processed, and the ablated sequence is passed to the model to obtain the affected prediction score y. s : y s =f(A-A s ) Where A s The evaluation function for ablation effect is as follows: g(A s )=yy s Next, regarding A s By imposing a constraint on the length of , the following objective function is formed: Where C represents A s The length ratio to A should be lower than a certain threshold requirement; To reduce the complexity of the algorithm, the constrained problem is transformed into an unconstrained problem by using a fixed Lagrange multiplier λ to maximize the Lagrange function. Identify the subsequences of behavioral trajectories that have the most significant impact on model predictions; Step 5: Evaluate the effectiveness of the interpreter; Step 6: Use LIME as a benchmark method to evaluate the effectiveness of XDeelMal.

2. The interpretation and evaluation method for the deep learning-based malware detection model according to claim 1, characterized in that, The XTracer+ dynamic analysis tool in step 2 includes: a) A Frida-based analytics engine used to inject JavaScript into target applications to monitor their behavior; b) Use Python scripts to automate tasks, integrate with Frida, execute specific Hook operations, and process data collected from the target application; c) Use Maxim to automatically generate a large number of trigger events for in-depth testing of the application.

3. The interpretation and evaluation method for the deep learning-based malware detection model according to claim 1, characterized in that, In step 3, the Transformer-based sequence model is based on a Transformer network. The Decoder of the Transformer network is replaced with an MLP to form an enhanced MLPHead, which transforms the sequence that should be output into a classification detection result. That is, the enhanced MLPHead performs classification operations at the top of the model and is used to perform further processing on the feature representation after passing through the Transformer encoder. The enhanced MLPHead introduces residual channels to enhance the model's modeling of nonlinear relationships and adds the output of the MLP to the original input. The encoder encodes the input sequence and extracts feature representations. The encoder consists of multiple identical encoder layers, each of which contains two sub-layers: a multi-head self-attention mechanism and a feedforward neural network.

4. The interpretation and evaluation method for the deep learning-based malware detection model according to claim 3, characterized in that, When constructing a Transformer-based sequence model, it is necessary to handle sequence features of length 512 that exceed the optimal capacity of the Transformer model. The handling method is as follows: First, actions involving continuous repetition are reduced to only one occurrence. Then, the first k occurrences of each call are retained, starting from the midpoint of the sequence. The sequence length is adjusted by changing the value of k to meet the requirements of the detection model.

5. The interpretation and evaluation method for the deep learning-based malware detection model according to claim 1, characterized in that, The specific steps for evaluating the effectiveness of the interpreter in step 5 are as follows: Step 5.1, consider a value represented as x. i For applications with sequence features belonging to category c, the most critical behavioral segment is represented as I. i This represents the corresponding interpretation of the interpreter; category c includes benign and malicious. Step 5.2, when x i Remove this explanation I i When, it can be represented as Modified sequence features; Step 5.3: The modified sequence features are fed into the trained Transformer-based sequence model, resulting in new predicted values ​​represented as... Step 5.4, change this value Compared with the original sequence feature x i The predicted value y c In parallel, the degree of change in this predicted value is used as an indicator to evaluate the explanatory power; Therefore, the formula for calculating effectiveness is as follows: Where y c and For the model prediction corresponding to category c, E i The greater the magnitude of the change, the greater the impact of the interpretation results on the APP classification.

6. The interpretation and evaluation method for the deep learning-based malware detection model according to claim 1, characterized in that, Step 6 uses LIME as a benchmark method to evaluate the validity of the XDeelMal detection results in step 4. The specific method is as follows: Step 6.1: Select the largest absolute weight value, denoted as w, for the LIME interpretation result of each application in the test set; Step 6.2: Adjust the threshold ratio Tr∈(-100%,100%) to generate the threshold T=Tr×w; In step 6.3, LIME interpretation results below the threshold T indicate contributions to the prediction of a malicious category, while results above the threshold T indicate contributions to the prediction of a benign category.

Images