An Android malicious application detection method based on feature affinity value analysis

Abstract

The application discloses an Android malicious application detection method based on feature closeness value analysis, which comprises the following steps: firstly, using Androguard to perform decompilation and feature extraction on an Android application to generate a feature matrix; then, using frequent pattern growth to analyze feature correlation to obtain a frequent pattern growth score of each feature; using a Pearson coefficient to mine feature correlation to obtain a Pearson coefficient score of each feature of a sample application; finally, defining a feature closeness value and performing vectorization representation, using feature closeness value analysis, and combining a multilayer perceptron to generate an Android malicious application detection model. The application uses frequent pattern growth and a Pearson coefficient to mine Android application feature correlation, improves the malicious detection effect of the model, the feature closeness value further improves the explanation quality of the model on the basis of ensuring the Android malicious detection effect, and the multilayer perceptron improves the nonlinear capability of the model and improves the effect of the model on a large amount of data sets.

Description

Technical Field

[0001] This invention belongs to the field of Android malicious application detection technology, and in particular relates to an Android malicious application detection method based on feature affinity value analysis. Background Technology

[0002] In the field of Android malicious application detection, the accuracy of model detection has always been a crucial standard, with many existing methods claiming an accuracy of around 99%. However, on the one hand, an improvement from 97% to 99% may not have sufficient practical significance. This is because in real-world Android application warning scenarios, "false negatives" (benign applications being mistakenly identified as malicious) are tolerable, while "false positives" (malicious applications being mistakenly identified as benign) can pose significant security risks. On the other hand, different malware families and datasets can both influence the final malware detection results. Furthermore, with the development of interpretability, model interpretability is increasingly valued. In the Android domain, feature extraction is a critical step, and some extracted features inherently possess a degree of interpretability. For example, `Landroid / telephony / gsm / SmsManager; -> sendTextMessage` generally represents the operation of sending a text message, corresponding to the hidden malicious behavior of "an attacker potentially causing the user to send expensive, paid text messages." Therefore, the analysis of static features such as permissions and APIs is necessary. Summary of the Invention

[0003] The purpose of this invention is to solve the problems mentioned in the background art above, and to propose a static analysis method based on feature affinity value. This method combines frequent pattern growth and Pearson coefficient definition and calculation of feature affinity value, and combines multilayer perceptron to generate the final malicious detection model, thus taking into account both malicious detection effect and behavior interpretation quality.

[0004] To achieve the objective of this invention, a method for detecting malicious Android applications based on feature affinity value analysis is disclosed, comprising the following steps:

[0005] Step 1: Extract features from the Android application and generate a feature matrix;

[0006] Step 2: Perform feature association analysis using frequent pattern growth to obtain the frequent pattern growth score for each feature;

[0007] Step 3: Use the Pearson coefficient to mine feature associations and obtain the Pearson coefficient score for each feature applied to the sample.

[0008] Step 4: Define the feature affinity value and represent it in a vectorized form;

[0009] Step 5: Use feature affinity analysis and combine it with a multilayer perceptron to generate an Android malicious application detection model.

[0010] Furthermore, in step 1, the Android application is decompiled and its features are extracted using Androguard to generate a feature matrix for subsequent feature affinity calculation.

[0011] Furthermore, step 2 specifically includes the following steps:

[0012] Step 2-1: Define an FP-Tree. Sort the transaction data items in the transaction data table according to their support, and then insert the data items in each transaction into a tree with NULL as the root node in descending order. At the same time, record the support of the node at each node. Define a conditional pattern base, which contains the set of prefix paths that appear together with the suffix pattern in the FP-Tree. Define an FP-conditional tree, which is a new FP-Tree formed by the conditional pattern base according to the construction principles of the FP-Tree.

[0013] Step 2-2: Define Support. Support is a metric used to measure the frequency of an itemset in a dataset. For an itemset X, support represents the proportion of transactions containing X out of the total number of transactions. The formula for calculating the support of itemset X for itemset Y is:

[0014]

[0015] Steps 2-3: Calculate frequent itemsets. First, the support of each item needs to be calculated. To build the FP-tree, the original dataset needs to be scanned twice. In the first scan, the occurrence frequency of all items is counted, and infrequent items with support less than the threshold are discarded to obtain frequent itemsets. The frequent itemsets are then sorted in descending order of support. The minimum support is set to 3, thus obtaining the item header table sorted in descending order with a minimum support of 3. In the second scan, the FP-tree is built, starting from an empty set, and each transaction in the sorted frequent itemsets is read in sequence. If an existing element already exists in the tree, its value is incremented; if the existing element does not exist, a branch is added to the tree. Finally, the FP-tree is recursively mined to obtain the frequent itemsets.

[0016] Steps 2-4: Based on the frequent itemsets, derive the frequent pattern growth score of each feature applied to the sample, which is then used to calculate the feature affinity value.

[0017] Furthermore, step 3 specifically includes the following steps:

[0018] Step 3-1: Perform feature correlation analysis using the Pearson coefficient. Let the feature set be F, and for the feature x of the i-th sample... i With feature y i Let their means be respectively and Next, the difference between each data point and the mean is calculated, and then the square of the product of these differences is calculated. The final Pearson coefficient is then calculated using the square of the differences. The specific calculation formula is as follows:

[0019]

[0020] Step 3-2: Obtain the Pearson vector based on the Android feature set, denoted as P. For the i-th feature, Pi represents the list of Pearson coefficients for the i-th feature, and the j-th item represents the degree of correlation between the i-th feature and the j-th feature, with the specific score falling within the interval [-1, 1]. 1 indicates perfect positive correlation, -1 indicates perfect negative correlation, and 0 indicates no correlation. By sorting the scores in descending order, we can obtain the list of features most relevant to each feature.

[0021] Step 3-3: Using the feature list sorted in descending order, normalize to obtain the Pearson coefficient score for each feature applied to the sample.

[0022] Furthermore, step 4 specifically includes the following steps:

[0023] Step 4-1: Normalized representation of feature correlation scores. Let the feature set be F, and let the frequent pattern growth score of feature A and feature B be y1. Then let x1 be the frequent pattern growth score of itemset (A,B). The calculation method is as follows:

[0024]

[0025]

[0026] Where N represents the number of elements in the frequent itemset, the support value represents the confidence of the frequent itemset, and y represents the final normalized score of the frequent pattern growth, where max(X1) represents the maximum value among all frequent pattern growth scores, which will be used to calculate the feature affinity value.

[0027] Step 4-2: Pearson coefficient normalization. Let the feature set be F, and let the frequent pattern growth score of feature A and feature B be y2. The calculation method is as follows:

[0028]

[0029] Where ρ is the Pearson coefficient value, and max(Y2) represents the maximum value among all Pearson coefficients. Experimental results show that this value is never negative, so there is no need to take the absolute value.

[0030] Step 4-3: Calculate the malicious frequency value. For itemsets (A, B), calculate the probability that a sample behaves maliciously when they appear together, and let this be the risk score y3. Then, for a sample set with N samples, the final score y3 for itemset (A, B) is calculated as follows.

[0031]

[0032] Where P(A) represents the label value of the sample when feature A is 1; if the sample is benign, P(A) is 0, otherwise it is 1. Furthermore, for the three scores y1, y2, and y3, the frequency formulas are as follows:

[0033]

[0034] Where freq represents the frequency of feature occurrence;

[0035] Step 4-4: Calculate the final feature affinity value. For feature A, its feature affinity value is defined as y, and the calculation formula is as follows:

[0036] y(A)=K×(y1(A)+y2(A))+(1-K)×y3(A)

[0037] Where K is the offset value, and the value is located in the interval [0,1].

[0038] Furthermore, step 5 specifically includes the following steps:

[0039] Step 5-1: Data preprocessing. Let the feature matrix be M, and the vector calculated based on the feature affinity value be V. Multiply the affinity value corresponding to each feature in V with the sample feature value. Then, the final matrix elements still fall within the interval [0,1], and the number of 0s after adjustment is greater than or equal to the number of 0s before adjustment. For the j-th feature of the i-th sample, the specific calculation formula for the value f is as follows:

[0040] f ij =M ij ×V j

[0041] Step 5-2: Normalization. The StandardScaler method is used to normalize matrix M. Let mean(M) be the mean of each column of the matrix, and std(M) be the standard deviation of each column. The normalization calculation is as follows:

[0042]

[0043] Step 5-3: The activation function introduces non-linearity, enabling the neural network to learn and represent more complex features; the activation function used is the ReLU function.

[0044] f(x) = max(0,x)

[0045] Step 5-4: In the field of Android malware detection, since the final output is a binary label, it is considered a binary classification problem, and the Binary Crossentropy loss function is chosen.

[0046]

[0047] Step 5-5: Use the Adam optimizer to train the model and finally obtain a malicious detection model based on a multilayer perceptron.

[0048] Compared with the prior art, the significant advancements of this invention are: 1) It uses frequent pattern growth and Pearson coefficient to mine the correlation between Android application features, thereby improving the model's malicious detection performance; 2) It defines a feature affinity value, which further improves the model's interpretation quality while ensuring the Android malicious detection performance; 3) It uses a multilayer perceptron to enhance the model's nonlinearity and improve its performance on large datasets.

[0049] To more clearly illustrate the functional characteristics and structural parameters of the present invention, further explanation is provided below in conjunction with the accompanying drawings and specific embodiments. Attached Figure Description

[0050] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0051] Figure 1 This is a schematic diagram of the overall model in an embodiment of the present invention;

[0052] Figure 2 This is a schematic diagram illustrating the principle of frequent pattern growth in an embodiment of the present invention;

[0053] Figure 3 This is a schematic diagram of a multilayer perceptron in an embodiment of the present invention. Detailed Implementation

[0054] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] A method for detecting malicious Android applications based on feature affinity value analysis includes the following steps:

[0056] Step (1): Use permissions and APIs to extract features and provide data support for subsequent feature analysis.

[0057] Step (2): Use frequent pattern growth to perform feature correlation analysis, laying the foundation for feature affinity calculation.

[0058] Step (3): Use Pearson coefficients to perform feature correlation analysis, laying the foundation for feature affinity calculation.

[0059] Step (4): Propose a vectorized representation method for feature affinity values ​​to provide theoretical guidance for model generation.

[0060] Step (5): Use feature affinity analysis and combine it with a multilayer perceptron to generate an Android malicious application detection model.

[0061] Specifically, step (1) uses Androguard to decompile and extract features from Android applications, including the following steps:

[0062] AndroGuard is used for feature extraction. For an Android application, the first step is reverse engineering, typically achieved using a JAR file called apktool. The decompiled APK file includes AndroidManifest.xml, smali files, etc. Next, program analysis scans this content, manually extracting intents, activities, permissions, API calls, etc., ultimately achieving complete feature engineering. AndroGuard integrates and separates this process, meaning that you can freely obtain the APK's internal information, including intents, activities, permissions, and function calls, by calling the corresponding functions.

[0063] Permissions and API calls are among the most common features in the detection of malicious Android applications. These features can be used to infer the possible behaviors and intentions of an Android application.

[0064] All permissions listed here are from the official Android documentation, so their specific meanings can be found there. Generally, official Android permissions can be categorized into location permissions, network permissions, storage permissions, phone and communication permissions, camera and audio permissions, device hardware permissions, and system utility permissions. Function calls involve sensitive content such as system permissions and network connections.

[0065] This step ultimately generates a feature matrix, which is used for subsequent feature affinity value calculation.

[0066] Specifically, step (2) uses frequent pattern growth to perform feature association analysis, including the following steps:

[0067] (21) Define an FP-Tree: After sorting the transaction data items in the transaction data table according to their support, insert the data items in each transaction into a tree with NULL as the root node in descending order, and record the support of each node. Define a conditional pattern base: Contains the set of prefix paths that appear together with the suffix pattern in the FP-Tree. Define an FP-conditional tree: A new FP-Tree formed by constructing the conditional pattern base according to the construction principles of the FP-Tree.

[0068] (22) Define Support. Support is a metric used to measure the frequency of an itemset's occurrence in a dataset. Specifically, for an itemset X, the support of itemset X for itemset Y is calculated using the following formula: Support Calculation Formula:

[0069]

[0070] (23) Calculate frequent itemsets. First, the support of each item needs to be calculated. To build the FP-tree, the original dataset needs to be scanned twice. In the first scan, the occurrence frequency of all items is counted, and infrequent items with support less than the threshold are discarded to obtain frequent itemsets. The frequent itemsets are then sorted in descending order of support. The minimum support is set to 3, thus obtaining the item header table sorted in descending order with a minimum support of 3. In the second scan, the FP-tree is constructed. Starting from the empty set, each transaction in the sorted frequent itemsets is read in sequence. If an existing element already exists in the tree, its value is incremented; if the existing element does not exist, a branch is added to the tree. Finally, the FP-tree is recursively mined to obtain the frequent itemsets.

[0071] (24) Finally, based on the frequent itemsets, the frequent pattern growth score of each feature applied to the sample is obtained, which is used to calculate the feature affinity value in the future.

[0072] Specifically, step (3) uses the Pearson coefficient to mine feature associations, including the following steps:

[0073] (31) Use Pearson coefficients for feature correlation analysis. Let the feature set be F. For the feature x of the i-th sample... i With feature y i Let their means be respectively and Next, the difference between each data point and the mean is calculated, and then the square of the product of these differences is calculated. The final Pearson coefficient is then calculated using the square of the differences. The specific calculation formula is as follows:

[0074]

[0075] (32) Obtain the Pearson vector based on the Android feature set, denoted as P. For the i-th feature, Pi represents the list of Pearson coefficients for the i-th feature, and the j-th item represents the degree of correlation between the i-th and j-th features, with the specific score falling within the interval [-1, 1]. 1 indicates perfect positive correlation, -1 indicates perfect negative correlation, and 0 indicates no correlation. By sorting the scores in descending order, a list of features most relevant to each feature can be obtained.

[0076] (33) Using the feature list sorted in descending order, normalize to obtain the Pearson coefficient score of each feature applied to the sample, which is then used to calculate the feature affinity value.

[0077] Specifically, step (4) defines the feature affinity value and performs a vectorized representation, including the following steps:

[0078] (41) Normalized representation of feature affinity score. Let the feature set be F, and let the frequent pattern growth score of feature A and feature B be y1. Then let x1 be the frequent pattern growth score of itemset (A,B). The calculation method is shown below, where N represents the number of elements in the frequent itemset, and the support value represents the confidence of the frequent itemset. y represents the final normalized score of frequent pattern growth, where max(X1) represents the maximum value among all frequent pattern growth scores, which will be used to calculate the feature affinity value.

[0079]

[0080]

[0081] (42) Pearson coefficient normalization: Let the feature set be F, and let the frequent pattern growth score of feature A and feature B be y2. The calculation method is as follows, where ρ is the Pearson coefficient value, and max(Y2) represents the maximum value among all Pearson coefficients. Experimental results show that this value is never negative, so there is no need to take the absolute value.

[0082]

[0083] (43) Calculate the frequency of malice. For itemset (A,B), calculate the probability that a sample is malicious when they appear together, denoted as risk score y3. For a sample set with N samples, the final score y3 for itemset (A,B) is calculated as follows, where P(A) represents the label value of the sample when feature A is 1. If the sample is benign, P(A) is 0; otherwise, it is 1. Furthermore, for the three scores y1, y2, and y3, the frequency formulas are as follows, where freq is the frequency of feature occurrence.

[0084]

[0085]

[0086] (44) Calculate the final feature affinity value. For feature A, its feature affinity value is defined as y, and the calculation formula is shown below, where K is the offset value, which is located in the interval [0,1]. When K approaches 0, it means that the experimental results focus more on the accuracy of the model. When K approaches 1, it means that the experimental results focus more on the feature correlation. Therefore, it is necessary to find the optimal K value, i.e., the optimal feature affinity value, in the experimental process so that the final malicious detection result takes into account both feature correlation and model accuracy. This calculation method provides theoretical guidance for the generation of the final Android malicious application detection model.

[0087] y(A)=K×(y1(A)+y2(A))+(1-K)×y3(A)

[0088] Specifically, step (5) generates a malicious detection model based on feature affinity analysis and multilayer perceptron, including the following steps:

[0089] (51) Data Preprocessing. Let the feature matrix be M, and the vector calculated based on the feature affinity value be V. There are two basic schemes for adjusting M. One is to stack V sequentially on matrix M, which means that the matrix with original values ​​of 0 or 1 will fall into the interval [0,2], and a large number of 0s will be eliminated. The second method is to multiply the affinity value corresponding to each feature in V with the sample feature value. Then the final matrix elements still fall into the interval [0,1], and the number of 0s after adjustment is greater than or equal to the number of 0s before adjustment. However, considering the actual meaning of the input, if the value that was originally 0 approaches 1 due to the strong feature correlation, it means that a certain feature has been "faked". Therefore, the second method is still considered here. For the j-th feature of the i-th sample, the specific calculation formula for the value f is as follows:

[0090] f ij =M ij ×V j

[0091] (52) Normalization. The StandardScaler method is used to normalize matrix M. Let mean(M) be the mean of each column of the matrix, and std(M) be the standard deviation of each column. The normalization calculation is as follows:

[0092]

[0093] (53) Activation functions introduce non-linearity, enabling neural networks to learn and represent more complex features. Neural networks without activation functions are essentially performing linear transformations; multiple linear transformations superimposed remain linear, failing to leverage the powerful expressive capabilities of neural networks. The activation function used is the ReLU function:

[0094] f(x) = max(0,x)

[0095] (54) In the field of Android malware detection, since the final output is a binary label, it can be considered a binary classification problem. For binary classification problems, the Binary Crossentropy loss function is usually chosen:

[0096]

[0097] (55) The Adam optimizer was used to train the model, and finally a malicious detection model based on multilayer perceptron was obtained.

[0098] Example

[0099] 1. Experimental Environment Preparation: The processor used in the experiment is an AMD Ryzen 55600G with Radeon Graphics@3.90GHz, and the memory is 32GB. The experiment involves several Python libraries, such as the Androguard library and the sklearn library. The former can be used for Android application analysis, easily extracting Android activities, intents, permissions, API calls, and simple function control graphs, while the latter is a feature-rich machine learning library that provides wrapper functions for many common machine learning models.

[0100] 2. Dataset Preparation: The dataset includes 1872 benign samples and 1020 malicious samples. The benign samples primarily come from the Androzoo dataset, a database containing approximately 3 million Android applications. These applications mainly originate from the Google Play Store and other data sources, and primarily contain the SHA code information of the Android applications. After obtaining an API key from Androzoo, the application can be downloaded using the API key. The malicious samples mainly come from the Androzoo dataset, the Drebin dataset, and the Virusshare dataset. Drebin is one of the most classic methods for analyzing Android malicious applications, providing a large number of Android malicious application samples, some of which contain Android malware family tags. The Virusshare dataset specifically provides information on Android malicious applications, including but not limited to internet capture, sandbox analysis, and malware submissions.

[0101] 3. Overall Model Principles: such as Figure 1As shown, in the first stage, feature correlation scores are calculated using frequent pattern growth and Pearson coefficients, followed by normalization to calculate feature affinity values, which are then vectorized. In the second stage, the feature matrix extracted from the combined features is input into the input layer of a multilayer perceptron, and parameters such as hidden layer weights, activation functions, and loss functions are set for training the multilayer perceptron. In the third stage, binary labels for Android malware detection are obtained, which, combined with LIME and SHAP, can be used to interpret malicious Android behavior.

[0102] 4. Description of Key Technologies:

[0103] S1: Frequent Growth Pattern: The frequent growth pattern process is as follows... Figure 2 As shown. Suppose the feature set contains elements {AN}. Each element in the set represents a feature. For example, element A represents the feature android.permission.BLUETOOTH, that is, {A→android.permission.BLUETOOTH}.

[0104] The initial dataset is shown in the table below:

[0105]

[0106] First, the support of each item needs to be calculated. To construct the FP-tree, the original dataset needs to be scanned twice. In the first pass, the occurrence frequency of all items is counted, and infrequent items with support less than a threshold are discarded to obtain the frequent itemset. The frequent itemset is then sorted in descending order of support. As shown in Table 4.4, the item header table sorted in descending order is obtained when the minimum support is 3.

[0107] During the second scan, an FP-tree is constructed. Starting from the empty set, transactions from the sorted frequent itemsets are read sequentially. If an existing element already exists in the tree, its value is incremented; otherwise, a branch is added to the tree. The FP-tree generated by the second scan has an empty root node, representing the empty set. Under the root node are three directly connected nodes: B, G, and F, representing itemsets {B}, {G}, and {F}, respectively. Under node B are two directly connected nodes: G and A, representing itemsets {B,G} and {B,A}, respectively. Under node G is one directly connected node: F, representing itemset {B,G,F}. Under node F are two directly connected nodes: K and M, representing itemsets {B,G,F,K} and {B,G,F,M}, respectively. Under node K is one directly connected node: L, representing itemset {B,G,F,K,L}. Under node M is also one directly connected node: L, representing itemset {B,G,F,M,L}. Under node A, there is a directly connected node F, representing the itemset {B, G, A, F}. This tree structure implicitly represents the inclusion relationship between itemsets through the connections between nodes, and each path in the tree represents a frequent itemset.

[0108] Next, we recursively mine the FP-tree. For example, mining based on B, we construct the conditional pattern base: {A:3,G:4,F:3,K:3,L:3,M:3}; mining based on A, we construct the conditional pattern base: {G:2,F:1,K:2,L:1,M:2}. Finally, after the recursion is complete, we obtain all frequent itemsets. The table below lists all frequent itemsets with 3 or more elements.

[0109]

[0110] S2: Multilayer Perceptron Module: The schematic diagram of the multilayer perceptron is shown below. Figure 3 As shown, the feature matrix obtained by vector and feature extraction engineering based on feature affinity analysis is used as the input layer. By reasonably setting the activation function, adjusting the optimizer and loss function, and analyzing features such as permissions and API call sequences of Android applications in detail, the final binary classification model is obtained.

[0111] The specific steps are as follows:

[0112] (1) Let the feature matrix be M, and the vector calculated based on the feature affinity value be V. There are two basic schemes for adjusting M. One is to stack V sequentially on matrix M, which means that the matrix with the original value of 0 or 1 will fall into the interval [0,2], and a large number of 0s will be eliminated. The second method is to multiply the affinity value corresponding to each feature in V with the sample feature value. Then the final matrix elements still fall into the interval [0,1], and the number of 0s after adjustment is greater than or equal to the number of 0s before adjustment. However, considering the actual meaning of the input, if the value that was originally 0 tends to 1 due to the strong feature correlation, it means that a certain feature has been "faked". Therefore, the second method is still considered here.

[0113] (2) The matrix M is normalized using the StandardScaler method.

[0114] (3) Use ReLU as the activation function to improve the nonlinearity of the model.

[0115] (4) Use binary cross-entropy as the loss function.

[0116] Model training is performed using the Adam optimizer.

[0117] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0118] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for detecting malicious Android applications based on feature affinity value analysis, characterized in that, Includes the following steps: Step 1: Extract features from the Android application and generate a feature matrix; Step 2: Perform feature association analysis using frequent pattern growth to obtain the frequent pattern growth score for each feature; Step 3: Use the Pearson coefficient to mine feature associations and obtain the Pearson coefficient score for each feature applied to the sample. Step 4: Define the feature affinity value and represent it in a vectorized form; Step 5: Use feature affinity analysis and combine it with a multilayer perceptron to generate an Android malicious application detection model; Step 4 specifically includes the following steps: Step 4-1: Normalized representation of feature correlation scores. Let the feature set be F, and let y1 be the frequent pattern growth score of feature A and feature B. Then let x1 be the frequent pattern growth score of itemset (A,B). The calculation method is as follows: Where N represents the number of elements in the frequent itemset, the support value represents the confidence of the frequent itemset, and y represents the final normalized score of the frequent pattern growth, where max(X1) represents the maximum value among all frequent pattern growth scores, which will be used to calculate the feature affinity value. Step 4-2: Pearson coefficient normalization. Let the feature set be F, and let the normalized Pearson coefficient scores of features A and B be y2. The calculation method is as follows: in Here, represents the Pearson coefficient value, and max(Y2) represents the maximum value among all Pearson coefficients. Experimental results show that this value is never negative, so there is no need to take the absolute value. Step 4-3: Calculate the malicious frequency value. For itemsets (A, B), calculate the probability that a sample behaves maliciously when they appear together, and let this probability be the risk score y3. Then, for a sample set with N samples, the final score y3 for itemsets (A, B) is calculated as follows. Where P(A) represents the label value of the sample when feature A is 1; if the sample is benign, P(A) is 0, otherwise it is 1. Furthermore, for the three scores y1, y2, and y3, the frequency formulas are as follows: Where freq represents the frequency of feature occurrence; Step 4-4: Calculate the final feature affinity value. For feature A, its feature affinity value is defined as y, and the calculation formula is as follows: Where K is the offset value, and the value is located in the interval [0,1].

2. The Android malicious application detection method based on feature affinity value analysis according to claim 1, characterized in that, In step 1, Androguard is used to decompile and extract features from the Android application, generating a feature matrix for subsequent feature affinity calculation.

3. The Android malicious application detection method based on feature affinity value analysis according to claim 1, characterized in that, Step 2 specifically includes the following steps: Step 2-1: Define an FP-Tree. Sort the transaction data items in the transaction data table according to their support, and then insert the data items in each transaction into a tree with NULL as the root node in descending order. At the same time, record the support of the node at each node. Define a conditional pattern base, which contains the set of prefix paths that appear together with the suffix pattern in the FP-Tree. Define an FP-conditional tree, which is a new FP-Tree formed by the conditional pattern base according to the construction principles of the FP-Tree. Step 2-2: Define Support. Support is a metric used to measure the frequency of an itemset in a dataset. For an itemset X, support represents the proportion of transactions containing X out of the total number of transactions. The formula for calculating the support of itemset X for itemset Y is: Steps 2-3: Calculate frequent itemsets. First, the support of each item needs to be calculated. To build the FP-tree, the original dataset needs to be scanned twice. In the first scan, the occurrence frequency of all items is counted, and infrequent items with support less than the threshold are discarded to obtain frequent itemsets. The frequent itemsets are then sorted in descending order of support. The minimum support is set to 3, thus obtaining the item header table sorted in descending order with a minimum support of 3. In the second scan, the FP-tree is built, starting from an empty set, and each transaction in the sorted frequent itemsets is read in sequence. If an existing element already exists in the tree, its value is incremented; if the existing element does not exist, a branch is added to the tree. Finally, the FP-tree is recursively mined to obtain the frequent itemsets. Steps 2-4: Based on the frequent itemsets, derive the frequent pattern growth score of each feature applied to the sample, which is then used to calculate the feature affinity value.

4. The Android malicious application detection method based on feature affinity value analysis according to claim 1, characterized in that, Step 3 specifically includes the following steps: Step 3-1: Perform feature correlation analysis using the Pearson coefficient. Let the feature set be F, and for the feature x of the i-th sample... i With feature y i Let their means be respectively and Next, the difference between each data point and the mean is calculated, and then the square of the product of these differences is calculated. The final Pearson coefficient is then calculated using the square of the differences. The specific calculation formula is as follows: Step 3-2: Obtain the Pearson vector based on the Android feature set, denoted as P. For the i-th feature, Pi represents the list of Pearson coefficients for the i-th feature, and the j-th item represents the degree of correlation between the i-th feature and the j-th feature, with the specific score falling within the interval [-1, 1]. 1 indicates perfect positive correlation, -1 indicates perfect negative correlation, and 0 indicates no correlation. By sorting the scores in descending order, obtain the list of features most relevant to each feature. Step 3-3: Using the feature list sorted in descending order, normalize to obtain the Pearson coefficient score for each feature applied to the sample.

5. The Android malicious application detection method based on feature affinity value analysis according to claim 1, characterized in that, Step 5 specifically includes the following steps: Step 5-1: Data preprocessing. Let the feature matrix be M, and the vector calculated based on the feature affinity value be V. Multiply the affinity value corresponding to each feature in V with the sample feature value. Then, the final matrix elements still fall within the interval [0,1], and the number of 0s after adjustment is greater than or equal to the number of 0s before adjustment. For the j-th feature of the i-th sample, the specific calculation formula for the value f is as follows: Step 5-2: Normalization. The StandardScaler method is used to normalize matrix M. Let mean(M) be the mean of each column of the matrix, and std(M) be the standard deviation of each column. The normalization calculation is as follows: Step 5-3: The activation function introduces non-linearity, enabling the neural network to learn and represent more complex features; the activation function used is the ReLU function. Step 5-4: In the field of Android malware detection, since the final output is a binary label, it is considered a binary classification problem, and the Binary Crossentropy loss function is chosen. Step 5-5: Use the Adam optimizer to train the model and finally obtain a malicious detection model based on a multilayer perceptron.

Images