An Android malware detection method based on multimodal feature fusion

Abstract

This patent proposes a method for detecting Android malware based on static detection of multimodal features in the field of mobile device security. While achieving malware detection, improvements are proposed to address the problem that traditional detection methods often rely on single modal features and the comprehensiveness of detection is limited. The solution mainly includes a data preprocessing module, a feature extraction module, a feature fusion module, and a final classification decision module. Specifically, it involves decompiling the original APK file, and then extracting visual image features, API sequence semantic features, and sensitive permission features. Through the feature fusion strategy, the features of the three modalities are integrated together as a unified representation of the original APK file, and detection is performed based on the fused features to identify whether the current application is malware. This patent can be used in the fields of mobile device security management, network security monitoring, and compliance risk control.

Description

[0001] This patent proposes an Android malware detection method based on multimodal feature fusion, which extracts visual image modal features and API sequence semantics from the original application file as text modal features, and uses permission features as supplementary modal features. The software is detected by fusing the features of the three modalities as the representation of the APK file of the original application file. Background Art

[0002] With the rapid development of mobile Internet communication technology and the significant improvement of hardware device performance, mobile devices and their applications have deeply penetrated into every aspect of our daily life. Among them, the Android operating system has occupied a vast market in the field of mobile device operating systems due to its open source nature and ease of use. However, a large number of users also means a large number of potential victims. Many attackers also target the Android operating system and develop malware to achieve the purpose of privacy theft, system damage, and fraud. Therefore, effective detection of malware on the Android operating system has become a focus of academic and industrial attention.

[0003] Malware detection technology based on static detection is a malware detection method that has received widespread attention. Different from dynamic detection methods, static detection does not require the actual execution of application files in a specific sandbox environment, which has more advantages in computing resources and time consumption, and also avoids triggering malicious behavior to cause damage to the analysis environment or system. In addition, during the static detection process, all codes and resources in the original file are analyzed, which can often focus on branch paths that may be difficult to trigger during actual execution, providing a more comprehensive perspective for application analysis.

[0004] The most basic static detection technology is to identify malicious applications by comparing the signatures (feature codes) of known malware. This method can quickly identify known malware, but it cannot accurately identify emerging malware or existing malware variants. At present, researchers often use decompilation technology to decompile the original APK file into a more readable file, and extract permission features, opcode features, API semantic features and visual image features from it through feature engineering, and combine machine learning technology to complete malware analysis. However, traditional static feature extraction methods often have shortcomings. For example, the visual image features of malware directly convert binary into grayscale images, which may cause the obtained visual images to contain a lot of noise information; API sequences are often obtained by dynamically executing APK, which requires a lot of time and computing resources. In addition, existing malware detection technologies often only focus on a certain static feature, which makes this type of detection method unable to utilize the complementarity of information between various modal features. Summary of the invention

[0005] This patent proposes an Android malware detection solution based on multimodal feature fusion to address the above core issues, aiming to solve the problem that the single-modal features used in general static detection methods cannot fully characterize the application file features. There are many kinds of static features that can be extracted from the original application files through feature engineering, and different static features consider different focuses. In terms of application permissions, malware often requests some uncommon or unnecessary permissions; in addition, malicious code fragments are different from normal software in program structure and functional blocks, which also causes it to show specific textures, shapes and styles in the visualized image. At the same time, the implementation of application functions depends on the calling relationship between the underlying APIs, and the API call sequence of malicious behavior is also significantly different from that of normal software. In summary, this patent intends to use the features of the three modes of permission features, the visual image features of the APK binary file, and the semantic features of the API call sequence as the basic single modality, and construct fusion features based on the three modalities for the final classification detection, and improve the accuracy and robustness of the final detection model by using the complementary information between various modalities. Aiming at the problem that traditional binary grayscale images have a large amount of irrelevant noise, a method of obtaining APK enhanced images is proposed, so that the APK files can be represented more comprehensively and accurately through RGB images; for the acquisition of API sequences, the method of obtaining API call sequences from function call graphs is adopted, thereby avoiding the large amount of computing resource overhead of dynamic execution methods.

[0006] The overall structure of the Android malware detection method based on multimodal fusion described in this patent is as follows: Figure 1As shown in the figure, it mainly consists of five parts, namely: (1) Data collection module. The training of deep learning models requires a large amount of data samples as support. This patent collects the original data samples required for model training from the public data sets of AndroZoo and VirusShare. (2) Data preprocessing module. The original application file is analyzed through reverse engineering, and the AndroidMainfest file compiled into a special binary format is parsed into the original format, and the more readable smail file is obtained by decompiling the DEX format executable file of the Dalvik virtual machine. Prepare for subsequent feature extraction. (3) Feature extraction module. The single modal features used in this patent are obtained from the decompiled application file by feature engineering. It consists of three sub-modules: permission feature extraction module, enhanced APK visual image feature extraction module and API sequence semantic feature extraction module. The permission feature extraction module obtains permission features by parsing the AndroidMainfest configuration file; the enhanced APK visual image feature extraction module encodes different information in the three channels of R, G, and B respectively, and obtains the corresponding image features through the neural network model. The API sequence semantic feature extraction module obtains the API sequence by parsing the function call graph of the original APK and extracts semantic features through a neural network model. (4) Feature fusion module, including feature dimension reduction and feature fusion module. The purpose of the feature dimension reduction module is to reduce the high-dimensional image features and API semantic features to a dimensional space of similar size to the permission features to avoid the problem of dimensional explosion during the feature fusion process. The feature fusion module is responsible for fusing the three feature spaces of similar size after dimensionality reduction as a unified representation of the original APK file for subsequent classification detection. (5) The detection and classification module uses the fused features obtained in the previous step to train the support vector machine to complete the final detection of malware.

[0007] The process of the Android malicious code detection method based on multimodal feature fusion described in this patent is as follows Figure 2 The detailed description is as follows:

[0008] Step 1: The solution based on multimodal feature fusion first needs to decompile the collected original APK files and save the file contents obtained after decompilation, including the original dex file, the decompiled AndroidMainFest.xml file and the smail file.

[0009] Step 2: Extract the specific permission information from the decompiled file content, and obtain the enhanced APK application file visualization image representation based on the DEX file and opcode sequence, parse the function call graph of the original file, and simplify the API call graph by excluding third-party API calls and abstracting the API into the corresponding package hierarchy.

[0010] Step 3: Use word frequency to convert the permission information obtained in the previous step into a feature vector, and use a deep learning network to extract the feature vector from the enhanced visualization image and the abstracted API sequence.

[0011] Step 4: Use an autoencoder to reduce the high-dimensional image features and API semantic features to a feature vector space of similar size to the permission feature space. At the same time, use residual connection to fuse the feature vectors of the three modalities.

[0012] Step 5: Use these fused feature vectors as input to train the classifier. During the training process, the classifier learns how to distinguish different categories by analyzing the relationship between features and corresponding labels. After the training is completed, the model's accuracy, recall rate, F1 score and other indicators are evaluated on the validation data set, and the hyperparameters in the training process are fine-tuned based on these indicators to achieve better results.

[0013] Step 6: After obtaining a fully trained and verified model, it can be used for actual detection tasks. The new data instance obtains the corresponding fused feature vector through the process of Step 1-Step 4. The model trained in Step 5 generates the final detection result based on this vector to identify whether the data instance is malicious or benign.

[0014] The Android malware detection system based on multimodal feature fusion described in this patent solves the problem that traditional detection systems cannot fully analyze the original application files by relying on single-modal features. First, the APK file is decompiled, and the permission features are obtained through the AndroidMainFest file. Then, the original DEX file, the structural information of the DEX file, and the opcode sequence are encoded into different channels of the RGB image to enhance the representation ability of the original APK application file by the visual image. By simplifying and abstracting the function call graph and extracting the API call sequence using the topological sorting method, a simplified representation that retains the original API call sequence structure and semantic features to the greatest extent is obtained. Finally, the above three features are fused through the feature fusion network for the training and classification of the final detection model. This classifier training and detection method based on fused feature vectors allows the system to learn from different features and utilize the joint representation capabilities of these features, so that when processing complex and variable data, it is more effective and accurate than the single feature source method, greatly improving the accuracy and robustness of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of this patent, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of this patent. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 The overall architecture diagram of the Android malware detection method based on multimodal feature fusion provided by this patent;

[0017] Figure 2 A flow chart of the Android malware detection method based on multimodal feature fusion provided by this patent;

[0018] Figure 3 The network architecture diagram of the automatic encoder for feature dimensionality reduction provided by this patent;

[0019] Figure 4 The network architecture diagram for feature fusion provided in this patent. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of this patent clearer, the technical solution in the embodiments of this patent will be clearly and completely described below in conjunction with the drawings in the embodiments of this patent. Obviously, the described embodiments are part of the embodiments of this patent, not all of them. Based on the embodiments in this patent, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this patent.

[0021] In the embodiments of this patent, due to the differences in the business systems of different users, the core applications and the complexity of the architecture are different. This example is only used as an example. In this example, the original application files that the model training relies on are collected from public data sets such as AndroZoo and VirusShare. The authors of these data sets attach great importance to the maintenance of the data sets, so they have more advantages than other data sets in accurately reflecting the real world. In the data preprocessing stage, this patent uses the Androguard library to decompile the original APK file. Androguard is a powerful open source Python library specifically used for reverse engineering and analysis of Android applications. It can be easily integrated with other modules of this patent. The classes.dex file before the decompilation of the original application file and the corresponding smail file after decompilation are the main source of features in this patent. Secondly, AndroidMainfest.xml, as the configuration file based on the application, is also an important source of features.

[0022] In the feature extraction stage, the permission feature selects 64 sensitive permissions as the basis, and analyzes the AndroidManifest.xml configuration file of the Android application. <uses-permission>Tags are used to parse the features declared by the application and match them with 64 sensitive features, and convert them into feature vectors based on the frequency of occurrence of these sensitive permissions. Image features are mainly obtained based on the DEX file of the application. The DEX file contains all the executable code of the application. Therefore, this patent obtains the binary stream of the DEX file, encodes it into the R channel of the RGB image with 8 bits per bit; however, in the process of converting binary to visual images, the original continuous file structure features are destroyed, and some malware will hide the malicious code to be used at runtime by adding additional structural segments without destroying the original format of DEX. Therefore, this patent considers encoding the structural information of the DEX file into the G channel of the RGB image to enhance the final visual image's representation of the original DEX structural information; in addition, the opcode sequence is also one of the important features for identifying malware. This patent considers using the rich contextual information provided in the opcode sequence to further enhance the visual image's ability to express the original application. By parsing the basic blocks of method calls in the Smali file, we can obtain the corresponding Opcode sequence, and in the Dalvik specification, each opcode can be represented by one byte, which can be mapped to the range of 0-255 pixel values ​​in the image. Therefore, this patent converts the opcode sequence into its byte representation and encodes it to the B channel. The enhanced RGB image representation of the APK file is obtained through the above three steps, and the corresponding features are extracted from the enhanced image using the ViT model. The semantic features of the API sequence are obtained by parsing the function call graph. In the function call graph, each node represents a specific function call, and each edge represents the calling relationship between APIs. Since there will be a large number of third-party nodes if the function call graph is not processed, this patent simplifies the function call graph by abstracting the API functions and excluding third-party API calls, and searches for nodes with an in-degree of 0 in the simplified function as the entry of the API sequence, obtains the abstract API call sequence through topological sorting, and uses the BERT model to obtain the semantic features of the API call sequence.

[0023] After obtaining the above three basic unimodal feature information, the original feature vectors extracted from the ViT model and the BERT model are as high as 768 dimensions, which is quite different from the 64-dimensional size of the permission feature vector space. Therefore, it is very necessary to perform feature dimensionality reduction before feature fusion. This patent adopts the following method: Figure 3 The autoencoder network shown in the figure reduces the dimensionality of image features and API semantic text features. The autoencoder structure used in this patent is composed of a symmetrical encoder and decoder. The encoder attempts to reduce the dimensionality of 768-dimensional features to 64 dimensions through a three-layer network, while the decoder attempts to restore the 64-dimensional vector space to the original 768-dimensional raw data space and be as close to the original input data as possible. During the training process of the autoencoder, this patent uses mean square error as the loss function when training the autoencoder. In order to make full use of the complementary information between each modality, this patent is based on the idea of ​​residual link and designs the following Figure 4 The feature fusion network shown in the figure is composed of three layers. The image features, API sequence semantic features and permission features are used as the input of the whole network, and then they are gradually fused at multiple levels. When each layer is fused, the basic features are re-input by residual link. In more detail, the first layer of the feature fusion network will unify the 64-dimensional image features, API sequence semantic features and permission features and splice them into the input, and output the 64-dimensional fused features; the second layer will splice the fused features of the first layer and the three original features once to form a 256-dimensional feature input, and then complete the feature fusion through the fully connected layer; the third layer further repeats the steps of the second layer to strengthen the association between each feature. Through the feature fusion network, more original modal information is retained when fusing different modal features, and additional nonlinear characteristics are added to enhance the expression ability of the model. The final output of the feature fusion network is a 64-dimensional fused feature vector. The support vector machine is trained as the final classification layer, and the model is evaluated through evaluation indicators such as Acc and F1. Finally, the trained model is used to detect unknown instances. During the detection process, the method of acquiring unknown instance fusion features is the same as that in the model training process. The model classifies or predicts these new instances based on its previous learning experience to determine whether they are malware.

[0024] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this patent, rather than to limit it. Although this patent has been described in detail with reference to the aforementioned embodiments, ordinary technicians in this field should understand that they can still modify the technical solutions recorded in the aforementioned embodiments, or replace some of the technical features therein with equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of this patent.

Claims

1. An Android malware detection method based on multimodal feature fusion, characterized by: By integrating the static features of multiple modalities and making full use of the complementarity of features between the modalities, the detection of Android malware is completed, including: Step 1: Decompile the collected original APK files based on the multimodal feature fusion solution, and save the file content obtained after decompilation; Step 2: Extract three basic modal features, including APK permission information, APK application file visualization image information with enhanced semantics, and API call graph information after API abstraction; Step 3: Convert the permission information into a 64-dimensional permission feature vector through word frequency, and use the pre-trained ViT model to extract a 768-dimensional image feature vector from the enhanced visualization image. Use the BERT model to extract a 768-dimensional semantic feature vector from the abstracted API sequence. Step 4: Use the autoencoder technology to reduce the 768-dimensional image feature vector and the 768-dimensional API semantic feature vector to the same dimension as the 64-dimensional permission feature vector. Then perform feature fusion and input the reduced-dimensional image features, API sequence semantic features, and permission features into the three-layer feature fusion network. In each layer of fusion, the basic features are re-input using residual connections to retain the original information and further enhance the feature expression capability. Step 5: Use the fused feature vector as input to train the classifier. During the training process, the classifier learns how to distinguish different categories by analyzing the relationship between features and corresponding labels. After the training is completed, the accuracy, recall rate, F1 score and other indicators of the model are evaluated on the validation data set, and the hyperparameters in the training process are fine-tuned based on these indicators to achieve better results. Step 6: After the model has been fully trained and verified, it is applied to the actual detection task; for new data instances, the corresponding fused feature vector is obtained through the process from Step 1 to Step 4, and the final detection result is generated using the model trained in Step 5 to determine whether the data instance is malicious or benign.

2. The Android malware detection method based on multimodal feature fusion according to claim 1, characterized in that: The step Step 1 includes: Based on the Androguard library, the original APK file is decompiled, and the original dex file, the decompiled AndroidMainfest.xml file and the smail file are saved as the basis for feature extraction.

3. The Android malware detection method based on multimodal feature fusion according to claim 1, characterized in that: The steps Step 2 and Step 3 include: The feature extraction module completes the extraction of three basic modal features and is composed of three single-modal feature extraction sub-modules; The permission feature module parses the AndroidMainfest configuration file <uses-permission> The tag obtains the usage permissions of the APK file, filters sensitive permissions based on the sensitive permission feature list, and generates a 64-dimensional permission feature vector through word frequency statistics; The image feature module obtains an enhanced visual image representation of the APK application file based on the DEX file and the opcode sequence. The representation encodes the original APK file binary information, the dex file deconstruction information, and the opcode sequence features. It also extracts image features through the pre-trained ViT model to generate a 768-dimensional image feature vector. The API sequence semantic feature extraction module first parses the function call graph of the original APK file, simplifies the function call graph by excluding third-party API calls and abstracting the API, then obtains the API call sequence through topological sorting, and extracts the API sequence semantic features through the pre-trained BERT model to generate a 768-dimensional API semantic feature vector.

4. The Android malware detection method based on multimodal feature fusion according to claim 1, characterized in that: Step 4 includes: The feature fusion module completes the dimensionality reduction and feature fusion of three single-modal features; The feature dimension reduction module uses an autoencoder network to reduce the extracted 768-dimensional image feature vector and 768-dimensional API semantic feature vector to the same dimensional space as the 64-dimensional permission feature vector, thus avoiding the dimensionality explosion problem during feature fusion. The feature fusion network consists of three layers. The first layer concatenates the image features, API sequence semantic features, and permission features that are reduced to 64 dimensions to form a 192-dimensional fused feature as input. After being processed by the fully connected layer, this layer outputs a 64-dimensional feature vector. The second layer concatenates the fused features of the first layer and the three original features to form a 256-dimensional feature input, and then completes the feature fusion through the fully connected layer. The third layer further repeats the steps of the second layer to strengthen the association between the features. The final output of the feature fusion network is a 64-dimensional fused feature vector. Through the feature fusion network, more original modal information is retained when fusing different modal features, and additional nonlinear characteristics are added to enhance the expressiveness of the model.

5. The Android malware detection method based on multimodal feature fusion according to claim 1, characterized in that: Step 5: The classification module detects malware based on the fused features. The support vector machine uses the fused features as input, uses the preset kernel function to complete the model training, and evaluates the model performance through evaluation indicators such as Acc and F1. Based on the output results of the trained SVM model, it determines whether the original APK file is a malicious file.

Images