A Contrastive Learning-Based Adversarial Android Malware Detection Method

Abstract

The present invention discloses an adversarial Android malware detection method based on contrastive learning, which comprises: firstly, determining a perturbed feature set and an unperturbed feature set in a feature space by defining an Android application and all feasible perturbation sets, and then determining the architecture of a feature projection model by using the obtained perturbed feature set and unperturbed feature set. Then, a feature projection model is obtained based on the loss function of contrastive learning and adversarial malware training to project feature vectors, so that the distance between the feature vectors obtained after projection can be expressed as a feature matching degree. The present invention utilizes deep learning technology to achieve efficient and low-loss adversarial Android malware detection, which greatly improves the robustness of the Android malware detection method based on machine learning.

Description

Technical Field

[0001] The present invention relates to the field of Android malware defense, and in particular to an adversarial Android malware detection method based on contrastive learning. Background Art

[0002] In recent years, with the widespread adoption of the Android operating system, Android malware has become a serious threat to the privacy and data integrity of users within the Android ecosystem. To protect against Android malware, machine learning-based Android malware detection algorithms have been proposed and widely used. However, these machine learning-based Android malware detection algorithms are not robust; they are susceptible to adversarial Android malware generation algorithms. Adversarial Android malware generation algorithms modify detectable Android malware to evade detection by machine learning-based Android malware detection systems. Adversarial Android malware poses new and significant challenges to Android malware detection systems. Contrastive learning-based Android malware defense methods are one of the key technologies used to mitigate this challenge.

[0003] Adversarial Android malware defense methods defend against adversarial Android malware by enhancing the robustness of machine learning-based Android malware detectors. This requires both that the defense algorithm effectively identify adversarial Android malware and that it not affect the detection success rate of existing malware. Existing adversarial Android malware defense methods primarily employ methods such as adversarial training, focusing on enhancing the robustness of the Android malware detection model itself. However, these methods suffer from the following major shortcomings: First, due to the inherent simplicity of Android malware detection models, enhancing their ability to detect adversarial Android malware often compromises their ability to detect legitimate software. Second, existing methods are primarily designed to address model vulnerabilities. Due to the wide range of model vulnerabilities, these approaches struggle to defend against adaptive attacks. Third, existing adversarial Android malware defense methods suffer from high computational overhead and poor generalization. Summary of the Invention

[0004] In response to the shortcomings of the existing technology, the present invention adopts an adversarial Android malware detection method based on contrastive learning.

[0005] The technical solutions adopted by the present invention to solve the technical problems are as follows:

[0006] A contrastive learning-based adversarial Android malware detection method, including:

[0007] 1) Construct two feature projection models for projecting the perturbed and non-perturbed features of Android software into the same low-dimensional space, respectively. Construct a calibration dataset consisting of both Android malware and benign Android software. Train the two feature projection models based on the calibration dataset and determine a rejection threshold during the training process.

[0008] 2) For the Android software to be detected, a machine learning-based Android malware classifier is used to perform preliminary detection. If the preliminary detection result is benign software, the process proceeds to step 3). If the preliminary detection result is malware, no subsequent operation is performed and the final detection result is malware.

[0009] 3) Extracting the perturbed features and the non-perturbed features of the Android software to be detected based on the classification results of step 1), and projecting the perturbed features and the non-perturbed features of the Android software to be detected into the same low-dimensional space using the two trained feature projection models;

[0010] 4) Calculating a feature matching score for the perturbed features and the non-perturbed features of the Android software to be detected in the low-dimensional space; if the feature matching score is higher than the rejection threshold, the final detection result is malware; otherwise, the final detection result is benign software.

[0011] Furthermore, in step 1), the disturbable features of the Android software are sensitive features that will change when disturbed, and the non-disturbable features are sensitive features that cannot change when disturbed; the sensitive features are permission features and encryption function features in the Android software.

[0012] Furthermore, the perturbable features and non-perturbable features of the Android software are classified using the following method: constructing a feasible perturbation set, iteratively perturbing the Android software from the feasible perturbation set and observing the changes in its sensitive features, classifying the sensitive features that have changed as perturbable features, and classifying the sensitive features that cannot be changed as non-perturbable features.

[0013] Furthermore, in the calibration data set including Android malware and Android benign software in step 2), the Android malware includes adversarial Android malware and conventional Android malware.

[0014] Furthermore, step 2) of training two feature projection models based on the calibration data set specifically includes:

[0015] The calibration dataset is used as a training dataset, wherein Android malware is used as a malicious sample, Android benign software is used as a benign sample, and adversarial Android malware is used as an adversarial malware sample; according to the classification results of step 1), the perturbed features and non-perturbed features of the samples in the calibration dataset are extracted to form a perturbed feature space and a non-perturbed feature space, feature matching scores are calculated according to the perturbed feature space and the non-perturbed feature space, and a contrastive learning loss function is further calculated, and two feature projection models are iteratively optimized based on the contrastive learning loss function.

[0016] Furthermore, in step 2), determining the rejection threshold during the training process specifically includes:

[0017] The initial value of the rejection threshold is pre-set before training;

[0018] During the iterative optimization process of the model, for each training round, the feature matching score of the current training sample is compared with the rejection threshold. If the feature matching score is higher than the rejection threshold and the current training sample is a malicious sample, the current training sample is marked as a true negative sample. If the feature matching score is higher than the rejection threshold but the current training sample is a benign sample, the current training sample is marked as a false negative sample.

[0019] In each training round, the K-quantile of the feature matching scores of all true negative samples is used as the update value to update the rejection threshold and calculate the false negative impact rate;

[0020] After the training is completed, the training round with the highest false negative impact rate is selected, and the preset threshold updated in this round is used as the final preset threshold.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] (1) The present invention uses a plug-in design. Based on the conventional Android malware classifier, it focuses on improving its detection performance in terms of adversarial Android malware. This design can effectively separate the detection capabilities of adversarial Android malware from those of general malware without compromising the detection performance of the original classifier itself in terms of general malware. This greatly improves the robustness of the Android malware detection method based on machine learning.

[0023] (2) The present invention uses contrastive learning technology to extract the unique features of adversarial Android malware, thereby achieving efficient adversarial Android malware detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 Schematic diagram of the architecture of the adversarial Android malware defense method based on contrastive learning;

[0025] Figure 2 Flowchart of the adversarial Android malware defense method based on contrastive learning. DETAILED DESCRIPTION

[0026] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be noted that the following examples are intended to facilitate understanding of the present invention and do not have any limiting effect on the present invention.

[0027] In one embodiment provided by the present invention, a contrastive learning-based adversarial Android malware detection method uses a plug-in design, building upon a conventional machine learning-based Android malware classifier to further achieve more efficient adversarial Android malware detection. This machine learning-based Android malware classifier is widely used in various Android systems, but struggles to defend against adversarial Android malware. The adversarial Android malware is generated by an adversarial Android malware generation algorithm, which can modify and mutate previously detectable malware while still retaining its original malicious functionality.

[0028] like Figure 1 and Figure 2 As shown, the adversarial Android malware detection method based on contrastive learning includes the following steps:

[0029] 1) Quantify all perturbed features in the feature space by defining Android applications and feasible perturbation sets, forming perturbed feature space and non-perturbed feature space;

[0030] 2) Constructing a feature projection model, projecting the perturbed feature space and the non-perturbed feature space obtained in step 1) into a low-dimensional space to compare their matching scores, calculating the loss function, and training the two feature projection models based on the calibration dataset;

[0031] 3) During the feature projection model training process, the rejection threshold of the matching score is determined by controlling its true negative influence ratio;

[0032] 4) For a piece of software to be detected, if it is identified as benign software by the machine learning-based Android malware classifier, this plug-in will be run for further identification. If it has already been classified as malware, no further processing will be performed and the final detection result will be malware.

[0033] 5) Extracting the perturbed and non-perturbed features of the Android software to be detected, projecting them into the same low-dimensional space using the two trained feature projection models, and calculating a feature matching score; if the feature matching score is higher than the rejection threshold, the final detection result is malware; otherwise, the final detection result is benign software.

[0034] Regarding step 1), the purpose of this step is to analyze the common sensitive features of Android software and classify them into perturbed and non-perturbed features. For this purpose, the present invention generates an empty Android software called a defined Android application. This defined Android application can be directly generated using the native Android software template of the Visual Studio development platform. Its source program files are empty, and no files other than those generated by the template itself are attached to implement other functions.

[0035] Based on the defined Android applications generated by the general software template, the features of the Android software are divided into perturbed features and non-perturbed features through feature extraction and perturbation analysis. The specific steps are as follows:

[0036] (1) The feature space quantization algorithm first obtains the permission information and function call information that define the Android application, and extracts its permission features and encryption function features; the permission features are whether specific permission information is used, such as camera permissions, GPS permissions, read and write external storage permissions, etc.; the encryption function features are whether specific function information is used, such as AES encryption function, MD5 encryption function, etc.

[0037] (2) The feature space quantization algorithm iteratively perturbs the Android application from the feasible perturbation set and observes the changes in features, classifying the changed features as perturbable features;

[0038] (3) The remaining features that cannot be changed are classified as non-disturbable features.

[0039] For step 2), this step mainly shifts the focus to determining the feature matching scores after obtaining the perturbed feature space and the non-perturbed feature space. However, in the original feature space, the perturbed features and the non-perturbed features are unlikely to be aligned in dimension, which makes the calculation of the feature matching score very difficult. To address these challenges, this module adopts an encoder model based on contrastive learning, which aims to project the perturbed feature space and the non-perturbed feature space into a common low-dimensional space, and then calculate the feature matching score based on the distance between the projected features. It includes the following steps:

[0040] (3-1) Constructing perturbed feature space and non-perturbed feature space projection models. The perturbed feature space and non-perturbed feature space projection models further learn the mapping relationship and project the features in the feature space into a unified mapping space for calculating the matching score of the features. The perturbed feature space projection model and the non-perturbed feature space projection model use an autoencoder structure to map high-dimensional feature vectors to a low-dimensional projection space;

[0041] (3-2) Training of projection models for perturbed and unperturbed feature spaces. Based on the training dataset of the malware detector and the adversarial malware generation algorithm, a calibration dataset consisting of Android malware and Android benign software is constructed.

[0042] (3-3) According to the perturbed feature space and the non-perturbed feature space defined in step 1), the perturbed features and the non-perturbed features of each training sample are extracted as input, and their corresponding projection vectors are projected.

[0043] (3-4) The projection vector in the projection space obtained through the above steps is used to obtain its feature matching score by calculating the corresponding distance.

[0044] The encoder model based on contrastive learning in this step is a core innovation of the present invention, which mainly includes the following two aspects:

[0045] (1) Model design. The encoder model based on contrastive learning aims to project perturbed and non-perturbed features from a high-dimensional space to a common low-dimensional space. This module adopts two separate encoder models for the perturbed feature space and the non-perturbed feature space respectively. The architecture of each encoder model is a multi-layer perceptron model with a ReLU activation function and a dropout layer. The input layer dimension corresponds to the respective dimensions of the perturbed and non-perturbed feature spaces, and the output dimension is a very small value, specifically 32.

[0046] (2) Model training. During the training of the encoder model, a calibration dataset is constructed using several Android malware and Android benign software as training samples. In order to achieve the goal of not conflicting the adversarial malware detection capability with the normal malware detection capability, this module adopts a customized contrastive learning loss consisting of three parts, each for the corresponding data. The first part aims to minimize any negative impact on the original detection performance of the Android malware detection system. It ensures that true benign samples are correctly identified to control the increase in false positive rate to an acceptable level. The second part aims to enhance the detection capability of this system by ensuring the correct identification of malicious samples that were previously misclassified as benign. The third part focuses on effectively detecting adversarial Android malware samples by identifying incompatibility features exhibited in their unique feature matching scores.

[0047] (i) In order to retain the benign samples (x b ), the first part of the designed contrastive learning loss will minimize the incompatibility scores of these samples. The objective formula is as follows:

[0048] D(x b )=l2(EPS(PS(x b)),EIPS(IPS(x b )))

[0049]

[0050] Where PS and IPS represent the perturbed feature space and the non-perturbed feature space respectively. EPS and EIPS represent the encoder models used to project the perturbed feature space and the non-perturbed feature space respectively, l2 represents the distance between the feature vectors, D(x b ) represents the feature matching score of benign samples. represents the set of benign samples in the training dataset, and |.| represents the cardinality of the set. Therefore, the first part of the customized contrastive learning loss focuses on minimizing the compatibility score of all benign samples in the training dataset of the machine learning-based Android malware detection system.

[0051] (ii) To improve the original performance of the Android malware detection system, the second part of the designed contrastive learning loss combines the malicious samples (x m ). In this case, the model aims to identify these samples as malicious. Therefore, this part of the loss function ensures that the feature matching score of benign samples is less than that of malicious samples. This goal can be expressed as:

[0052] D(x m )=l2(EPS(PS(x m )),EIPS(IPS(x m )))

[0053]

[0054] in, is the set of benign and malicious sample pairs in the training dataset, where the benign and malicious sample pairs consist of any benign and any malicious samples in the training dataset. m ) represents the feature matching score of the malicious sample. m is a hyperparameter representing a fixed distance.

[0055] (iii) To enable the model to detect adversarial Android malware, pseudo-adversarial Android malware samples are introduced into the designed contrastive learning loss function. That is, among the samples that can be successfully classified as malware by the machine learning-based Android malware classifier, their feature vectors are randomly perturbed, so that the perturbed feature vectors are misclassified as normal samples by the machine learning-based Android malware classifier. After obtaining the pseudo-adversarial malware samples, the model incorporates them into the training process of the encoder model to approximate the adversarial malware samples. The goal of this training is to ensure that the adversarial malware samples (xpam ) has a higher feature matching score than regular malware samples because adversarial malware samples exhibit the most severe feature mismatch in features. Therefore, the third part of the contrastive learning loss is formulated as follows:

[0056] D(x pam )=l2(EPS(PS(x pam )),EIPS(IPS(x pam )))

[0057]

[0058] Among them, D(x pam ) represents the feature matching score of the adversarial malware sample, is a set of adversarial malware samples and malicious sample pairs, represents the cardinality of the set, and m is a hyperparameter.

[0059] In summary, the final training loss function of the model can be expressed as:

[0060] L=λ1L1+λ2L2+λ3L3

[0061] Among them, λ1, λ2, and λ3 are hyperparameters.

[0062] Regarding step 3), this step primarily involves determining a threshold for the feature matching score after building the feature projection encoder model. If the feature matching score of an input sample exceeds this threshold, the model will identify it as malicious. To determine this threshold, this module also determines the threshold for the feature matching score during the model training process in step 2. This includes the following steps:

[0063] (1) Pre-set the initial value of the rejection threshold before training;

[0064] (2) During the iterative optimization process of the model, for each training round, the adversarial Android malware detection system with this plug-in is used to identify true negative samples and false negative samples from the calibration dataset; specifically, in each training round, the feature matching score of the current training sample is compared with the rejection threshold. If the feature matching score is higher than the rejection threshold and the current training sample is a malicious sample, the current training sample is marked as a true negative sample. If the feature matching score is higher than the rejection threshold but the current training sample is a benign sample, the current training sample is marked as a false negative sample.

[0065] (3) For each training round, the feature matching scores of these true negative and false negative samples are calculated. A threshold is calibrated based on the K-quantile of the feature matching scores of the true negative samples to control the true negative impact rate. In this embodiment, K is 5%. Using this threshold, the false negative impact rate is calculated and the training round with the highest false negative impact rate is selected. The preset threshold updated in this round is used as the final preset threshold. The false negative impact rate is the proportion of false negative samples in all negative samples.

[0066] Using the above method, this embodiment tests a data set of 1,000 adversarial malware samples. The test results are shown in the following table.

[0067] Table 1: Detection success rate of adversarial malware in this example

[0068]

[0069] As can be seen from the above, this embodiment has an extremely high detection success rate for models divided by different data sets and different feature spaces, and its detection success rate can exceed 90%.

[0070] The embodiments described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting adversarial Android malware based on contrastive learning, characterized in that: include: 1) Construct two feature projection models for projecting the perturbed and non-perturbed features of Android software into the same low-dimensional space, respectively. Construct a calibration dataset consisting of both Android malware and benign Android software. Train the two feature projection models based on the calibration dataset and determine a rejection threshold during the training process. 2) For the Android software to be detected, a machine learning-based Android malware classifier is used to perform preliminary detection. If the preliminary detection result is benign software, the process proceeds to step 3). If the preliminary detection result is malware, no subsequent operation is performed and the final detection result is malware. 3) Extracting the perturbed and non-perturbed features of the Android software to be tested, and projecting the perturbed and non-perturbed features of the Android software to be tested into the same low-dimensional space using two trained feature projection models; 4) Calculate the feature matching score for the perturbed features and non-perturbed features of the Android software to be detected in the low-dimensional space; If the feature matching score is higher than the rejection threshold, the final detection result is malware, otherwise the final detection result is benign software.

2. The method for detecting adversarial Android malware based on contrastive learning according to claim 1, wherein: The disturbable features of the Android software are sensitive features that will change when disturbed, and the non-disturbable features are sensitive features that cannot change when disturbed; the sensitive features are permission features and encryption function features in the Android software.

3. The method for detecting adversarial Android malware based on contrastive learning according to claim 1, wherein: The perturbed features and non-perturbed features of the Android software are classified using the following method: A feasible perturbation set is constructed. The Android software is iteratively perturbed from the feasible perturbation set and the changes in its sensitive features are observed. The sensitive features that change are classified as perturbed features, and the sensitive features that cannot change are classified as non-perturbed features.

4. The method for detecting adversarial Android malware based on contrastive learning according to claim 1, wherein: In step 2), both of the feature projection models are multi-layer perceptron models with ReLU activation function and dropout layer.

5. The method for detecting adversarial Android malware based on contrastive learning according to claim 1, wherein: In step 2), the calibration data set includes Android malware and Android benign software, and the Android malware includes adversarial Android malware and conventional Android malware.

6. The method for detecting adversarial Android malware based on contrastive learning according to claim 4, wherein: Step 2) training two feature projection models based on the calibration data set specifically includes: The calibration dataset is used as the training dataset, where Android malware is used as the malicious sample x m , Android benign software is used as a benign sample x b , adversarial Android malware as adversarial malware sample x pam ; According to the classification results of step 1), the perturbed features and non-perturbed features of the samples in the calibration dataset are extracted to form a perturbed feature space and an non-perturbed feature space. The feature matching score is calculated based on the perturbed feature space and the non-perturbed feature space, and the contrastive learning loss function is further calculated. The two feature projection models are iteratively optimized based on the contrastive learning loss function.

7. The method for detecting adversarial Android malware based on contrastive learning according to claim 6, wherein: The contrastive learning loss function is: L=λ1L1+λ2L2+λ3L3 Among them, λ1, λ2 and λ3 are hyperparameters, L is the contrastive learning loss, L1, L2 and L3 are the first, second and third parts of the contrastive learning loss; The first part L1 of the contrastive learning loss is specifically: D(x b )=l2(EPS(PS(x b )),EIPS(IPS(x b ))) Among them, PS and IPS represent the perturbed feature space and the non-perturbed feature space respectively, EPS and EIPS represent the feature projection models for projecting perturbed features and non-perturbed features respectively, l2 represents the L2 distance, D(x b ) represents the feature matching score of benign samples, represents the set of all benign samples in the training dataset, and |.| represents the cardinality of the set; The first part L2 of the contrastive learning loss is specifically: D(x m )=l2(EPS(PS(x m )),EIPS(IPS(x m ))) in, represents the set of sample pairs consisting of any benign sample and any malicious sample in the training data set, D(x m ) represents the feature matching score of malicious samples, and m is a hyperparameter; The first part L3 of the contrastive learning loss is specifically: D(x pam )=l2(EPS(PS(x pam )),EIPS(IPS(x pam ))) Among them, D(x pam ) represents the feature matching score of the adversarial malware sample, Represents the set of sample pairs consisting of any adversarial malware sample and any malicious sample in the training dataset.

8. The method for detecting adversarial Android malware based on contrastive learning according to claim 6, wherein: In step 2), determining the rejection threshold during the training process specifically includes: The initial value of the rejection threshold is pre-set before training; During the iterative optimization process of the model, for each training round, the feature matching score of the current training sample is compared with the rejection threshold. If the feature matching score is higher than the rejection threshold and the current training sample is a malicious sample, the current training sample is marked as a true negative sample. If the feature matching score is higher than the rejection threshold but the current training sample is a benign sample, the current training sample is marked as a false negative sample. In each training round, the K-quantile of the feature matching scores of all true negative samples is used as the update value to update the rejection threshold and calculate the false negative impact rate; After the training is completed, the training round with the highest false negative impact rate is selected, and the preset threshold updated in this round is used as the final preset threshold.

9. The method for detecting adversarial Android malware based on contrastive learning according to claim 8, wherein: The false negative impact rate is the ratio of false negative samples to all negative samples.

10. The method for detecting adversarial Android malware based on contrastive learning according to claim 1, wherein: In step 5), the feature matching score is the L2 distance between the two sets of features in the low-dimensional space.

Images