Software detection method, system and equipment of Android platform and medium

Abstract

The invention relates to a software detection method, system and device for an Android platform and a medium. The method comprises the steps of obtaining original application data of Android security software and Android malicious software; obtaining a training set based on the original application data; based on a preset bidirectional long-short term cycle network and a preset text convolutional network, an initial prediction model is constructed; training the initial prediction model by using the training set to obtain a target malicious software prediction model; and obtaining to-be-detected application data of the to-be-detected Android software, and processing the to-be-detected application data based on the target malicious software detection model to obtain a prediction result of the to-be-detected Android software. The problem that along with rapid development of a malicious software technology, a traditional malicious software detection method is low in detection efficiency and prone to being attacked by a malicious software escape technology, and consequently the accuracy of a detection result is low is solved.

Description

Background Art

[0002] As smartphones have become more and more popular, the Android platform has become one of the most popular mobile operating systems in the world due to its openness. As users become increasingly dependent on Android devices, malware poses a serious threat to user privacy and device security. These malware usually tamper with application (APK) files to implant malicious code, thereby achieving the purpose of stealing data, remotely controlling, or even destroying devices.

[0003] Traditional malware detection technology mainly relies on signature matching and behavior analysis. However, with the rapid development of malware technology, traditional malware detection methods are vulnerable to malware evasion technology attacks when detecting malware, which not only leads to low detection efficiency, but also affects the accuracy of detection results. For example, through dynamic code loading, encryption and obfuscation, malware can effectively evade detection systems based on static features. Summary of the invention

[0004] In order to overcome the problem that with the rapid development of malware technology, traditional malware detection methods have low detection efficiency and are vulnerable to malware evasion technology attacks, resulting in low accuracy of detection results, the present application provides a software detection method, system, device and medium for an Android platform.

[0005] In the first aspect, in order to solve the above technical problems, the present application provides a software detection method for an Android platform, comprising:

[0006] Get raw application data of Android security software and Android malware;

[0007] Obtain a training set based on the original application data;

[0008] Based on the preset bidirectional long short-term recurrent network and the preset text convolutional network, an initial prediction model is constructed;

[0009] Using the training set to train the initial prediction model, a target malware prediction model is obtained;

[0010] The application data to be tested of the Android software to be tested is obtained, and the application data to be tested is processed based on the target malware detection model to obtain a prediction result of the Android software to be tested.

[0011] In a second aspect, the present application also provides a software detection system for an Android platform, comprising:

[0012] The acquisition module is used to obtain the original application data of Android security software and Android malware;

[0013] A first obtaining module is used to obtain a training set based on original application data;

[0014] A construction module is used to construct an initial prediction model based on a preset bidirectional long-short term recurrent network and a preset text convolutional network;

[0015] A training module, used to train the initial prediction model using the training set to obtain a target malware prediction model;

[0016] The second obtaining module is used to obtain the application data to be tested of the Android software to be tested, and process the application data to be tested based on the target malware detection model to obtain the malicious prediction result of the Android software to be tested.

[0017] In a third aspect, the present application also provides a computing device, including a memory, a processor, and a program stored in the memory and running on the processor, and when the processor executes the program, the steps of a software detection method for an Android platform as described above are implemented.

[0018] In a fourth aspect, the present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes the steps of a software detection method for an Android platform.

[0019] The beneficial effects of the present application are: constructing a training set through the original application data of Android security software and security malware, and constructing an initial prediction model based on a preset bidirectional long-short term recurrent network and a preset text convolutional network, and using the training set to train the initial prediction model to obtain a target malware prediction model. In this way, since the training set contains data samples of Android security software and security malware, the data samples in the training set are rich enough to deepen the training degree of the initial prediction model, so as to improve the objectivity of the model training, thereby improving the accuracy of the trained target malware prediction model. Then, the target malware prediction model is used to automatically identify and process the application data to be tested of the Android software to be tested, which can not only improve the detection efficiency, but also identify the application data of the trained Android malware to avoid being attacked by the evasion technology of the trained Android malware, thereby improving the accuracy of the detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flowchart of a software detection method for an Android platform is shown as an exemplary embodiment of the present application;

[0021] Figure 2 The present invention is a schematic diagram of the structure of a software detection system for an Android platform, showing an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0022] The following examples are provided to further explain and supplement the present application and do not constitute any limitation to the present application.

[0023] The following describes a software detection method, system, device and medium for an Android platform according to an embodiment of the present application in conjunction with the accompanying drawings.

[0024] An embodiment of the present application provides a software detection method for an Android platform, which is applied to a terminal device. In the present application scheme, the terminal device is used as the execution subject to illustrate the present application scheme, and the terminal device is used to execute the steps of a software detection method for an Android platform.

[0025] See also Figure 1 , Figure 1 A software detection method for an Android platform is shown as an exemplary embodiment of the present application. Figure 1 As shown, the present application provides a software detection method for an Android platform, comprising:

[0026] Step S11, obtaining original application data of Android security software and Android malware;

[0027] Step S12, obtaining a training set based on the original application data;

[0028] Step S13, constructing an initial prediction model based on a preset bidirectional long short-term recurrent network and a preset text convolutional network;

[0029] Step S14, training the initial prediction model using the training set to obtain a target malware prediction model;

[0030] Step S15, obtaining the application data to be tested of the Android software to be tested, and processing the application data to be tested based on the target malware detection model to obtain a prediction result of the Android software to be tested.

[0031] A software detection method for an Android platform of the present embodiment, a training set is constructed by the original application data of Android security software and security malware, and an initial prediction model is constructed based on a preset bidirectional long-short term recurrent network and a preset text convolutional network, and the initial prediction model is trained using the training set to obtain a target malware prediction model. In this way, since the training set contains data samples of Android security software and security malware, the data samples in the training set are rich enough to deepen the training degree of the initial prediction model, so as to improve the objectivity of the model training, thereby improving the accuracy of the trained target malware prediction model. Then, the target malware prediction model is used to automatically identify and process the application data to be tested of the Android software to be tested, which can not only improve the detection efficiency, but also identify the application data of the trained Android malware, avoid being attacked by the evasion technology of the trained Android malware, thereby improving the accuracy of the detection result. At the same time, the method of the present embodiment can also identify the application data of the problem software with code obfuscation problems, and the prediction results of the target malware detection model include malware, error software and security software.

[0032] In this embodiment, the bidirectional long short-term recurrent network (Bidirectional Long Short-Term Memory, Bi-LSTM) is a special recurrent neural network (Recurrent Neural Network, RNN) structure, which is widely used in sequence data processing, especially in the field of natural language processing (Natural Language Parsing, NLP). Bi-LSTM processes data by combining two independent LSTM (Long Short-Term Memory, recurrent neural network) layers, which transmit and learn information along the forward and reverse directions of the time series respectively. This structure enables the network to obtain past and future context information at each time point.

[0033] The Text Convolutional Neural Network (TextCNN) consists of a word embedding layer, a convolution layer, an activation layer, a pooling layer, a fully connected layer, and an output layer. The word embedding layer is used to convert the input text data into a vector of a fixed dimension between 50 and 300. The convolution layer uses multiple convolution kernels of different sizes on top of the word embedding layer to extract local features in the text data. Each convolution kernel slides on the embedding matrix of the text data to extract and generate a new feature map. Then an activation layer is connected to enhance the nonlinear ability of the network. The feature map generated by the convolution layer is downsampled by the pooling layer, and finally the output is classified by the fully connected layer. The structure of the text convolutional network is simple and efficient. It is particularly effective in short text classification tasks, such as sentiment analysis and topic classification. Due to its parallel processing characteristics, it shows efficient performance when processing large-scale data. It can effectively improve the accuracy of training the model using the opcode training set, and then through the parameter tuning and verification of the prediction model, it can more accurately detect the ever-changing Android applications on the market.

[0034] Typically, for a text convolutional network, when the number of samples in the training set used for training is less than a preset amount or the training task is relatively simple, the word embedding layer is set to be converted to a dimension of 50, 100 or 128, and when the number of samples in the training set is greater than or equal to a preset amount or the training task is relatively complex, the word embedding layer is set to be converted to a dimension of 200, 256 or 300. In this embodiment, the word embedding layer is set to be converted to a dimension of 256.

[0035] Optionally, original application data corresponding to the Android security software and the Android malware is obtained, including:

[0036] Get Android security software and Android malware from a pre-set Android software dataset;

[0037] Reverse engineer each Android software in Android security software and Android malware to get the initial code;

[0038] Decompile the initial code to obtain the target format code;

[0039] Extract the opcode of the target format code to obtain the intermediate layer opcode and the native code opcode;

[0040] The original application data is obtained based on the middle layer opcode and the native code opcode.

[0041] In this embodiment, the Android software dataset (Androzoo) is a foreign Android application dataset, which uses a crawler to crawl Android security software data from the Android App Store and Android malware data from the VirusTotal website. Among them, the Android security software data and Android malware data are stored in APK files in an APK (Android Package, machine program) structure, and virustotal is a website that provides malware samples, which is used to obtain typical Android malware samples.

[0042] Therefore, the Android security software and Android malware obtained from the preset Android software data set in this embodiment can cover most of the Android software samples on the market, ensuring the richness of the number of samples in the training set obtained based on the original application data of the Android security software and Android malware, so as to improve the training depth of the subsequent initial prediction model, thereby improving the training accuracy of the initial prediction model. At the same time, the Apktool tool and IDA pro tool are used to reverse engineer each Android software in the Android security software and Android malware to derive the implementation logic of each Android software and obtain the initial code corresponding to the implementation logic. Here, the Apktool and IDA pro tools perform two types of data extraction work, the apktool tool extracts the initial intermediate layer opcode, and the IDA pro extracts the initial native code opcode. And the initial code is decompiled to adjust the format of the initial code to the target format code that can be recognized by the subsequent initial prediction model, that is, the code in text format. Then, since the APK file contains smali code files and .so files, the smali file contains the intermediate layer opcode / smali opcode of the software compiled by the Dalvik virtual machine, and the .so file contains the native code (native code) opcode / local code opcode / arm assembly language of the software, the opcode is extracted from the target format code, and the intermediate layer opcode and native code opcode can be directly extracted, and the data of the two modes of intermediate layer opcode and native code opcode are used as the data in the original application data, which is convenient for the subsequent training process. Different levels of malicious analysis of Android software can be performed, and the training accuracy of the initial prediction model is further improved, so that the trained target malware prediction model can contain a more accurate summary of the global situation of Android applications, thereby improving the prediction accuracy of the target malware prediction model for the software to be tested.

[0043] Among them, smali code is an assembly language that Android Dalvik uses to execute bytecode. Smali is the medium between the Java language and the Dalvik virtual machine, which is equivalent to a summary of high-level languages ​​such as Java or Kotlin in the program.

[0044] Optionally, a training set is obtained based on the original application data, including:

[0045] Preprocessing the original application data to obtain intermediate application data; wherein the preprocessing includes mapping processing and cleaning processing;

[0046] Perform data dimension reduction on the intermediate application data to obtain the target training data;

[0047] A training set is formed based on the target training data.

[0048] In this embodiment, the original application data is pre-processed by mapping and cleaning the original application data using a pre-written python automation script, which can filter out illegal data (error data) and abnormal data (all zero data) in the original application data, and can also analyze more useful information and data that has a greater impact on the prediction. Then, the intermediate application data obtained by the pre-processing is subjected to data dimensionality reduction to obtain target training data that is easy to be recognized by the initial prediction model, so as to improve the training efficiency of the initial prediction model.

[0049] In this embodiment, the TF-IDF (Term Frequency-Inverse Document Frequency) method is used to perform data dimension reduction on the intermediate application data obtained by preprocessing. The TF-IDF method is a weight calculation method widely used in text mining and information retrieval, which is used to evaluate the importance of a word to a document set or one of the documents in a corpus. The idea is based on the fact that if a word appears frequently in an article and rarely appears in other articles, it is considered that the word has a good ability to distinguish categories and is an important word in this article. The target training data obtained by data dimension reduction using the TF-IDF method can better summarize the code call information of Android software, thereby further improving the training accuracy of the initial prediction model.

[0050] Optionally, the initial prediction model is trained using the training set to obtain a target malware prediction model, including:

[0051] The training set is input into the initial prediction model, and the bidirectional long short-term recurrent network and the text convolutional network are trained using the training samples in the training set to obtain the trained initial prediction model;

[0052] Based on the test samples in the training set and the trained initial prediction model, a target malware prediction model is obtained.

[0053] In this embodiment, the training samples in the training set are used to perform initial training on the bidirectional long-short term recurrent network and the text convolution network in the initial prediction model to obtain the trained initial prediction model, and the target malware prediction model is obtained based on the test samples in the training set and the trained initial prediction model. In this way, by training the model in batches using training samples and test samples, the workload of each training can be reduced, and the slow operation of the training system due to excessive training workload during the training process can be avoided, thereby improving the efficiency of model training. Among them, the training set includes a training sample set, a test sample set, and a verification sample set, and the verification samples in the verification sample set are used to verify the prediction accuracy of the target malware detection model obtained by training. By randomly dividing the data in the training set into a training sample set, a test sample set, and a verification sample set, the randomness and objectivity of the data in each set can be guaranteed, human factors can be reduced, and the accuracy of the target malware detection model can be effectively improved.

[0054] Optionally, based on the test samples in the training set and the trained initial prediction model, a target malware prediction model is obtained, including:

[0055] Use the test samples in the training set to test the trained initial model and obtain the test results;

[0056] Based on the matching result between the test result and the corresponding true result, a first accuracy rate of the trained initial prediction model is obtained;

[0057] Based on the first accuracy rate, a target malware prediction model is obtained.

[0058] In this embodiment, the first accuracy rate of the trained initial prediction model is obtained by testing the trained initial model with the test sample in the training set and the matching result between the test result and the corresponding real result, so as to understand whether the trained initial prediction model meets the accuracy requirement, and obtain the target malware prediction model based on the first accuracy rate, so that the target malware prediction model can meet the accuracy requirement, thereby improving the accuracy of the detection result output by the target malware prediction model. The first accuracy rate is calculated as the number of successful matches divided by the number of test samples, usually expressed in the mathematical form of percentage.

[0059] Optionally, based on the first accuracy rate, obtaining a target malware prediction model includes:

[0060] When the first accuracy is greater than or equal to a preset value, using the trained initial prediction model as a target malware prediction model;

[0061] When the first accuracy rate is less than a preset value, performing a preset number of iterative training on the trained initial prediction model to obtain an iterative prediction model;

[0062] Obtaining a second accuracy rate of the iterated prediction model, and if the second accuracy rate is greater than or equal to a preset value, using the iterated prediction model as a target malware prediction model;

[0063] If the second accuracy rate is less than a preset value, the iterative prediction model is continuously iterated for a preset number of times until the corresponding accuracy rate is greater than or equal to the preset value, thereby obtaining a target malware prediction model.

[0064] In this embodiment, based on the first accuracy rate, it can be understood whether the trained initial prediction model meets the accuracy requirement, that is, when the first accuracy rate is greater than or equal to the preset value, it means that the trained initial prediction model meets the accuracy requirement, and the trained initial prediction model is used as the target malware prediction model, so that the accuracy of the target malware prediction model when making predictions can meet the requirements. When the first accuracy rate is less than the preset value, it means that the trained initial prediction model does not meet the accuracy requirement, and the trained initial prediction model is iteratively trained until the accuracy of the model obtained by training is greater than or equal to the preset value, and the model with an accuracy rate greater than or equal to the preset value is used as the target malware prediction model, so that the accuracy of the target malware prediction model when making predictions can meet the requirements.

[0065] In this embodiment, when the second accuracy of the prediction model after iteration is less than a preset value, the training samples, test samples and validation samples in the training set are divided again, and the iterative prediction model is iteratively trained a preset number of times using the training samples and test samples respectively. If the corresponding accuracy is less than the preset value, the training samples, test samples and validation samples in the training set are divided again, and iterative training is performed until the corresponding accuracy is greater than or equal to the preset value.

[0066] In this embodiment, each time the training is iterated, the grid search method or the manual parameter adjustment method is used to tune and verify the parameters of the training model. Among them, grid search (Grid Search): find the best parameter configuration combination by systematically traversing multiple parameter combinations in the model. Manual parameter adjustment: first determine the parameter range of each parameter to be adjusted in the model, and conduct multiple experiments based on the principle of controlling variables to find the best configuration combination of each parameter to be adjusted in the model. For example, for Bi-LSTM, the parameters to be adjusted include hidden layer size, learning rate, and batch size.

[0067] Optionally, the application data to be tested is processed based on the target malware detection model to obtain malicious prediction results of the Android software to be tested, including:

[0068] Preprocess the application data to be tested to obtain the intermediate data to be tested;

[0069] Perform data dimension reduction on the intermediate data to be tested to obtain the target data to be tested;

[0070] Inputting the target data to be tested into the target malware detection model, and using the bidirectional long short-term recurrent network and the text convolutional network of the target malware detection model to process the target data to be tested respectively, to obtain a first result and a second result;

[0071] The first result and the second result are integrated by voting method to obtain the prediction result of the Android software to be tested.

[0072] In this embodiment, the target malware detection model uses a bidirectional long short-term recurrent network and a text convolutional network to process the target data to be detected that is easy to be identified by the target malware detection model after preprocessing and data dimension reduction, respectively, to achieve dual identification of the target data to be detected, and obtain a first result and a second result. The first result and the second result are integrated by voting. Compared with the single identification processing of the target data to be detected using only a bidirectional long short-term recurrent network or a text convolutional network, the method of this embodiment has undergone dual identification, that is, only when the first result and the second result are both safe software, the prediction result of the target malware detection model is safe software, thereby further improving the prediction accuracy of the target malware detection model.

[0073] The voting method uses the ensemble learning method. Ensemble learning is a powerful methodology in machine learning. It solves a single prediction problem by building and combining multiple learners to achieve better prediction performance than a single model. The basic idea of ​​ensemble learning is that the overall effect of combining multiple learners is usually better than the effect of any single learner.

[0074] This application uses a bidirectional long short-term recurrent network (Bi-LSTM) and a text convolutional network (TextCNN) to perform feature learning and classification on the application data of Android software. Bi-LSTM can capture the dependencies between the context in the opcode sequence, while TextCNN uses the convolutional layer to automatically extract features in the local area. By effectively integrating the learning results of these two models, not only the accuracy of Android malware detection is improved, but also the adaptability of the trained target malware prediction model to new and variant malware is enhanced, overcoming the limitations of traditional methods in dealing with complex and variant malicious code.

[0075] See also Figure 2 , Figure 2 A software detection system for an Android platform is shown as an exemplary embodiment of the present application. Figure 2 As shown, the present application provides a software detection system for an Android platform, including:

[0076] The acquisition module is used to obtain the original application data of Android security software and Android malware;

[0077] A first obtaining module is used to obtain a training set based on original application data;

[0078] A construction module is used to construct an initial prediction model based on a preset bidirectional long-short term recurrent network and a preset text convolutional network;

[0079] A training module, used to train the initial prediction model using the training set to obtain a target malware prediction model;

[0080] The second obtaining module is used to obtain the application data to be tested of the Android software to be tested, and process the application data to be tested based on the target malware detection model to obtain the malicious prediction result of the Android software to be tested.

[0081] The software detection system of an Android platform of the present embodiment, through the original application data of Android security software and security malware acquired by the acquisition module, constructs a training set in the first acquisition module, and uses the construction module to construct an initial prediction model based on a preset bidirectional long-short term recurrent network and a preset text convolutional network, and uses the training set to train the initial prediction model in the training module to obtain a target malware prediction model. In this way, since the training set contains data samples of Android security software and security malware, the data samples in the training set are rich enough to deepen the training degree of the initial prediction model, so as to improve the objectivity of the model training, thereby improving the accuracy of the target malware prediction model obtained by training. Then, in the second acquisition module, the target malware prediction model is used to automatically identify and process the application data to be tested of the Android software to be tested, which can not only improve the detection efficiency, but also identify the application data of the trained Android malware, and avoid being attacked by the evasion technology of the trained Android malware, thereby improving the accuracy of the detection result.

[0082] Optionally, obtain a module, specifically for:

[0083] Get Android security software and Android malware from a pre-set Android software dataset;

[0084] Reverse engineer each Android software in Android security software and Android malware to get the initial code;

[0085] Decompile the initial code to obtain the target format code;

[0086] Extract the opcode of the target format code to obtain the intermediate layer opcode and the native code opcode;

[0087] Get the original application data based on the middle layer opcode and native code opcode

[0088] Optionally, the first module is specifically used to:

[0089] Preprocessing the original application data to obtain intermediate application data;

[0090] Perform data dimension reduction on the intermediate application data to obtain the target training data;

[0091] A training set is formed based on the target training data.

[0092] Optionally, the training module is specifically used to:

[0093] The training set is input into the initial prediction model, and the bidirectional long short-term recurrent network and the text convolutional network are trained using the training samples in the training set to obtain the trained initial prediction model;

[0094] Based on the test samples in the training set and the trained initial prediction model, a target malware prediction model is obtained.

[0095] Optionally, the training module is specifically used to:

[0096] Use the test samples in the training set to test the trained initial model and obtain the test results;

[0097] Based on the matching result between the test result and the corresponding true result, a first accuracy rate of the trained initial prediction model is obtained;

[0098] Based on the first accuracy rate, a target malware prediction model is obtained.

[0099] Optionally, the training module is specifically used to:

[0100] When the first accuracy is greater than or equal to a preset value, using the trained initial prediction model as a target malware prediction model;

[0101] When the first accuracy rate is less than a preset value, performing a preset number of iterative training on the trained initial prediction model to obtain an iterative prediction model;

[0102] Obtaining a second accuracy rate of the iterated prediction model, and if the second accuracy rate is greater than or equal to a preset value, using the iterated prediction model as a target malware prediction model;

[0103] If the second accuracy rate is less than a preset value, the iterative prediction model is continuously iterated for a preset number of times until the corresponding accuracy rate is greater than or equal to the preset value, thereby obtaining a target malware prediction model.

[0104] Optionally, the second obtaining module is specifically used for:

[0105] Preprocess the application data to be tested to obtain the intermediate data to be tested;

[0106] Perform data dimension reduction on the intermediate data to be tested to obtain the target data to be tested;

[0107] Inputting the target data to be tested into the target malware detection model, and using the bidirectional long short-term recurrent network and the text convolutional network of the target malware detection model to process the target data to be tested respectively, to obtain a first result and a second result;

[0108] The first result and the second result are integrated by voting method to obtain the prediction result of the Android software to be tested.

[0109] A computing device according to an embodiment of the present application includes a memory, a processor, and a program stored in the memory and running on the processor. When the processor executes the program, some or all steps of the software detection method for the Android platform described above are implemented.

[0110] Among them, the computing device can be a computer, and correspondingly, its program is computer software. The above-mentioned parameters and steps in a computing device of the present application can refer to the parameters and steps in the embodiment of a software detection method for an Android platform above, and will not be repeated here.

[0111] In an embodiment of the present application, a computer-readable storage medium is provided, in which instructions are stored. When the instructions are executed, the steps of the software detection method for an Android platform are executed.

[0112] The computer-readable storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0113] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method of the embodiment of the present disclosure. The aforementioned computer-readable storage medium may be a non-transitory computer-readable storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, and other media that can store program codes, or a transient computer-readable storage medium.

[0114] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0115] Those skilled in the art know that the present application can be implemented as a system, method or computer program product. Therefore, the present disclosure can be specifically implemented in the following forms, namely: it can be complete hardware, it can be complete software (including firmware, resident software, microcode, etc.), or it can be a combination of hardware and software, generally referred to as "module" or "system" herein. In addition, in some embodiments, the present application can also be implemented in the form of a computer program product in one or more computer-readable media, and the computer-readable medium contains computer-readable program code. Computer-readable storage media can be, for example, but not limited to - electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above.

[0116] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0117] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A software detection method for an Android platform, characterized in that: include: Get raw application data of Android security software and Android malware; Obtaining a training set based on the original application data; Based on the preset bidirectional long short-term recurrent network and the preset text convolutional network, an initial prediction model is constructed; Using the training set to train the initial prediction model to obtain a target malware prediction model; The application data to be tested of the Android software to be tested is obtained, and the application data to be tested is processed based on the target malware detection model to obtain a prediction result of the Android software to be tested.

2. The method according to claim 1, characterized in that The obtaining of original application data corresponding to the Android security software and the Android malware includes: Get Android security software and Android malware from a pre-set Android software dataset; Reverse engineering each Android software in the Android security software and the Android malware to obtain an initial code; Decompiling the initial code to obtain a target format code; Extracting the operation code from the target format code to obtain the intermediate layer operation code and the native code operation code; Original application data is obtained based on the intermediate layer operation code and the native code operation code.

3. The method according to claim 1, characterized in that The obtaining of a training set based on the original application data comprises: Preprocessing the original application data to obtain intermediate application data; Performing data dimension reduction on the intermediate application data to obtain target training data; A training set is formed based on the target training data.

4. The method according to claim 1, characterized in that: The using the training set to train the initial prediction model to obtain a target malware prediction model includes: Inputting the training set into the initial prediction model, and using the training samples in the training set to train the bidirectional long short-term recurrent network and the text convolutional network to obtain a trained initial prediction model; A target malware prediction model is obtained based on the test samples in the training set and the trained initial prediction model.

5. The method according to claim 4, characterized in that The step of obtaining a target malware prediction model based on the test samples in the training set and the trained initial prediction model includes: Using the test samples in the training set to test the trained initial model to obtain a test result; Based on the matching result between the test result and the corresponding true result, obtaining a first accuracy rate of the trained initial prediction model; Based on the first accuracy rate, a target malware prediction model is obtained.

6. The method according to claim 5, characterized in that The step of obtaining a target malware prediction model based on the first accuracy rate includes: When the first accuracy rate is greater than or equal to a preset value, using the trained initial prediction model as a target malware prediction model; When the first accuracy rate is less than the preset value, performing a preset number of iterative training on the trained initial prediction model to obtain an iterative prediction model; Obtaining a second accuracy rate of the iterated prediction model, and if the second accuracy rate is greater than or equal to the preset value, using the iterated prediction model as a target malware prediction model; If the second accuracy rate is less than the preset value, the iterative prediction model is continuously trained for the preset number of times until the corresponding accuracy rate is greater than or equal to the preset value, thereby obtaining a target malware prediction model.

7. The method according to any one of claims 1 to 6, characterized in that: The processing of the application data to be tested based on the target malware detection model to obtain a malicious prediction result of the Android software to be tested includes: Preprocessing the application data to be tested to obtain intermediate data to be tested; Performing data dimension reduction on the intermediate data to be tested to obtain target data to be tested; Inputting the target data to be tested into the target malware detection model, and using the bidirectional long short-term recurrent network and the text convolutional network of the target malware detection model to process the target data to be tested respectively, to obtain a first result and a second result; The first result and the second result are integrated by voting to obtain a prediction result of the Android software to be tested.

8. A software detection system for an Android platform, characterized in that: include: The acquisition module is used to obtain the original application data of Android security software and Android malware; A first obtaining module, used for obtaining a training set based on the original application data; A construction module is used to construct an initial prediction model based on a preset bidirectional long-short term recurrent network and a preset text convolutional network; A training module, used to train the initial prediction model using the training set to obtain a target malware prediction model; The second obtaining module is used to obtain the application data to be tested of the Android software to be tested, and process the application data to be tested based on the target malware detection model to obtain the malicious prediction result of the Android software to be tested.

9. A computing device comprising a memory, a processor, and a program stored in the memory and running on the processor, characterized in that: When the processor executes the program, the steps of a software detection method for an Android platform as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device executes the steps of a software detection method for an Android platform as described in any one of claims 1 to 7.

Images