Android malicious software detection model training method, device and equipment

Abstract

The invention belongs to the field of Android malicious software detection in information security, and particularly relates to a training method, device and equipment of an Android malicious software detection model. The method comprises the steps of obtaining an original Android software sample data set; adopting random undersampling to process most types of Android benign samples; processing minority classes of Android malicious samples by adopting oversampling based on boundary density weighting; adopting evolution screening undersampling processing to resample the android software sample data set; by means of the modes, the Android software sample data set can be optimized; based on the optimized Android software sample data set, hyper-parameters of a classifier of the Android software detection model are adjusted and optimized through a binary particle swarm optimization algorithm, and therefore iterative training of the Android software detection model is achieved. According to the method, the training efficiency and the detection accuracy of the Android malicious software classification model can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of malware detection, and in particular relates to a training method, device and equipment for an Android malware detection model. Background Art

[0002] With the development of mobile networks, smart mobile devices have become popular rapidly, among which Android devices account for the majority of the market share, and the number of Android applications has also exploded. While users enjoy the convenience brought by Android applications, their privacy and security are also greatly threatened. According to STATISTA statistics, the number of smartphone users in the world will be about 6.6 billion in 2022, and the number of smartphone users in China will be close to 1.04 billion, accounting for more than 15% of the total users, and it is expected that by 2026, the number of smartphone users in China will increase to about 1.18 billion.

[0003] In the Android app market, most apps are benign, while malware is relatively rare. This leads to the problem of class imbalance in the training data set, making it easier for machine learning models to favor the majority class, while the performance of detecting malware in the minority class is insufficient. The scarcity of minority class samples includes absolute scarcity where the minority samples themselves are scarce and relative scarcity where the minority samples themselves are not small but the majority samples are too many. This makes it difficult to distinguish the characteristics and differences between noise data and minority class data, making denoising difficult. Classifiers with overall classification effect as the learning goal tend to be biased towards the majority class, that is, normal samples, and thus ignore the minority class malware samples. This imbalance not only leads to poor performance of traditional classification algorithms in detecting malware, but may also lead to serious security risks. This leads to high false positive and false negative rates in classifiers in practical applications. Specifically, the classifier can better identify normal samples, but has poor recognition ability for malware samples, and cannot effectively detect and intercept malware, which in turn affects the security and privacy protection of user devices.

[0004] Common methods used in existing research to deal with class imbalance problems include sampling techniques at the data level, such as oversampling and undersampling, which balance the number of samples by adjusting the data distribution, thereby improving the training effect of the classifier. Secondly, adjustment methods at the algorithm level, such as cost-sensitive learning and ensemble methods, enhance the classifier's ability to recognize minority class samples by introducing sample weights or building multiple classifiers during the training process. Among them, oversampling balances the data set by increasing the number of minority class samples, but it may lead to overfitting because the newly generated samples do not always represent the actual situation well. Undersampling balances the data set by reducing the number of majority class samples. Although it can effectively reduce the amount of data, it may lose a lot of useful information and affect the generalization ability of the model. While these methods improve the performance of the classifier, they also bring new challenges and need to be carefully selected and adjusted in practical applications. Therefore, how to reduce the impact of class imbalance and improve the detection accuracy of malicious samples in Android malware detection is one of the key research issues at present.

[0005] At present, Chinese patent CN117150491A proposes a malware detection method and device, including decompiling the APK file of the software to be detected to obtain a decompiled file; inputting the decompiled file into a pre-trained malware detection model to obtain a detection result. By combining the application-based sampling strategy and the family-based sampling strategy, the samples are effectively balanced, the meta-learning is improved, and the diversity between samples is considered, thereby effectively solving the sample imbalance and family missing problems in the Android malware family classification, improving the malware classification effect and the ability to detect new malware.

[0006] However, these existing technologies do not consider the original distribution of minority samples when balancing the training samples when training malware detection models, and do not consider the original distribution of minority samples when synthesizing data. They treat boundary samples and non-boundary samples equally, and are prone to generating redundant samples when synthesizing samples in non-boundary areas. In addition, minority class samples can only be added in integer multiples during oversampling, and in most cases, absolute consistency in the number of minority and majority class samples cannot be achieved. Even if the distribution differences of minority class samples are taken into account, the classification decision boundary has a certain enhancement effect, but if a sample is particularly difficult to learn, the sample is likely to be a noise sample, and a large number of new samples synthesized around it may be noise samples, which may amplify the noise of the data set and affect the classification performance of the classifier. In addition, synthesizing new samples near boundary samples will result in serious sample overlap, which is not conducive to subsequent classification. Summary of the invention

[0007] In order to solve the problems existing in the above-mentioned prior art, the present invention proposes a training method, device and equipment for an Android malware detection model, which processes the majority class of Android benign samples by random under-sampling, and processes the minority class of Android malicious samples by over-sampling based on boundary density weighting; then uses evolutionary screening under-sampling to process the resampled Android samples to further optimize the Android software sample data set; after optimizing the Android sample data set, the binary particle swarm optimization algorithm is used to tune the hyperparameters of the classifier, thereby improving the detection efficiency of the classification model while improving the detection accuracy of the minority class samples.

[0008] In a first aspect of the present invention, the present invention provides a method for training an Android malware detection model, the method comprising:

[0009] Obtaining an original Android software sample data set, where the original Android software sample data set is an unbalanced data set, including a minority class of Android malicious samples and a majority class of Android benign samples;

[0010] Random undersampling is used to process the majority of Android benign samples to obtain an under-sampled Android software sample dataset;

[0011] The oversampling based on boundary density weighting is used to process the minority class of Android malicious samples to obtain the oversampled Android software sample dataset;

[0012] The Android software sample data set is resampled by using evolutionary screening undersampling to obtain a balanced Android software sample data set; the resampled Android software sample data set includes an undersampled Android software sample data set and an oversampled Android software sample data set;

[0013] Inputting the balanced Android software sample data set into an Android malware detection model to obtain a detection result, and calculating a corresponding performance indicator based on the detection result;

[0014] Using a binary particle swarm optimization algorithm to tune the hyperparameters of the Android malware detection model to train the Android malware detection model;

[0015] The binary particle swarm optimization algorithm uses the data dimension of the balanced Android software sample data set as the search space, the hyperparameters of the Android malware detection model as particles, and the performance index obtained from the detection result as the fitness value.

[0016] In a second aspect of the present invention, the present invention further provides a training device for an Android malware detection model, the device comprising:

[0017] A data acquisition module is used to acquire an original Android software sample data set, where the original Android software sample data set is an unbalanced data set, including a minority class of Android malicious samples and a majority class of Android benign samples;

[0018] The first undersampling processing module uses random undersampling to process the majority of Android benign samples to obtain an undersampled Android software sample data set;

[0019] The oversampling processing module uses oversampling based on boundary density weighting to process the minority class of Android malicious samples and obtain an oversampled Android software sample dataset;

[0020] A second undersampling processing module, using evolutionary screening undersampling processing to resample the Android software sample data set to obtain a balanced Android software sample data set; the resampled Android software sample data set includes an undersampled Android software sample data set and an oversampled Android software sample data set;

[0021] The training module inputs the balanced Android software sample data set into the Android malware detection model to obtain a detection result, and calculates a corresponding performance indicator based on the detection result; uses a binary particle swarm optimization algorithm to tune the hyperparameters of the Android malware detection model to train the Android malware detection model; the binary particle swarm optimization algorithm uses the data dimension of the balanced Android software sample data set as the search space, the hyperparameters of the Android malware detection model as the particles, and the performance indicator obtained from the detection result as the fitness value.

[0022] In a third aspect of the present invention, the present invention provides a computer device, comprising: a processor and a memory; the processor is used to execute a computer program stored in the memory, so that the computer device executes the training method of an Android malware detection model described in the first aspect of the present invention.

[0023] The present invention adopts a new combination of random undersampling, oversampling based on boundary density weighting and evolutionary screening undersampling to control the class size during the resampling process to avoid feature loss and improve the detection of minority classes. It achieves class balance of Android software data, while avoiding overfitting and underfitting of the learner, and reducing the training time of the Android malware detection model. The binary particle swarm optimization algorithm intelligently adjusts the behavior of the particle swarm, optimizes the parameters of the Android malware detection model and searches for the global optimal solution according to the changes in the search space and the state of the particles, thereby improving the performance and accuracy of the Android malware detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a flow chart of a training method for an Android malware detection model in an embodiment of the present invention;

[0025] Figure 2 A flowchart of generating an oversampled Android software sample data set based on boundary density weighting in an embodiment of the present invention;

[0026] Figure 3 This is a flow chart of tuning parameters of an Android malware detection model using a binary particle swarm optimization algorithm in an embodiment of the present invention;

[0027] Figure 4 Schematic diagram of the structure of a training device for an Android malware detection model in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Figure 1 is a training method for an Android malware detection model according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0031] S1. Obtain an original Android software sample data set, where the original Android software sample data set is an unbalanced data set, including Android malicious samples of a minority class and Android benign samples of a majority class; S2. Use random undersampling to process Android benign samples of the majority class to obtain an under-sampled Android software sample data set;

[0032] S3, using oversampling based on boundary density weighting to process the minority class of Android malicious samples to obtain an oversampled Android software sample dataset;

[0033] S4, using evolutionary screening undersampling to resample the Android software sample data set to obtain a balanced Android software sample data set; the resampled Android software sample data set includes an undersampled Android software sample data set and an oversampled Android software sample data set;

[0034] S5. Inputting the balanced Android software sample data set into an Android malware detection model to obtain a detection result, and calculating a corresponding performance indicator based on the detection result;

[0035] S6. Using a binary particle swarm optimization algorithm to tune the hyperparameters of the Android malware detection model to train the Android malware detection model;

[0036] The binary particle swarm optimization algorithm uses the data dimension of the balanced Android software sample data set as the search space, the hyperparameters of the Android malware detection model as particles, and the performance index obtained from the detection result as the fitness value.

[0037] In the embodiment of the present invention, in step S1, Android sample data can be extracted from open source malicious sample libraries such as Androzoo and VirusShare. When obtaining the Android software sample data set, the type of the original sample (Android malware or Android benign software) can be known at the same time, that is, the specific number of Android malware in the Android software sample data set can be known at this time; a large number of Android samples in the Android software sample data set can reduce the impact of randomness on the model. In order to obtain good training capabilities, at least 20,000 samples are used, among which the ratio of benign samples to malicious samples can be 9:1.

[0038] In the embodiments of the present invention, it is considered that traditional oversampling will synthesize a large amount of data and generate noise in severely skewed datasets, which greatly increases the computational cost of training and leads to overfitting. Without constraints, some undersampling techniques may remove too many samples from the minority class, resulting in loss of significant features and underfitting. Therefore, the present invention takes advantage of oversampling and undersampling and proposes a hybrid resampling strategy to control the class size during the resampling process to avoid feature loss and improve the detection of minority classes. The average class size of all samples is calculated as the baseline for resampling, and the sample average class N is used as the baseline for resampling. AvgSize The size of is determined by the ratio of the total number of samples to the corresponding sample type. If the number of majority class samples is larger than the average class size, the number will be reduced to the average class size, and the number of minority classes will be reduced to the average class size. Finally, noise data and redundant information are removed from all samples. At the same time, the evolutionary screening undersampling method is introduced to remove noise samples and overlapping samples in the resampled Android software sample dataset to further optimize the Android software sample dataset.

[0039] In the embodiment of the present invention, in step S2, a random under-sampling method is used to randomly select a part of the Android benign samples from the majority class, so that the number of selected majority class samples is close to or the number of average class samples, forming an under-sampled Android software sample data set NS.

[0040] In an embodiment of the present invention, in step S3, boundary density weighted oversampling is used to increase the number of minority class samples to a number close to or equal to the number of samples of the average class. For different minority class samples, different cost weights need to be assigned according to their distribution density and the positional relationship of the majority class samples. The weight represents the importance of the minority class sample and determines how many samples are synthesized based on the minority class sample. The generation of synthetic samples should be constrained by the limited distance. It is assumed that the direction of the difficulty of learning minority class samples should be the connection direction with the nearest neighbor majority class sample. If the synthetic sample is generated between each minority class sample and its nearest neighbor majority class sample, the sample can easily change the boundary of the class classifier. The closer the position of the synthetic sample distribution is to the majority class sample, the more the decision boundary of the minority class may be expanded.

[0041] In the embodiment of the present invention, in step S3, Figure 2 As shown, the oversampling based on boundary density weighting is used to process the minority class of Android malicious samples, and the oversampled Android software sample data set obtained includes:

[0042] S301, using the K nearest neighbor algorithm to calculate the Euclidean distance between the minority class sample and other samples, and obtain K nearest neighbor samples;

[0043] S302, calculating the cost weight of the minority class sample according to the number of majority class samples in the K nearest neighbor samples of the minority class sample and the number of minority class samples in the neighbors of the minority class sample;

[0044] S303, calculating the distance limit between the minority class sample and other samples according to the number of majority class samples in the K nearest neighbor samples of the minority class sample and the number of minority class samples in the neighbors of the minority class sample;

[0045] S304, determining the number of synthetic samples to be generated according to the number of minority class samples, the cost weight of the minority class samples, and the average class size of the original Android software sample data set;

[0046] S305, generating random points between the minority class sample and the nearest majority class sample, and these random points are used as new synthetic samples, and the distance between the minority class sample and the new synthetic sample does not exceed the distance limit;

[0047] S306. Obtain an oversampled Android software sample data set according to the number of synthetic samples that need to be generated for the minority class samples and the distance limit between the minority class samples and other samples.

[0048] In this embodiment of the present invention, the cost weight W of the minority class samples is i The following points are mainly considered in the setting of : (1) Minority samples near the boundary should be given higher weights than those far from the boundary, because minority samples near the boundary can provide more decision-making information; (2) Sparse minority samples are more important than dense minority samples, because sparse minority samples are important samples that affect the performance of the classifier, and more synthetic samples are needed to balance samples of different classes; (3) If minority samples are close to majority samples and are densely distributed, while other minority samples are also close to majority samples but are sparsely distributed, then the former should be given a higher weight because they have a greater impact on the classifier performance.

[0049] For example, in some embodiments, different cost weights need to be assigned to different minority class samples according to their distribution density and the positional relationship of the majority class samples, and normalized so that the sum of all weights is equal to 1. The cost weight of the minority class sample is the ratio or noise ratio between the number of majority class samples in the K nearest neighbor samples of the minority class sample and the number of minority class samples in the neighbors of the minority class sample. The noise ratio refers to the ratio of noise added to the original data. The specific value of this ratio can be adjusted according to different application scenarios and requirements, and can be expressed as:

[0050]

[0051] Where a represents the noise value, which can be 0, 1, 2, etc. maj represents the number of majority class samples in the neighbors of minority class samples, O min Represents the number of minority samples in the neighbors of minority samples, from which the cost weights W of different minority samples are calculated i .

[0052] In the embodiment of the present invention, the distance limit d i The setting of d mainly considers the following two points: (1) The distance between sparsely distributed minority samples and their generated synthetic samples is farther than the distance between densely distributed minority samples and their generated synthetic samples, because the former needs to generate a wider distance limit d. i To improve the performance of the classifier; (2) It is more important for minority class samples to be close to densely distributed majority class samples than for minority class samples to be close to sparsely distributed majority class samples. The former should be assigned a wider distance limit.

[0053] For example, in some embodiments, the distance limit when generating synthetic samples is adjusted according to the density characteristics around the minority class samples to ensure that the generated synthetic samples are reasonably distributed. The distance limit between the minority class samples and other samples is the ratio value or noise ratio value between the number of majority class samples in the K nearest neighbor samples of the minority class samples and the number of neighbor samples in the K nearest neighbor samples of the minority class samples. The distance limit is calculated as follows:

[0054]

[0055] Where b represents the noise value, which can be 0, 1, 2, etc. maj represents the number of majority class samples in the neighbors of minority class samples, O min Represents the number of minority samples in the neighbors of minority samples, from which the synthetic sample distance limit d of different minority samples is calculated i .

[0056] In the embodiment of the present invention, a synthetic sample is generated between each minority class sample and its nearest majority class sample, and for each minority class sample, its nearest majority class sample is found. Random points are generated between the minority class sample and the nearest majority class sample, and these random points are used as new synthetic samples, and the random points do not exceed the distance limit. According to the calculated weight, the number of synthetic samples to be generated is determined, which can be expressed as:

[0057] New i =W i / W*(N AvgSize -mins)

[0058] Among them, W i represents the cost weights of different minority class samples, W represents the sum of sample weights, N AvgSize represents the average class size, mins represents the number of minority class samples, x i Represents the current minority class sample.

[0059] According to the number of synthetic samples New i , the formula for linear synthetic samples is as follows:

[0060]

[0061] Among them, r represents a i ], x i represents the current minority class sample, x maj represents the majority class sample closest to it, d i represents the synthetic sample distance limit of minority class samples, Represents a new synthesized sample.

[0062] After the resampling process of step S2 and step S3, a balanced Android software sample data set can be obtained; and the balanced Android software sample data set needs to be further optimized. In step S4 of this embodiment, the noise samples and overlapping samples in the resampled Android software sample data set are removed by the undersampling method of evolutionary screening; the undersampling method of evolutionary screening includes the nearest neighbor undersampling algorithm, Tomek Links undersampling algorithm, clustering-based undersampling method, and neighborhood cleaning rule undersampling algorithm. Taking the Tomek Links undersampling algorithm as an example, Tomek Links refers to samples of two different categories, which are each other's nearest neighbors and no other samples are closer than the distance between them. These sample pairs are usually considered to be noise or located on the decision boundary. By deleting one sample in Tomek Links (usually the majority class sample), the data set can be further cleaned up. Assume that two sample points x i and x j Belong to different categories in the resampled Android software sample dataset: xi belongs to the minority class, x j Belongs to the majority class. Let d(x i ,x j ) represents x i and x j If there is no third sample point x k Satisfy d(x k ,x i ) <d(x i ,x j ) or d(x k ,x j ) <d(x i ,x j ) condition, then this pair (x i ,x j ) are Tomek links. Two samples are called Tomek links if one of them is noise or both samples are close to the boundary. If one sample of Tomek links belongs to the majority class, the sample of the majority class is deleted. For each minority class, if it cannot find the nearest neighbor belonging to the majority class or no Tomek links are found in its nearest neighbors, the sample is retained. By removing Tomeklinks, the overlapping samples between classes can be cleared and the nearest neighbors of the samples all belong to the same class, resulting in more accurate classification.

[0063] In an embodiment of the present invention, in step S5, a balanced Android software sample data set is used as training set data to train an Android malware detection model, so that the trained Android malware detection model can be used for detecting Android malware; wherein the Android malware detection model is implemented using a machine learning module or a deep learning model, such as a support vector machine (SVM), a random forest, etc., and also such as a convolutional neural network (CNN), a graph convolutional neural network (GCN), a recurrent neural network (RNN), etc.

[0064] In the embodiment of the present invention, Figure 3 As shown, the method of using a binary particle swarm optimization algorithm to tune the hyperparameters of the Android malware detection model to train the Android malware detection model includes:

[0065] S501, initializing target parameters, constructing particle positions and velocities based on the feature set of the balanced Android software sample data set and the Android malware detection model parameters in the target parameters, and generating a particle population;

[0066] S502, calculating the fitness value of each particle in the particle population at the current moment, and determining the global optimal position of the particle population at the current moment through the fitness value;

[0067] S503, updating the search speed of each particle at the current moment according to the global optimal position at the current moment, and updating the position of each bat at the current moment according to the updated search speed of each particle and the linearly decreasing inertia weight;

[0068] S504, judging whether the current moment meets the preset convergence condition, if so, outputting the global optimal position at the current moment, if not, returning to the fitness value of each particle in the particle population at the current moment, and determining the global optimal position of the particle population at the current moment by the fitness value;

[0069] S505. Import the classifier parameters in the output global optimal position into the Android malware detection model to parameterize the Android malware detection model to update the parameters of the Android malware detection model until the iterative process ends and the Android malware detection model is trained.

[0070] In a preferred embodiment of the present invention, step S5 creates N particles in the d-dimensional search space and randomly initializes their positions and velocities. Each particle represents a possible optimal solution, and the algorithm adjusts and evaluates the particles to find the best solution (particle) to maximize the learning performance. The position x of the particle irepresents the current solution, i.e., the parameter combination of SVM, such as the penalty parameter C and the kernel function parameter gamma. The particle's velocity v i Indicates the direction and step size of particle movement. The fitness value of a particle indicates the quality of the solution, and cross-validation is used to evaluate the fitness value of each particle.

[0071] Step S511: In each stage, the i-th particle (position x i , the speed is v i ) moves towards the best position it has experienced in the current iteration (tth time) (personal best position (Pbest)) and the best position determined in the entire search space (global best position (Gbest)). Considering the dimension of the particle, the new velocity of the i-th particle in the search space is obtained The formula is as follows.

[0072]

[0073] in, represents the position of the i-th particle in the d-th dimension at the t-th iteration, represents the velocity of the ith particle in the dth dimension at the tth iteration, r1 and r2 represent two random numbers ranging from 0 to 1. c1 and c2 represent acceleration coefficients, which control the influence of individual and global optimal particles. ω represents the inertia weight, which plays a balancing role in global and local search. and denote the best position recorded in the entire search space and the personal best position experienced by the ith particle in the tth execution stage, respectively.

[0074] Step S512: According to the obtained new velocity of the particle, the formula for updating the new position of each particle is as follows:

[0075]

[0076] in, represents the position of the i-th particle in the d-th dimension at the t-th iteration, represents the velocity of the ith particle in the dth dimension at the t+1th iteration, from which the position of the ith particle in the dth dimension at the t+1th iteration is calculated

[0077] Step S513: The fitness value is calculated based on the cross-validation method. In each iteration, the fitness value of each particle is calculated by performing k-fold cross-validation on the training data set. The fitness value can be the classification accuracy, F1 score or other performance indicators.

[0078] Step S514: The inertia weight ω adopts a linear decreasing strategy, gradually decreasing from the initial value to the final value to balance the capabilities of global search and local search. The specific formula is:

[0079]

[0080] Among them, ω start represents the starting value of the inertia weight, ω end represents the starting value of the inertia weight, t represents the number of iterations, and t max Indicates the maximum number of iterations.

[0081] Step S515: If the new position of the particle exceeds the preset search space range, its position can be adjusted back to the boundary value, or the position and speed can be randomly reinitialized. In addition, a speed limit strategy can be adopted to ensure that the speed of the particle does not exceed a certain maximum value.

[0082] Step S516: Repeat the fitness calculation and speed position update until the maximum number of iterations is reached and the optimal solution is obtained. The model training and testing are performed using the 10-fold cross validation method. The feature vector set is randomly divided into ten mutually exclusive groups of data, nine of which are selected as training sets each time, and the remaining group is selected as a test set. Finally, the average of the results of the ten data is taken as the model. The sample is judged whether it is malicious based on the classification results, and finally the efficient detection of Android malware is achieved.

[0083] In a preferred embodiment of the present invention, in order to further improve the detection efficiency of the Android malware detection model, this embodiment further processes the balanced Android software sample data set, decompiles these samples using the decompilation tool androguard, and mainly uses the androlyze.py module in androguard to extract subsequent permission features and API features, such as application application permissions, camera call permissions, contact information API acquisition, SMS sending API and other features.

[0084] Among them, this embodiment mainly uses the androlyze.py module in androguard to extract the permission features and API features and construct the original feature vector. Figure 4 As shown, the feature vector construction process is as follows:

[0085] Step S601: traverse all features of all samples in the original data set and construct an original feature vector matrix, where each column of the matrix represents a feature, and each row represents a sample. The matrix value consists of "0" and "1", where "0" indicates that the application does not contain this feature, and "1" indicates that the application contains this feature. All values ​​of the original feature vector matrix are initialized to "0";

[0086] Step S602: traverse each sample in the original data set, and if the sample contains a feature in the original feature vector matrix, the value corresponding to the feature in the matrix is ​​changed from "0" to "1";

[0087] Step S603: After traversing all samples in the original data set, the original feature vector matrix is ​​obtained.

[0088] In a preferred embodiment of the present invention, this embodiment can also perform dimensionality reduction processing on the original eigenvector matrix, construct a set of orthogonal bases, project the high-dimensional data onto a hyperplane, reduce the high-dimensional data to a low dimension, and make the variance of the data after dimensionality reduction as large as possible, so that the data after dimensionality reduction retains most of the information in the original high-dimensional data. The process of principal component analysis is as follows:

[0089] Step S701: For a sample set X = {x1, x2, ..., x n}, the data is centralized so that each feature has a zero mean, ensuring that all features are on the same scale, preventing some features from having an unbalanced impact on the PCA results due to different dimensions, and making the calculation of the covariance matrix more accurate. The formula used is as follows:

[0090]

[0091] Among them, x i represents the data vector of the i-th sample, and n represents the total number of samples.

[0092] Step S702: Calculate the covariance matrix C of the centralized data. The covariance matrix describes the linear relationship between each feature and reflects the distribution of the data and the correlation between the features.

[0093]

[0094] Among them, X represents the centralized data matrix, X T represents the transpose of the centered data matrix, and n represents the total number of samples.

[0095] Step S703: Perform eigenvalue decomposition on the covariance matrix C to obtain the eigenvalue λ i and the eigenvector v i The eigenvalue represents the variance of the data in the direction of the corresponding eigenvector. The eigenvector represents the main direction (principal component) of the data. Through eigenvalue decomposition, the principal component of the data can be found, that is, the direction that retains the main information of the data. The formula for eigenvalue decomposition is as follows:

[0096] Cv i =λ i v i

[0097] Among them, λ i represents the eigenvalue, v i represents the corresponding eigenvector, and C represents the covariance matrix.

[0098] Step S704: Take the first k largest eigenvalues ​​(k is the target dimension) and calculate the corresponding eigenvector V = (v1, v2, ..., v k ), construct a new low-dimensional sample set X' with V as a set of bases. Selecting the principal component can maximize the retention of the main information of the data while reducing the dimension of the data. By selecting the eigenvectors with the largest eigenvalues ​​of the first k, it can ensure that the variance of the retained data is the largest and the information loss is minimized. The formula for transforming the data from the original space to the new low-dimensional space using the selected eigenvectors is as follows:

[0099] X′=XV k

[0100] Among them, X' represents the data after dimension reduction, V k represents the selected eigenvector matrix, and X represents the centered data matrix.

[0101] Through the above embodiments, high-dimensional data is converted into low-dimensional data, which can significantly reduce the amount of calculation and improve the calculation efficiency. This is particularly important for large-scale Android software sample data sets and Android malware detection models with high real-time requirements. In this process, factors that do not contribute much to training and prediction are further removed, and the main features that affect the model performance are retained, thereby improving the generalization ability and prediction accuracy of the Android malware detection model.

[0102] In the embodiment of the present invention, Figure 4 As shown, the present invention also provides a training device for an Android malware detection model, comprising:

[0103] A data acquisition module is used to acquire an original Android software sample data set, where the original Android software sample data set is an unbalanced data set, including a minority class of Android malicious samples and a majority class of Android benign samples;

[0104] The first undersampling processing module uses random undersampling to process the majority of Android benign samples to obtain an undersampled Android software sample data set;

[0105] The oversampling processing module uses oversampling based on boundary density weighting to process the minority class of Android malicious samples and obtain an oversampled Android software sample dataset;

[0106] A second undersampling processing module, using evolutionary screening undersampling processing to resample the Android software sample data set to obtain a balanced Android software sample data set; the resampled Android software sample data set includes an undersampled Android software sample data set and an oversampled Android software sample data set;

[0107] The training module inputs the balanced Android software sample data set into the Android malware detection model to obtain a detection result, and calculates a corresponding performance indicator based on the detection result; uses a binary particle swarm optimization algorithm to tune the hyperparameters of the Android malware detection model to train the Android malware detection model; the binary particle swarm optimization algorithm uses the data dimension of the balanced Android software sample data set as the search space, the hyperparameters of the Android malware detection model as the particles, and the performance indicator obtained from the detection result as the fitness value.

[0108] In an embodiment of the present invention, the present invention further provides a computer device, including: a processor and a memory;

[0109] The memory is used to store computer programs;

[0110] The processor is used to execute the computer program stored in the memory so that the computer device executes the training method of an Android malware detection model described in the present invention.

[0111] In an embodiment of the present invention, a memory stores executable instructions, which are executed by a processor to perform the training method described above. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous connection dynamic random access memory (SLDRAM), and direct memory bus random access memory (DRRAM). It should be noted that the memory of the method described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0112] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0113] In an embodiment of the present invention, the constrained resampling algorithm used in the present invention significantly reduces the overlapping area between the minority class and the majority class, and neither generates a large number of noise samples nor does it appear that the sample aggregates, while avoiding the generation of redundant samples, and the majority class is consistent with the original distribution. The minority class data synthesized by oversampling based on boundary density weighting is extended along the direction of the ideal decision boundary, which not only enhances the sample boundary, but also ensures a very clear classification boundary, and does not synthesize more samples in the majority class area. This enables the present invention to reduce the overlap of boundary samples, thereby optimizing the training efficiency and detection accuracy of the Android malware detection model.

[0114] A person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer-readable storage medium, which can include: ROM, RAM, disk or CD, etc.

[0115] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A training method for an Android malware detection model, characterized in that: The method comprises: Obtaining an original Android software sample data set, where the original Android software sample data set is an unbalanced data set, including a minority class of Android malicious samples and a majority class of Android benign samples; Random undersampling is used to process the majority of Android benign samples to obtain an under-sampled Android software sample dataset; The oversampling based on boundary density weighting is used to process the minority class of Android malicious samples to obtain the oversampled Android software sample dataset; The resampled Android software sample data set is processed by evolutionary screening undersampling to obtain a balanced Android software sample data set; the resampled Android software sample data set includes an undersampled Android software sample data set and an oversampled Android software sample data set; Inputting the balanced Android software sample data set into an Android malware detection model to obtain a detection result, and calculating a corresponding performance indicator based on the detection result; Using a binary particle swarm optimization algorithm to tune the hyperparameters of the Android malware detection model to train the Android malware detection model; The binary particle swarm optimization algorithm uses the data dimension of the balanced Android software sample data set as the search space, the hyperparameters of the Android malware detection model as particles, and the performance index obtained from the detection result as the fitness value.

2. The method for training an Android malware detection model according to claim 1, characterized in that: The oversampling based on boundary density weighting is used to process the Android malicious samples of minority classes, and the oversampled Android software sample data set obtained includes: The K nearest neighbor algorithm is used to calculate the Euclidean distance between the minority class samples and other samples, and K nearest neighbor samples are obtained; The cost weight of the minority class samples is calculated based on the number of majority class samples in the K nearest neighbor samples of the minority class samples and the number of minority class samples in the neighbors of the minority class samples; According to the number of majority class samples in the K nearest neighbor samples of the minority class samples and the number of minority class samples in the neighbors of the minority class samples, the distance limit between the minority class samples and other samples is calculated; Determine the number of synthetic samples to be generated based on the number of minority class samples, the cost weight of minority class samples, and the average class size of the original Android software sample dataset; Generating random points between the minority class sample and the nearest majority class sample, the random points being used as new synthetic samples, wherein the distance between the minority class sample and the new synthetic sample does not exceed the distance limit; According to the number of synthetic samples that need to be generated for minority samples and the distance limit between minority samples and other samples, an oversampled Android software sample dataset is obtained.

3. The training method of an Android malware detection model according to claim 2, characterized in that: The setting conditions of the cost weight of the minority class samples include: 1) the weight of the minority class samples close to the boundary is higher than the weight of the minority class samples far from the boundary; 2) the weight of the sparse minority class samples is higher than the weight of the dense minority class samples.

4. A method for training an Android malware detection model according to claim 2 or 3, characterized in that: The cost weight of the minority class sample is the ratio value or the noise ratio value between the number of majority class samples in the K nearest neighbor samples of the minority class sample and the number of minority class samples in the neighbors of the minority class sample.

5. The method for training an Android malware detection model according to claim 2, characterized in that: The setting conditions of the distance limit between the minority class samples and other samples include: 1) the distance between the sparsely distributed minority samples and the synthetic samples generated by them is smaller than the distance between the densely distributed minority samples and the synthetic samples generated by them; 2) the distance limit of the minority class samples close to the densely distributed majority class samples is larger than the distance limit of the minority class samples close to the sparsely distributed majority class samples.

6. A method for training an Android malware detection model according to claim 2 or 5, characterized in that: The distance between the minority class sample and other samples is limited to the ratio value or noise ratio value between the number of majority class samples in the K nearest neighbor samples of the minority class sample and the number of neighbor samples in the K nearest neighbor samples of the minority class sample.

7. The method for training an Android malware detection model according to claim 1, characterized in that: The method of using evolutionary screening undersampling to process the resampled Android software sample data set to obtain a balanced Android software sample data set includes using an evolutionary screening undersampling method to remove noise samples and overlapping samples in the resampled Android software sample data set; the evolutionary screening undersampling method includes a nearest neighbor undersampling algorithm, a Tomek Links undersampling algorithm, a clustering-based undersampling method, and a neighborhood cleaning rule undersampling algorithm.

8. The method for training an Android malware detection model according to claim 1, characterized in that: The step of using a binary particle swarm optimization algorithm to tune the hyperparameters of the Android malware detection model to train the Android malware detection model includes: Initializing target parameters, constructing particle positions and velocities based on the feature set of the balanced Android software sample data set and the Android malware detection model parameters in the target parameters, and generating a particle population; Calculate the fitness value of each particle in the particle population at the current moment, and determine the global optimal position of the particle population at the current moment through the fitness value; The search speed of each particle at the current moment is updated by the global optimal position at the current moment, and the position of each bat at the current moment is updated by the updated search speed of each particle and the linearly decreasing inertia weight; Determine whether the current moment meets the preset convergence condition. If so, output the global optimal position at the current moment. If not, return to calculate the fitness value of each particle in the particle population at the current moment, and determine the global optimal position of the particle population at the current moment through the fitness value; The classifier parameters in the output global optimal position are imported into the Android malware detection model to parameterize the Android malware detection model to update the parameters of the Android malware detection model until the iterative process is completed and the Android malware detection model is trained.

9. A training device for an Android malware detection model, characterized in that: include: A data acquisition module is used to acquire an original Android software sample data set, where the original Android software sample data set is an unbalanced data set, including a minority class of Android malicious samples and a majority class of Android benign samples; The first undersampling processing module uses random undersampling to process the majority of Android benign samples to obtain an undersampled Android software sample data set; The oversampling processing module uses oversampling based on boundary density weighting to process the minority class of Android malicious samples and obtain an oversampled Android software sample dataset; A second undersampling processing module, using evolutionary screening undersampling processing to resample the Android software sample data set to obtain a balanced Android software sample data set; the resampled Android software sample data set includes an undersampled Android software sample data set and an oversampled Android software sample data set; A training module, inputting the balanced Android software sample data set into an Android malware detection model to obtain a detection result, and calculating a corresponding performance indicator based on the detection result; A binary particle swarm optimization algorithm is used to tune the hyperparameters of the Android malware detection model to train the Android malware detection model; the binary particle swarm optimization algorithm uses the data dimension of a balanced Android software sample data set as a search space, the hyperparameters of the Android malware detection model as particles, and the performance index obtained from the detection result as a fitness value.

10. A computer device, characterized in that: include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory so that the computer device executes the training method of an Android malware detection model as described in any one of claims 1 to 8.

Images