A training method, device and equipment of an Android malware detection model

Abstract

The present application belongs to the field of Android malware detection in information security, and particularly relates to a training method, device and equipment of an Android malware detection model; the method comprises the following steps: obtaining an original Android software sample dataset; using random undersampling to process the majority of Android benign samples; using boundary density weighting-based oversampling to process the minority of Android malicious samples; using evolutionary screening undersampling to process the resampled Android software sample dataset; these methods can optimize the Android software sample dataset; based on the optimized Android software sample dataset, the hyperparameters of the classifier of the Android software detection model are optimized by using a binary particle swarm optimization algorithm, so that iterative training of the Android software detection model is realized. The present application can improve the training efficiency and detection accuracy of the Android malware classification model.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of malware detection, and particularly relates to a training method and device of an Android malware detection model and equipment. BACKGROUND

[0002] With the development of mobile networks, smart mobile devices have rapidly popularized, among which Android devices account for a large share, and the number of Android applications has also shown explosive growth. While users enjoy the convenience brought by Android applications, their privacy and security are also greatly threatened. According to STATISTA statistics, the number of global smartphone users in 2022 was about 6.6 billion, and the number of Chinese smartphone users was close to 1.04 billion, accounting for more than 15% of the total users, and it is estimated that by 2026, the number of Chinese smartphone users will increase to about 1.18 billion.

[0003] In the Android application market, most applications are benign, while malware is relatively rare. This leads to the problem of class imbalance in the training data set, making machine learning models more likely to be biased towards the majority class, and the performance of malware detection for the minority class is insufficient. The scarcity of minority class samples, including the absolute scarcity of the scarcity of the minority samples themselves and the relative scarcity of the minority samples themselves not being few but the majority samples being too many. It is difficult to distinguish the characteristics and differences between noise data and minority class data, and the denoising work is difficult. The classifier with the overall classification effect as the learning goal shows the problem of bias towards the majority class, i.e. normal samples, thereby ignoring the minority class malware samples. This imbalance not only leads to poor performance of traditional classification algorithms in detecting malware, but also may lead to serious security risks. The classifier in actual application appears high false positive rate and false negative rate, which is specifically manifested that the classifier can better identify normal samples, but the recognition ability of malware samples is poor, which cannot effectively detect and intercept malware, and further affects the security and privacy protection of user devices.

[0004] The common methods for dealing with class imbalance problems in existing research include data-level sampling techniques such as oversampling and undersampling, which balance the number of samples by adjusting the data distribution to improve the training effect of the classifier. Secondly, algorithm-level adjustment methods such as cost-sensitive learning and ensemble methods, which enhance the recognition ability of the classifier for minority class samples by introducing sample weights or constructing multiple classifiers during training. Oversampling balances the dataset by increasing the number of minority class samples, but may cause overfitting because the newly generated samples do not always represent the actual situation well. Undersampling balances the dataset by reducing the number of majority class samples, which can effectively reduce the amount of data, but may lose a lot of useful information and affect the generalization ability of the model. These methods improve the performance of the classifier while also bringing new challenges, which need to be carefully selected and adjusted in practical applications. Therefore, how to reduce the impact of class imbalance and improve the detection accuracy of malicious samples in Android malware detection is one of the key research problems.

[0005] Currently, Chinese patent CN117150491A proposes a malware detection method and device, which includes decompiling the APK file of the software to be detected to obtain a decompiled file; inputting the decompiled file into a pre-trained malware detection model to obtain a detection result. By combining application-based sampling strategies and family-based sampling strategies, the samples are effectively balanced, meta-learning is improved, and the diversity between samples is considered, thereby effectively solving the sample imbalance and family missing problems in Android malware family classification, improving the classification effect of malware and the ability to detect new malware.

[0006] However, these existing technologies do not consider the original distribution of minority samples when synthesizing data, and treat boundary samples and non-boundary samples equally, which may produce redundant samples when synthesizing samples in the non-boundary region. In addition, when oversampling, only integer multiples of minority class samples can be added, and in most cases, absolute consistency in the number of minority and majority class samples cannot be achieved. Even if the distribution difference of minority class samples is considered, it has a certain enhancing effect on the classification decision boundary, but if a sample is particularly difficult to learn, the sample is likely to be a noise sample, and synthesizing a large number of new samples around it may be noise samples, which may amplify the noise of the dataset and affect the classification performance of the classifier. And synthesizing new samples near the boundary samples, which may cause serious overlap of samples, is not conducive to subsequent classification. SUMMARY

[0007] To solve the problems in the prior art, the application provides a training method, device and equipment for an Android malware detection model, random undersampling is used to process Android benign samples of a majority class, oversampling based on boundary density weighting is used to process Android malicious samples of a minority class, undersampling is used to process resampled Android samples by evolutionary screening, so as to further optimize an Android software sample dataset, and a binary particle swarm optimization algorithm is used to optimize hyperparameters of a classifier after the Android sample dataset is optimized, so as to improve the detection efficiency of a classification model and improve the detection accuracy of the minority class samples.

[0008] In a first aspect of the application, the application provides a training method for an Android malware detection model, the method comprising:

[0009] An original Android software sample dataset is obtained, the original Android software sample dataset being an unbalanced dataset, comprising Android malicious samples of a minority class and Android benign samples of a majority class;

[0010] Random undersampling is used to process the Android benign samples of the majority class, so as to obtain an undersampled Android software sample dataset;

[0011] Oversampling based on boundary density weighting is used to process the Android malicious samples of the minority class, so as to obtain an oversampled Android software sample dataset;

[0012] Evolutionary screening is used to process a resampled Android software sample dataset by undersampling, so as to obtain a balanced Android software sample dataset; the resampled Android software sample dataset comprises the undersampled Android software sample dataset and the oversampled Android software sample dataset;

[0013] The balanced Android software sample dataset is input into an Android malware detection model, a detection result is obtained, and a corresponding performance index is calculated based on the detection result;

[0014] A binary particle swarm optimization algorithm is used to optimize hyperparameters of the Android malware detection model, so as to train the Android malware detection model;

[0015] The binary particle swarm optimization algorithm uses the data dimension of the balanced Android software sample dataset as a search space, uses the hyperparameters of the Android malware detection model as particles, and uses the performance index obtained from the detection result as a fitness value.

[0016] In a second aspect of the application, the application further provides a training device for an Android malware detection model, the device comprising:

[0017] A data acquisition module acquires an original Android software sample dataset, which is an unbalanced dataset including Android malicious samples of a minority class and Android benign samples of a majority class;

[0018] A first undersampling processing module adopts random undersampling to process the Android benign samples of the majority class to obtain an undersampled Android software sample dataset;

[0019] A oversampling processing module adopts boundary density weighted oversampling to process the Android malicious samples of the minority class to obtain an oversampled Android software sample dataset;

[0020] A second undersampling processing module adopts evolutionary screening undersampling to process a resampled Android software sample dataset to obtain a balanced Android software sample dataset; the resampled Android software sample dataset includes the undersampled Android software sample dataset and the oversampled Android software sample dataset;

[0021] A training module inputs the balanced Android software sample dataset into an Android malicious software detection model to obtain a detection result and calculate corresponding performance indicators based on the detection result; a binary particle swarm optimization algorithm is adopted to optimize hyperparameters of the Android malicious software detection model to train the Android malicious software detection model; the binary particle swarm optimization algorithm takes the data dimension of the balanced Android software sample dataset as a search space, takes the hyperparameters of the Android malicious software detection model as particles, and takes the performance indicators obtained from the detection result as fitness values.

[0022] In a third aspect of the present application, a computer device is provided, comprising a processor and a memory; the processor is configured to execute a computer program stored in the memory to enable the computer device to perform the training method of the Android malicious software detection model according to the first aspect of the present application.

[0023] The present application adopts a new combination of random undersampling, boundary density weighted oversampling and evolutionary screening undersampling to control the class size in the resampling process, to avoid feature loss and improve the detection of the minority class. The class balance of the Android software data is achieved, while the overfitting and underfitting of the learner are avoided, and the training time of the Android malicious software detection model is reduced. The binary particle swarm optimization algorithm intelligently adjusts the behavior of the particle swarm, and according to the changes of the search space and the state of the particles, the optimization of the parameters of the Android malicious software detection model and the search of the global optimal solution are realized, so as to improve the performance and accuracy of the Android malicious software detection model. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 The flowchart of the training method of the Android malicious software detection model in the embodiment of the present application;

[0025] Figure 2 A flow chart for generating a super-sampled Android software sample data set based on boundary density weighting in an embodiment of the present application;

[0026] Figure 3 A flow chart for parameter tuning of an Android malware detection model using a binary particle swarm optimization algorithm in an embodiment of the present application;

[0027] Figure 4 A structural schematic diagram of a training device for an Android malware detection model in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device including a series of steps or units does not necessarily have to include only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product, or device.

[0030] Figure 1 is a training method of an Android malware detection model in an embodiment of the present application, as shown in Figure 1 The method comprises the following steps:

[0031] S1, obtaining an original Android software sample data set, the original Android software sample data set being an unbalanced data set including Android malicious samples of a minority class and Android benign samples of a majority class; S2, processing the Android benign samples of the majority class using random under-sampling to obtain an under-sampled Android software sample data set;

[0032] S3, processing the Android malicious samples of the minority class using boundary density weighting-based oversampling to obtain a super-sampled Android software sample data set;

[0033] S4, adopt the evolutionary undersampling processing resampling Android software sample data set, get balanced Android software sample data set, the resampling Android software sample data set includes the undersampling Android software sample data set and the oversampling Android software sample data set;

[0034] S5, the balanced Android software sample data set is input into Android malware detection model, and the detection result is obtained, and the corresponding performance index is calculated based on the detection result;

[0035] S6, the hyperparameters of the Android malware detection model are optimized by using the binary particle swarm optimization algorithm to train the Android malware detection model;

[0036] Wherein, the binary particle swarm optimization algorithm takes the data dimension of the balanced Android software sample data set as the search space, takes the hyperparameters of the Android malware detection model as the particles, and takes the performance index obtained by the detection result as the fitness value.

[0037] In the embodiment of the application, Android sample data can be extracted from Androzoo, VirusShare and other open source malicious sample libraries in step S1, and the types (Android malware or Android benign software) of the original samples can be obtained when the Android software sample data set is obtained, that is, the specific number of Android malware in the Android software sample data set can be known at this time; A large number of Android samples in the Android software sample data set can reduce the influence of chance on the model, in order to obtain good training ability, at least 20000 samples are used, and the ratio of benign samples to malignant samples can be 9:1.

[0038] In the embodiment of the application, considering that the traditional oversampling will synthesize a large amount of data and produce noise in the seriously skewed data set, greatly increasing the calculation cost of training and leading to overfitting. Without constraints, some undersampling techniques may remove too many samples from the minority class, resulting in loss of significant features and underfitting. Therefore, the application utilizes the advantages of oversampling and undersampling, and proposes a hybrid resampling strategy to control the class size in the resampling process to avoid feature loss and improve detection of the minority class. The average class size N AvgSize is determined by the ratio of the total number of samples to the corresponding sample type, if the number of majority class samples is greater than the average class size, the number is reduced to the average class size, and the number of minority class is reduced to the average class size, and finally the noise data and redundant information of all samples are removed;At the same time, the evolutionary undersampling method is introduced to remove the noise samples and overlapping samples in the resampling Android software sample data set, so as to further optimize the Android software sample data set.

[0039] In the embodiment of the present application, in step S2, a random undersampling method is used to randomly select a part of the majority class of Android benign samples, so that the number of selected majority class samples is close to or equal to the number of average class samples, to form an undersampled Android software sample dataset NS.

[0040] In the embodiment of the present application, in step S3, the boundary density weighted oversampling is used to increase the number of minority class samples to close to or equal to the number of average class samples. For different minority class samples, different cost weights need to be assigned according to their distribution density and the positional relationship with the majority class samples. The weight represents the importance of the minority class sample and determines how many samples are synthesized according to the minority class sample. The generation of the synthesized sample should be constrained by the limited distance. It is assumed that the direction of learning the difficulty of the minority class sample should be the connection direction with the nearest neighbor majority class sample. If the synthesized sample is generated between each minority class sample and its nearest neighbor majority class sample, the sample can easily change the boundary of the class classifier. The closer the position of the synthesized sample distribution to the sample of the majority class, the more likely it is to expand the decision boundary of the minority class.

[0041] In the embodiment of the present application, in step S3, as shown in Figure 2 The boundary density weighted oversampling processing of the minority class Android malicious samples includes:

[0042] S301, using K nearest neighbor algorithm to calculate the Euclidean distance between the minority class sample and other samples, and obtaining K nearest neighbor samples;

[0043] S302, according to the number of majority class samples in the K nearest neighbor samples of the minority class sample and the number of minority class samples in the neighbors of the minority class sample, the cost weight of the minority class sample is calculated;

[0044] S303, according to the number of majority class samples in the K nearest neighbor samples of the minority class sample and the number of minority class samples in the neighbors of the minority class sample, the distance limit between the minority class sample and other samples is calculated;

[0045] S304, according to the number of minority class samples, the cost weight of the minority class sample and the average class size of the original Android software sample dataset, the number of synthesized samples to be generated is determined;

[0046] S305, generating random points between the minority class sample and the nearest majority class sample, which are used as new synthesized samples, and the distance between the minority class sample and the new synthesized sample does not exceed the distance limit;

[0047] S306, according to the number of synthesized samples to be generated by the minority class sample and the distance limit between the minority class sample and other samples, an oversampled Android software sample dataset is obtained.

[0048] In this embodiment of the present invention, the cost weight W of the minority class samples is i The following points are mainly considered in the setting of : (1) Minority samples near the boundary should be given higher weights than minority samples far from the boundary, because minority samples near the boundary can provide more decision information; (2) Sparse minority samples are more important than dense minority samples, because sparse minority samples are important samples that affect the performance of the classifier, and more synthetic samples are needed to balance samples of different classes; (3) If minority samples are close to majority samples and are densely distributed, while other minority samples are also close to majority samples but are sparsely distributed, then the former should be given a higher weight because they have a greater impact on the classifier performance.

[0049] For example, in some embodiments, different cost weights need to be assigned to different minority class samples based on their distribution density and positional relationship with the majority class samples, and normalized so that the sum of all weights is equal to 1. The cost weight of the minority class sample is the ratio between the number of majority class samples in the K nearest neighbor samples of the minority class sample and the number of minority class samples in the neighbors of the minority class sample, or the noise ratio value. The noise ratio value refers to the ratio of noise added to the original data. The specific value of this ratio can be adjusted according to different application scenarios and requirements, and can be expressed as:

[0050]

[0051] Where a represents the noise value, which can be 0, 1, 2, etc. maj represents the number of majority class samples in the neighbors of minority class samples, O min Represents the number of minority samples in the neighbors of the minority samples, from which the cost weights W of different minority samples are calculated i .

[0052] In the embodiment of the present invention, the distance limit d i The setting of d mainly considers the following two points: (1) The distance between sparsely distributed minority samples and their generated synthetic samples is farther than the distance between densely distributed minority samples and their generated synthetic samples, because the former needs to generate a wider distance limit d. i To improve the performance of the classifier; (2) It is more important for minority class samples to be close to densely distributed majority class samples than for minority class samples to be close to sparsely distributed majority class samples, and the former should be assigned a wider distance limit.

[0053] For example, in some embodiments, according to the density characteristics around the minority class samples, the distance limit when generating the synthetic samples is adjusted to ensure that the generated synthetic samples are reasonably distributed. The distance limit of the minority class samples from other samples is the ratio value between the number of majority class samples in the K nearest neighbor samples of the minority class samples and the number of neighbor samples in the K nearest neighbor samples of the minority class samples or the noise ratio value. The distance limit is calculated as follows:

[0054]

[0055] where b represents a noise value, which can take values 0, 1, 2, etc., O maj represents the number of majority class samples in the neighbors of the minority class samples, O min represents the number of minority class samples in the neighbors of the minority class samples, and thus the distance limit d i of the synthetic samples of different minority class samples is calculated.

[0056] In the embodiments of the present application, a synthetic sample is generated between each minority class sample and its nearest majority class sample. For each minority class sample, its nearest majority class sample is found. Random points are generated between the minority class sample and the nearest majority class sample, and these random points are used as new synthetic samples. The random points do not exceed the distance limit. According to the calculated weight, the number of synthetic samples that need to be generated is determined, which can be represented as:

[0057] New i = W i / W*(N AvgSize -mins)

[0058] where W i represents the cost weight of different minority class samples, W represents the sum of sample weights, N AvgSize represents the average class size, mins represents the number of minority class samples, and x i represents the current minority class sample.

[0059] According to the number of synthetic samples New i , the formula for linear synthetic samples is as follows:

[0060]

[0061] where r represents a random number between [0, d i ], x i represents the current minority class sample, x maj represents the nearest majority class sample, d i represents the synthetic sample distance limit of the minority class sample, represents the new synthetic sample.

[0062] After the resampling process of step S2 and step S3, a balanced Android software sample data set can be obtained; and the balanced Android software sample data set needs to be further optimized. In step S4 of this embodiment, the noise samples and overlapping samples in the resampled Android software sample data set are removed by the undersampling method of evolutionary screening; the undersampling method of evolutionary screening includes the nearest neighbor undersampling algorithm, Tomek Links undersampling algorithm, clustering-based undersampling method, and neighborhood cleaning rule undersampling algorithm. Taking the Tomek Links undersampling algorithm as an example, Tomek Links refers to samples of two different categories, which are each other's nearest neighbors and no other samples are closer than the distance between them. These sample pairs are usually considered to be noise or located on the decision boundary. By deleting one sample in Tomek Links (usually the majority class sample), the data set can be further cleaned up. Assume that two sample points x i and x j Belong to different categories in the resampled Android software sample dataset: xi belongs to the minority class, x j Belongs to the majority class. Let d(x i ,x j ) represents x i and x j If there is no third sample point x k Satisfy d(x k ,x i ) <d(x i ,x j ) or d(x k ,x j ) <d(x i ,x j ) condition, then this pair (x i ,x j ) are Tomek links. Two samples are called Tomek links if one of them is noise or both samples are close to the boundary. If one sample of Tomek links belongs to the majority class, the sample of the majority class is deleted. For each minority class, if it cannot find a nearest neighbor belonging to the majority class or no Tomek links are found among its nearest neighbors, the sample is retained. By removing Tomek links, overlapping samples between classes can be cleared, and the nearest neighbors of the samples all belong to the same class, resulting in more accurate classification.

[0063] In the embodiment of the present application, in step S5, the balanced Android software sample dataset is used as the training set data to train the Android malware detection model, so that the trained Android malware detection model can be used for the detection of Android malware; wherein the Android malware detection model is implemented by using a machine learning module or a deep learning model, such as a support vector machine (SVM), a random forest (Random Forest), and the like, and also such as a convolutional neural network (CNN), a graph convolutional neural network (GCN), a recurrent neural network (RNN), and the like.

[0064] In the embodiment of the present application, as shown in Figure 3 The step of training the Android malware detection model by using the binary particle swarm optimization algorithm to optimize the hyperparameters of the Android malware detection model includes:

[0065] S501, initializing a target parameter, constructing the position and speed of a particle based on the feature set of the balanced Android software sample dataset and the Android malware detection model parameter in the target parameter, and generating a particle population;

[0066] S502, calculating the fitness value of each particle in the particle population at the current time, and determining the global optimal position of the particle population at the current time through the fitness value;

[0067] S503, updating the search speed of each particle at the current time through the global optimal position at the current time, and updating the position of each bat at the current time through the updated search speed of each particle and the linearly decreasing inertia weight;

[0068] S504, determining whether the current time meets the preset convergence condition, if yes, outputting the global optimal position at the current time, and if not, returning to the step of calculating the fitness value of each particle in the particle population at the current time and determining the global optimal position of the particle population at the current time through the fitness value;

[0069] S505, importing the classifier parameter in the output global optimal position into the Android malware detection model to parameterize the Android malware detection model, so as to update the parameters of the Android malware detection model until the iteration process ends, and the Android malware detection model is trained.

[0070] In the preferred embodiment of the present application, step S5 creates N particles in a d-dimensional search space and randomly initializes their positions and speeds. Each particle represents a possible optimal solution, and the algorithm adjusts and evaluates the particles to find the best solution (particle) to maximize the learning performance. The position x iSVMs, such as the penalty parameter C and the kernel function parameter gamma. The velocity of the particle v i The direction and step length of the particle movement. The fitness value of the particle represents the quality of the solution, and the fitness value of each particle is evaluated using cross-validation.

[0071] Step S511: In each stage, the movement trend of the ith particle (position x i , velocity v i ) is towards the best position it has experienced in the current iteration (personal best position (Pbest)) and the best position determined in the entire search space (global best position (Gbest)). Considering the dimensionality of the particle, the new velocity of the ith particle in the search space v is obtained as follows.

[0072]

[0073] where, represents the position of the ith particle in the dth dimension at the tth iteration, represents the velocity of the ith particle in the dth dimension at the tth iteration, and r1 and r2 represent two random numbers in the range of 0 to 1. c1 and c2 represent acceleration coefficients, controlling the influence of individual and global optimal particles. ω represents the inertia weight, playing a balancing role in global and local search. and represent the best position recorded in the entire search space, and the personal best position experienced by the ith particle in the tth execution stage, respectively.

[0074] Step S512: According to the obtained new velocity of the particle, the formula for updating the new position of each particle is as follows:

[0075]

[0076] where, represents the position of the ith particle in the dth dimension at the tth iteration, represents the velocity of the ith particle in the dth dimension at the t+1th iteration, and thus the position of the ith particle in the dth dimension at the t+1th iteration x

[0077] Step S513: The calculation of the fitness value is based on the cross-validation method. In each iteration, the fitness value of each particle is calculated by k-fold cross-validation on the training data set. The fitness value can be the classification accuracy, F1 score or other performance indicators.

[0078] Step S514: the inertia weight ω adopts a linear decreasing strategy, and gradually decreases from an initial value to a final value to balance the abilities of global search and local search. The specific formula is:

[0079]

[0080] wherein ω start represents the initial value of the inertia weight, ω end represents the initial value of the inertia weight, t represents the iteration number, and t max represents the maximum iteration number.

[0081] Step S515: if the new position of the particle exceeds the preset search space range, the position can be adjusted back to the boundary value, or the position and the speed are randomly reinitialized. In addition, a speed limiting strategy can be adopted to ensure that the speed of the particle does not exceed a certain maximum value.

[0082] Step S516: repeat the fitness calculation and the speed position update until the maximum iteration number is reached, and the optimal solution is obtained. The ten-fold cross-validation method is adopted for model training and testing. Among them, the feature vector set is randomly divided into ten mutually disjoint groups of data, each time nine groups are selected as the training set, and the remaining one group is selected as the test set, and finally the average value of the results of ten times of data is taken as the model. According to the classification result, it is judged whether the sample is malicious or not, and finally the efficient detection of Android malware is realized.

[0083] In the preferred embodiment of the present application, in order to further improve the detection efficiency of the Android malware detection model, the balanced Android software sample data set is further processed, and the samples are decompiled using the decompilation tool androguard. The androlyze.py module in androguard is mainly used for feature extraction of subsequent permission features and API features, such as application permission, camera call permission, get address book information API, send SMS API and the like.

[0084] Among them, the androlyze.py module in androguard is mainly used for feature extraction of permission features and API features and construction of the original feature vector in the present embodiment. As shown in Figure 4 the feature vector construction process is as follows:

[0085] Step S601: all features of all samples in the original data set are traversed and an original feature vector matrix is constructed, each column of the matrix represents a feature, each row represents a sample, and the matrix value is composed of “0” and “1”, wherein “0” represents that the application does not contain the feature, and “1” represents that the application contains the feature, and all values of the original feature vector matrix are initialized to “0”;

[0086] Step S602: Traverse each sample in the original dataset. If the sample contains a feature in the original feature vector matrix, change the corresponding value in the matrix from "0" to "1".

[0087] Step S603: After traversing all samples in the original dataset, obtain the original feature vector matrix.

[0088] In the preferred embodiment of the present application, the original feature vector matrix can also be processed for dimension reduction, a set of orthogonal bases is constructed, high-dimensional data is projected onto a hyperplane, high-dimensional data is reduced to low-dimensional, and the variance of the reduced data is as large as possible. The process of principal component analysis is as follows:

[0089] Step S701: For a sample set X={x1, x2, …, xn}, perform centering processing on the data, so that each feature has zero mean, ensure that all features are on the same scale, prevent some features from having different dimensions and affecting the PCA result, and make the calculation of the covariance matrix more accurate. The formula used is as follows: n

[0090]

[0091] Where x i represents the data vector of the i-th sample, and n represents the total number of samples.

[0092] Step S702: Calculate the covariance matrix C of the centered data. The covariance matrix describes the linear relationship between features. It reflects the distribution of data and the correlation between features.

[0093]

[0094] Where X represents the centered data matrix, X T represents the transpose of the centered data matrix, and n represents the total number of samples.

[0095] Step S703: Perform eigenvalue decomposition on the covariance matrix C to obtain eigenvalues λ i and eigenvectors v i . The eigenvalue represents the variance of the data in the direction of the corresponding eigenvector. The eigenvector represents the main direction (principal component) of the data. Through eigenvalue decomposition, the principal component of the data can be found, i.e. the direction that retains the main information of the data. The formula for eigenvalue decomposition is as follows:

[0096] Cv i = λ i v i

[0097] ​wherein, λ i denotes the eigenvalue, v i denotes the corresponding eigenvector, and C denotes the covariance matrix.

[0098] Step S704: taking the first k maximum eigenvalues (k is the target dimension) and calculating the corresponding eigenvectors V=(v1, v2, …, vk) to construct a new low-dimensional sample set X' with V as a set of bases. k The principal component selection can maximize the retention of the main information of the data and reduce the dimension of the data. By selecting the first k eigenvectors with the maximum eigenvalues, the maximum data variance and the minimum information loss can be ensured. The formula for converting the data from the original space to the new low-dimensional space using the selected eigenvectors is as follows:

[0099] X' = XV k

[0100] wherein, X' denotes the data after dimension reduction, V k denotes the selected eigenvector matrix, and X denotes the centralized data matrix.

[0101] By the above embodiment, the high-dimensional data is converted into low-dimensional data, which can significantly reduce the calculation amount and improve the calculation efficiency. This is particularly important for large-scale Android software sample data sets and Android malware detection models with high real-time requirements. In this process, factors that have little contribution to training and prediction are further removed, and the main features that have an impact on the model performance are retained, thereby improving the generalization ability and prediction accuracy of the Android malware detection model.

[0102] In the embodiment of the application, as Figure 4 indicated, the application also provides a training device of an Android malware detection model, comprising:

[0103] a data acquisition module, which acquires an original Android software sample data set, wherein the original Android software sample data set is an unbalanced data set, including Android malicious samples of a minority class and Android benign samples of a majority class;

[0104] a first undersampling processing module, which adopts random undersampling to process the Android benign samples of the majority class to obtain an undersampled Android software sample data set;

[0105] an oversampling processing module, which adopts boundary density weighted oversampling to process the Android malicious samples of the minority class to obtain an oversampled Android software sample data set;

[0106] The second undersampling processing module adopts evolutionary screening undersampling processing to resample an Android software sample data set, to obtain a balanced Android software sample data set; the resampled Android software sample data set comprises an undersampled Android software sample data set and an oversampled Android software sample data set;

[0107] The training module inputs the balanced Android software sample data set into an Android malware detection model, obtains a detection result, and calculates a corresponding performance index based on the detection result; a binary particle swarm optimization algorithm is adopted to optimize hyperparameters of the Android malware detection model, to train the Android malware detection model; the binary particle swarm optimization algorithm takes data dimensions of the balanced Android software sample data set as a search space, takes the hyperparameters of the Android malware detection model as particles, and takes the performance index obtained from the detection result as a fitness value.

[0108] In the embodiment of the present application, the present application also provides a computer device, comprising: a processor and a memory;

[0109] The memory is used to store a computer program;

[0110] The processor is used to execute the computer program stored in the memory, so that the computer device executes the training method of the Android malware detection model described in the present application.

[0111] In the embodiment of the present application, the memory stores executable instructions, which execute the training method described above when executed by the processor. The memory can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. The non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example, but not limitation, many forms of RAM can be used, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM). It should be noted that the memory of the method described herein is intended to include, but not limited to, these and any other suitable types of memory.

[0112] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces the functions / operations specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, or entirely on a remote machine or server.

[0113] In the embodiments of the present application, the constraint resampling algorithm adopted by the present application significantly reduces the overlap between the minority class and the majority class, neither generates a large number of noise sample phenomena, nor appears sample aggregation phenomenon, while avoiding the generation of redundant samples, the majority class is consistent with the original distribution. The minority class data synthesized by the oversampling based on the boundary density weighting is expanded along the direction of the ideal decision boundary, which not only plays a role in enhancing the sample boundary, but also ensures a very clear classification boundary, and does not synthesize more samples in the majority class area. This makes the present application be able to reduce the overlap of boundary samples, thereby optimizing the training efficiency and detection accuracy of the Android malware detection model.

[0114] Those skilled in the art can understand that all or part of the steps in the above-mentioned embodiments can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer readable storage medium, which can include ROM, RAM, magnetic disk or optical disk, etc.

[0115] Although the embodiments of the present application have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made thereto without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for training an Android malware detection model, characterized in that, The method comprises: obtaining an original Android software sample data set, the original Android software sample data set being an unbalanced data set comprising Android malicious samples of a minority class and Android benign samples of a majority class; handling the Android benign samples of the majority class by random undersampling to obtain an undersampled Android software sample data set; handling the Android malicious samples of the minority class by border density weighting-based oversampling to obtain an oversampled Android software sample data set; handling the resampled Android software sample data set by evolutionary undersampling to obtain a balanced Android software sample data set, the resampled Android software sample data set comprising the undersampled Android software sample data set and the oversampled Android software sample data set, the evolutionary undersampling method comprising a nearest neighbor undersampling algorithm, a Tomek Links undersampling algorithm, a clustering-based undersampling method, and a neighborhood cleaning rule undersampling algorithm; inputting the balanced Android software sample data set into an Android malware detection model to obtain a detection result and calculate corresponding performance indicators based on the detection result; optimizing hyperparameters of the Android malware detection model by a binary particle swarm optimization algorithm to train the Android malware detection model; wherein the binary particle swarm optimization algorithm takes the data dimension of the balanced Android software sample data set as a search space, takes the hyperparameters of the Android malware detection model as particles, and takes the performance indicators obtained from the detection result as fitness values; the handling of the Android malicious samples of the minority class by border density weighting-based oversampling to obtain the oversampled Android software sample data set comprises: calculating the Euclidean distance between the minority class samples and other samples by a K-nearest neighbor algorithm and obtaining K nearest neighbor samples; calculating the cost weight of the minority class samples according to the number of majority class samples in the K nearest neighbor samples of the minority class samples and the number of minority class samples in the neighbors of the minority class samples; calculating the distance limit between the minority class samples and other samples according to the number of majority class samples in the K nearest neighbor samples of the minority class samples and the number of minority class samples in the neighbors of the minority class samples; determining the number of synthetic samples to be generated according to the number of minority class samples, the cost weight of the minority class samples, and the average class size of the original Android software sample data set; generating random points between the minority class samples and the nearest majority class samples, the random points serving as new synthetic samples, and the distance between the minority class samples and the new synthetic samples not exceeding the distance limit; obtaining the oversampled Android software sample data set according to the number of synthetic samples to be generated for the minority class samples and the distance limit between the minority class samples and other samples; the cost weight of the minority class samples is a proportional value or a noise proportional value between the number of majority class samples in the K nearest neighbor samples of the minority class samples and the number of minority class samples in the neighbors of the minority class samples; the optimization of the hyperparameters of the Android malware detection model by the binary particle swarm optimization algorithm to train the Android malware detection model comprises: Initialize a target parameter, construct positions and velocities of particles based on a feature set of the balanced Android software sample dataset and Android malware detection model parameters in the target parameter, and generate a particle population; Calculate fitness values of each particle in the particle population at the current time, and determine a global optimal position of the particle population at the current time through the fitness values; Update search velocities of each particle at the current time through the global optimal position at the current time, and update positions of each bat at the current time through the updated search velocities of each particle and a linearly decreasing inertia weight; Determine whether the current time meets a preset convergence condition, if yes, output the global optimal position, and if not, return to calculate the fitness values of each particle in the particle population at the current time, and determine the global optimal position of the particle population at the current time through the fitness values; Import classifier parameters in the output global optimal position into the Android malware detection model to parameterize the Android malware detection model, update parameters of the Android malware detection model, and complete training of the Android malware detection model until the iteration process ends. 2.The method of claim 1, wherein, The setting condition of the cost weight of the minority class sample includes: 1) the weight of the minority class sample close to the boundary is higher than the weight of the minority class sample far from the boundary; and 2) the weight of the sparse minority class sample is higher than the weight of the dense minority class sample. 3.The method of claim 1, wherein, The setting condition of the distance limit of the minority class sample and other samples includes: 1) the distance between the sparse distributed minority sample and the synthetic sample generated by the minority sample is less than the distance between the dense distributed minority sample and the synthetic sample generated by the minority sample; and 2) the distance limit of the minority class sample close to the densely distributed majority class sample is greater than the distance limit of the minority class sample close to the sparsely distributed majority class sample.

4. The method of claim 1 or 3, wherein the method further comprises: The distance limit of the minority class sample and other samples is a ratio value or a noise ratio value between the number of majority class samples in K nearest neighbor samples of the minority class sample and the number of neighbor samples in the K nearest neighbor samples of the minority class sample. 5.The method of claim 1, wherein, The resampling Android software sample dataset by using the evolutionary screening undersampling processing includes removing noise samples and overlapping samples in the resampling Android software sample dataset by using an undersampling method of evolutionary screening. 6.A device for training an Android malware detection model, configured to perform the method for training an Android malware detection model according to any one of claims 1 to 5. The method comprises the steps of: a data acquisition module acquires an original Android software sample dataset, the original Android software sample dataset is an unbalanced dataset, and includes minority class Android malware samples and majority class Android benign samples; a first undersampling processing module processes the majority class Android benign samples by using random undersampling to obtain an undersampled Android software sample dataset; an oversampling processing module processes the minority class Android malware samples by using boundary density weighted oversampling to obtain an oversampled Android software sample dataset; and a model training module trains an Android malware detection model based on the undersampled Android software sample dataset and the oversampled Android software sample dataset. The second undersampling processing module adopts evolutionary screening undersampling processing to resample an Android software sample dataset to obtain a balanced Android software sample dataset; the resampled Android software sample dataset includes an undersampled Android software sample dataset and an oversampled Android software sample dataset; The training module inputs the balanced Android software sample dataset into an Android malware detection model to obtain a detection result, and calculates a corresponding performance index based on the detection result; The binary particle swarm optimization algorithm is used to optimize the hyperparameters of the Android malware detection model to train the Android malware detection model; the binary particle swarm optimization algorithm takes the data dimension of the balanced Android software sample dataset as a search space, takes the hyperparameters of the Android malware detection model as particles, and takes the performance index obtained from the detection result as a fitness value.

7. A computer device, comprising: Comprise: A processor and a memory; The memory is used to store a computer program; The processor is used to execute the computer program stored in the memory, so that the computer device executes the training method of the Android malware detection model in any one of claims 1 to 5.

Images