Android malicious program detection method and system based on multi-modal feature linear weighted fusion

Abstract

The invention provides an Android rogue program detection method and system based on multi-modal feature linear weighted fusion, and belongs to the technical field of rogue program analysis. The method comprises the following steps of: visualizing Dalvik byte stream data of an Android application program into a'vector 'color image; constructing a dynamic permission information table to carry out one-hot coding processing on the permission information of the Android application program; respectively processing and analyzing the feature information represented by the two modes, constructing a lightweight convolutional neural network model to perform feature extraction and learning on the image data, and constructing a lightweight feedforward neural network model to perform feature extraction and learning on the text data; and fusing the extracted and learned features of the two different modal data by using a linear weighting mode, and inputting the fused feature vector into a classifier for classification to obtain a classification result, thereby improving the accuracy and efficiency of detecting the malicious Android application program.

Description

Technical Field

[0001] The present invention belongs to the technical field of malicious program analysis, and provides an Android malicious program detection method and system based on multi-modal feature linear weighted fusion. Background Art

[0003] Existing detection methods for Android malicious programs are mainly divided into traditional detection methods and detection methods based on artificial intelligence technology. Traditional detection methods are mainly divided into detection methods based on static analysis and dynamic analysis. Static analysis identifies potential malicious behaviors by checking the code, permissions, and resource files of the application without running the application; dynamic analysis determines whether it is a malicious program by running the application in a sandbox environment and monitoring its runtime behavior, including system calls, network communications, and file operations. In recent years, with the development of artificial intelligence technology, malicious program detection methods based on artificial intelligence technology (such as machine learning and deep learning) have gradually emerged. They use the static features (such as permissions, API call frequency, code structure) and dynamic features (such as runtime behavior, system call sequence) of the application to construct feature vectors, and identify the features of malicious programs by training detection models to achieve detection and classification of malicious programs. The application of artificial intelligence technology to detect Android malicious programs has become the mainstream research in the field of malicious program analysis. However, how to use this technology to further improve the accuracy of detection is still one of the research hotspots in this field.

[0004] At present, the Android malware detection methods based on artificial intelligence technology include using the static information of the program as features or abstracting the program byte stream file into grayscale images and matrix images for research. However, these methods have the following disadvantages:

[0005] (1) Most studies only use single modal information as features, which is not comprehensive in representing the information of the application, resulting in less than ideal detection results. In addition, the method has poor adaptability and is difficult to cope with various changes and complex environments.

[0006] (2) Grayscale images are used to represent byte stream files. Grayscale images can only represent single-channel information and cannot represent richer information and higher analysis accuracy.

[0007] (3) Using matrix images to represent byte streams can easily destroy the continuity of the byte stream sequence and make the model ignore some feature information. In addition, matrix images usually need to be filled with data to meet their format, which makes the byte stream features represented by matrix images easy to carry additional noise to affect the detection results of the model.

[0008] Due to these shortcomings, the field of Android malicious program detection still has problems such as low detection accuracy, low efficiency, and insufficient stability. Summary of the invention

[0009] In view of the above-mentioned problems, the present invention aims to propose an Android malware detection method and system based on multimodal feature linear weighted fusion, and apply heterogeneous multimodal data feature fusion technology to the field of Android malware analysis. It can use image and text two-modal data to represent the feature information of Android applications, thereby making up for the limitations of single-modal data. At the same time, a relatively lightweight model is constructed to extract and learn features of different modalities, and the complementarity between the two modal data is utilized to improve the accuracy and robustness of malware detection.

[0010] In order to achieve the above object, the present invention adopts the following technical scheme:

[0011] A method for detecting Android malicious programs by linear weighted fusion of multimodal features comprises the following steps:

[0012] Step 1: Use static analysis tools to perform static analysis on the Android application, obtain the static features of the application, obtain the permission information used by it, and extract the Dalvik bytecode data in the Android application;

[0013] Step 2: Encode the program permission information obtained in step 1 by constructing a dynamic permission table to obtain the Android application permission features represented by text modal data; at the same time, process the Dalvik byte stream data obtained in step 1, visualize the byte stream data as a "vector" color image, and obtain the Android application features represented by image modal data;

[0014] Step 3: Using the permission feature data of the text modality and the bytecode image feature data of the image modality obtained in step 2, a lightweight feedforward neural network model and a lightweight convolutional neural network model are respectively constructed to train and learn them, so as to realize feature extraction of data of different modalities;

[0015] Step 4: For the feature vectors of different modes extracted in step 3, use the linear weighted fusion method to fuse the multimodal features to obtain the fused feature vector, which is used as the input of the final Android malware classifier;

[0016] Step 5: Use the trained classification model to build an Android malware detection system, detect and classify the Android applications to be tested, and obtain the detection and classification results.

[0017] In the above technical solution, the specific method for processing different feature data in step 2 is:

[0018] For the permission features of the text modality obtained in step 1, firstly, by counting the permission information of all programs in the benign and malicious Android application data set, the number of times each permission information has been used can be obtained, and then the number of times used is sorted from large to small, and the permission information with a number of times used greater than or equal to the set threshold is taken out to construct a dynamic permission table, which is used as the basis for the final permission feature encoding; then the permission information is encoded using one-hot encoding, that is, if the corresponding permission in the dynamic permission table is used in the program, it is encoded as 1, otherwise it is encoded as 0, and finally the feature vector after encoding is obtained.

[0019] For all the Dalvik bytecode data in the obtained APK, all the Dalvik bytecode data are spliced ​​into a vector byte stream vector, and the grayscale pixel values ​​are normalized by treating each byte as an 8-bit grayscale pixel value (i.e., the grayscale value is linearly mapped from [0,255] to the [0,1] range), and the normalized grayscale value is converted into a color value through the viridis color mapping, and finally the converted color value is converted back to the [0,255] range to obtain a "vector" color image with a width of 1 and a height of the byte stream vector length.

[0020] In the above technical solution, the specific method for extracting features from text modal data in step 3 is:

[0021] For the feature vector obtained by encoding the permission features in step 2, convert it into tensor data and build a lightweight feedforward neural network model to extract its features. The feedforward neural network model is built using an 8-layer network structure, with 1 input layer, 1 output layer, and 6 hidden layers; each hidden layer from the input layer to the output layer contains 50, 32, 32, 16, 16, and 8 neurons respectively, and the output layer contains 2 neurons; at the same time, prelu is used as the activation function after each hidden layer, thereby using the network structure to extract the text permission feature data and obtain a feature vector with a dimension of 2.

[0022] In the above technical solution, the specific method for extracting features from the image modality data in step 3 is:

[0023] For the "vector" color image visualized in step 2, since the code length of each application is different, the height of the visualized image is also different, so the image height needs to be normalized to a uniform size to facilitate the construction of a convolutional neural network model for feature extraction. First, load the visualized "vector" color image data, normalize its height to a uniform size, and convert the adjusted image into tensor data for use as the input of the model; then use 3 convolutional layers, 3 pooling layers, and two fully connected layers to build a convolutional neural network model. Each convolutional layer uses a one-dimensional convolutional layer with a convolution kernel size of 1*12 and a stride of 1. Each pooling layer uses a maximum pooling layer with a convolution kernel size of 1*12. Prelu is used as the activation function after each convolution layer. The input channel of the first one-dimensional convolutional layer is The three color channels of the "vector" image have an output channel of 32, the output channel of the second one-dimensional convolution layer is 64, and the output channel of the third one-dimensional convolution layer is 128. The features extracted by the third pooling layer are flattened to obtain 1024 neurons, which are passed to a fully connected layer containing 128 neurons. After calculation, they are passed again to a fully connected layer containing 2 neurons, and sigmoid is used as the activation function of the fully connected layer. Finally, the convolutional neural network model is used to extract the image modal feature data to obtain a feature vector with a dimension of 2.

[0024] In the above technical solution, the specific method of step 4 is:

[0025] For the feature vectors obtained by extracting the text modality authority feature data and the feature vectors obtained by extracting the image modality feature data in step 3, the length of the feature vectors extracted from the two modalities is 2. The feature vectors of the two modalities are fused using the linear weighted fusion method. First, different weights are assigned to the feature vectors of different modalities. The feature vector of the text modality is assigned a weight of text , assign weights to the feature vectors of the image modality image ; Then multiply the feature vectors of different modes by the weights assigned to the corresponding modes to obtain the final feature vectors of different modes; Finally, add the final feature vectors of different modes to obtain the fused feature vectors. After obtaining the fused feature vectors of different modes, use the Android malware classifier to classify them and obtain the classification results of Android applications.

[0026] An Android malware detection system based on multi-modal feature linear weighted fusion, comprising:

[0027] APK file analysis module: used to perform format detection and static analysis on Android APK files, and extract static features and files;

[0028] APK data extraction and preprocessing module: used to process the static permission features and files extracted by the APK file analysis module, build a dynamic permission table to encode the static permission features to obtain text modal features, and then build the Dalvik bytecode into a byte stream vector and visualize it as a "vector" color image to obtain image modal features;

[0029] Multimodal feature extraction module: used to build a lightweight convolutional neural network model to extract and learn the features of "vector" color images, and to build a lightweight feedforward neural network model to extract and learn the permission features;

[0030] Multimodal feature fusion and classification module: used to fuse feature vectors extracted from different modalities, perform linear fusion by assigning different weights to feature vectors of different modalities, and classify the linearly fused features to obtain the classification results of the APK file.

[0031] A computer-readable storage medium, wherein the storage medium stores an Android malicious program detection program with multimodal feature linear weighted fusion, and when the program is executed by a computer, the steps of the Android malicious program detection method or system with multimodal feature linear weighted fusion described in any one of the above-mentioned schemes are implemented.

[0032] Compared with the prior art, the present invention provides an Android malicious program detection method and system based on multi-modal feature linear weighted fusion, which has the following beneficial effects and advantages:

[0033] 1. The present invention proposes a method for characterizing malicious programs based on heterogeneous multimodal data features, which characterizes different features of malicious programs from two perspectives: image modality and text modality. Multimodal data can enable people to understand and analyze Android malicious programs more deeply through the mutual support and integration of different modal data. At the same time, the multi-angle description provided by multimodal data can enable data to be integrated and supplemented with each other to improve the accuracy and richness of the information contained in the malicious program.

[0034] 2. The present invention converts the DEX bytecode file into a "vector" color image. The "vector" image will not destroy the bytecode sequence in the DEX file, and the generated "vector" image will not additionally fill the image to generate unnecessary noise. At the same time, the color image can provide more effective feature information due to its rich color information and higher information content, which can better improve the detection accuracy compared with the existing method.

[0035] 3. The present invention constructs different lightweight neural network models for different modal data to extract and learn features, so as to perform different feature representations on different modal data, and uses linear weighted fusion technology to fuse the feature representations of different modalities, and classifies them according to the fused feature representations to obtain classification results. Compared with existing methods, the construction of lightweight network models shows more excellent performance in training and detection efficiency.

[0036] Instruction Manual

[0037] Figure 1 It is a schematic diagram of the process provided by the present invention;

[0038] Figure 2 It is a structural schematic diagram of the overall workflow of the present invention;

[0039] Figure 3 It is a structural schematic diagram of the feedforward neural network model provided by the present invention;

[0040] Figure 4 It is a structural schematic diagram of the convolutional neural network model provided by the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present invention clearer, examples are now used to illustrate the specific method as follows:

[0042] This embodiment provides an Android malware detection method based on multi-modal feature linear weighted fusion. Figure 1 As shown, the following steps are included:

[0043] Step 1: Use static analysis tools to perform static analysis on the Android application, obtain the static features of the application, obtain the permission information used by it, and extract the Dalvik bytecode data in the Android application;

[0044] Step 2: Encode the program permission information obtained in step 1 by constructing a dynamic permission table to obtain the Android application permission features represented by text modal data; at the same time, process the Dalvik byte stream data obtained in step 1, visualize the byte stream data as a "vector" color image, and obtain the Android application features represented by image modal data;

[0045] The specific method for processing different feature data in step 2 is:

[0046] For the obtained text modal permission features, we first count the permission information of all programs in the benign and malicious Android application data set, and get the number of times each permission information has been used. Then we sort them from large to small according to the number of times they are used, and take out the permission information whose number of times is greater than or equal to the set threshold, and construct a dynamic permission table. This dynamic permission table is used as the basis for the final permission feature encoding; then we use one-hot encoding to encode the permission information, that is, if the corresponding permission in the dynamic permission table is used in the program, it is encoded as 1, otherwise it is encoded as 0, and finally the feature vector after encoding is obtained.

[0047] For the obtained Dalvik bytecode data, first all the data are spliced ​​into a vector byte stream vector, then each byte is regarded as an 8-bit grayscale pixel value, and the grayscale pixel value is normalized (that is, the grayscale value is linearly mapped from [0,255] to [0,1] range), and the normalized grayscale value is converted to a color value through the viridis color mapping, and finally the converted color value is converted back to the [0,255] range to obtain a "vector" color image with a width of 1 and a height of the byte stream vector length.

[0048] Step 3: Using the permission feature data of the text modality and the bytecode image feature data of the image modality obtained in step 2, a lightweight feedforward neural network model and a lightweight convolutional neural network model are constructed to train and learn them, so as to realize feature extraction of data of different modalities; Figure 3 and Figure 4 .

[0049] The specific method for feature extraction of text modal data in step 3 is:

[0050] For the feature vector obtained by encoding the permission features in step 2, convert it into tensor data and build a lightweight feedforward neural network model to extract its features. The feedforward neural network model is built using an 8-layer network structure, with 1 input layer, 1 output layer, and 6 hidden layers; each hidden layer from the input layer to the output layer contains 50, 32, 32, 16, 16, and 8 neurons respectively, and the output layer contains 2 neurons; at the same time, prelu is used as the activation function after each hidden layer, thereby using the network structure to extract the text permission feature data and obtain a feature vector with a dimension of 2.

[0051] The specific method for feature extraction of image modality data is:

[0052] For the "vector" color image visualized in step 2, since the code length of each application is different, the height of the visualized image is also different, so the image height needs to be normalized to a uniform size to facilitate the construction of a convolutional neural network model for feature extraction. First, load the visualized "vector" color image data, normalize its height to a uniform size, and convert the adjusted image into tensor data for use as the input of the model; then use 3 convolutional layers, 3 pooling layers, and two fully connected layers to build a convolutional neural network model. Each convolutional layer uses a one-dimensional convolutional layer with a convolution kernel size of 1*12 and a stride of 1. Each pooling layer uses a maximum pooling layer with a convolution kernel size of 1*12. Prelu is used as the activation function after each convolution layer. The input channel of the first one-dimensional convolutional layer is The three color channels of the "vector" image have an output channel of 32, the output channel of the second one-dimensional convolution layer is 64, and the output channel of the third one-dimensional convolution layer is 128. The features extracted by the third pooling layer are flattened to obtain 1024 neurons, which are passed to a fully connected layer containing 128 neurons. After calculation, they are passed again to a fully connected layer containing 2 neurons, and sigmoid is used as the activation function of the fully connected layer. Finally, the convolutional neural network model is used to extract the image modal feature data to obtain a feature vector with a dimension of 2.

[0053] Step 4: For the feature vectors of different modes extracted in step 3, use the linear weighted fusion method to fuse the multimodal features to obtain the fused feature vector, which is used as the input of the final Android malware classifier;

[0054] Step 4: Extract the feature vectors obtained from the text modality permission feature data and the feature vectors obtained from the image modality feature data. The dimension of the feature vectors extracted from the two modalities is 2. Use the linear weighted fusion method to fuse the feature vectors of the two modalities. First, assign different weights to the feature vectors of different modalities. The feature vector of the text modality is assigned a weight of text , assign weights to the feature vectors of the image modality image ; Then multiply the feature vectors of different modes by the weights assigned to the corresponding modes to obtain the final feature vectors of different modes; Finally, add the final feature vectors of different modes to obtain the fused feature vectors. After obtaining the fused feature vectors of different modes, use the Android malware classifier to classify them and obtain the classification results of Android applications.

[0055] Step 5: Use the trained classification model to build an Android malware detection system, detect and classify the Android applications to be tested, and obtain the detection and classification results.

[0056] This embodiment provides an Android malware detection system based on multi-modal feature linear weighted fusion. Figure 2 As shown, it includes the following modules:

[0057] APK file analysis module: used to perform format detection and static analysis on Android APK files, and extract static features and files;

[0058] APK data extraction and preprocessing module: used to process the static permission features and files extracted by the APK file analysis module, build a dynamic permission table to encode the static permission features to obtain text modal features, and then build the Dalvik bytecode into a byte stream vector and visualize it as a "vector" color image to obtain image modal features;

[0059] Multimodal feature extraction module: used to build a lightweight convolutional neural network model to extract and learn the features of "vector" color images, and to build a lightweight feedforward neural network model to extract and learn the permission features;

[0060] Multimodal feature fusion and classification module: used to fuse feature vectors extracted from different modalities, perform linear fusion by assigning different weights to feature vectors of different modalities, and classify the features after linear fusion to obtain the classification results of APK files;

[0061] In this embodiment, the specific implementation of the APK data extraction and preprocessing module is as follows:

[0062] First, determine whether the given file is a valid APK file, unpack the valid APK file and extract the required data; then for the obtained text-modal permission features, first count the permission information of all programs in the benign and malicious Android application data set, and get the number of times each permission information has been used, sort them from large to small according to the number of uses, and take out the permission information with a number of uses greater than or equal to the set threshold, construct a permission table, and use the permission table as the final permission feature; then use one-hot encoding to encode the permission information, that is, if the corresponding permission in the permission table is used in the program, it is encoded as 1, otherwise it is encoded as 0, and finally the feature vector after encoding is obtained.

[0063] For all the Dalvik bytecodes in the obtained APK, all the Dalvik bytecodes are concatenated into a vector byte stream vector, the pixel values ​​of the bits are normalized, the grayscale values ​​are linearly mapped from [0,255] to the [0,1] range, and the normalized grayscale values ​​are linearly mapped from [0,255] to the [0,1] range, and the normalized grayscale values ​​are converted to color values ​​through viridis color mapping, and finally the converted color values ​​are converted back to the [0,255] range to obtain a "vector" color image with a width of 1 and a height of the byte stream vector length.

[0064] In this embodiment, the multimodal feature extraction module is specifically implemented as follows:

[0065] The permission features are encoded to obtain feature vectors, which are converted into tensor data and a feedforward neural network model is constructed to extract their features. An 8-layer network structure is used to construct the feedforward neural network model, with 1 input layer, 1 output layer, and 6 hidden layers; each hidden layer from the input layer to the output layer contains 50, 32, 32, 16, 16, and 8 neurons respectively, and the output layer contains 2 neurons; at the same time, prelu is used as the activation function after each hidden layer, and the network structure is used to extract the text permission feature data to obtain a feature vector with a dimension of 2.

[0066] The height of the visualized "vector" color image is normalized, and the normalized image is converted into tensor data for the input of the model. Then, a convolutional neural network model is constructed using 3 convolutional layers, 3 pooling layers, and two fully connected layers. Each convolutional layer uses a one-dimensional convolutional layer with a convolution kernel size of 1*12 and a stride of 1. Each pooling layer uses a maximum pooling layer with a convolution kernel size of 1*12. Prelu is used as the activation function after each convolution layer. The input channel of the first one-dimensional convolutional layer is "vector". "The color image has 3 channels, the output channel is 32, the output channel of the second one-dimensional convolution layer is 64, and the output channel of the third one-dimensional convolution layer is 128. The features extracted by the third pooling layer are flattened to obtain 1024 neurons, which are passed to a fully connected layer containing 128 neurons. After calculation, they are passed to a fully connected layer containing 2 neurons again, and sigmoid is used as the activation function of the fully connected layer. Finally, the convolutional neural network model is used to extract the image modality feature data to obtain a feature vector with a dimension of 2.

[0067] In this embodiment, the multimodal feature fusion and classification module is specifically implemented as follows:

[0068] The feature vectors obtained by feature extraction of text modality authority feature data and the feature vectors obtained by feature extraction of "vector" color image modality feature data are given different weights to feature vectors of different modalities, and the feature vectors of text modality are given weights. text , assign weights to the feature vectors of the image modality image ; Then multiply the feature vectors of different modes by the weights assigned to the corresponding modes to obtain the final feature vectors of different modes; Finally, add the final feature vectors of different modes to obtain the fused feature vector. After obtaining the fused feature vectors of different modes, use the APK file classifier to classify them and obtain the classification results of the APK file.

[0069] The specific implementation process of the system described in this embodiment includes the following steps:

[0070] Step 1: Construct a dataset and collect a total of 8239 Android application samples from the Drebin dataset and the CICMalDroid dataset, including 4011 benign Android application samples and 4228 malicious Android application samples. Divide them into training set, test set and validation set in a ratio of 7:2:1, and ensure that the ratio of benign samples to malicious samples in each set is consistent with the ratio of benign samples to malicious samples in the overall sample set;

[0071] Step 2: Process all samples in the dataset, including the following steps:

[0072] Step 2.1: Perform static analysis on the APK file and use the static analysis tool Androguard to obtain the permission information and DEX bytecode file of the APK file;

[0073] Step 2.2: Process the permission information obtained in step 2.1, count and sort the permission information of the entire sample data set, set the threshold to 50, and extract the permissions that have been used more than or equal to the set threshold 50 times to build a dynamic permission table, sort the extracted permission data from high to low according to the number of times used, and obtain a dynamic permission table with a length of 112;

[0074] Step 2.3: Process the DEX bytecode files obtained in step 2.1, splice all DEX files into vector byte stream vectors, and visualize them as "vector" color images based on the vector byte stream vectors. First, get the byte data of all DEX files and splice them into a byte stream vector one by one. Secondly, use the Image.frombytes function of the PIL library in Python to create a single-channel grayscale image with a width of 1 and a height of the byte stream vector length, that is, the grayscale value of each pixel directly corresponds to the value of a byte in the byte stream vector. Then, convert the grayscale value of the created grayscale image into a NumPy array and normalize it through the Normalize function to normalize the pixel value range from [0,255] to [0,1]. Next, use the get_cmap function of the Matplotlib library to get the viridis color map, which is used to map the normalized grayscale value to the color value in the [0,1] range. Finally, the obtained color value in the [0,1] range is multiplied by 255 to restore it to the [0,255] range and generate a three-channel "vector" color image containing color information and ignoring the alpha channel.

[0075] Step 3: Extracting features from the permission feature data represented by the text modality, including the following steps:

[0076] Step 3.1: Use the dynamic permission table constructed in step 2.2 to one-hot encode the permission information of the Android APK file. That is, if the corresponding permission in the dynamic permission table is used in the program, it is encoded as 1, otherwise it is encoded as 0. The encoded data is converted into a feature tensor with a dimension of 1 and a length equal to the length of the dynamic permission table.

[0077] Step 3.2: Use the feature vector encoded in step 3.1 as the input of the feedforward neural network model, and use the model to extract and learn the features of the text modality;

[0078] Step 4: Extract features from the bytecode data represented by the image modality, including the following steps:

[0079] Step 4.1: For the "vector" color image obtained by visualization in step 2.3, use the transforms.Resize function of the torchvision library in Python to normalize it into an image with a fixed height of 128*128 and a width of 1, and convert the adjusted image into a feature tensor with a dimension of (3,128*128,1);

[0080] Step 4.2: Remove the last dimension from the image feature tensor obtained in step 4.1 and use it as the input of the convolutional neural network model, and use the model to extract and learn image features;

[0081] Step 5: The text features obtained in step 3 and the image features obtained in step 4 are fused as multimodal data features, and the image modal features are given a weight of 2 and a text modal feature weight of 1. They are multiplied by the feature vectors extracted from each modality and then added to obtain the fused multimodal feature vector.

[0082] Step 6: Input the multimodal feature vector obtained in step 5 into the classifier and output the classification result of the APK file, that is, detect whether the Android application is a benign application or a malicious application.

[0083] Based on the above embodiments, the present invention also provides a computer-readable storage medium, wherein the storage medium includes a physical device that can be read and written by a computer system, such as a hard disk, a solid-state drive, an optical disk, a USB flash drive, etc. At the same time, the storage medium stores an Android malicious program detection program with multimodal feature linear weighted fusion, and when the program is executed by a computer, it implements the steps of the Android malicious program detection method or system with multimodal feature linear weighted fusion described in any one of the above embodiments.

Claims

1. An Android malware detection method based on linear weighted fusion of multimodal features, characterized in that: The following steps are involved: Step 1: Use static analysis tools to perform static analysis on the Android application, obtain the static features of the application, obtain the permission information used by it, and extract the Dalvik bytecode data in the Android application; Step 2: Encode the program permission information obtained in step 1 by constructing a dynamic permission table to obtain the Android application permission features represented by text modal data; at the same time, process the Dalvik byte stream data obtained in step 1, visualize the byte stream data as a "vector" color image, and obtain the Android application features represented by image modal data; Step 3: Using the permission feature data of the text modality and the bytecode image feature data of the image modality obtained in step 2, a lightweight feedforward neural network model and a lightweight convolutional neural network model are respectively constructed and trained and learned to realize feature extraction of different modality data; Step 4: For the feature vectors of different modes extracted in step 3, use the linear weighted fusion method to fuse the multimodal features to obtain the fused feature vector, which is used as the input of the final Android malware classifier; Step 5: Use the trained classification model to build an Android malware detection system, detect and classify the Android applications to be tested, and obtain the detection and classification results.

2. The Android malicious program detection method based on multimodal feature linear weighted fusion according to claim 1 is characterized in that: The specific method for encoding the permission information in step 2 is as follows: for the obtained permission feature in text mode, firstly, by counting the permission information of all benign and malicious programs in the Android application data set, the number of times each permission information has been used is obtained, and the number of times is sorted from large to small according to the number of times, and the permission information with a number of times greater than or equal to a set threshold is taken out to construct a dynamic permission table, and the dynamic permission table is used as the final permission feature; Then, one-hot encoding is used to encode the permission information. That is, if the corresponding permission in the dynamic permission table is used in the program, it is encoded as 1, otherwise it is encoded as 0, and finally the feature vector after encoding is obtained.

3. The Android malware detection method based on multimodal feature linear weighted fusion according to claim 1, characterized in that: The specific method for visualizing the bytecode data in step 2 is: extract the Dalvik bytecode and splice it into a byte stream vector, linearly map the grayscale value from [0,255] to [0,1] by treating each byte as an 8-bit pixel value, and convert the normalized grayscale value into a color value through the viridis color map, and finally convert the converted color value back to the [0,255] range to obtain a "vector" color image with a width of 1 and a height of the byte stream vector length.

4. The Android malware detection method based on multimodal feature linear weighted fusion according to claim 1, characterized in that: The specific method for feature extraction of text modal data in step 3 is: for the feature vector obtained by encoding the permission feature in step 2, convert it into tensor data and build a lightweight feedforward neural network model to extract its features, and use an 8-layer network structure to build the feedforward neural network model, wherein there is 1 input layer, 1 output layer, and 6 hidden layers; each hidden layer from the input layer to the output layer contains 50, 32, 32, 16, 16, and 8 neurons respectively, and the output layer contains 2 neurons; at the same time, prelu is used as the activation function after each hidden layer, thereby using the network structure to extract the text permission feature data and obtain a feature vector with a dimension of 2.

5. The Android malware detection method based on multimodal feature linear weighted fusion according to claim 1, characterized in that: The specific method for extracting features from the image modality data in step 3 is as follows: for the "vector" color image obtained by visualizing the bytecode data in step 2, the image needs to be first normalized to a uniform size to facilitate the construction of a convolutional neural network model for feature extraction, and the adjusted image is converted into tensor data to facilitate use as the input of the model; a convolutional neural network model is constructed using 3 convolutional layers, 3 pooling layers, and two fully connected layers, each convolutional layer uses a one-dimensional convolutional layer with a convolution kernel size of 1*12 and a stride of 1, each pooling layer uses a maximum pooling layer with a convolution kernel size of 1*12, and prel u is used as the activation function after each convolution layer. The input channels of the first one-dimensional convolution layer are 3 channels of the color image, and the output channels are 32. The output channels of the second one-dimensional convolution layer are 64. The output channels of the third one-dimensional convolution layer are 128. The features extracted by the third pooling layer are flattened to obtain 1024 neurons, which are passed to the fully connected layer containing 128 neurons. After calculation, they are passed again to the fully connected layer containing 2 neurons. Sigmoid is used as the activation function of the fully connected layer. The convolutional neural network model is used to extract the image modality feature data to obtain a feature vector with a dimension of 2.

6. The Android malicious program detection method based on multimodal feature linear weighted fusion according to claim 1 is characterized in that: The specific method for multimodal feature fusion in step 4 is as follows: for the feature vector obtained by feature extraction of text modality authority feature data and the feature vector obtained by feature extraction of image modality feature data in step 3, the length of the feature vectors extracted from the two modalities is 2, and the feature vectors of the two modalities are feature fused using a linear weighted fusion method. First, different weights are assigned to the feature vectors of different modalities, and the feature vector of the text modality is assigned a weight weight. text , assign weights to the feature vectors of the image modality image ; Then, the feature vectors of different modes are multiplied by the weights assigned to the corresponding modes to obtain the final feature vectors of different modes; Finally, the final feature vectors of different modes are added to obtain the fused feature vectors; After obtaining the fused feature vectors of different modes, the Android malware classifier is used to classify them to obtain the classification results of the Android application.

7. An Android malware detection system based on linear weighted fusion of multimodal features, characterized in that: An Android malicious program detection method for implementing the multimodal feature linear weighted fusion as described in any one of claims 1 to 6; the system comprises: APK file analysis module: used to perform format detection and static analysis on Android APK files, and extract static features and files; APK data extraction and preprocessing module: used to process the static permission features and files extracted by the APK file analysis module, and build a dynamic permission table to encode the static permission features to obtain text modal features, and then build the Dalvik bytecode into a byte stream vector and visualize it as a "vector" color image to obtain image modal features; Multimodal feature extraction module: used to build a lightweight convolutional neural network model to extract and learn the features of "vector" color images, and to build a lightweight feedforward neural network model to extract and learn the permission features; Multimodal feature fusion and classification module: used to fuse feature vectors extracted from different modalities, perform linear fusion by assigning different weights to feature vectors of different modalities, and classify the linearly fused features to obtain the classification results of the APK file.

8. A computer-readable storage medium, characterized in that: The storage medium stores an Android malicious program detection program with linear weighted fusion of multimodal features. When the program is executed by a computer, it implements the steps of the Android malicious program detection method or system with linear weighted fusion of multimodal features as described in any one of claims 1 to 7.

Images