Android malicious software multi-classification dynamic detection method and system

Abstract

In order to effectively improve the accuracy rate of Android malicious software detection, the invention provides an Android malicious software dynamic detection method based on the combination of an improved zebra optimization algorithm (IZOA) and a light gradient hoisting machine (Light GBM) model, and relates to a dynamic detection method for Android malicious software based on the combination of the improved zebra optimization algorithm (IZOA) and the light gradient hoisting machine (Light GBM) model, in particular to a dynamic detection method for Android malicious software based on the combination of the improved zebra optimization algorithm (IZOA) and the light gradient hoisting machine (Light GBM) model and a dynamic detection method for Android malicious software based on the combination of the improved zebra optimization algorithm (IZOA) and the light GBM model. According to the IZOA-LightGBM method provided by the invention, elite reverse learning and a firefly disturbance strategy are introduced, and the convergence speed and the search capability of a traditional zebra optimization algorithm are enhanced through IZOA; and a hyper-parameter of the LightGBM model is optimized by utilizing IZOA, so that the multi-classification dynamic detection of the Android malicious software is realized. Experimental results show that the overall accuracy rates of the IZOA-LightGBM method provided by the invention on a CICMalDroid-2020 data set and a CCCS-CIC-AndMal-2020 data set are 99.75% and 98.86% respectively, and the IZOA-LightGBM method is superior to other comparison models.

Description

Technical Field

[0001] The present invention relates to the technical field of malware detection, and in particular to a multi-classification dynamic detection method and system for Android malware. Background Art

[0002] With the rapid development and diversification of Android applications, the Android malware attacks they bring are becoming increasingly severe. Android malware detection methods can be roughly divided into three categories: static analysis methods, dynamic analysis methods, and hybrid analysis methods. A study by Gorment et al. in 2023 showed that most studies used static analysis, accounting for 53.3%, followed by dynamic analysis, accounting for 28.9%, and hybrid analysis accounting for only 17.8%. Although the current mainstream Android malware detection methods based on static analysis, especially signature-based technologies, can effectively identify known Android malware. However, by changing the code structure and behavior patterns of Android malware, it is difficult for detection methods based on static analysis to effectively identify its true intentions, resulting in a decrease in detection accuracy.

[0003] To this end, researchers proposed a dynamic analysis method based on Android malware behavior. Android malware is detected by running results in a sandbox environment. In order to improve the accuracy of Android malware detection, machine learning (ML) algorithms are widely adopted. Aslan et al.'s research shows that ML methods show good results in detecting known Android malware and unknown Android malware. Recently, Gradient Boosting Decision Trees (GBDT) have achieved excellent performance in many studies. The Light Gradient Boosting Machine (LightGBM) model is an improved GBDT with the advantages of faster training speed and higher efficiency. In the study of Kirubavathi et al., the LightGBM model was used to detect Android malware with an accuracy of 98.05%.

[0004] However, the LightGBM model contains a large number of hyperparameters, and the setting of their values ​​has a great impact on the detection performance of the model. In addition, manual parameter tuning is extremely challenging due to the large number of hyperparameters, the high complexity of the model itself, and the coupling between nonlinear hyperparameters. Since hyperparameter optimization problems are usually non-convex or non-differentiable optimization problems, traditional optimization methods may obtain local rather than global optimal solutions. Metaheuristic algorithms can effectively solve complex, large search space and non-convex optimization problems to which hyperparameter optimization problems belong. For example, Al Ogaili et al. proposed a population update process of the whale optimization algorithm using weighted arithmetic mean, and used the improved algorithm for feature selection to detect Android malware attacks. Dong et al. proposed an initialization process of the fireworks optimization algorithm using Levy flight, and improved the algorithm update process using the elitist guidance strategy. The improved fireworks optimization algorithm was then applied to optimize the hyperparameters of the SVM model, and the optimized SVM model was used to detect Android malware. The Zebra Optimization Algorithm (ZOA) is a new metaheuristic algorithm that has better performance than traditional metaheuristic algorithms. However, ZOA still suffers from the problems of slow convergence and falling into local optimal solutions, which limits its performance. Summary of the invention

[0005] In view of the shortcomings of the above-mentioned prior art, the present invention proposes an improved zebra optimization algorithm (IZOA), uses the IZOA algorithm to optimize the hyperparameters of the LightGBM model, and uses the optimized LightGBM model to dynamically detect Android malware.

[0006] The technical solution adopted by the present invention comprises the following steps:

[0007] Step 1: Build the IZOA-LightGBM dynamic detection model;

[0008] Step 2: Download the software to be tested, obtain the behavior of the software and collect its behavior data, pre-process the obtained data and input it into the IZOA-LightGBM dynamic detection model;

[0009] Specifically, observe the behavior of malware and collect data about its behavior, including system calls, API calls, network activities, file system operations, etc.

[0010] Step 3: Use the IZOA-LightGBM dynamic detection model to detect the software to be tested and output the detection results.

[0011] Furthermore, the specific steps of model construction in step 1 include:

[0012] Step 1.1: Initialize the environment and parameters;

[0013] Step 1.2: Obtain an Android malware dataset based on dynamic analysis and preprocess the dataset;

[0014] Step 1.3: Divide the preprocessed Android malware dataset into training set, validation set and test set;

[0015] Step 1.4: Determine the hyperparameters of the LightGBM model to be optimized and initialize the LightGBM model with default hyperparameters;

[0016] Step 1.5: On the training set, use the IZOA algorithm to optimize the default hyperparameters of the LightGBM model, and evaluate the optimization results of different hyperparameter combinations through the validation set to select the optimal hyperparameter combination;

[0017] Step 1.6: Build the LightGBM model based on the optimal hyperparameter combination;

[0018] Step 1.7: Use the test set to evaluate the performance of the model constructed in step 1.6, calculate the various evaluation indicators of the model, and determine whether the various indicators of the model reach the expected threshold. If so, proceed to step 1.8; otherwise, return to step 1.5;

[0019] Step 1.8: Output the tested model and use it as the IZOA-LightGBM dynamic detection model.

[0020] Furthermore, the hyperparameters to be optimized for the LightGBM model include: learning rate, minimum number of samples required for a leaf node, maximum depth of the tree, number of leaf nodes on each tree, maximum possible number of feature value bins, minimum number of data samples in a leaf node, proportion of feature subsets used to train the model in each iteration, sampling ratio for controlling training data, frequency of bagging, L1 regularization, and L2 regularization.

[0021] Furthermore, the specific steps of step 1.5 include:

[0022] Step 1.5.1: Initialize parameters, including the number of zebra populations, the minimum and maximum values ​​of the hyperparameters to be optimized for the LightGBM model, the maximum number of iterations, the control disturbance amplitude, the initial attraction coefficient, and the rate at which the attraction is adjusted to decay;

[0023] Step 1.5.2: Initialize the zebra population based on the EOBL algorithm, where each zebra corresponds to a set of hyperparameter values ​​to be optimized;

[0024] Step 1.5.3: Calculate the fitness function value of each zebra in the population, and select the zebra with the smallest fitness function value in the population as the pioneer zebra;

[0025] Step 1.5.4: Calculate the new position of the zebra according to the following formula:

[0026]

[0027] in, Zebra A i The updated value of the jth hyperparameter value, r is a random number in the interval [0,1], PZ j is the jth hyperparameter value of Pioneer Zebra,

[0028] Step 1.5.5: Use the following position update formula to update the position of the zebra in the foraging phase. If the fitness function value of the new position is smaller, update the position; otherwise, keep the original position:

[0029]

[0030] in, Zebra A i new location; is the fitness function value of the new position, F(A i ) is the fitness function value of the original position;

[0031] Step 1.5.6: In the defense phase, according to the value of the random number p∈[0,1], the new position of the zebra is calculated by the following formula:

[0032] Among them, M1 represents the escape strategy, M2 represents the counterattack strategy; t is the current iteration number, T is the maximum iteration number; β is a constant, its value is equal to 0.01; AZ represents the position of any zebra in the zebra population except the i-th one, AZ j is the value of its jth hyperparameter;

[0033] Step 1.5.7: Update the zebra position in the defense phase and use the FDS algorithm to update the zebra position again;

[0034] Step 1.5.8: Determine whether the current iteration has traversed all zebras. If not, return to step 1.5.4 to continue updating the position of the next zebra until all zebras are updated; otherwise, go to step 1.5.9;

[0035] Step 1.5.9: Determine whether the current number of iterations has reached the maximum number of iterations. If not, return to step 1.5.3; otherwise, output IZOA's pioneer zebra, that is, the optimal hyperparameters of the LightGBM model.

[0036] Furthermore, the specific steps of step 1.5.2 include:

[0037] Step 1.5.2.1: Randomly generate an initial population of z zebras, and define each zebra i as a position vector A i =(a i,1 ,…,a i,j ,…,a i,11 ), where a i,j is the jth hyperparameter value, ranging from [l j ,u j ], 1≤i≤z, 1≤j≤11, and each vector corresponds to a set of hyperparameter values ​​to be optimized in the LightGBM model;

[0038] Step 1.5.2.2: For any zebra A i , generate its reverse zebra A′ through EOBL i , and A′ i =(a′ i,1 ,a′ i,j ,…,a′ i,11 ), where a′ i,j = r·(l j +u j )-a i,j ;

[0039] Step 1.5.2.3: Calculate the current zebra A by the following formula i and its reverse zebra A′ i The fitness function value F(A i ) and F(A′ i ):

[0040] F(A i )=min(1-Accuracy LightGBM )

[0041] Among them, Accuracy LightGBM Indicates the accuracy of the LightGBM model;

[0042] Step 1.5.2.4: Determine F(A′ i ) <F(A i ) is true, if so, then A i Defined as an elite zebra, and the elite zebra is denoted as E i , and go to step 1.5.2.5; otherwise, Ai Directly use it as the next generation of zebra and proceed to step 1.5.2.8;

[0043] Step 1.5.2.5: Calculate E using the following formula i Elite Reverse Zebra

[0044]

[0045] Among them, e i，j For elite Zebra E i The jth hyperparameter value of a j and b j are the lower and upper bounds of the elite zebra population, respectively, a j =min[e 1，j ,…,e i，j ,…,e p，j ], b j =max[e 1，j ,…,e i，j ,…,e p，j ];

[0046] Step 1.5.2.6: Calculate E separately i and The fitness function value F(E i )and And select the next generation of zebras according to the following formula:

[0047]

[0048] Step 1.5.2.7: Update the initial population using the next generation of zebras;

[0049] Step 1.5.2.8: Determine whether all zebras have been updated. If so, proceed to step 1.5.2.9. Otherwise, return to step 1.5.2.3.

[0050] Step 1.5.2.9: Define the zebra with the smallest fitness function value in the population as the pioneer zebra PZ.

[0051] Furthermore, the specific steps of step 1.5.7 include:

[0052] Step 1.5.7.1: Update the zebra position in the defense phase using the position update formula in step 1.5.5;

[0053] Step 1.5.7.2: Calculate the jth hyperparameter value of zebra i by the following formula, and use the position update formula in step 1.5.5 to get the position of the new zebra

[0054] is the spatial distance between them, and δ is the step size factor in the interval [0,1].

[0055] 7. An Android malware multi-classification dynamic detection system, based on an Android malware multi-classification dynamic detection method, characterized in that it includes:

[0056] Model building module, used to build the IZOA-LightGBM dynamic detection model;

[0057] Data input module, used to download the software to be tested and input it into the IZOA-LightGBM dynamic detection model;

[0058] The dynamic detection module is used to use the IZOA-LightGBM dynamic detection model to detect the software to be tested and output the detection results.

[0059] Therefore, the present invention adopts the above-mentioned Android malware multi-classification dynamic detection method, which has the following beneficial effects:

[0060] First, the present invention introduces elite reverse learning to improve the population initialization process of the ZOA algorithm, increases the diversity of the initial population, and accelerates the convergence speed of the ZOA algorithm; and introduces the firefly perturbation strategy to improve the population update process of the ZOA algorithm, improves the local search ability of the ZOA algorithm, and avoids falling into the local optimal solution;

[0061] Second, the present invention optimizes the hyperparameters of LightGBM through the improved IZOA algorithm, effectively improving the accuracy of Android malware detection.

[0062] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 Flowchart of improved population initialization for introducing EOBL.

[0064] Figure 2 Flowchart of improved zebra position update for introducing FDS.

[0065] Figure 3 Flowchart of the IZOA algorithm.

[0066] Figure 4 This is the flowchart of the IZOA-LightGBM algorithm.

[0067] Figure 5 is the variance distribution of the number of principal components of the CMD data set.

[0068] Figure 6is the variance distribution of the number of principal components of the CCA data set.

[0069] Figure 7 This is the confusion matrix of IZOA-LightGBM in CMD.

[0070] Figure 8 is the confusion matrix of IZOA-LightGBM in CCA.

[0071] Fig. 9 It is the loss function curve of CMD dataset.

[0072] Fig.10 It is the loss function curve of CCA dataset. DETAILED DESCRIPTION

[0073] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art make various changes or modifications to the present invention, and these equivalent forms also fall within the scope limited by the claims attached to the application.

[0074] 1. Improve the zebra optimization algorithm to optimize the LightGBM model

[0075] (1) LightGBM model

[0076] LightGBM uses gradient-based one-side sampling to filter out samples with small gradients during training, thereby reducing the amount of computation. In addition, the use of a mutually exclusive feature bundling algorithm reduces the number of features used in the model training process, effectively reducing the complexity of the model. This model has received widespread attention and has been successfully used in many different types of tasks, such as classification, regression, and sorting. The LightGBM model has the advantages of faster training speed and higher efficiency, which makes it an ideal choice for Android malware detection. However, the performance of LightGBM is largely affected by its many hyperparameters. Table 1 lists the 11 key hyperparameters that need to be optimized in the LightGBM model.

[0077] Table 1 Hyperparameters of LightGBM model optimization

[0078]

[0079] (2) Traditional zebra optimization algorithm optimizes LightGBM's hyperparameters

[0080] The Zebra Optimization Algorithm (ZOA) is a metaheuristic algorithm proposed by Trojovska et al. in 2022. The algorithm solves the optimization problem by simulating the foraging and defense behaviors of zebras. The performance of ZOA is better than that of 9 well-known optimization algorithms (e.g., Gray Wolf Optimization Algorithm GWO, Genetic Algorithm GA, PSO algorithm, etc.). The steps to optimize the hyperparameters of LightGBM based on the traditional Zebra Optimization Algorithm ZOA include:

[0081] Step 1: Initialize the zebra population;

[0082] Randomly generate an initial population of z zebras. Define each zebra i as a position vector A i =(a i,1 ,…,a i,j ,…,a i,11 ), these position vectors correspond to the 11 hyperparameters to be optimized in Table 1, where a i,j Represents the jth hyperparameter value, with a value range of [l j ,u j ], 1≤i≤z, 1≤j≤11.

[0083] Fitness function F(A i ) is calculated as:

[0084] F(A i )=min(1-Accuracy LightGBM ) (1)

[0085] Where, Accuracy LightGBM Indicates the accuracy of the LightGBM model;

[0086] The zebra with the smallest fitness function value in the population is defined as the pioneer zebra PZ, and other zebras are guided to move to the position of the pioneer zebra.

[0087] Step 2: Foraging phase;

[0088] Calculate Zebra A by formula (2) i The jth hyperparameter value of , and the position of zebra i is updated using formula (3):

[0089]

[0090] In the formula, is the new position of zebra i, is the updated value of its jth hyperparameter value, ) is the corresponding fitness function update value. r is a random number in the interval [0,1], PZ j is the jth hyperparameter value of Pioneer Zebra,

[0091] Step 3: Defense phase;

[0092] At this stage, if the zebra is attacked by the lion, it will flee (M1), otherwise it will fight back (M2). Let the selection probability p∈[0,1] be a random number. According to its value, different strategies (M1 or M2) are used to calculate the new position of the zebra through formula (4), and then the zebra position is updated using formula (3).

[0093]

[0094] Where t is the current iteration number, T is the maximum iteration number, and β is a constant whose value is equal to 0.01. AZ represents the position of any zebra in the zebra population except the i-th zebra. j is the value of its jth hyperparameter;

[0095] Step 4: Iteration;

[0096] In each iteration, the zebra with the smallest current fitness value is selected as the pioneer zebra PZ, and then steps 2 and 3 are repeated until the maximum number of iterations is reached, and the pioneer zebra PZ selected after the last iteration is taken as the optimal solution.

[0097] (3) Improve the zebra optimization algorithm to optimize the hyperparameters of LightGBM

[0098] In order to better utilize LightGBM to realize Android malware detection, the present invention proposes an improved zebra optimization algorithm IZOA and uses IZOA to optimize the hyperparameters of the LightGBM model.

[0099] In ZOA, the population is initialized by random generation, which leads to a slow convergence speed. The present invention improves the initialization process of ZOA by introducing Elite Oppositional-Based Learning (EOBL), speeds up the convergence speed of the algorithm and improves the global search capability of the algorithm. In addition, ZOA may also fall into a local optimal solution during the population update process. The present invention introduces the Firefly Disturbance Strategy (FDS) to improve the population update process of ZOA, further avoid falling into a local optimal solution, and improve the local search capability.

[0100] ①Introducing elite reverse learning to improve population initialization

[0101] Oppositional-Based Learning (OBL) is a strategy for enhancing ML proposed by Tizhoosh et al. in 2005. Wang Shenwen et al. introduced the idea of ​​elite learning and proposed EOBL based on OBL. Experimental results show that EOBL has better performance than OBL.

[0102] The invention generates elite reverse zebras through EOBL, calculates and compares the fitness function values ​​of the current zebra and the elite reverse zebra, and selects the smaller one as the next generation zebra.

[0103] like Figure 1 As shown in the figure, the specific steps of population initialization based on EOBL improved ZOA are as follows:

[0104] Step 1: For any zebra A i , the reverse zebra generated by EOBL is A′ i =(a′ i,1 ,…,a′ i,j ,…,a′ i,11 ), where a′ i,j = r·(l j +u j )-a i,j ; If F(A′ i ) <F(A i ), then A i Defined as elite zebra and denoted as E i Otherwise, A i Directly as the next generation of zebra;

[0105] Step 2: Select all elite zebras in the zebra population to form an elite zebra population; let e i,j For elite Zebra E i The jth hyperparameter value of is calculated by formula (5) The jth hyperparameter value of And use formula (6) to select the next generation of zebras:

[0106]

[0107] In the formula, a j and b j are the lower and upper bounds of the elite zebra population, respectively. j =min[e 1，j ,…,e i，j ,…,e p，j ], b j =max[e 1，j ,…,e i，j ,…,e p，j], p represents the number of elite zebras, and the number of elite zebras is less than or equal to the number of zebra population. It's an elite reverse zebra The corresponding fitness function value.

[0108] ②Introduce firefly disturbance to update zebra position

[0109] The firefly algorithm is a metaheuristic algorithm proposed by Yang et al. in 2010. Its idea is derived from the attraction and movement between fireflies in nature. The present invention introduces a key strategy in the firefly algorithm, FDS, to improve the population update process of ZOA. Through FDS, a new zebra is generated, and the fitness function value of the current zebra and the new zebra is compared, and the smaller one is selected as the next generation of zebra.

[0110] like Figure 2 As shown, after the position update at the end of the defense phase, FDS is used to update Zebra A again i The position of zebra A is calculated by formula (7) i The j-th hyperparameter value of , and then use formula (3) to update the position.

[0111]

[0112] In the formula, β0 and θ are both constants, For the current zebra A i The spatial distance between the pioneer zebra PZ and the target zebra PZ, δ is the step size factor in the interval [0,1].

[0113] ③Improved Zebra Optimization Algorithm IZOA Optimized LightGBM Hyperparameters

[0114] like Figure 3 As shown, the specific steps for optimizing LightGBM hyperparameters using IZOA are as follows:

[0115] Step 1: Set IZOA parameters;

[0116] Set the parameters of IZOA, including: the number of zebra populations, the minimum and maximum values ​​of the hyperparameters to be optimized in the LightGBM model, the maximum number of iterations, the control disturbance amplitude, the initial attraction coefficient, and the rate of adjusting the attraction attenuation;

[0117] Step 2: Introduce EOBL to initialize the population;

[0118] First, randomly generate a zebra population; then compare the fitness function values ​​of the current zebra and the elite reverse zebra, and select the smaller one as the next generation of zebras;

[0119] Step 3: Update Pioneer Zebra;

[0120] Select the zebra with the smallest fitness function value in the population as the pioneer zebra;

[0121] Step 4: Position update during foraging phase;

[0122] Use formula (2) to calculate the new position of the zebra, and use formula (3) to update the position; if the fitness function value of the new position is smaller, then update the position, otherwise, keep the original position;

[0123] Step 5: Position update during defense phase;

[0124] According to the value of the random number p, the new position of the zebra is calculated using formula (4), and the position is updated using formula (3); if the fitness function value of the new position is smaller, the position is updated, otherwise, the original position is retained;

[0125] Step 6: Introduce FDS to update the zebra position again;

[0126] Use formula (7) to calculate the new position of the zebra, and then use formula (3) to update the position; if the fitness function value at the new position is smaller, then update the position, otherwise, keep the original position;

[0127] Step 7: Check whether all zebras have been traversed;

[0128] Check whether the current iteration traverses all zebras. If not, return to step 4 to continue updating the position of the next zebra to ensure that all zebras are updated; otherwise, go to step 8;

[0129] Step 8: Check whether the maximum number of iterations has been reached;

[0130] If the maximum number of iterations is not reached, return to step 3 to continue iterating. Otherwise, output the pioneer zebra of IZOA, that is, the optimal hyperparameters of the LightGBM model, and end the optimization process.

[0131] 2. Android malware detection method based on IZOA-LightGBM

[0132] like Figure 4 As shown in the figure, the specific steps for Android malware detection based on IZOA-LightGBM are as follows:

[0133] Step 1: Initialize the environment and parameters;

[0134] The environment includes: software dependency installation, data set preparation, and environment configuration; initialization parameters are the IZOA parameters set above;

[0135] Step 2: Input dataset;

[0136] Input the Android malware dataset based on dynamic analysis, which uses the CCA dataset and the CMD dataset;

[0137] Step 3: Data preprocessing;

[0138] Use one-hot encoding to convert the Android malware dataset into an input format acceptable to the model, and perform data preprocessing on the dataset to enhance model performance;

[0139] Step 4: Divide the data set;

[0140] The data set is divided into training set, validation set and test set. The training set is used for model training, the validation set is used for model parameter adjustment, and the test set is used to evaluate model performance.

[0141] Step 5: Initialize the LightGBM model;

[0142] Initialize the LightGBM model with default hyperparameters;

[0143] Step 6: Use IZOA to optimize LightGBM model hyperparameters;

[0144] Use the IZOA algorithm to optimize the hyperparameters of the LightGBM model, evaluate the effects of different hyperparameter combinations through the validation set, and select the optimal hyperparameter combination. Pass the optimal hyperparameters found to the LightGBM model;

[0145] Step 7: Build the IZOA-LightGBM model based on the optimal hyperparameters;

[0146] Step 8: Use the test set to evaluate the performance of the IZOA-LightGBM model;

[0147] Calculate the evaluation indicators of the IZOA-LightGBM model (such as accuracy, recall, F1 score, etc.) to determine whether the indicators of the model meet expectations. If so, proceed to step 9; otherwise, return to step 6 and re-optimize the LightGBM model.

[0148] Step 9: Output the detection results and indicators of the IZOA-LightGBM model for the Android malware dataset;

[0149] Step 10: Save the detection results and the constructed IZOA-LightGBM model.

[0150] The complete pseudo code of the IZOA-LightGBM model is shown in Table 2.

[0151] Table 2 IZOA-LightGBM pseudo code

[0152]

[0153]

[0154] Example

[0155] In order to verify the performance of the IZOA-LightGBM model proposed in the present invention, the following simulation experiments were carried out.

[0156] 1. Experimental environment

[0157] Windows 10 64-bit operating system, 16GB of memory, Intel(R) Core(TM) i7-6700 processor, CPU3.40GHz, Visual Studio Code and Python 3.11.

[0158] 2. Dataset

[0159] This embodiment uses two widely recognized public datasets based on dynamic analysis to verify the performance of the IZOA-LightGBM model proposed in this invention on different datasets. The first is the Canadian Institute for Cybersecurity Android Malware Dataset 2020 (CICMalDroid-2020) dataset, referred to as the CMD dataset. The second is the Canadian Institute for Cybersecurity project in collaboration with Canadian Centre for Cyber ​​Security Android Malware 2020 (CCCS-CIC-AndMal-2020) dataset, referred to as the CCA dataset. These two datasets are ideal for Android malware detection and evaluation due to their high quality and diversity.

[0160] The CMD dataset collects more than 17,341 Android samples from multiple sources, including the VirusTotal service, Contagio security blog, AMD, MalDozer, etc. For dynamic analysis, the dataset covers five different categories: adware, banking malware, SMS malware, riskware, and benign software. The dataset contains 471 features. The number of samples in each category is shown in Table 3.

[0161] Table 3 CMD dataset

[0162]

[0163] The CCA dataset is a public dataset jointly produced by the Canadian Centre for Cyber ​​Security and the Canadian Institute for Cyber ​​Security in 2020. For dynamic analysis, the dataset contains 142 features. There are 14 different types of Android malware categories in the dataset, including adware, backdoor, file infector, no category, potentially unwanted applications (PUA), ransomware, riskware, scareware, Trojan, Trojan banker, Trojan dropper, Trojan SMS, Trojan spy, and zero-day vulnerability. After removing the no category and zero-day vulnerability categories from the dataset, 12 categories remain. The number of samples in each category is shown in Table 4.

[0164] Table 4 CCA dataset

[0165]

[0166] 3. Evaluation Metrics

[0167] 1) Training time: record the time point when the model training starts and the time point when the training ends. The difference between the two is the time required for model training.

[0168] (2) Detection time: Detection time refers to the time from the beginning of model detection to the end of the detection process, which is determined by calculating the difference between these two time points.

[0169] (3) Model size: Model size refers to the space occupied by the ML model on the storage medium.

[0170] (4) Accuracy: Accuracy refers to the ratio of the number of samples correctly predicted by the model to the total number of samples. It is used to evaluate the model's ability to correctly classify samples, as shown in the following formula:

[0171]

[0172] Among them, TP (True Positive) represents the number of samples correctly predicted by the model as a certain category; TN (True Negative) represents the number of samples correctly predicted by the model as other categories; FP (False Positive) represents the number of samples of other categories that the model incorrectly predicts as this category; FN (False Negative) represents the number of samples of this category that the model incorrectly predicts as other categories.

[0173] (5) Precision: It refers to the proportion of samples that are actually positive among the samples predicted by the model to be positive. The calculation formula is:

[0174]

[0175] (6) Recall: It is used to measure how many of the true positive samples are correctly predicted as positive. The calculation formula is:

[0176]

[0177] (7) F1-Score: It is used to evaluate the performance of the classification model. Its calculation formula is:

[0178]

[0179] 4. Data preprocessing

[0180] This embodiment performs a series of data preprocessing on the CMD and CCA datasets, including balancing the dataset, feature selection, and feature dimensionality reduction. The purpose of balancing the dataset is to make the model's predictions for all categories fair and to make the model have better generalization capabilities for all categories. Feature selection and feature dimensionality reduction are to remove irrelevant or redundant features to reduce the complexity of the model. In most cases, the detection accuracy of the model can be improved while reducing the risk of overfitting of the model.

[0181] (1) Balanced Dataset

[0182] In order to balance the data set, the present invention uses three different oversampling techniques, namely Adaptive Synthetic Sampling Approach (Adasyn), Random Oversampling (Random) and Synthetic Minority Over-sampling Technique (Smote). The SMS malware category in the CMD data set has the largest number of samples, which is 3904, so the present invention oversamples the samples of each category to 4000. The Trojan category in the CCA data set has a larger number of samples, which is 4025. The present invention oversamples the categories with less than 4025 samples to 4025 samples, and uses random undersampling to 4025 samples for categories with more than 4025 samples. Table 5 shows the accuracy of the data sets generated using different oversampling techniques on the default LightGBM model.

[0183] Table 5 Comparison of different oversampling technologies

[0184]

[0185] As can be seen from Table 5, for CMD and CCA datasets, oversampling technology generally improves the accuracy of the model, which is significantly improved compared with the unbalanced dataset. The CMD and CCA datasets both achieved the highest accuracy using Random oversampling technology. Therefore, the present invention uses Random technology to deal with the data imbalance problem. After balancing, the CMD dataset has 20,000 samples and the CCA dataset has 48,300 samples.

[0186] (2) Feature selection

[0187] The present invention inputs the balanced CMD and CCA datasets into the LightGBM model with default hyperparameters for feature selection to determine the relative importance of the features in the dataset for predicting labels. The present invention uses split gain as a criterion for measuring feature importance. Through this method, feature columns whose split gain is not zero are identified and retained, and combined with the label column to construct a new dataset. The results before and after feature selection are shown in Table 6.

[0188] Table 6 Feature selection results based on LightGBM model

[0189]

[0190] As can be seen from Table 6, the split gain-based feature selection strategy not only reduces the number of features in the data set, but also slightly improves the accuracy of the model. This may be because the strategy effectively removes redundant features that do not contribute much to the detection results, while reducing the noise interference in the data, so that the model can focus more on information that is substantially helpful to the detection results.

[0191] (3) Feature Dimensionality Reduction

[0192] After feature selection, the present invention further applies principal component analysis (PCA) to reduce the feature dimension of the data set. Converting a high-dimensional space into a low-dimensional space while retaining the original structure and important information of the data as much as possible is called dimensionality reduction. Reducing the data dimension can make the ML model analyze the data faster and easier. The cumulative explained variance of the CMD data set is as follows Figure 5 The cumulative explained variance of the CCA dataset is shown in Figure 6 The cumulative explained variance refers to the ratio of the sum of the variance explained by the first n principal components to the sum of the variance explained by all principal components. The results before and after dimensionality reduction are shown in Table 7.

[0193] Table 7 Comparison of data sets before and after dimensionality reduction

[0194]

[0195] according to Figure 5From Table 7, we can see that after dimensionality reduction of the CMD dataset, 99.9% of the cumulative explained variance was achieved with 29 principal components. Although the accuracy was reduced by 0.7%, the training time was accelerated by 1.5 seconds. Figure 6 As shown in Table 7, after dimensionality reduction of the CCA dataset, 99.9% of the cumulative explained variance was achieved with 108 principal components. Although the accuracy was reduced by 0.52%, the training time was accelerated by 1.2 seconds.

[0196] 5. Experimental results and analysis

[0197] In order to ensure the reliability of the experimental results and eliminate the influence of accidental factors, the experiments in this embodiment were repeated 20 times independently, and the final result was the average value of these independent experiments.

[0198] In this example, 80% of the data in the dataset is used to train the model, 10% is used to fit the model during the training process, and the remaining 10% of the data is used for model testing and evaluation. In order to further prevent the model from overfitting, an early stopping strategy is used in the evaluation process, and the number of training rounds is set to 500. When the accuracy of the model does not increase in 10 consecutive rounds, the model will end training.

[0199] During the experiment, some classic optimization algorithms and classifiers were selected as comparison models, including: LightGBM model optimized by ZOA (ZOA-LightGBM), LightGBM model optimized by simulated annealing algorithm (SA) (SA-LightGBM), LightGBM model optimized by PSO algorithm (PSO-LightGBM), XGBoost model optimized by IZOA proposed in this paper (IZOA-XGBoost), LightGBM model with default hyperparameters, Logistic Regression model (LR) with default hyperparameters, and Multi-Layer Perceptron model (MLP) with default hyperparameters. The optimal parameters of each optimization algorithm determined after multiple experiments are shown in Table 8. The LightGBM model uses multi-class logarithmic loss suitable for multi-classification tasks as the performance indicator for evaluating the model, and the gradient boosting type is GBDT. The XGBoost model also uses multi-class logarithmic loss as the performance indicator for evaluating the model.

[0200] Table 8 Optimization algorithm parameters

[0201]

[0202] (1) Confusion Matrix Comparison and Analysis

[0203] As a commonly used performance evaluation method, the confusion matrix can intuitively show the detection effect of the model. The confusion matrix of the IZOA-LightGBM model is as follows: Figure 7 and Figure 8 As shown. Figure 7 and Figure 8 It can be seen that the vast majority of samples of the IZOA-LightGBM model proposed in the present invention are concentrated on the main diagonal of the confusion matrix. The sample points on the main diagonal represent correctly classified samples, while the sample points on the non-diagonal represent incorrectly classified samples. Therefore, the high proportion of main diagonal samples is intuitive evidence of the excellent detection performance of the model. In the CMD dataset, the IZOA-LightGBM model only misidentified 5 samples in a test set with 2000 samples. This phenomenon shows that the model has a strong ability to distinguish when detecting software samples.

[0204] (2) Comparison of accuracy

[0205] Table 9 shows the overall accuracy comparison of the above eight models on the CMD and CCA datasets, and Table 10 shows the accuracy comparison of each category.

[0206] Table 9 Overall accuracy comparison

[0207]

[0208] Table 10 Comparison of accuracy of each category

[0209]

[0210] As can be seen from Table 9, the IZOA-LightGBM model achieves higher accuracy on both the CMD and CCA datasets, 99.75% and 98.86%, respectively. As can be seen from Table 10, the model also achieves higher accuracy in most categories. This shows that the IZOA algorithm effectively enhances the classification ability of the LightGBM model. The accuracy of the LightGBM model combined with other optimization algorithms (ZOA, SA, PSO) is also higher than that of the unoptimized model. This shows that these algorithms have a positive impact on the performance of the model. However, the LR and MLP models perform worse than the decision tree-based detection model on both datasets, especially on the CMD dataset, with lower accuracy.

[0211] (3) Accuracy comparison

[0212] Table 11 shows the accuracy comparison of the above eight models on the CMD and CCA datasets.

[0213] Table 11 Accuracy comparison

[0214]

[0215] As shown in Table 11, on the CMD and CCA datasets, the IZOA-LightGBM model shows better accuracy than other comparison models. The performance of the ZOA-LightGBM model, SA-LightGBM model, and PSO-LightGBM model is also very close, but slightly lower than the IZOA-LightGBM model in some categories. The performance of IZOA-XGBoost is also relatively good overall, but still slightly lower than the previously mentioned models. The LR model and MLP model have lower accuracy than other models in most categories, which may be due to the lack of hyperparameter optimization.

[0216] (4) Recall rate comparison

[0217] Table 12 shows the recall comparison of the above eight models on the CMD and CCA datasets.

[0218] Table 12 Recall rate comparison

[0219]

[0220] As shown in Table 12, the recall rate shows a similar trend to the precision rate. On the CMD dataset, the IZOA-LightGBM model performs better, with the recall rates of the Benign and Adware classes reaching or approaching 100%. On the CCA dataset, the recall rates of the FileInfector and Backdoor categories reach 100%. However, the unoptimized models, such as the LightGBM model with default hyperparameters, the LR model, and the MLP model, perform poorly, performing well on some categories but poorly on others. In addition, for the FileInfector category, most models can correctly identify it.

[0221] (5) F1 score comparison

[0222] Table 13 shows the F1 score comparison of the above eight models on the CMD and CCA datasets.

[0223] Table 13 F1 score comparison

[0224]

[0225] Compared with the previous precision and recall analysis, the F1 score, as the harmonic mean of the two, can more comprehensively evaluate the model performance. A high F1 score means that the model has achieved a good balance between precision and recall. As shown in Table 13, in the CMD dataset, the IZOA-LightGBM model performs better. In the CCA dataset, the IZOA-LightGBM model also performs better in most categories. It can be further seen that there are differences in the F1 scores of the same model on different datasets. For example, the overall performance of the IZOA-LightGBM model on the CMD dataset is better than that on the CCA dataset. This may be due to differences in sample distribution, feature representation, etc. between the two datasets, which affects the generalization ability of the model. In addition, the experimental results show that an increase in sample categories may lead to an increase in detection difficulty.

[0226] (6) Convergence analysis of loss function

[0227] Fig. 9 and Fig.10 The loss function of the IZOA-LightGBM model in the training, validation, and testing processes on the CMD and CCA datasets is shown as a function of the number of iterations. The blue curve represents the training loss, the orange curve represents the validation loss, and the red dot represents the test loss. Fig. 9 and Fig.10 It can be seen that both the training loss and the validation loss decrease rapidly with the increase in the number of iterations and gradually stabilize. The training loss is always lower than the validation loss, indicating that the model performs better on the training set than on the validation set. This phenomenon is expected because the model will try to fit the training data as much as possible during training. In addition, throughout the training process, the gap between the validation loss and the training loss remains in a small range, indicating that the model has not overfitted significantly during training. As can be seen from the figure, the test loss is close to the final value of the validation loss, indicating that the model's performance on the test set is similar to that on the validation set.

[0228] (7) Comparison of different improvement strategies

[0229] In order to verify the necessity of improving the IZOA-LightGBM model, this example uses the ERL improved zebra optimization algorithm (EZOA), the FDS-based improved zebra optimization algorithm (FZOA), and the unimproved ZOA to optimize the LightGBM model. The evaluation results are shown in Table 14.

[0230] Table 14 Comparison of different improvement strategies

[0231]

[0232] It can be seen from Table 14 that different improvement strategies can improve the detection performance of the model. Compared with other improvement strategies, the IZOA-LightGBM model combines the improvements of the two strategies and has the best performance.

[0233] (8) Comparison of time complexity and model size

[0234] The purpose of comparing the time complexity and model size is to evaluate the efficiency and practicality of the model. The evaluation results are shown in Table 15.

[0235] Table 15 Comparison of time complexity and model size

[0236]

[0237]

[0238] As can be seen from Table 15, IZOA-LightGBM exhibits a high time complexity, which is reflected in the fact that it requires a long training time. However, the model training is performed offline, and the trained model can be reused. Therefore, the training time of the model is not particularly important. In addition, the shorter detection time and smaller model size of the IZOA-LightGBM model mean that it may be suitable for deployment on devices with limited computing resources to detect Android malware in real time.

[0239] The LightGBM model optimized using the metaheuristic algorithm showed better detection performance than the LightGBM model with default hyperparameters on both datasets, but the training time increased significantly and the model size also increased. The increase in training time may be due to the introduction of the metaheuristic algorithm, and the increase in model size may be due to the fact that the LightGBM model generates larger and deeper trees.

[0240] The SA-LightGBM model has the longest training time in both datasets, which may be due to the longer optimization time required for SA. The IZOA-XGBoost model performs stably on both datasets, but has longer training and detection times and a larger model size, which is 28.43MB (CMD) and 37.69MB (CCA), respectively. In addition, the models under the CCA dataset generally have a longer training time, which may be due to the fact that the CCA dataset has more sample categories and more samples than the CMD dataset.

[0241] (9) Comparison with other studies in the prior art

[0242] In this embodiment, this method is compared with related research in the prior art. Most studies have adopted ML or DL ​​methods. Mahdavifar et al., the proposers of the CMD dataset, proposed a pseudo-label deep neural network (PLDNN) detection method and conducted experiments on the CMD dataset. Mohamed et al. used 4 different ML models to analyze the CMD dataset. Musikawan et al. proposed an effectively improved deep neural network. Ullah et al. proposed an integrated model. Rahali et al. proposed an image-based deep neural network method. Xie et al. proposed a DL-based multi-label detection model. Al-Andoli et al. proposed a parallel DL framework called PDL-FEMC. Li et al. proposed an Android malware detection model called SynDroid. This embodiment is classified according to the dataset and sorted according to the time of proposal. The results are shown in Table 16.

[0243] Table 16 Comparison with other studies

[0244]

[0245]

[0246] In Table 16, the studies of Musikawan, Batouche, and Xie et al. included two categories that the authors of the CCA dataset suggested to delete, resulting in a lower accuracy. As shown in Table 16, on the CMD dataset, when detecting the same category and using dynamic analysis, the model proposed by the present invention achieved a higher accuracy than the model proposed by Mahdavifar and Padmavathi et al. On the CCA dataset, when detecting the same category and using dynamic analysis, the accuracy of the model proposed by the present invention is also higher than the model proposed by Rahali et al.

[0247] 6. Analysis results

[0248] The present invention uses two public data sets, CMD data set and CCA data set, to evaluate the detection performance of the IZOA-LightGBM model. First, the CMD and CCA data sets are preprocessed respectively, including data set balancing, feature selection and feature dimensionality reduction, to improve the accuracy and efficiency of model training and detection. Afterwards, the accuracy, precision, recall, F1 score, training time, detection time and model size are evaluated. The evaluation results show that the IZOA-LightGBM model achieves an accuracy of 99.75% on the CMD data set and an overall accuracy of 98.86% on the CCA data set. It is superior to other comparison models and shows the application potential of the model in Android malware detection tasks. It can be seen from the evaluation results that the IZOA-LightGBM model has better detection performance than the LightGBM model combined with other optimization algorithms (such as ZOA-LightGBM, SA-LightGBM and PSO-LightGBM). In addition, the IZOA-LightGBM model has a short detection time and a moderate model size, which is suitable for deployment on devices with limited computing resources for real-time Android malware detection.

[0249] References:

[0250] Literature [1] Mahdavifar, S.; Abdul Kadir, AF; Fatemi, R.; Alhadidi, D.; Ghorbani, AADynamic Android Malware Category Classification using Semi-SupervisedDeep Learning. In Proceedings of the 2020IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing,Intl Conf on CyberScience and Technology Congress(DASC / PiCom / CBDCom / CyberSciTech), 2020; pp.515-522.

[0251] Reference [2] Mohamed, S.E.; Ashaf, M.; Ehab, A.; Shereef, O.; Metwaie, H.; Amer, E. Detecting malicious android applications based on API calls and permissions using machine learning algorithms. In Proceedings of the 2021 International Mobile, Intelligent, and Ubiquitous Computing Conference (MIUCC), 2021; pp. 1-6.

[0252] Reference [3] Musikawan, P.; Kongsorot, Y.; You, I.; So-In, C. An Enhanced Deep Learning Neural Network for the Detection and Identification of Android Malware. IEEE Internet of Things Journal 2023, 10, 8560-8577, doi: 10.1109 / jiot.2022.3194881.

[0253] Reference [4] Ullah, F.; Ullah, S.; Naeem, M.R.; Mostarda, L.; Rho, S.; Cheng, X. Cyber-threat detection system using a hybrid approach of transfer learning and multi-model image representation. Sensors 2022, 22, 5883.

[0254] Reference [5] Padmavathi, G.; Shanmugapriya, D.; Roshni, A. Performance analysis of unsupervised machine learning methods for mobile malware detection. In Proceedings of the 2022 9th International Conference on Computing for Sustainable Global Development (INDIACom), 2022; pp. 201-206.

[0255] Reference [6] Rahali, A.; Lashkari, A. H.; Kaur, G.; Taheri, L.; Gagnon, F.; Massicotte, F. DIDroid: Android Malware Classification and Characterization Using Deep Image Learning. In Proceedings of the 2020 the 10th International Conference on Communication and Network Security, 2020; pp. 70-82.

[0256] Reference [7] Batouche, A.; Jahankhani, H. A comprehensive approach to android malware detection using machine learning. Information Security Technologies for Controlling Pandemics 2021, 171-212.

[0257] Literature [8] Al-Andoli, MN; Tan, SC; Sim, KS; Lim, CP; Goh, PYParallelDeep Learning with a hybrid BP-PSO framework for feature extraction and malware classification. Applied Soft Computing 2022,131, doi:10.1016 / j.asoc.2022.109756.

[0258] Literature [9] Xie, J.; Li, S.; Zhang, Y.; Sun, P.; Xu, H.Analysis and detection against network attacks in the overlapping phenomenon of behaviorattribute. Computers&Security 2022,121,102867.

[0259] Literature

[10] Li,J.;He,J.;Li,W.;Fang,W.;Yang,G.;Li,T.

[0260] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A multi-classification dynamic detection method for Android malware, characterized in that: The following steps are involved: Step 1: Build the IZOA-LightGBM dynamic detection model; Step 2: Download the software to be tested, obtain the behavior of the software and collect its behavior data, pre-process the obtained data and input it into the IZOA-LightGBM dynamic detection model; Step 3: Use the IZOA-LightGBM dynamic detection model to detect the software to be tested and output the detection results.

2. The Android malware multi-classification dynamic detection method according to claim 1, characterized in that: Step 1 The specific steps of model construction include: Step 1.1: Initialize the environment and parameters; Step 1.2: Obtain an Android malware dataset based on dynamic analysis and preprocess the dataset; Step 1.3: Divide the preprocessed Android malware dataset into training set, validation set and test set; Step 1.4: Determine the hyperparameters of the LightGBM model to be optimized and initialize the LightGBM model with default hyperparameters; Step 1.5: On the training set, use the IZOA algorithm to optimize the default hyperparameters of the LightGBM model, and evaluate the optimization results of different hyperparameter combinations through the validation set to select the optimal hyperparameter combination; Step 1.6: Build the LightGBM model based on the optimal hyperparameter combination; Step 1.7: Use the test set to evaluate the performance of the model built in step 1.6, calculate the various evaluation indicators of the model, and determine whether the various indicators of the model reach the expected threshold. If so, proceed to step 1.8; otherwise, return to step 1.5; Step 1.8: Output the tested model and use it as the IZOA-LightGBM dynamic detection model.

3. The Android malware multi-classification dynamic detection method according to claim 1, characterized in that: The hyperparameters to be optimized for the LightGBM model include: learning rate, minimum number of samples required for a leaf node, maximum depth of the tree, number of leaf nodes on each tree, maximum possible number of feature value bins, minimum number of data samples in a leaf node, proportion of feature subsets used to train the model in each iteration, sampling ratio of control training data, frequency of bagging, L1 regularization, and L2 regularization.

4. The Android malware multi-classification dynamic detection method according to claim 2, characterized in that: The specific steps of step 1.5 include: Step 1.5.1: Initialize parameters, including the number of zebra populations, the minimum and maximum values ​​of the hyperparameters to be optimized for the LightGBM model, the maximum number of iterations, the control disturbance amplitude, the initial attraction coefficient, and the rate at which the attraction is adjusted to decay; Step 1.5.2: Initialize the zebra population based on the EOBL algorithm, where each zebra corresponds to a set of hyperparameter values ​​to be optimized; Step 1.5.3: Calculate the fitness function value of each zebra in the population, and select the zebra with the smallest fitness function value in the population as the pioneer zebra; Step 1.5.4: Calculate the new position of the zebra according to the following formula: in, Zebra A i The updated value of the jth hyperparameter value, r is a random number in the interval [0,1], PZ j is the jth hyperparameter value of Pioneer Zebra, Step 1.5.5: Use the following position update formula to update the position of the zebra in the foraging phase. If the fitness function value of the new position is smaller, update the position; otherwise, keep the original position: in, Zebra A i new location; is the fitness function value of the new position, F(A i ) is the fitness function value of the original position; Step 1.5.6: In the defense phase, according to the value of the random number p∈[0,1], the new position of the zebra is calculated by the following formula: Among them, M1 represents the escape strategy, M2 represents the counterattack strategy; t is the current iteration number, T is the maximum iteration number; β is a constant, its value is equal to 0.01; AZ represents the position of any zebra in the zebra population except the i-th one, AZ j is the value of its jth hyperparameter; Step 1.5.7: Update the zebra position in the defense phase and use the FDS algorithm to update the zebra position again; Step 1.5.8: Determine whether the current iteration has traversed all zebras. If not, return to step 1.5.4 to continue updating the position of the next zebra until all zebras are updated; otherwise, go to step 1.5.9; Step 1.5.9: Determine whether the current number of iterations has reached the maximum number of iterations. If not, return to step 1.5.3; otherwise, output IZOA's pioneer zebra, that is, the optimal hyperparameters of the LightGBM model.

5. The Android malware multi-classification dynamic detection method according to claim 2, characterized in that: The specific steps of step 1.5.2 include: Step 1.5.2.1: Randomly generate an initial population of z zebras, and define each zebra i as a position vector A i =(a i,1 ,…,a i,j ,…,a i,11 ), where a i,j is the jth hyperparameter value, ranging from [l j ,u j ], 1≤i≤z, 1≤j≤11, and each vector corresponds to a set of hyperparameter values ​​to be optimized in the LightGBM model; Step 1.5.2.2: For any zebra A i , generate its reverse zebra A′ through EOBL i , and A′ i =(a′ i,1 ,…,a′ i,j ,…,a′ i,11 ), where a′ i,j = r·(l j +u j )-a i,j ; Step 1.5.2.3: Calculate the current zebra A by the following formula i and its reverse zebra A′ i The fitness function value F(A i ) and F(A′ i ): F(A i )=min(1-Accuracy LightGBM ) Among them, Accuracy LightGBM Indicates the accuracy of the LightGBM model; Step 1.5.2.4: Determine F(A′ i ) <F(A i ) is true, if so, then A i Defined as an elite zebra, and the elite zebra is denoted as E i , and go to step 1.5.2.5; otherwise, A i Directly use it as the next generation of zebra and proceed to step 1.5.2.8; Step 1.5.2.5: Calculate E using the following formula i Elite Reverse Zebra Among them, e i，j For elite Zebra E i The jth hyperparameter value of a j and b j are the lower and upper bounds of the elite zebra population, respectively, a j =min[e 1，j ,…,e i，j ,…,e p，j ], b j =max[e 1，j ,…,e i，j ,…,e p，j ]; Step 1.5.2.6: Calculate E separately i and The fitness function value F(E i )and And select the next generation of zebras according to the following formula: Step 1.5.2.7: Update the initial population using the next generation of zebras; Step 1.5.2.8: Determine whether all zebras have been updated. If so, proceed to step 1.5.2.

9. Otherwise, return to step 1.5.2.

3. Step 1.5.2.9: Define the zebra with the smallest fitness function value in the population as the pioneer zebra PZ.

6. The Android malware multi-classification dynamic detection method according to claim 2, characterized in that: The specific steps of step 1.5.7 include: Step 1.5.7.1: Update the zebra position in the defense phase using the position update formula in step 1.5.5; Step 1.5.7.2: Calculate the jth hyperparameter value of zebra i by the following formula, and use the position update formula in step 1.5.5 to get the position of the new zebra in, are constants, For the current zebra A i The spatial distance between the pioneer zebra PZ and the target zebra PZ, δ is the step size factor in the interval [0,1].

7. An Android malware multi-classification dynamic detection system, implemented based on the method described in any one of claims 1-6, characterized in that: include: Model building module, used to build the IZOA-LightGBM dynamic detection model; Data input module, used to download the software to be tested and input it into the IZOA-LightGBM dynamic detection model; The dynamic detection module is used to use the IZOA-LightGBM dynamic detection model to detect the software to be tested and output the detection results.

Images