Malicious software identification method based on Android malicious software detection model

Abstract

The invention provides a malicious software identification method based on an Android malicious software detection model, and relates to the technical field of malicious software identification. The APK file contains the permission information and the function calling relation, so that the permission vector and the function calling graph corresponding to the APK file can be constructed. A first model and a second model are trained respectively, the first model is used for malicious software detection based on the permission information in the APK file, and the second model is used for malicious software detection based on the function call graph. And finally, integrating the first model and the second model to obtain the Android malicious software detection model. The obtained android malicious software detection model can greatly improve the detection accuracy and robustness, and is suitable for detection of large-scale android malicious software.

Description

Technical Field

[0001] The present invention relates to the technical field of malware identification, and in particular to a malware identification method based on an Android malware detection model. Background Art

[0002] Due to the open source nature of Android, it has brought many security issues. Currently, there are three common techniques for detecting Android malware: static analysis, dynamic analysis, and hybrid analysis. Among them, static analysis is fast but easily affected by obfuscation; dynamic analysis is not easily affected by obfuscation, but it is slow; hybrid analysis is a combination of the two.

[0003] At present, many new methods have been proposed to improve the accuracy of malware detection. A series of methods focus on hybrid analysis, such as malicious detection methods based on permissions and dynamic analysis. However, since dynamic analysis requires the execution of software, it is time-consuming and permissions may be over-declared, which will affect the accuracy of the model to a certain extent. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a malware identification method based on an Android malware detection model to solve the above technical problems.

[0005] The technical solution of the present invention to solve the above technical problems is as follows: a malware identification method based on an Android malware detection model, comprising: obtaining an APK data set, wherein the APK data set includes APK files; according to the APK data set, determining the permission vector and function call graph corresponding to each APK file in the APK data set respectively, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file; based on the permission vector corresponding to each APK file, training a preset neural network model to obtain a first model, wherein the first model is used to identify whether the application corresponding to the APK file is malware based on the permissions required by the application corresponding to the APK file; based on the function call graph corresponding to each APK file, training a preset graph convolutional neural network model to obtain a second model, wherein the second model is used to identify whether the application corresponding to the APK file is malware based on the function call graph corresponding to the APK file; performing model integration processing on the first model and the second model to generate an Android malware detection model, so as to perform malware identification on the APK file to be detected based on the Android malware detection model.

[0006] The beneficial effects of the present invention are as follows: the APK file contains permission information and function call relationships, so the permission vector and function call graph corresponding to the APK file can be constructed. The first model and the second model are trained separately, the first model is used to detect malware based on the permission information in the APK file, and the second model is used to detect malware based on the function call graph. Finally, the first model and the second model are integrated to obtain an Android malware detection model. The obtained Android malware detection model can greatly improve the accuracy and robustness of detection, and is suitable for large-scale Android malware detection.

[0007] Based on the above technical solution, the present invention can also be improved as follows.

[0008] Furthermore, for each APK file, the permission vector corresponding to the APK file is determined in the following manner: based on the APK file, determining the permissions required for the application corresponding to the APK file; and constructing the permission vector corresponding to the APK file based on the permissions required for the application corresponding to the APK file and a preset default permission set.

[0009] Furthermore, for each APK file, the function call graph corresponding to the APK file is determined in the following manner: according to the APK file, the framework space method, application space method, class to which each framework space method belongs, and class to which each application space method belongs defined in the application corresponding to the APK file are obtained, and an initial function call graph is generated; each of the framework space methods represents a method customized by the Android system framework, and each of the application space methods represents a method customized by the user when writing the application corresponding to the APK file, and the initial function call graph is used to describe the calling relationship between the framework space method and the application space method; the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space are obtained respectively, and the callback relationship table in the Android framework space The callback relationship between framework space methods is characterized, the inheritance relationship in the Android application space includes class inheritance relationship and method inheritance relationship, the class inheritance relationship represents the inheritance relationship between classes, the method inheritance relationship represents the inheritance relationship between application space methods and between framework space methods and application space methods, and the permission relationship in the Android framework space represents the correspondence between framework space methods and permissions required for framework space methods; with framework space methods, application space methods and permissions required for framework space methods as nodes, based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space and the permission relationship in the Android framework space, the initial function call graph is updated to obtain a new function call graph; the new function call graph is simplified to obtain a function call graph corresponding to the APK file.

[0010] Furthermore, it also includes: determining the attribute vectors of each node respectively, the attribute vector of each framework space method is a vector describing the application programming interface package to which the framework space method belongs, the attribute vector of each application space method is a vector describing the operation code required by the application space method, and the attribute vector of each permission required by the framework space method is a vector describing the permission type and danger type to which the permission required by the framework space method belongs.

[0011] Furthermore, each callback relationship in the Android framework space is determined in the following manner: a potential callback method is obtained, the potential callback method represents a framework space method that can be executed and overwritten by the Android application space, and the Android application space represents an independent environment used when the application corresponding to the APK file runs on the device; for each potential callback method, it is determined whether there is a registration method corresponding to the potential callback method, and whether the potential callback method is called inside the class to which the registration method belongs. If there is a registration method corresponding to the potential callback method and the potential callback method is called inside the class to which the registration method belongs, then a callback relationship in the Android framework space is constructed based on the potential callback method and the registration method corresponding to the potential callback method, the registration method represents a framework space method with the class to which the potential callback method belongs as a parameter, and the parameter represents a variable declared in the framework space method definition.

[0012] Further, the obtaining of potential callback methods includes: respectively determining whether each framework space method meets a first criterion, and determining the framework space method that meets the first criterion as a potential callback method, wherein the first criterion is: the class to which the framework space method belongs can be accessed and inherited by any class to which the framework space method belongs and the class to which the application space method belongs, and the class to which the framework space method belongs can be extended, and the framework space method can be overwritten by the Android application space.

[0013] Furthermore, the method inheritance relationship is determined in the following manner: for each application space method, determine whether there is a first method corresponding to the application space method based on the class inheritance relationship; if so, determine that the application space method and the first method constitute the method inheritance relationship; wherein, the first method is an application space method or a framework space method, the class to which the first method belongs has an inheritance relationship with the class to which the application space method belongs, and the signature corresponding to the first method is the same as the signature corresponding to the application space method.

[0014] Furthermore, the simplification of the new function call graph includes: replacing the nodes corresponding to each framework space method in the new function call graph with the nodes corresponding to the class to which each framework space method belongs; replacing the nodes corresponding to each application space method in the new function call graph with the nodes corresponding to the class to which each application space method belongs.

[0015] To solve the above technical problems, the present application also provides a malware identification device based on an Android malware detection model, comprising:

[0016] An acquisition module, used to acquire an APK data set, wherein the APK data set includes an APK file;

[0017] A data processing module, configured to determine, according to the APK data set, a permission vector and a function call graph corresponding to each APK file in the APK data set, respectively, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file;

[0018] A first training module, configured to train a preset neural network model based on permission vectors corresponding to each APK file to obtain a first model, wherein the first model is configured to identify whether an application corresponding to the APK file is malware based on permissions required by the application corresponding to the APK file;

[0019] A second training module is used to train a preset graph convolutional neural network model based on a function call graph corresponding to each APK file to obtain a second model, wherein the second model is used to identify whether an application corresponding to the APK file is malware based on the function call graph corresponding to the APK file;

[0020] The model integration module is used to perform model integration processing on the first model and the second model to generate an Android malware detection model, so as to identify malware on the APK file to be detected based on the Android malware detection model.

[0021] To solve the above technical problems, the present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a malware identification method based on an Android malware detection model as described above is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A flowchart of a malware identification method based on an Android malware detection model of the present invention;

[0023] Figure 2A detection flow chart based on permission features of a malware identification method based on an Android malware detection model of the present invention;

[0024] Figure 3 A schematic diagram of a process of obtaining a function call graph of a malware identification method based on an Android malware detection model according to the present invention;

[0025] Figure 4 A detection flow chart based on a function call graph of a malware identification method based on an Android malware detection model of the present invention;

[0026] Figure 5 A graph showing the model accuracy mean under different node types of a malware identification method based on an Android malware detection model of the present invention;

[0027] Figure 6 A graph showing the change in model accuracy under different numbers of GNN layers of a malware identification method based on an Android malware detection model of the present invention;

[0028] Figure 7 A detection flow chart of a malware identification method based on an Android malware detection model according to the present invention based on a logistic regression meta-model;

[0029] Figure 8 A schematic diagram of a malware identification device based on an Android malware detection model according to the present invention. DETAILED DESCRIPTION

[0030] The principles and features of the present invention are described below. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0031] like Figure 1As shown, this embodiment provides a malware identification method based on an Android malware detection model, including: obtaining an APK data set, wherein the APK data set includes APK files; according to the APK data set, determining the permission vector and function call graph corresponding to each APK file in the APK data set respectively, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file; based on the permission vector corresponding to each APK file, training a preset neural network model to obtain a first model, wherein the first model is used to identify whether the application corresponding to the APK file is malware based on the permissions required by the application corresponding to the APK file; based on the function call graph corresponding to each APK file, training a preset graph convolutional neural network model to obtain a second model, wherein the second model is used to identify whether the application corresponding to the APK file is malware based on the function call graph corresponding to the APK file; performing model integration processing on the first model and the second model to generate an Android malware detection model, so as to perform malware identification on the APK file to be detected based on the Android malware detection model.

[0032] The APK file contains permission information and function call relationships, so the permission vector and function call graph corresponding to the APK file can be constructed. The first model and the second model are trained separately. The first model is used to detect malware based on the permission information in the APK file, and the second model is used to detect malware based on the function call graph. Finally, the first model and the second model are integrated to obtain an Android malware detection model. The obtained Android malware detection model can greatly improve the accuracy and robustness of detection and is suitable for large-scale Android malware detection.

[0033] APK files include benign APK files and malicious APK files. In this embodiment, the APK data set comes from: 3000 malicious APK files are selected from the MalDroid database, which cover three main types of malware: Adware, Banking and SMS, and each type contains 1000 samples. This classification method helps the model learn and identify the characteristics of different types of malicious behaviors. A total of 5019 APK files were downloaded from the Androzoo database, of which 2033 were marked as malware, including but not limited to ransomware and Trojan software, to provide a wider range of malware behavior samples. The remaining 2986 are benign APK files, and these benign applications cover a variety of common application types, such as social networks, news, tools and games. Combined in the above manner, a comprehensive data set consisting of 8019 APK files is finally formed. This huge data set not only provides enough sample size to train and verify the model, but also the diverse sample types help to improve the generalization ability and accuracy of the model in the actual environment.

[0034] Optionally, in an embodiment, for each APK file, the permission vector corresponding to the APK file is determined in the following manner: based on the APK file, determining the permissions required for the application corresponding to the APK file; and constructing the permission vector corresponding to the APK file based on the permissions required for the application corresponding to the APK file and a preset default permission set.

[0035] Specifically, based on the APK file, the AndroidManifest file is obtained by using the apktools tool, and various key information and configurations of the application corresponding to the APK file are parsed, including permission information, that is, the permissions required by the application corresponding to the APK file are obtained.

[0036] In this embodiment, a default permission set is first constructed. The default permission set contains 325 commonly used permissions, covering various operations and function access in the Android system, including network access permissions, system permissions, and data access permissions. On this basis, the permissions in the AndroidManifest file corresponding to each APK file are scanned. If the permission is not included in the default permission set, the permission is added to the default permission set to update the default permission set. The final default permission set will include all permissions in all APK files, and there will be no duplicate permissions. In this example, the final default permission set includes 474 permissions, and the default permission set is represented in the form of a vector, that is, a 474-dimensional vector is formed.

[0037] For each APK file, when constructing the permission vector, the corresponding positions of the permissions required by the application corresponding to the APK file are marked as 1, and the corresponding positions of the permissions not required by the application corresponding to the APK file are marked as 0. This process generates a multi-dimensional vector, where each dimension represents a specific permission, thus forming a complete representation of the APK permissions.

[0038] Based on the permission vectors corresponding to each APK file, the preset neural network model is trained to obtain a first model, specifically: Figure 2 As shown, an input layer is constructed to receive data input from the outside, and the input data contains 474 features. Three hidden layers are constructed, and the hidden layers include: the first hidden layer has 256 nodes; the second hidden layer has 128 nodes; the third hidden layer has 32 nodes. The ReLU activation function is used, and a dropout layer (Dropout) is added after each hidden layer, and the dropout rate is set to 0.2. An output layer is added, which has only one neuron and uses the Sigmoid activation function. In this binary classification problem, the Sigmoid function can compress the output to between 0 and 1, indicating probability. The training is 100 cycles, and the batch size is 32.

[0039] The network loss function calculation formula of the first model is as follows:

[0040]

[0041] Where y is the true label (0 or 1); is the probability predicted by the model; N is the number of samples.

[0042] Optionally, in an embodiment, for each APK file, the function call graph corresponding to the APK file is determined in the following manner: according to the APK file, the framework space method, application space method, class to which each framework space method belongs, and class to which each application space method belongs defined in the application corresponding to the APK file are obtained, and an initial function call graph is generated; each of the framework space methods represents a method customized by the Android system framework, and each of the application space methods represents a method customized by the user when writing the application corresponding to the APK file, and the initial function call graph is used to describe the calling relationship between the framework space method and the application space method; the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space are obtained respectively, and the callback relationship in the Android framework space The relationship represents the callback relationship between framework space methods, the inheritance relationship in the Android application space includes class inheritance relationship and method inheritance relationship, the class inheritance relationship represents the inheritance relationship between classes, the method inheritance relationship represents the inheritance relationship between application space methods and between framework space methods and application space methods, and the permission relationship in the Android framework space represents the correspondence between framework space methods and permissions required for framework space methods; with framework space methods, application space methods and permissions required for framework space methods as nodes, based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space and the permission relationship in the Android framework space, the initial function call graph is updated to obtain a new function call graph; the new function call graph is simplified to obtain a function call graph corresponding to the APK file.

[0043] Specifically, Figure 3 As shown in the figure, the Dex code and AndroidManifest file can be extracted from the APK file using the apktool tool. The Dex file, also known as the Dalvik executable file, is a key component of an Android application and contains compiled Java code, including user-defined logic and references to Android APIs. These codes are interpreted and executed by the Android runtime, enabling the application to implement various functions and interactions. By parsing the Dex code, the classes (C) and methods (M) defined in the application can be systematically extracted. Using the third-party tool Androguard, an initial function call graph can be generated, but the graph only includes call relationships, not callback relationships and inheritance relationships.

[0044] In the Android system, the Android application space refers to the independent environment used by each application when running on the device. This includes code, data, and resources, and is protected by the sandbox mechanism to ensure the independence and security of the application. The Android framework space refers to the core libraries and services provided by the Android system that support the operation of applications, such as core libraries and system services. Applications run in the Android application space, but need to call libraries and services in the Android framework space to perform various tasks.

[0045] Optionally, in an embodiment, each callback relationship in the Android framework space is determined in the following manner: obtaining a potential callback method, the potential callback method representing a framework space method that can be executed and overwritten by the Android application space, and the Android application space representing an independent environment used when the application corresponding to the APK file runs on the device; for each potential callback method, determining whether there is a registration method corresponding to the potential callback method, and determining whether the potential callback method is called inside the class to which the registration method belongs. If there is a registration method corresponding to the potential callback method and the potential callback method is called inside the class to which the registration method belongs, then a callback relationship in the Android framework space is constructed based on the potential callback method and the registration method corresponding to the potential callback method, the registration method representing a framework space method with the class to which the potential callback method belongs as a parameter, and the parameter representing a variable declared in the framework space method definition.

[0046] Optionally, in an embodiment, obtaining the potential callback method includes: separately determining whether each framework space method meets a first criterion, and determining the framework space method that meets the first criterion as a potential callback method, the first criterion being: the class to which the framework space method belongs can be accessed and inherited by any class to which the framework space method belongs and the class to which the application space method belongs, and the class to which the framework space method belongs can be extended, and the framework space method can be overwritten by the Android application space.

[0047] The specific expression of the first criterion is:

[0048] 1.isPublic(c)=1

[0049] 2.isFinal(c)=0

[0050] 3.isInterface(c)=1VVx∈constructors(c)isPublic(x)

[0051] 4.isPublic(m)=1VisProtected(m)=1

[0052] The specific meanings of the above four standards are: 1. In programming, the public modifier means that this class can be accessed by any other class, that is, standard 1 indicates that the class corresponding to the framework space method m can be accessed by any other class. 2. In programming, when the final modifier is used for a class, it means that the class cannot be inherited. isFinal(c) = 0, which means that the modifier of class c is not final, and class c can be inherited. 3. It means that class c is an interface and its constructors are all public modified. In programming, the constructors in the interface are implicitly public. This is the interface specification indicating that interface c can be instantiated. 4. It means that the framework space method m can be public or protected, which means that method m can be overridden by the external application space. Standards 1, 2 and 3 ensure that class c is visible to the application space class and can be extended, and standard 4 ensures that method m can be overridden in the application space.

[0053] For each potential callback method, determine whether there is a registration method corresponding to the potential callback method, specifically:

[0054] Use a parameter set, which is a multi-mapping relationship: α F :C F →M F , where C F It is a class in the Android framework space, M F It is a method in the Android framework space. That is to say, check whether the class class(m) to which method m belongs satisfies α F (c) is not equal to the empty set. The condition can be verified by the following formula:

[0055]

[0056] Where c represents the class passed as a parameter, r represents the registration method, and α F It is a collection used to store the mapping relationship between c and r, and c∈argumentTypes(r) is a collection of parameter types representing method r.

[0057] When judging whether the potential callback method is called inside the class to which the registered method belongs, specifically: the call of the potential callback method m occurs in the class u=class(r) to which the registered method belongs, specifically including the methods in u and the internal classes of u. If the call of the potential callback method m is detected in u, then the potential callback method m is the final callback method, otherwise it is not a callback method.

[0058] The callback method and its corresponding registration method are determined by the above conditions. Each callback method and its corresponding registration method form a mapping pair and are saved in a mapping collection to characterize the callback relationship in the Android framework space.

[0059] Optionally, in an embodiment, the method inheritance relationship is determined in the following manner: for each application space method, determine whether there is a first method corresponding to the application space method based on the class inheritance relationship; if so, determine that the application space method and the first method constitute the method inheritance relationship; wherein, the first method is an application space method or a framework space method, the class to which the first method belongs has an inheritance relationship with the class to which the application space method belongs, and the signature corresponding to the first method is the same as the signature corresponding to the application space method.

[0060] Class-level inheritance diagram I(C)(C,E (c) parentOf) formula is:

[0061]

[0062] The class inheritance relationship is expressed in the form of a class-level inheritance graph. The class-level inheritance graph I(C) is constructed by analyzing the inheritance relationship between classes and is expressed as I(C)(C, E (C) parentOf). This formula defines the condition for class-level inheritance relationships: if class c i and c j There is an inheritance relationship between them, namely (c i , c j )∈E (C) parentOf, it means that c i It is c j The parent class of .

[0063] Based on the class-level inheritance graph, a method-level inheritance graph is generated, and the method inheritance relationship is expressed through the method-level inheritance graph. (M) parentOf) formula is:

[0064] E(M)parentOf=(m i , m j )|(class(m i ), class(m j )∈E (C) parentOf∧

[0065] sig(m i )=sig(m i );

[0066] This formula shows that if method m i and m j The class to which it belongs (m i ) and class(m j ) In the class inheritance diagram E (C)parentOf has a parent-child relationship, and the signatures of these two methods are the same (sig(m i )=sig(m j )), that is, the two methods have the same method name and method parameters, then in the method inheritance graph E(M)parentOf, m i will be used as m j The parent method exists, that is, the first method. This shows that method-level inheritance is based on class-level inheritance and the consistency of method signatures.

[0067] In order to better determine whether an APK file is benign, permission nodes are added based on the initial function call graph. These permissions are required by the Android framework space and will not cause over-declaration issues.

[0068] The formula for adding permission nodes is as follows:

[0069]

[0070] Frame Space Method M F The relationship between the edge and the authority is as shown in the above formula, where: The set of edges between methods and permissions, m: methods in the Android framework space, p: permission nodes, M F : Framework space method, Ψ(m): the set of permissions required by method m.

[0071] Optionally, in an embodiment, it also includes: determining the attribute vectors of each node respectively, the attribute vector of each of the framework space methods is a vector describing the application programming interface package (API package) to which the framework space method belongs, the attribute vector of each of the application space methods is a vector describing the operation codes required for the application space method, and the attribute vector of each of the permissions required by the framework space method is a vector describing the permission type and danger type to which the permissions required by the framework space method belong.

[0072] The attribute of the framework space method is its corresponding package name, which is represented by a one-hot vector. Specifically, the attribute of each framework space method is represented by a one-hot vector, and the dimension of this vector is equal to the total number of API packages in the API list. In this embodiment, the total number of API packages is 226.

[0073] One-hot encoding is a commonly used numerical representation method for converting categorical variables into numerical data that can be processed by machine learning algorithms. In this method, each category is represented as a binary vector whose length is equal to the number of categories, where only one position is 1, indicating the current category, and the rest of the positions are 0.

[0074] For framework space methods, a total of 226 API packages are defined, each with a position. If a method belongs to a specific API package, the corresponding position in the one-hot vector is set to 1, and the rest of the positions are 0. In this way, each framework space method can be represented by a unique vector to represent the API package it belongs to.

[0075] For example, if the "onCreate" method in the "android.app.Activity" class is at the 42nd position in the API list, then its one-hot vector is 1 at the 42nd bit and the rest of the bits are 0. This representation method can clearly distinguish and process methods belonging to different API packages, which facilitates subsequent analysis and calculation.

[0076] In this embodiment, the attributes of the application space method use a 21-dimensional Boolean vector to describe the opcode. Specifically, the attributes of the application space method are designed as a 21-bit Boolean vector, which is used to identify different opcode groups used in the main body of the application code. Opcodes are a mechanism in low-level programming that represent various operations that can be performed during program execution, such as arithmetic operations, logical operations, control flow instructions, etc.

[0077] Each bit in this vector corresponds to a specific opcode group, and if any opcode in this group is used in the application, the corresponding bit is set to true, otherwise it is false. This encoding method provides a compact and effective way to describe the behavioral characteristics of the application.

[0078] For example, during the execution of a certain application space method of an application, if operations such as arithmetic operations and array access are involved, then in the attribute vector representing the method, the bits corresponding to the arithmetic operations and array access opcode groups will be marked as true, thereby reflecting that these operations have been actually used. Correspondingly, if the method does not use other types of opcodes, then these bits will remain false in the vector, clearly indicating that they have not been called in the method. The 21 opcodes in this embodiment are specifically shown in Table 1:

[0079] Table 121 Operation code name diagram

[0080]

[0081]

[0082] The attribute vector of the permission node is a one-hot vector of the group to which the permission belongs, and an additional bit is used to indicate the dangerous type of the permission, that is, whether it is classified as a dangerous permission. Specifically, in this embodiment, there are 20 permission groups, as shown in Table 2:

[0083] Table 2 Authorization group names and hazard types

[0084]

[0085]

[0086] That is to say, the attribute vector of each permission node will include a 20-bit one-hot vector, indicating the group number to which the permission belongs, and an additional bit indicating whether the permission is classified as a dangerous permission. Example: The permission is android.permission.GET_ACCOUNTS, group number: 0 (accounts and account management), danger flag: 1 (dangerous permission), the one-hot vector indicates: Since the group number is 0, the first bit is 1, and the following 19 bits are 0. Because it is a dangerous permission, the last bit (bit 21) is 1.

[0087] It should be noted that the groups and permissions in Table 2 are essentially a one-to-many relationship, that is, one permission group has multiple permissions.

[0088] Optionally, in an embodiment, the simplification of the new function call graph includes: replacing the nodes corresponding to each framework space method in the new function call graph with nodes corresponding to the class to which each framework space method belongs; replacing the nodes corresponding to each application space method in the new function call graph with nodes corresponding to the class to which each application space method belongs.

[0089] The new function call graph contains a large number of nodes and edges, and the generalization ability of the Android malware detection model will be limited. The new function call graph contains nodes such as framework space method nodes (api), application space method nodes (user), and permission nodes (permission); the edges are shown in the following table:

[0090] Table 3. Edge types in the new function call graph

[0091] starting point relation end user invokes user user invokes_api API user parent_of user API api_parent_of user API uses permiSSion API calls_back API

[0092] Specifically, in this embodiment, there are six types of edges, as shown in the table. The first and second types are ordinary calling relationships, the third and fourth types are inheritance relationships, the fifth type is a permission relationship, and the sixth type is a callback relationship.

[0093] During the simplification process, the nodes are simplified using the following formula:

[0094]

[0095] In the formula, τ represents the node type; Represents the original method node set; class(m) represents the class to which node m belongs; P represents the permission set.

[0096] The function of this formula is to simplify the method nodes to the classes they belong to. In other words, the framework space method nodes and application space nodes are simplified by class attribution. The purpose of this is to maintain the simplicity of the node structure without changing the permission constraints.

[0097] The edges are simplified accordingly using the following formula:

[0098]

[0099] Where t represents the edge type; an edge of type requires represents the permissions required by the framework space method. For the edges between methods and permissions, they are mapped to the edges between the class to which the method belongs and the permissions.

[0100] For other types of edges (including inheritance, call, callback), that is, when t≠requires is satisfied, these edges are attributed to the edges between corresponding classes through mapping between methods.

[0101] Based on the function call graph corresponding to each APK file, the preset graph convolutional neural network model is trained to obtain the second model. Specifically:

[0102] Construct a graph convolutional neural network model. For heterogeneous graphs, the hidden representation of node i in the l+1th layer uses the following formula:

[0103]

[0104] In the formula, the symbol σ represents a nonlinear activation function, and ReLU is used in this embodiment. R represents the set of all edge types, c i，r is the normalization coefficient used to adjust the contribution of each neighbor node, is the weight matrix associated with edge type r in layer I, Rather, it is the weight matrix associated with node i in the i-th layer. represents the hidden representation of node i in layer I.

[0105] When training the model, it was found that the model performance was best when the number of convolutional layers was 3. In addition, in the function call graph, the node types containing permissions and methods, as well as the edge types of inheritance, call, callback, and permissions required by framework space methods, all played a key role in the optimization effect of the model.

[0106] like Figure 3 As shown in Figure 1, the GCN model is trained using a binary cross entropy loss function, which measures model performance by calculating the difference between the predicted probability and the actual label. The model parameters are optimized using the Adam optimizer, which outperforms other optimizers even in the default configuration. The maximum number of iterations during training is set to 100, and the model with the smallest loss is selected for testing.

[0107] In order to determine the node types of FCG, an ablation study was performed by restricting the node types V. The node types were divided into three groups: N (No distinction), AU (AP and User nodes), AUP (API, User, and Permissions nodes). The GCN model was trained and tested using this simplified set of symbols. Therefore, the purpose of the ablation study is to test whether distinguishing node types and permission nodes significantly improves the performance of the model. Each node configuration starts from n=0 and uses a variable number of GCN layers to evaluate whether increasing the number of GCN layers (i.e., larger neighborhoods) will improve the performance of the Android malware detection model. The scenario with n=0 represents a baseline Android malware detection model.

[0108] The first model and the second model were tested using the test set, and the test results were evaluated. For the second model, a series of ablation studies were conducted including node types and convolutional layers of the graph convolutional neural network. The final experimental results are shown in Table 4 below.

[0109] Table 4 Second model test results

[0110]

[0111]

[0112] The experimental results show that when user nodes and API nodes are treated as the same type (N), the average accuracy of the model is 87.36%. When the node types are distinguished into user nodes and API nodes, the average accuracy of the model is 91.40%. With the addition of permission nodes, the average accuracy reaches 92.74%. For the trend chart of accuracy improvement, see Figure 4 shown.

[0113] The impact of the number of GCN layers on the model is as follows: When n = 0, the average accuracy of the model is 81.88%. Subsequently, as the number of GCN layers increases, the average accuracy increases by 7.17%, 3.74%, 1.14%, and 0.86%, respectively. In particular, the average accuracy increases by 5.78%, 4.59%, 0.58%, and 0% after removing the N node types. This shows that the number of GCN layers plays a key role in detecting Android malware, but no significant performance improvement is observed when the third and fourth layers are added. As the number of GCN layers increases, the average accuracy changes as shown in the figure. Figure 5 shown.

[0114] For the first model, an experimental comparison is carried out, and the results are shown in Table 5:

[0115] Table 5. Results of the first model experiment

[0116] Method Accuracy(%) Precision Recall F1-Score SVM 89 0.88 0.87 0.87 ANN 90.45 0.9590 0.8890 0.9227

[0117] The experimental results show that ANN outperforms SVM in all indicators, including accuracy, precision, recall, and F1-Score. In particular, ANN performs better in precision and F1-Score, indicating that it can more effectively reduce the false positive rate while maintaining a high recall rate. Therefore, ANN shows higher accuracy and stability in detecting Android malware and can better handle high-dimensional features based on permissions.

[0118] The first model and the second model are integrated to generate an Android malware detection model. Specifically, for the first model and the second model, prediction is performed on the test data to obtain the prediction probability of each APK. Using the prediction probability and the accuracy of the model, a new feature u is constructed. i =a i ·p i , where a i and p i They correspond to the accuracy of the model and the probability of a single APK prediction result. This new feature is used to train a logistic regression meta-model, such as Figure 7 shown.

[0119] In order to verify the effectiveness of the hybrid analysis method, a control group was designed in the experiment. The control group includes the following methods: using only permissions, using only function call graphs, and using an integrated method. By comparing these methods, the performance of the hybrid analysis method in different situations can be comprehensively evaluated and its superiority can be verified. The experimental results are shown in Table 6:

[0120] Table 6 Experimental results comparison table

[0121] Method Accuracy(%) Precision Recall F1-Score FCG 95.59 0.9622 0.9673 0.9647 Permissions 90.45 0.9590 0.8890 0.9227 integrated 96.50％ 98.45％ 94.58％ 96.48％

[0122] The present invention uses function call graphs and permission features to detect maliciousness. The method extracts permission information and function call relationships from the Android application package through static analysis technology, and constructs permission vectors and function call graphs respectively. First, a multi-layer neural network is used to detect permission information; secondly, a graph convolutional network is used to detect malware on the function call graph. The nodes in the function call graph include user methods, system methods, and permission nodes, and callback relationships are introduced to enhance detection capabilities. Finally, based on the logistic regression metamodel, the detection results of the permission model and the function call graph model are integrated. Therefore, the present invention can improve the accuracy and robustness of model detection through the permission model and function call graph of the manifest file. The method has high detection efficiency and accuracy, and is suitable for the detection of large-scale Android malware.

[0123] In other words, the function call graph is used to characterize the APK behavior, which is not affected by obfuscation. In addition, the potential callback relationship between methods and the inheritance relationship between methods are added on the basis of the function call graph. More importantly, the permission features used include the permissions declared in the manifest file AndroidManifest and the permissions required for system methods declared in the Android dex file. For these two types of permissions, the permissions in the manifest file are user-defined, while the permissions required for system methods are required by the Android system. Since the permissions in the manifest file are user-defined, it may cause over-declaration problems. In order to improve the quality of model detection, the necessary nodes required by the system method are added to the function call graph. The goal is to increase the speed of the detection model and reduce misjudgments.

[0124] Embodiment 2

[0125] like Figure 8 As shown, this embodiment provides a malware identification device based on an Android malware detection model, including:

[0126] An acquisition module, used to acquire an APK data set, wherein the APK data set includes an APK file;

[0127] A data processing module, configured to determine, according to the APK data set, a permission vector and a function call graph corresponding to each APK file in the APK data set, respectively, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file;

[0128] A first training module, configured to train a preset neural network model based on permission vectors corresponding to each APK file to obtain a first model, wherein the first model is configured to identify whether an application corresponding to the APK file is malware based on permissions required by the application corresponding to the APK file;

[0129] A second training module is used to train a preset graph convolutional neural network model based on a function call graph corresponding to each APK file to obtain a second model, wherein the second model is used to identify whether an application corresponding to the APK file is malware based on the function call graph corresponding to the APK file;

[0130] The model integration module is used to perform model integration processing on the first model and the second model to generate an Android malware detection model, so as to identify malware on the APK file to be detected based on the Android malware detection model.

[0131] Optionally, in an embodiment, for each APK file, the permission vector corresponding to the APK file is determined in the following manner: based on the APK file, determining the permissions required for the application corresponding to the APK file; and constructing the permission vector corresponding to the APK file based on the permissions required for the application corresponding to the APK file and a preset default permission set.

[0132] Optionally, in an embodiment, for each APK file, the function call graph corresponding to the APK file is determined in the following manner: according to the APK file, the framework space method, application space method, class to which each framework space method belongs, and class to which each application space method belongs defined in the application corresponding to the APK file are obtained, and an initial function call graph is generated; each of the framework space methods represents a method customized by the Android system framework, and each of the application space methods represents a method customized by the user when writing the application corresponding to the APK file, and the initial function call graph is used to describe the calling relationship between the framework space method and the application space method; the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space are obtained respectively, and the callback relationship in the Android framework space The relationship represents the callback relationship between framework space methods, the inheritance relationship in the Android application space includes class inheritance relationship and method inheritance relationship, the class inheritance relationship represents the inheritance relationship between classes, the method inheritance relationship represents the inheritance relationship between application space methods and between framework space methods and application space methods, and the permission relationship in the Android framework space represents the correspondence between framework space methods and permissions required for framework space methods; with framework space methods, application space methods and permissions required for framework space methods as nodes, based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space and the permission relationship in the Android framework space, the initial function call graph is updated to obtain a new function call graph; the new function call graph is simplified to obtain a function call graph corresponding to the APK file.

[0133] Optionally, in an embodiment, it also includes: determining the attribute vectors of each node respectively, the attribute vector of each of the framework space methods is a vector describing the application programming interface package to which the framework space method belongs, the attribute vector of each of the application space methods is a vector describing the operation codes required for the application space method, and the attribute vector of each of the permissions required by the framework space method is a vector describing the permission type and danger type to which the permissions required by the framework space method belong.

[0134] Optionally, in an embodiment, each callback relationship in the Android framework space is determined in the following manner: obtaining a potential callback method, the potential callback method representing a framework space method that can be executed and overwritten by the Android application space, and the Android application space representing an independent environment used when the application corresponding to the APK file runs on the device; for each potential callback method, determining whether there is a registration method corresponding to the potential callback method, and determining whether the potential callback method is called inside the class to which the registration method belongs. If there is a registration method corresponding to the potential callback method and the potential callback method is called inside the class to which the registration method belongs, then a callback relationship in the Android framework space is constructed based on the potential callback method and the registration method corresponding to the potential callback method, the registration method representing a framework space method with the class to which the potential callback method belongs as a parameter, and the parameter representing a variable declared in the framework space method definition.

[0135] Optionally, in an embodiment, obtaining the potential callback method includes: separately determining whether each framework space method meets a first criterion, and determining the framework space method that meets the first criterion as a potential callback method, the first criterion being: the class to which the framework space method belongs can be accessed and inherited by any class to which the framework space method belongs and the class to which the application space method belongs, and the class to which the framework space method belongs can be extended, and the framework space method can be overwritten by the Android application space.

[0136] Optionally, in an embodiment, the method inheritance relationship is determined in the following manner: for each application space method, determine whether there is a first method corresponding to the application space method based on the class inheritance relationship; if so, determine that the application space method and the first method constitute the method inheritance relationship; wherein, the first method is an application space method or a framework space method, the class to which the first method belongs has an inheritance relationship with the class to which the application space method belongs, and the signature corresponding to the first method is the same as the signature corresponding to the application space method.

[0137] Optionally, in an embodiment, the simplification of the new function call graph includes: replacing the nodes corresponding to each framework space method in the new function call graph with nodes corresponding to the class to which each framework space method belongs; replacing the nodes corresponding to each application space method in the new function call graph with nodes corresponding to the class to which each application space method belongs.

[0138] Embodiment 3

[0139] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a malware identification method based on an Android malware detection model as described in Embodiment 1 is implemented.

[0140] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0141] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A malware identification method based on an Android malware detection model, characterized in that: include: Obtain an APK data set, where the APK data set includes an APK file; Determine, according to the APK data set, a permission vector and a function call graph corresponding to each APK file in the APK data set, respectively, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file; Based on the permission vectors corresponding to each APK file, a preset neural network model is trained to obtain a first model, wherein the first model is used to identify whether the application corresponding to the APK file is malware based on the permissions required by the application corresponding to the APK file; Based on the function call graphs corresponding to the APK files, a preset graph convolutional neural network model is trained to obtain a second model, wherein the second model is used to identify whether the application corresponding to the APK file is malware based on the function call graphs corresponding to the APK files; The first model and the second model are subjected to model integration processing to generate an Android malware detection model, so as to perform malware identification on the APK file to be detected based on the Android malware detection model.

2. According to the method for identifying malware based on the Android malware detection model of claim 1, it is characterized in that: For each APK file, the permission vector corresponding to the APK file is determined in the following way: Determine, according to the APK file, the permissions required by the application corresponding to the APK file; A permission vector corresponding to the APK file is constructed according to the permissions required by the application corresponding to the APK file and a preset default permission set.

3. According to the method for identifying malware based on the Android malware detection model of claim 1, it is characterized in that: For each APK file, the function call graph corresponding to the APK file is determined in the following manner: According to the APK file, the framework space method, application space method, class to which each framework space method belongs, and class to which each application space method belongs defined in the application corresponding to the APK file are obtained, and an initial function call graph is generated; each of the framework space methods represents a method customized by the Android system framework, and each of the application space methods represents a method customized by the user when writing the application corresponding to the APK file, and the initial function call graph is used to describe the calling relationship between the framework space method and the application space method; Respectively obtain the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space, wherein the callback relationship in the Android framework space represents the callback relationship between framework space methods, the inheritance relationship in the Android application space includes class inheritance relationship and method inheritance relationship, the class inheritance relationship represents the inheritance relationship between classes, the method inheritance relationship represents the inheritance relationship between application space methods and between framework space methods and application space methods, and the permission relationship in the Android framework space represents the correspondence between framework space methods and the permissions required by framework space methods; Taking the framework space method, the application space method and the permissions required by the framework space method as nodes, based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space and the permission relationship in the Android framework space, the initial function call graph is updated to obtain a new function call graph; The new function call graph is simplified to obtain a function call graph corresponding to the APK file.

4. The malware identification method based on the Android malware detection model according to claim 3 is characterized in that: Also includes: Determine the attribute vector of each node respectively, the attribute vector of each framework space method is a vector describing the application programming interface package to which the framework space method belongs, the attribute vector of each application space method is a vector describing the operation code required for the application space method, and the attribute vector of each permission required by the framework space method is a vector describing the permission type and danger type to which the permission required by the framework space method belongs.

5. The malware identification method based on the Android malware detection model according to claim 3 is characterized in that: The callback relationship in each of the Android framework spaces is determined in the following way: Obtaining a potential callback method, wherein the potential callback method represents a framework space method that can be executed and overwritten by an Android application space, wherein the Android application space represents an independent environment used by an application corresponding to an APK file when running on a device; For each potential callback method, determine whether there is a registration method corresponding to the potential callback method, and determine whether the potential callback method is called inside the class to which the registration method belongs. If there is a registration method corresponding to the potential callback method and the potential callback method is called inside the class to which the registration method belongs, then a callback relationship in the Android framework space is constructed based on the potential callback method and the registration method corresponding to the potential callback method. The registration method represents a framework space method with the class to which the potential callback method belongs as a parameter, and the parameter represents a variable declared in the framework space method definition.

6. The malware identification method based on the Android malware detection model according to claim 5 is characterized in that: The method for obtaining potential callbacks includes: Determine whether each framework space method meets the first criterion respectively, and determine the framework space method that meets the first criterion as a potential callback method. The first criterion is: the class to which the framework space method belongs can be accessed and inherited by any class to which the framework space method belongs and the class to which the application space method belongs, and the class to which the framework space method belongs can be extended, and the framework space method can be overwritten by the Android application space.

7. The malware identification method based on the Android malware detection model according to claim 3 is characterized in that: The method inheritance relationship is determined in the following way: For each application space method, determine whether there is a first method corresponding to the application space method based on the class inheritance relationship. If so, determine that the application space method and the first method constitute the method inheritance relationship; wherein, the first method is an application space method or a framework space method, the class to which the first method belongs has an inheritance relationship with the class to which the application space method belongs, and the signature corresponding to the first method is the same as the signature corresponding to the application space method.

8. The malware identification method based on the Android malware detection model according to claim 1, characterized in that: The simplifying process of the new function call graph includes: Replacing the nodes corresponding to the various framework space methods in the new function call graph with the nodes corresponding to the classes to which the various framework space methods belong; The nodes corresponding to the various application space methods in the new function call graph are replaced with nodes corresponding to the classes to which the various application space methods belong.

9. A malware identification device based on an Android malware detection model, characterized in that: include: An acquisition module, used to acquire an APK data set, wherein the APK data set includes an APK file; A data processing module, configured to determine, according to the APK data set, a permission vector and a function call graph corresponding to each APK file in the APK data set, respectively, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file; A first training module, configured to train a preset neural network model based on permission vectors corresponding to each APK file to obtain a first model, wherein the first model is configured to identify whether an application corresponding to the APK file is malware based on permissions required by the application corresponding to the APK file; A second training module is used to train a preset graph convolutional neural network model based on a function call graph corresponding to each APK file to obtain a second model, wherein the second model is used to identify whether an application corresponding to the APK file is malware based on the function call graph corresponding to the APK file; The model integration module is used to perform model integration processing on the first model and the second model to generate an Android malware detection model, so as to identify malware on the APK file to be detected based on the Android malware detection model.

10. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a malware identification method based on an Android malware detection model as described in any one of claims 1 to 8 is implemented.

Images