A malware identification method based on an Android malware detection model

Abstract

The application provides a malware identification method based on an Android malware detection model, and relates to the technical field of malware identification. The APK file contains permission information and function call relationship, so the permission vector and function call graph corresponding to the APK file can be constructed. A first model and a second model are trained respectively, the first model is used for malware detection based on the permission information in the APK file, and the second model is used for malware detection based on the function call graph. Finally, the first model and the second model are integrated to obtain an Android malware detection model. The obtained Android malware detection model can greatly improve the accuracy and robustness of detection, and is suitable for large-scale Android malware detection.

Description

Technical Field

[0001] The present invention relates to the technical field of malware identification, and in particular to a malware identification method based on an Android malware detection model. Background Art

[0002] Android's open-source nature has led to numerous security issues. Currently, three common techniques for detecting Android malware are static analysis, dynamic analysis, and hybrid analysis. While static analysis is fast, it's susceptible to obfuscation; while dynamic analysis is less susceptible to obfuscation, it's slower; and hybrid analysis combines the two.

[0003] Currently, many new methods have been proposed to improve the accuracy of malware detection. A number of methods focus on hybrid analysis, such as malware detection based on permissions and dynamic analysis. However, dynamic analysis requires software execution and is time-consuming. It also suffers from over-declaration of permissions, which can affect model accuracy. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a malware identification method based on an Android malware detection model to solve the above technical problems.

[0005] The technical solution of the present invention to solve the above technical problems is as follows: a malware identification method based on an Android malware detection model, comprising: obtaining an APK dataset, wherein the APK dataset includes APK files; determining, based on the APK dataset, a permission vector and a function call graph corresponding to each APK file in the APK dataset, respectively, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file; training a preset neural network model based on the permission vector corresponding to each APK file to obtain a first model, wherein the first model is used to identify whether the application corresponding to the APK file is malware based on the permissions required by the application corresponding to the APK file; training a preset graph convolutional neural network model based on the function call graph corresponding to each APK file to obtain a second model, wherein the second model is used to identify whether the application corresponding to the APK file is malware based on the function call graph corresponding to the APK file; performing model integration processing on the first model and the second model to generate an Android malware detection model, so as to identify malware for the APK file to be detected based on the Android malware detection model.

[0006] The present invention has the following beneficial effects: APK files contain permission information and function call relationships, thus constructing a permission vector and function call graph corresponding to the APK file. A first model and a second model are trained separately: the first model is used to detect malware based on the permission information in the APK file, and the second model is used to detect malware based on the function call graph. Finally, the first and second models are integrated to obtain an Android malware detection model. The resulting Android malware detection model significantly improves detection accuracy and robustness, making it suitable for large-scale Android malware detection.

[0007] On the basis of the above technical solution, the present invention can also be improved as follows.

[0008] Furthermore, for each APK file, the permission vector corresponding to the APK file is determined in the following manner: based on the APK file, determining the permissions required by the application corresponding to the APK file; and constructing the permission vector corresponding to the APK file based on the permissions required by the application corresponding to the APK file and a preset default permission set.

[0009] Furthermore, for each APK file, the function call graph corresponding to the APK file is determined in the following manner: according to the APK file, the framework space method, application space method, class to which each framework space method belongs, and class to which each application space method belongs defined in the application corresponding to the APK file are obtained, and an initial function call graph is generated; each of the framework space methods represents a method customized by the Android system framework, and each of the application space methods represents a method customized by the user when writing the application corresponding to the APK file. The initial function call graph is used to describe the calling relationship between the framework space method and the application space method; the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space are obtained respectively, and the callback relationship table in the Android framework space The callback relationship between framework space methods is characterized, and the inheritance relationship in the Android application space includes a class inheritance relationship and a method inheritance relationship. The class inheritance relationship represents the inheritance relationship between classes, and the method inheritance relationship represents the inheritance relationship between application space methods and between framework space methods and application space methods. The permission relationship in the Android framework space represents the correspondence between framework space methods and the permissions required for framework space methods. With framework space methods, application space methods and the permissions required for framework space methods as nodes, the initial function call graph is updated based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space and the permission relationship in the Android framework space to obtain a new function call graph. The new function call graph is simplified to obtain a function call graph corresponding to the APK file.

[0010] Furthermore, it also includes: determining the attribute vectors of each node respectively, the attribute vector of each framework space method is a vector describing the application programming interface package to which the framework space method belongs, the attribute vector of each application space method is a vector describing the operation code required by the application space method, and the attribute vector of each permission required by the framework space method is a vector describing the permission type and danger type to which the permission required by the framework space method belongs.

[0011] Furthermore, each callback relationship in the Android framework space is determined in the following manner: a potential callback method is obtained, the potential callback method represents a framework space method that can be executed and overwritten by the Android application space, and the Android application space represents an independent environment used when the application corresponding to the APK file runs on the device; for each potential callback method, it is determined whether there is a registration method corresponding to the potential callback method, and whether the potential callback method is called inside the class to which the registration method belongs. If there is a registration method corresponding to the potential callback method and the potential callback method is called inside the class to which the registration method belongs, then a callback relationship in the Android framework space is constructed based on the potential callback method and the registration method corresponding to the potential callback method. The registration method represents a framework space method with the class to which the potential callback method belongs as a parameter, and the parameter represents a variable declared in the framework space method definition.

[0012] Furthermore, the obtaining of potential callback methods includes: respectively judging whether each framework space method meets the first criterion, and determining the framework space method that meets the first criterion as a potential callback method, wherein the first criterion is: the class to which the framework space method belongs can be accessed and inherited by any class to which the framework space method belongs and the class to which the application space method belongs, and the class to which the framework space method belongs can be extended, and the framework space method can be overwritten by the Android application space.

[0013] Furthermore, the method inheritance relationship is determined in the following manner: for each application space method, whether there is a first method corresponding to the application space method is determined based on the class inheritance relationship; if so, it is determined that the application space method and the first method constitute the method inheritance relationship; wherein, the first method is an application space method or a framework space method, the class to which the first method belongs has an inheritance relationship with the class to which the application space method belongs, and the signature corresponding to the first method is the same as the signature corresponding to the application space method.

[0014] Furthermore, the simplification processing of the new function call graph includes: replacing the nodes corresponding to each framework space method in the new function call graph with nodes corresponding to the class to which each framework space method belongs; replacing the nodes corresponding to each application space method in the new function call graph with nodes corresponding to the class to which each application space method belongs.

[0015] To solve the above technical problems, the present application also provides a malware identification device based on an Android malware detection model, comprising:

[0016] An acquisition module, configured to acquire an APK data set, wherein the APK data set includes an APK file;

[0017] a data processing module, configured to determine, based on the APK data set, a permission vector and a function call graph corresponding to each APK file in the APK data set, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file;

[0018] A first training module is configured to train a preset neural network model based on the permission vectors corresponding to the APK files to obtain a first model, wherein the first model is configured to identify whether the application corresponding to the APK file is malware based on the permissions required by the application corresponding to the APK file;

[0019] a second training module, configured to train a preset graph convolutional neural network model based on a function call graph corresponding to each APK file to obtain a second model, wherein the second model is configured to identify whether an application corresponding to the APK file is malware based on the function call graph corresponding to the APK file;

[0020] The model integration module is used to perform model integration processing on the first model and the second model to generate an Android malware detection model, so as to identify malware on the APK file to be detected based on the Android malware detection model.

[0021] To solve the above technical problems, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, it implements a malware identification method based on the Android malware detection model as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a flowchart of a malware identification method based on an Android malware detection model of the present invention;

[0023] Figure 2This is a detection flow chart of a malware identification method based on an Android malware detection model according to the present invention based on permission features;

[0024] Figure 3 This is a schematic diagram of a process for obtaining a function call graph of a malware identification method based on an Android malware detection model according to the present invention;

[0025] Figure 4 A detection flow chart based on a function call graph of a malware identification method based on an Android malware detection model of the present invention;

[0026] Figure 5 This is a graph showing the mean model accuracy under different node types of a malware identification method based on an Android malware detection model according to the present invention;

[0027] Figure 6 This is a graph showing the model accuracy changes under different GNN layers of a malware identification method based on an Android malware detection model of the present invention;

[0028] Figure 7 This is a detection flow chart of a malware identification method based on an Android malware detection model according to the present invention, which is based on a logistic regression meta-model;

[0029] Figure 8 Schematic diagram of a malware identification device based on an Android malware detection model according to the present invention. DETAILED DESCRIPTION

[0030] The principles and features of the present invention are described below. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0031] like Figure 1As shown, the embodiment provides a malware identification method based on an Android malware detection model, including: obtaining an APK dataset, the APK dataset including APK files; determining a permission vector and a function call graph corresponding to each APK file in the APK dataset according to the APK dataset, the permission vector being a vector describing the required permissions of an application corresponding to an APK file; training a preset neural network model based on the permission vector corresponding to each APK file to obtain a first model, the first model being used to identify whether the application corresponding to an APK file is malware based on the required permissions of the application; training a preset graph convolutional neural network model based on the function call graph corresponding to each APK file to obtain a second model, the second model being used to identify whether the application corresponding to an APK file is malware based on the function call graph; and performing model integration processing on the first model and the second model to generate an Android malware detection model, so as to identify malware of a to-be-detected APK file based on the Android malware detection model.

[0032] The APK file contains permission information and function call relationship, and therefore, the permission vector and the function call graph corresponding to the APK file can be constructed. The first model and the second model are trained respectively, the first model being used for malware detection based on the permission information in the APK file, and the second model being used for malware detection based on the function call graph. Finally, the first model and the second model are integrated to obtain the Android malware detection model. The obtained Android malware detection model can greatly improve the accuracy and robustness of detection, and is suitable for large-scale Android malware detection.

[0033] APK files include both benign and malicious APK files. In this example, the APK dataset was sourced from 3,000 malicious APK files selected from the MalDroid database. These files cover three major malware types: adware, banking malware, and SMS malware, with 1,000 samples of each type. This classification method helps the model learn and identify the characteristics of different types of malicious behavior. A total of 5,019 APK files were downloaded from the Androzoo database, of which 2,033 were labeled as malware, including but not limited to ransomware, Trojans, and spyware, providing a wider range of malware behavior samples. The remaining 2,986 were benign APK files, covering a variety of common application types such as social networks, news, tools, and games. Combined in this manner, a comprehensive dataset consisting of 8,019 APK files was ultimately formed. This large dataset not only provides a sufficient sample size for training and validating the model, but the diverse sample types also help improve the model's generalization and accuracy in real-world settings.

[0034] Optionally, in an embodiment, for each APK file, the permission vector corresponding to the APK file is determined in the following manner: based on the APK file, determining the permissions required for the application corresponding to the APK file; and constructing the permission vector corresponding to the APK file based on the permissions required for the application corresponding to the APK file and a preset default permission set.

[0035] Specifically, based on the APK file, the AndroidManifest file is obtained by using the apktools tool, and various key information and configurations of the application corresponding to the APK file are parsed, including permission information, that is, the permissions required by the application corresponding to the APK file are obtained.

[0036] In this embodiment, a default permission set is first constructed. The default permission set contains 325 commonly used permissions, covering various operations and function access in the Android system, including network access permissions, system permissions, and data access permissions. On this basis, the permissions in the AndroidManifest file corresponding to each APK file are scanned. If the permission is not included in the default permission set, the permission is added to the default permission set to update the default permission set. The final default permission set will include all permissions in all APK files, and there will be no duplicate permissions. In this example, the final default permission set includes 474 permissions, and the default permission set is represented in the form of a vector, that is, a 474-dimensional vector is formed.

[0037] For each APK file, when constructing the permission vector, the corresponding positions of the permissions required by the application corresponding to the APK file are marked as 1, and the corresponding positions of the permissions not required by the application corresponding to the APK file are marked as 0. This process generates a multi-dimensional vector, where each dimension represents a specific permission, thus forming a complete representation of the APK permissions.

[0038] Based on the permission vectors corresponding to each APK file, the preset neural network model is trained to obtain the first model, specifically: Figure 2 As shown in the figure, an input layer is constructed to receive external data input, which contains 474 features. Three hidden layers are constructed, including the first hidden layer with 256 nodes, the second hidden layer with 128 nodes, and the third hidden layer with 32 nodes. The ReLU activation function is used, and a dropout layer is added after each hidden layer with a dropout rate set to 0.2. An output layer is added with a single neuron and a Sigmoid activation function. In this binary classification problem, the Sigmoid function compresses the output to a range between 0 and 1, representing probability. Training is performed for 100 epochs, with a batch size of 32.

[0039] The network loss function calculation formula of the first model is as follows:

[0040]

[0041] Where y is the true label (0 or 1); is the probability predicted by the model; N is the number of samples.

[0042] Optionally, in an embodiment, for each APK file, the function call graph corresponding to the APK file is determined in the following manner: according to the APK file, the framework space method, application space method, class to which each framework space method belongs, and class to which each application space method belongs defined in the application corresponding to the APK file are obtained, and an initial function call graph is generated; each of the framework space methods represents a method customized by the Android system framework, and each of the application space methods represents a method customized by the user when writing the application corresponding to the APK file, and the initial function call graph is used to describe the calling relationship between the framework space method and the application space method; the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space are obtained respectively, and the callback relationship in the Android framework space The relationship represents the callback relationship between the framework space methods. The inheritance relationship in the Android application space includes the class inheritance relationship and the method inheritance relationship. The class inheritance relationship represents the inheritance relationship between the classes. The method inheritance relationship represents the inheritance relationship between the application space methods and between the framework space method and the application space method. The permission relationship in the Android framework space represents the correspondence between the framework space method and the permission required by the framework space method. With the framework space method, the application space method and the permission required by the framework space method as nodes, the initial function call graph is updated based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space and the permission relationship in the Android framework space to obtain a new function call graph. The new function call graph is simplified to obtain the function call graph corresponding to the APK file.

[0043] Specifically, such as Figure 3 As shown in Figure 1, the apktool tool can be used to extract Dex code and AndroidManifest files from APK files. Dex files, also known as Dalvik executable files, are key components of Android applications and contain compiled Java code, including user-defined logic and references to Android APIs. This code is interpreted and executed by the Android runtime, enabling the application to implement various functions and interactions. By parsing the Dex code, the classes (C) and methods (M) defined in the application can be systematically extracted. Using the third-party tool Androguard, an initial function call graph can be generated, but this graph only includes call relationships, not callback relationships and inheritance relationships.

[0044] In the Android system, the Android application space refers to the independent environment used by each application when running on the device. This includes code, data, and resources, and is protected by a sandbox mechanism to ensure the independence and security of the application. The Android framework space refers to the core libraries and services provided by the Android system, which support the running of applications, such as core libraries and system services. Applications run in the Android application space, but need to call libraries and services in the Android framework space to perform various tasks.

[0045] Optionally, in embodiments, the callback relationship in each of the Android framework spaces is determined by: obtaining potential callback methods, the potential callback methods representing framework space methods that can be executed and overridden by the Android application space, the Android application space representing the independent environment used by the application corresponding to the APK file when running on the device; for each potential callback method, determining whether there is a registration method corresponding to the potential callback method, and determining whether the potential callback method is called inside the class to which the registration method belongs, if there is a registration method corresponding to the potential callback method and the potential callback method is called inside the class to which the registration method belongs, then the callback relationship in the Android framework space is formed based on the potential callback method and the registration method corresponding to the potential callback method, the registration method representing a framework space method with the class to which the potential callback method belongs as a parameter, the parameter representing a variable declared in the framework space method definition.

[0046] Optionally, in embodiments, the obtaining of the potential callback methods includes: respectively determining whether each framework space method meets the first criterion, and determining the framework space methods meeting the first criterion as potential callback methods, the first criterion being that the class to which the framework space method belongs can be accessed and inherited by any class to which a framework space method or an application space method belongs, and the class to which the framework space method belongs can be extended, and the framework space method can be overridden by the Android application space.

[0047] The specific representation of the first criterion is:

[0048] 1. isPublic(c) = 1

[0049] 2. isFinal(c) = 0

[0050] 3. isInterface(c) = 1 VVx∈constructors(c)isPublic(x)

[0051] 4. isPublic(m) = 1 VisProtected(m) = 1

[0052] The specific meanings of the above four standards are: 1. In programming, the public modifier means that this class can be accessed by any other class, that is, standard 1 means that the class corresponding to the framework space method m can be accessed by any other class. 2. In programming, when the final modifier is used for a class, it means that this class cannot be inherited. isFinal(c) = 0, it means that the modifier of class c is not final, and class c can be inherited. 3. It means that class c is an interface and its constructors are all public modified. In programming, the constructors in the interface are implicitly public. This is the interface specification indicating that interface c can be instantiated. 4. It means that the framework space method m can be public or protected, which means that method m can be overridden by the external application space. Standards 1, 2, and 3 ensure that class c is visible to the application space class and can be extended. Standard 4 ensures that method m can be overridden in the application space.

[0053] For each potential callback method, determine whether there is a registration method corresponding to the potential callback method, specifically:

[0054] Use a parameter set, which is a multi-mapping relationship: α F :C F →M F , where C F It is a class in the Android framework space, M F It is a method in the Android framework space. That is to say, check whether the class class(m) to which method m belongs satisfies α F (c) is not equal to the empty set. The condition can be verified by the following formula:

[0055]

[0056] Where c represents the class passed as a parameter, r represents the registration method, α F It is a collection used to store the mapping relationship between c and r, and c∈argumentTypes(r) is a collection of parameter types representing method r.

[0057] When judging whether the potential callback method is called inside the class to which the registered method belongs, specifically: the call of the potential callback method m occurs in the class u = class(r) to which the registered method belongs, specifically including the methods in u and the inner classes of u. If the call of the potential callback method m is detected in u, then the potential callback method m is the final callback method, otherwise it is not a callback method.

[0058] The callback method and its corresponding registration method are determined by the above conditions. Each callback method and its corresponding registration method form a mapping pair and are saved in a mapping collection to represent the callback relationship in the Android framework space.

[0059] Optionally, in an embodiment, the method inheritance relationship is determined in the following manner: for each application space method, determine whether there is a first method corresponding to the application space method based on the class inheritance relationship; if so, determine that the application space method and the first method constitute the method inheritance relationship; wherein, the first method is an application space method or a framework space method, the class to which the first method belongs has an inheritance relationship with the class to which the application space method belongs, and the signature corresponding to the first method is the same as the signature corresponding to the application space method.

[0060] Class-level inheritance diagram I(C)(C,E (c) parentOf) formula is:

[0061]

[0062] The class inheritance relationship is expressed in the form of a class-level inheritance graph. The class-level inheritance graph I(C) is constructed by analyzing the inheritance relationship between classes and is expressed as I(C)(C, E (C) parentOf). This formula defines the conditions for class-level inheritance relationships: If class c i and c j There is an inheritance relationship between them, namely (c i , c j )∈E (C) parentOf, then it means c i It is c j The parent class of .

[0063] Based on the class-level inheritance graph, a method-level inheritance graph is generated, and the method inheritance relationship is expressed through the method-level inheritance graph. (M) parentOf) formula is:

[0064] E(M)parentOf=(m i , m j )|(class(m i ), class(m j )∈E (C) parentOf∧

[0065] sig(m i )=sig(m i );

[0066] This formula shows that if method m i and m j Class class(m i ) and class(m j ) In the class inheritance diagram E (C)parentOf has a parent-child relationship, and the signatures of these two methods are the same (sig(m i )=sig(m j )), that is, the two methods have the same method name and method parameters, then in the method inheritance graph E(M)parentOf, m i will be used as m j The parent method exists, that is, the first method. This shows that method-level inheritance is based on class-level inheritance and method signature consistency.

[0067] To better determine whether an APK file is benign, permission nodes are added based on the initial function call graph. These permissions are required by the Android framework space and will not cause over-declaration issues.

[0068] The formula for adding permission nodes is as follows:

[0069]

[0070] Frame Space Method M F The relationship between the edge and the authority is as shown in the above formula, where, The set of edges between methods and permissions, m: method in Android framework space, p: permission node, M F : framework space method, Ψ(m): the set of permissions required by method m.

[0071] Optionally, in an embodiment, it also includes: determining the attribute vectors of each node respectively, the attribute vector of each of the framework space methods is a vector describing the application programming interface package (API package) to which the framework space method belongs, the attribute vector of each of the application space methods is a vector describing the operation code required by the application space method, and the attribute vector of each of the permissions required by the framework space method is a vector describing the permission type and danger type to which the permissions required by the framework space method belong.

[0072] The attributes of a framework space method are its corresponding package name, represented by a one-hot vector. Specifically, each framework space method attribute is represented by a one-hot vector whose dimension is equal to the total number of API packages in the API list. In this example, the total number of API packages is 226.

[0073] One-hot encoding is a commonly used numerical representation method for converting categorical variables into numerical data that can be processed by machine learning algorithms. In this method, each category is represented as a binary vector with a length equal to the number of categories, where only one position is 1, indicating the current category, and all other positions are 0.

[0074] For framework space methods, a total of 226 API packages are defined, with each package corresponding to a position. If a method belongs to a specific API package, the corresponding position in the one-hot vector is set to 1, and the remaining positions are set to 0. This allows each framework space method to be represented by a unique vector representing the API package it belongs to.

[0075] For example, if the "onCreate" method in the "android.app.Activity" class is at the 42nd position in the API list, then its one-hot vector is 1 at the 42nd bit, and the remaining bits are all 0. This representation method can clearly distinguish and process methods belonging to different API packages, facilitating subsequent analysis and calculations.

[0076] In this embodiment, the attributes of the application space method are designed as 21-dimensional Boolean vectors to describe opcodes. Specifically, the attributes of the application space method are designed as a 21-bit Boolean vector, which is used to identify different opcode groups used in the main body of the application code. Opcodes are a mechanism in low-level programming that represent various operations that can be performed during program execution, such as arithmetic operations, logical operations, and control flow instructions.

[0077] Each bit in this vector corresponds to a specific opcode group. If any opcode in this group is used in the application, the corresponding bit is set to true, otherwise it is false. This encoding method provides a compact and efficient way to describe the behavioral characteristics of the application.

[0078] For example, during the execution of an application space method in an application, if operations such as arithmetic operations and array access are involved, then in the attribute vector representing the method, the bits corresponding to the arithmetic operations and array access opcode groups will be marked as true, thereby reflecting that these operations have actually been used. Correspondingly, if the method does not use other types of opcodes, then these bits will remain false in the vector, clearly indicating that they have not been called in the method. The 21 opcodes in this embodiment are specifically shown in Table 1:

[0079] Table 121 Operation code name diagram

[0080]

[0081]

[0082] The attribute vector of a permission node is a one-hot vector of the group to which the permission belongs, with an additional bit used to indicate the dangerousness type of the permission, that is, whether it is classified as a dangerous permission. Specifically, in this embodiment, there are 20 permission groups, as shown in Table 2:

[0083] Table 2 Schematic diagram of authority group names and hazard types

[0084]

[0085]

[0086] That is, the attribute vector for each permission node will include a 20-bit one-hot vector, indicating the group number to which the permission belongs, and an additional bit indicating whether the permission is classified as dangerous. For example, if the permission is android.permission.GET_ACCOUNTS, group number: 0 (Accounts and Account Management), and danger flag: 1 (Dangerous Permission), the one-hot vector indicates that: since the group number is 0, the first bit is 1, and the next 19 bits are all 0. Because it is a dangerous permission, the last bit (bit 21) is 1.

[0087] It should be noted that the groups and permissions in Table 2 are essentially a one-to-many relationship, that is, one permission group has multiple permissions.

[0088] Optionally, in an embodiment, the simplification of the new function call graph includes: replacing the nodes corresponding to each framework space method in the new function call graph with nodes corresponding to the class to which each framework space method belongs; replacing the nodes corresponding to each application space method in the new function call graph with nodes corresponding to the class to which each application space method belongs.

[0089] The new function call graph contains a large number of nodes and edges, which will limit the generalization ability of the Android malware detection model. The new function call graph contains nodes such as framework space method nodes (api), application space method nodes (user), and permission nodes (permission); the included edges are shown in the following table:

[0090] Table 3 Edge types in the new function call graph

[0091] starting point relation end user invokes user user invokes_api API user parent_of user API api_parent_of user API uses permiSSion API calls_back API

[0092] Specifically, in this embodiment, there are six types of edges, as shown in the table. The first and second types are ordinary call relationships, the third and fourth types are inheritance relationships, the fifth type is a permission relationship, and the sixth type is a callback relationship.

[0093] During the simplification process, the nodes are simplified using the following formula:

[0094]

[0095] Where, τ represents the node type; Represents the original method node set; class(m) represents the class to which node m belongs; P represents the permission set.

[0096] This formula simplifies method nodes to their respective classes. In other words, it simplifies framework-space method nodes and application-space nodes by class affiliation. This aims to maintain a simple node structure without changing permission constraints.

[0097] The edges are simplified accordingly using the following formula:

[0098]

[0099] Where t represents the edge type; an edge of type requires represents the permissions required by a framework space method. Edges between methods and permissions are mapped to edges between the class to which the method belongs and the permission.

[0100] For other types of edges (including inheritance, call, and callback), that is, when t≠requires is satisfied, these edges are attributed to the edges between corresponding classes through mapping between methods.

[0101] Based on the function call graph corresponding to each APK file, the preset graph convolutional neural network model is trained to obtain the second model. Specifically:

[0102] Construct a graph convolutional neural network model. For heterogeneous graphs, the hidden representation of node i in the l+1th layer uses the following formula:

[0103]

[0104] In the formula, the symbol σ represents a nonlinear activation function, and ReLU is used in this embodiment. R represents the set of all edge types, c i，r is the normalization coefficient used to adjust the contribution of each neighbor node, is the weight matrix associated with edge type r in layer I, Rather, it is the weight matrix associated with node i in layer i. represents the hidden representation of node i in layer I.

[0105] During model training, we found that the model performance was optimal when the number of convolutional layers was 3. Furthermore, in the function call graph, the node types containing permissions and methods, as well as the edge types for inheritance, call, callback, and permissions required for framework space methods, all played a key role in the model's optimization.

[0106] like Figure 3 As shown in the figure, the GCN model is trained using the binary cross-entropy loss function, which measures model performance by calculating the difference between the predicted probability and the actual label. The model parameters are optimized using the Adam optimizer, which outperforms other optimizers even with the default configuration. The maximum number of iterations during training is set to 100, and the model with the lowest loss is selected for testing.

[0107] To determine the node types of FCG, an ablation study was performed by restricting the node types V. The node types were divided into three groups: N (No Distinction), AU (AP and User nodes), AUP (API, User, and Permissions nodes). The GCN model was trained and tested using this simplified set of symbols. Therefore, the purpose of the ablation study was to test whether distinguishing between node types and permission nodes significantly improved the performance of the model. Each node configuration started from n = 0 and used a variable number of GCN layers to evaluate whether increasing the number of GCN layers (i.e., larger neighborhood) would improve the performance of the Android malware detection model. The scenario with n = 0 represents a baseline Android malware detection model.

[0108] The first and second models were tested on the test set and the results were evaluated. For the second model, a series of ablation studies were performed, including node types and convolutional layers of the graph convolutional neural network. The final experimental results are shown in Table 4 below.

[0109] Table 4 Second model test results

[0110]

[0111]

[0112] The experimental results show that: when user nodes and API nodes are treated as the same type (N), the average accuracy of the model is 87.36%. When the node types are distinguished into user nodes and API nodes, the average accuracy of the model is 91.40%. With the addition of permission nodes, the average accuracy reaches 92.74%. The accuracy improvement trend chart can be seen in Figure 4 shown.

[0113] The impact of the number of GCN layers on the model is as follows: When n = 0, the average accuracy of the model is 81.88%. Subsequently, as the number of GCN layers increases, the average accuracy increases by 7.17%, 3.74%, 1.14%, and 0.86%, respectively. In particular, the average accuracy increases by 5.78%, 4.59%, 0.58%, and 0% after removing the N node types. This shows that the number of GCN layers plays a key role in detecting Android malware, but no significant performance improvement is observed when the third and fourth layers are added. As the number of GCN layers increases, the average accuracy changes as shown in the figure below. Figure 5 shown.

[0114] For the first model, an experimental comparison is conducted, and the results are shown in Table 5:

[0115] Table 5. First model test results

[0116] Method Accuracy(%) Precision Recall F1-Score Support Vector Machine 89 0.88 0.87 0.87 ANN 90.45 0.9590 0.8890 0.9227

[0117] Experimental results show that ANNs outperform SVMs across all metrics, including accuracy, precision, recall, and F1-score. ANNs particularly outperform SVMs in precision and F1-score, demonstrating their ability to more effectively reduce false positives while maintaining high recall. Therefore, ANNs demonstrate greater accuracy and stability in detecting Android malware and are better able to handle high-dimensional permission-based features.

[0118] The first model and the second model are integrated to generate an Android malware detection model. Specifically, the first model and the second model are predicted on the test data to obtain the predicted probability of each APK. A new feature u is constructed using the predicted probability and the accuracy of the model. i =a i ·p i , where a i and p i They correspond to the accuracy of the model and the probability of a single APK prediction result. This new feature is used to train the logistic regression meta-model, such as Figure 7 shown.

[0119] To verify the effectiveness of the hybrid analysis method, a control group was designed. This control group included the following methods: using permissions only, using the function call graph only, and using an integrated method. By comparing these methods, we can comprehensively evaluate the performance of the hybrid analysis method in different situations and verify its superiority. The experimental results are shown in Table 6:

[0120] Table 6 Experimental results comparison table

[0121] Method Accuracy(%) Precision Recall F1-Score FCG 95.59 0.9622 0.9673 0.9647 Permissions 90.45 0.9590 0.8890 0.9227 integrated 96.50％ 98.45％ 94.58％ 96.48％

[0122] The present invention uses function call graphs and permission features to detect malware. The method extracts permission information and function call relationships from the Android application package through static analysis technology, and constructs permission vectors and function call graphs respectively. First, a multi-layer neural network is used to detect permission information; secondly, a graph convolutional network is used to detect malware on the function call graph. The nodes in the function call graph include user methods, system methods, and permission nodes, and callback relationships are introduced to enhance detection capabilities. Finally, based on the logistic regression meta-model, the detection results of the permission model and the function call graph model are integrated. Therefore, the present invention can improve the accuracy and robustness of model detection through the permission model and function call graph of the manifest file. This method has high detection efficiency and accuracy, and is suitable for the detection of large-scale Android malware.

[0123] In other words, the function call graph is used to represent the APK behavior, which is not affected by obfuscation. In addition, the potential callback relationship between methods and the inheritance relationship between methods are added on the basis of the function call graph. More importantly, the permission features used include the permissions declared in the manifest file AndroidManifest and the permissions required for the system methods declared in the Android dex file. For these two types of permissions, the permissions in the manifest file are user-defined, while the permissions required for the system methods are required by the Android system. Since the manifest file permissions are user-defined, it may cause over-declaration problems. In order to improve the quality of model detection, the necessary nodes required by the system methods are added to the function call graph. The goal is to speed up the detection model and reduce misjudgments.

[0124] Example 2

[0125] like Figure 8 As shown, this embodiment provides a malware identification device based on an Android malware detection model, including:

[0126] An acquisition module, configured to acquire an APK data set, wherein the APK data set includes an APK file;

[0127] a data processing module, configured to determine, based on the APK data set, a permission vector and a function call graph corresponding to each APK file in the APK data set, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file;

[0128] A first training module is configured to train a preset neural network model based on the permission vectors corresponding to the APK files to obtain a first model, wherein the first model is configured to identify whether the application corresponding to the APK file is malware based on the permissions required by the application corresponding to the APK file;

[0129] a second training module configured to train a preset graph convolutional neural network model based on the function call graph corresponding to each APK file, to obtain a second model, the second model being configured to identify whether an application program corresponding to an APK file is malware based on the function call graph corresponding to the APK file;

[0130] a model integration module configured to perform model integration processing on the first model and the second model, to generate an Android malware detection model, and to identify malware based on the Android malware detection model.

[0131] Optionally, in an embodiment, for each APK file, the permission vector corresponding to the APK file is determined by: determining, according to the APK file, permissions required by an application program corresponding to the APK file; and constructing, according to the permissions required by the application program corresponding to the APK file and a preset default permission set, the permission vector corresponding to the APK file.

[0132] Optionally, in an embodiment, for each APK file, the function call graph corresponding to the APK file is determined by: obtaining, according to the APK file, framework space methods, application space methods, classes to which each framework space method belongs, and classes to which each application space method belongs, defined in an application program corresponding to the APK file, and generating an initial function call graph; each framework space method represents a method defined by an Android system framework, each application space method represents a method defined by a user when writing the application program corresponding to the APK file, and the initial function call graph is used to describe a calling relationship between the framework space methods and the application space methods; obtaining a callback relationship in an Android framework space, an inheritance relationship in an Android application space, and a permission relationship in the Android framework space; the callback relationship in the Android framework space represents a callback relationship between the framework space methods, the inheritance relationship in the Android application space includes a class inheritance relationship and a method inheritance relationship, the class inheritance relationship represents an inheritance relationship between classes, the method inheritance relationship represents an inheritance relationship between the application space methods, between the framework space methods, and between the framework space methods and the application space methods, and the permission relationship in the Android framework space represents a corresponding relationship between the framework space methods and permissions required by the framework space methods; taking the framework space methods, the application space methods, and the permissions required by the framework space methods as nodes, updating the initial function call graph based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space, to obtain a new function call graph; and performing simplification processing on the new function call graph, to obtain the function call graph corresponding to the APK file.

[0133] Optionally, in an embodiment, it also includes: determining the attribute vectors of each node respectively, the attribute vector of each of the framework space methods is a vector describing the application programming interface package to which the framework space method belongs, the attribute vector of each of the application space methods is a vector describing the operation code required by the application space method, and the attribute vector of each of the permissions required by the framework space method is a vector describing the permission type and danger type to which the permissions required by the framework space method belong.

[0134] Optionally, in an embodiment, the callback relationship in each Android framework space is determined in the following manner: obtaining a potential callback method, the potential callback method representing a framework space method that can be executed and overwritten by the Android application space, and the Android application space representing an independent environment used when the application corresponding to the APK file runs on the device; for each potential callback method, determining whether there is a registration method corresponding to the potential callback method, and determining whether the potential callback method is called inside the class to which the registration method belongs. If there is a registration method corresponding to the potential callback method and the potential callback method is called inside the class to which the registration method belongs, then a callback relationship in the Android framework space is constructed based on the potential callback method and the registration method corresponding to the potential callback method. The registration method represents a framework space method with the class to which the potential callback method belongs as a parameter, and the parameter represents a variable declared in the framework space method definition.

[0135] Optionally, in an embodiment, obtaining the potential callback method includes: separately determining whether each framework space method meets the first criterion, and determining the framework space method that meets the first criterion as the potential callback method, the first criterion being: the class to which the framework space method belongs can be accessed and inherited by any class to which the framework space method belongs and the class to which the application space method belongs, and the class to which the framework space method belongs can be extended, and the framework space method can be overwritten by the Android application space.

[0136] Optionally, in an embodiment, the method inheritance relationship is determined in the following manner: for each application space method, determine whether there is a first method corresponding to the application space method based on the class inheritance relationship; if so, determine that the application space method and the first method constitute the method inheritance relationship; wherein, the first method is an application space method or a framework space method, the class to which the first method belongs has an inheritance relationship with the class to which the application space method belongs, and the signature corresponding to the first method is the same as the signature corresponding to the application space method.

[0137] Optionally, in an embodiment, the simplification of the new function call graph includes: replacing the nodes corresponding to each framework space method in the new function call graph with nodes corresponding to the class to which each framework space method belongs; replacing the nodes corresponding to each application space method in the new function call graph with nodes corresponding to the class to which each application space method belongs.

[0138] Example 3

[0139] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a malware identification method based on an Android malware detection model as described in Example 1 is implemented.

[0140] In the description of this specification, the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0141] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A malware identification method based on an Android malware detection model, characterized in that: include: Obtain an APK data set, where the APK data set includes an APK file; Determining, based on the APK data set, a permission vector and a function call graph corresponding to each APK file in the APK data set, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file; Training a preset neural network model based on the permission vectors corresponding to the APK files to obtain a first model, wherein the first model is used to identify whether the application corresponding to the APK file is malware based on the permissions required by the application corresponding to the APK file; Training a preset graph convolutional neural network model based on a function call graph corresponding to each APK file to obtain a second model, wherein the second model is used to identify whether the application corresponding to the APK file is malware based on the function call graph corresponding to the APK file; Performing model integration processing on the first model and the second model to generate an Android malware detection model, so as to identify malware for the APK file to be detected based on the Android malware detection model; For each APK file, the function call graph corresponding to the APK file is determined in the following way: According to the APK file, the framework space method, application space method, class to which each framework space method belongs, and class to which each application space method belongs, defined in the application corresponding to the APK file, are obtained, and an initial function call graph is generated; each of the framework space methods represents a method customized by the Android system framework, and each of the application space methods represents a method customized by the user when writing the application corresponding to the APK file. The initial function call graph is used to describe the calling relationship between the framework space method and the application space method; Respectively obtain the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space. The callback relationship in the Android framework space represents the callback relationship between framework space methods. The inheritance relationship in the Android application space includes a class inheritance relationship and a method inheritance relationship. The class inheritance relationship represents the inheritance relationship between classes. The method inheritance relationship represents the inheritance relationship between application space methods and between framework space methods and application space methods. The permission relationship in the Android framework space represents the correspondence between framework space methods and the permissions required by framework space methods. Taking the framework space method, the application space method, and the permissions required by the framework space method as nodes, based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space, the initial function call graph is updated to obtain a new function call graph; The new function call graph is simplified to obtain a function call graph corresponding to the APK file.

2. The malware identification method based on the Android malware detection model according to claim 1, characterized in that: For each APK file, the permission vector corresponding to the APK file is determined in the following way: Determine, based on the APK file, the permissions required by the application corresponding to the APK file; A permission vector corresponding to the APK file is constructed according to the permissions required by the application corresponding to the APK file and a preset default permission set.

3. The malware identification method based on the Android malware detection model according to claim 1, characterized in that: Also includes: Determine the attribute vector of each node respectively, the attribute vector of each framework space method is a vector describing the application programming interface package to which the framework space method belongs, the attribute vector of each application space method is a vector describing the operation code required by the application space method, and the attribute vector of each permission required by the framework space method is a vector describing the permission type and danger type to which the permission required by the framework space method belongs.

4. The malware identification method based on the Android malware detection model according to claim 1, characterized in that: The callback relationship in each of the Android framework spaces is determined in the following way: Obtaining a potential callback method, where the potential callback method represents a framework space method that can be executed and overwritten by an Android application space, where the Android application space represents an independent environment used by an application corresponding to an APK file when running on a device; For each potential callback method, determine whether there is a registration method corresponding to the potential callback method, and determine whether the potential callback method is called inside the class to which the registration method belongs. If there is a registration method corresponding to the potential callback method and the potential callback method is called inside the class to which the registration method belongs, then a callback relationship in the Android framework space is constructed based on the potential callback method and the registration method corresponding to the potential callback method. The registration method represents a framework space method with the class to which the potential callback method belongs as a parameter, and the parameter represents a variable declared in the framework space method definition.

5. The malware identification method based on the Android malware detection model according to claim 4, characterized in that: The method for obtaining potential callbacks includes: Determine whether each framework space method meets the first criterion respectively, and determine the framework space method that meets the first criterion as a potential callback method. The first criterion is: the class to which the framework space method belongs can be accessed and inherited by any class to which the framework space method belongs and the class to which the application space method belongs, and the class to which the framework space method belongs can be extended, and the framework space method can be overwritten by the Android application space.

6. The malware identification method based on the Android malware detection model according to claim 1, characterized in that: The method inheritance relationship is determined in the following way: For each application space method, determine whether there is a first method corresponding to the application space method based on the class inheritance relationship. If so, determine that the application space method and the first method constitute the method inheritance relationship; wherein, the first method is an application space method or a framework space method, the class to which the first method belongs has an inheritance relationship with the class to which the application space method belongs, and the signature corresponding to the first method is the same as the signature corresponding to the application space method.

7. The malware identification method based on the Android malware detection model according to claim 1, characterized in that: The simplifying process of the new function call graph includes: Replacing the nodes corresponding to the various framework space methods in the new function call graph with nodes corresponding to the classes to which the various framework space methods belong; The nodes corresponding to the various application space methods in the new function call graph are replaced with nodes corresponding to the classes to which the various application space methods belong.

8. A malware identification device based on an Android malware detection model, characterized in that: include: An acquisition module, configured to acquire an APK data set, wherein the APK data set includes an APK file; a data processing module, configured to determine, based on the APK data set, a permission vector and a function call graph corresponding to each APK file in the APK data set, wherein the permission vector is a vector describing the permissions required by the application corresponding to the APK file; A first training module is configured to train a preset neural network model based on the permission vectors corresponding to the APK files to obtain a first model, wherein the first model is configured to identify whether the application corresponding to the APK file is malware based on the permissions required by the application corresponding to the APK file; a second training module, configured to train a preset graph convolutional neural network model based on a function call graph corresponding to each APK file to obtain a second model, wherein the second model is configured to identify whether an application corresponding to the APK file is malware based on the function call graph corresponding to the APK file; a model integration module, configured to perform model integration processing on the first model and the second model to generate an Android malware detection model, so as to identify malware for the APK file to be detected based on the Android malware detection model; For each APK file, the function call graph corresponding to the APK file is determined in the following manner: according to the APK file, the framework space method, application space method, class to which each framework space method belongs, and class to which each application space method belongs defined in the application corresponding to the APK file are obtained, and an initial function call graph is generated; each of the framework space method represents a method customized by the Android system framework, and each of the application space method represents a method customized by the user when writing the application corresponding to the APK file. The initial function call graph is used to describe the calling relationship between the framework space method and the application space method; the callback relationship in the Android framework space, the inheritance relationship in the Android application space, and the permission relationship in the Android framework space are obtained respectively, the callback relationship in the Android framework space represents the callback relationship between the framework space methods, the inheritance relationship in the Android application space includes the class inheritance relationship and the method inheritance relationship, the class inheritance relationship represents the inheritance relationship between each class, the method inheritance relationship represents the inheritance relationship between each application space method and between the framework space method and the application space method, and the permission relationship in the Android framework space represents the correspondence between the framework space method and the permissions required by the framework space method; Taking the framework space method, application space method and the permissions required by the framework space method as nodes, based on the callback relationship in the Android framework space, the inheritance relationship in the Android application space and the permission relationship in the Android framework space, the initial function call graph is updated to obtain a new function call graph; the new function call graph is simplified to obtain the function call graph corresponding to the APK file.

9. An electronic device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a malware identification method based on an Android malware detection model as described in any one of claims 1 to 7.

Images