Android malicious software detection method, system and device based on API and software permission and medium

Abstract

The invention belongs to the technical field of Android systems, and discloses an Android malicious software detection method, system and device based on APIs and software permissions and a medium, and the method comprises the steps of constructing an APK file data set, extracting APK source codes, constructing a function call graph, calculating and sorting API importance scores, and generating an API importance sorting table; extracting a permission list, calculating permission importance scores and sorting, and generating a permission importance sorting table; combining the two tables to construct feature vectors; and constructing an initial malicious software detection model by using the one-dimensional convolutional neural network, and performing prediction classification on the to-be-identified APK file by using the trained model to obtain a malicious software detection result. According to the technical scheme, the function call graph and authority analysis are combined, the number of APIs used for constructing features and the number of authorities are reduced, and the accuracy and efficiency of malicious software detection are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of Android systems, and in particular, relates to an Android malware detection method, system, device and medium based on API and software permissions. Background Art

[0002] With the rapid development of the Android operating system, Android applications have brought great convenience to our daily lives. However, the increasing number of Android malware has also posed a serious threat to the personal information security of users. Traditional detection methods have achieved good results in Android malware detection tasks, but due to the increasingly complex structure of malware, these methods are prone to generate a large amount of redundant data, and are also interfered by the obfuscation techniques used by malware authors, which to some extent affects the performance of the detection model. Summary of the invention

[0003] The purpose of the present invention is to provide an Android malware detection method, system, device and medium based on API and software permissions to solve the problems existing in the above-mentioned prior art.

[0004] To achieve the above object, the present invention provides an Android malware detection method based on API and software permissions, comprising:

[0005] Constructing an APK file dataset, wherein the APK file dataset includes benign APK files and malicious APK files;

[0006] Extracting source code of each APK file in the APK file dataset;

[0007] Constructing a function call graph corresponding to each APK file based on the extracted source code, calculating an API importance score corresponding to each API function contained in the function call graph, and sorting each API function in descending order based on the calculated API importance score to obtain an API importance sorting table corresponding to each APK file;

[0008] Extracting a permission list in the source code of each APK file, calculating a permission importance score corresponding to each permission declaration in the permission list, and sorting each permission declaration in descending order based on the calculated permission importance score to obtain a permission importance sorting table for each APK file;

[0009] Constructing a feature vector corresponding to each APK file based on the API importance ranking table and the permission importance ranking table;

[0010] Building an initial malware detection model based on a one-dimensional convolutional neural network, and training the malware detection model based on each feature vector to obtain a trained malware detection model;

[0011] Based on the trained malware detection model, predictive classification of the APK file to be identified is performed to obtain a malware detection result corresponding to the APK file to be identified.

[0012] Optionally, the specific calculation formula of the API importance score is:

[0013]

[0014] Where n is the number of benign software training samples, m is the number of malware training samples, and d iAPIB is the in-degree of the API in the function call graph of the i-th benign software sample, d jAPIM is the in-degree of API in the function call graph of the jth malware sample, AvgIndgree APIB is the average in-degree of the API in the function call graph of the benign software sample, AvgIndgree APIM is the average in-degree of the API in the function call graph of the malware sample; S API is the API importance score.

[0015] Optionally, the specific calculation formula of the permission importance score is:

[0016]

[0017] Where n and m are the number of benign software training samples and malicious software training samples, respectively. is the number of occurrences of permission P in benign software samples, is the number of occurrences of permission P in the malware sample, Avgp B is the average number of occurrences of permission P in benign software samples, Avgp M is the average number of occurrences of permission P in malware samples, S P is the importance score of permission P.

[0018] Optionally, the process of constructing the feature vector specifically includes:

[0019] Selecting a number of API functions and a number of permission declarations from the API importance ranking table and the permission importance ranking table respectively based on the importance ranking;

[0020] A feature vector of the corresponding APK file is constructed based on the in-degree corresponding to the selected API function and the selected permission declaration.

[0021] Optionally, the training process of the malware detection model specifically includes:

[0022] An initial malware detection model is constructed based on a one-dimensional convolutional neural network, the feature vector is input into the initial malware detection model for prediction and classification, and training is performed with the goal of minimizing the loss between the initial training result after classification and the software category corresponding to the input feature vector to obtain a trained malware detection model.

[0023] An Android malware detection system based on API and software permissions, comprising:

[0024] A data collection module is used to construct an APK file data set, wherein the APK file data set includes benign APK files and malicious APK files; and extract source code of each APK file in the APK file data set;

[0025] An API importance evaluation module is used to construct a function call graph corresponding to each APK file according to the extracted source code, calculate the API importance score corresponding to each API function contained in the function call graph, and sort each API function in descending order based on the calculated API importance score to obtain an API importance ranking table corresponding to each APK file;

[0026] A permission importance evaluation module, used to extract the permission list in the source code of each APK file, calculate the permission importance score corresponding to each permission statement in the permission list, sort each permission statement in descending order based on the calculated permission importance score, and obtain a permission importance ranking table for each APK file;

[0027] The malware detection module is used to construct a feature vector corresponding to each APK file according to the API importance ranking table and the permission importance ranking table; construct an initial malware detection model based on a one-dimensional convolutional neural network, train the malware detection model based on each feature vector, and obtain a trained malware detection model; perform predictive classification of the APK file to be identified based on the trained malware detection model, and obtain a malware detection result corresponding to the APK file to be identified.

[0028] An electronic device includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the Android malware detection method based on API and software permissions.

[0029] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements an Android malware detection method based on an API and software permissions.

[0030] The technical effects of the present invention are:

[0031] The present invention extracts the function call graph and manifest file of the software. Subsequently, two different evaluation mechanisms are used to evaluate the importance of each API call and permission. This process significantly reduces the number of APIs and permissions used to construct features, while improving the accuracy. After screening, the vectors composed of these key features are input into the one-dimensional convolutional neural network (1DCNN) model for training and detection, which improves the accuracy and efficiency of malware detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0034] Figure 1 ASP-Droid framework diagram in an embodiment of the present invention;

[0035] Figure 2 It is a flow chart of extracting function call graph in an embodiment of the present invention;

[0036] Figure 3 A schematic diagram of node calling relationships in an embodiment of the present invention;

[0037] Figure 4 1DCNN model structure diagram in an embodiment of the present invention;

[0038] Figure 5 It is a schematic diagram comparing the generalization capabilities of ASP-Droid in an embodiment of the present invention and the baseline method;

[0039] Figure 6 1DCNN model structure comparison results in the embodiment of the present invention;

[0040] Figure 7 1 is a graph showing comparative experimental results of two API characteristic value representation methods in an embodiment of the present invention;

[0041] Figure 8 This is a comparative experimental result diagram of using only one feature on the Andro-Dumpsys dataset in an embodiment of the present invention;

[0042] Fig. 9 It is a detection flow chart in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] Various exemplary embodiments of the present invention will now be described in detail. This detailed description should not be considered as limiting the present invention, but should be understood as a more detailed description of certain aspects, features, and embodiments of the present invention.

[0044] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0045] Embodiment 1

[0046] like Figure 1 - Fig. 9 As shown, this embodiment provides an Android malware detection method based on API and software permissions, including:

[0047] An APK file data set is constructed, wherein the APK file data set includes benign APK files and malicious APK files; source code of each APK file in the APK file data set is extracted; a function call graph corresponding to each APK file is constructed based on the extracted source code, an API importance score corresponding to each API function contained in the function call graph is calculated, and each API function is sorted in descending order based on the calculated API importance score to obtain an API importance ranking table corresponding to each APK file; a permission list in the source code of each APK file is extracted, and a permission importance score corresponding to each permission statement in the permission list is calculated, and each permission statement is sorted in descending order based on the calculated permission importance score to obtain a permission importance ranking table for each APK file; a feature vector corresponding to each APK file is constructed based on the API importance ranking table and the permission importance ranking table; an initial malware detection model is constructed based on a one-dimensional convolutional neural network, and the malware detection model is trained based on each feature vector to obtain a trained malware detection model; predictive classification of the APK file to be identified is performed based on the trained malware detection model to obtain a malware detection result corresponding to the APK file to be identified.

[0048] This embodiment provides an Android malware detection method (ASP-Droid) based on API and software permissions. This method decompiles the APK of the Android application and extracts the function call graph and manifest file of the software. Subsequently, ASP-Droid uses two different evaluation mechanisms to evaluate the importance of each API call and permission respectively. This process significantly reduces the number of APIs and permissions used to build features while improving accuracy. After screening, the vectors composed of these key features are input into a one-dimensional convolutional neural network (1DCNN) model for training and detection. This embodiment is compared with other existing methods on two real software data sets. The results show that ASP-Droid performs well in detecting malware.

[0049] This embodiment proposes an Android malware detection method based on API and software permissions. A PI and S oftware P ermissions, ASP-Droid), the core of which is to use two evaluation mechanisms to finely screen APIs and software permissions, significantly improving the analysis efficiency and reducing the number of APIs and permissions in the analysis process. This method optimizes the limitations of traditional static analysis methods, especially when dealing with software features. Traditional methods are often inefficient due to their reliance on a large number of software features and are susceptible to attackers' obfuscation techniques.

[0050] The ASP-Droid method first decompiles the APK file and constructs the function call graph of the software. The function call graph reveals the internal execution logic of the application and the mutual calling relationship between functions, and can understand the interaction between APIs. Unlike traditional methods, ASP-Droid deeply analyzes the function call graph to identify API patterns that frequently appear in malware. When extracting API information, the package name, class name, method name, parameter list, return value and other information are recorded in detail to ensure accurate distinction of APIs. This method can accurately screen out APIs that are closely related to malicious behavior and avoid being interfered by a large number of irrelevant APIs. Combined with an in-depth analysis of permission features, permission requests related to malicious behavior can be further identified, and a more accurate malware detection model can be constructed. Finally, this embodiment inputs these selected APIs and permission features into the 1DCNN model for training, so that the model can capture the deep features of malware.

[0051] The contribution of this embodiment is that it provides a new perspective for Android malware detection. Through the importance evaluation mechanism of ASP-Droid, the number of APIs and permissions is significantly reduced, and this evaluation mechanism enables the method to more accurately identify Android malware.

[0052] ASP-Droid Description:

[0053] Framework Overview: ASP-Droid's framework is as follows Figure 1 As shown, the method consists of the following three parts:

[0054] (1) Evaluate API importance based on the function call graph. First, decompile the APK to obtain its function call graph, which shows in detail the interaction pattern between functions within the program. Then focus on analyzing the 11 API types contained in the graph and count their in-degrees in the function call graph. This indicator reflects the importance of the API in the application and provides a quantitative indicator to measure the activity of each API. Finally, by comparing the average in-degree of these APIs in malware and benign software, we can identify those APIs that differ greatly in different types of software. (2) Evaluate the importance of permissions. By decompiling the APK, this embodiment extracts and analyzes the AndroidManifest.xml file therein. Then, based on the permission declarations in the file, count which permissions are declared. Finally, calculate the average number of permissions in benign software and malware.

[0055] (3) Feature fusion and malware detection. This part first fuses the API features and permission features selected according to their importance and uses them as the final feature representation of the Android software, which can fully reflect the behavioral characteristics of the software. Then, the feature vector is input into the 1DCNN model, and the complex patterns and relationships between the features are learned to conduct in-depth analysis of the software to determine whether the software is malware.

[0056] Evaluate API importance: In order to evaluate the importance of API, you first need to obtain the function call graph of the software. In Android malware detection, the Function Call Graph (FCG) is a key program analysis tool that shows in detail the calling relationship between functions in the program, including system API calls, user-defined functions, and method calls in application logic. By deeply analyzing the FCG, the execution flow and logical structure of the program can be clearly understood, and potential malicious behavior patterns can be identified. This embodiment uses the function call graph to evaluate the importance of related APIs and simplifies the complex call graph into a certain number of APIs. By simplifying and abstracting the FCG, the detection efficiency can be optimized and unnecessary analysis overhead can be reduced. The function call graph plays a vital role in revealing the true behavior of the application and improving the accuracy and efficiency of malware detection.

[0057] Extracting the function call graph can be done in three steps:

[0058] Step 1: Load the APK file;

[0059] Step 2: Decompile the APK file and extract the source code of the APK; Step 3: Build a function call graph based on the source code information of the APK.

[0060] The process of extracting the function call graph is as follows Figure 2 As shown. After the decompilation operation, this embodiment saves the function call graph of the APK as a GEXF file. GEXF is an open standard file format for describing graph structures and related data. It stores graph information in XML format, allowing graph data to be exchanged and shared between different applications. GEXF can be used to represent the structure and properties of graphs, networks, and complex systems. Table 1 lists the main tags of the GEXF file.

[0061] Table 1 GEXF tags

[0062]

[0063] Taking the software "a.envisionmobile.caa.apk" as an example, this embodiment uses the Gephi tool to open the function call graph file, such as Figure 3 shown.

[0064] exist Figure 3In the example, the first two columns are the node names of the functions, such as "android / app / Activity;->on-Cre ate(android / os / Bundle;)V". In this node name, "android / app / Activity" is the package name and class name of the method, "onCreate" is the method name, "android / os / Bundle" is the parameter type of the method, and "V" is the return value type of the method, "Void", which means that this method has no return value. This method will be called when an Activity is created. In the process of extracting the function name, this embodiment not only focuses on the basic name of the function, but also includes the package name, class name, parameter type and return value type. This detailed API information greatly enhances the model's ability to distinguish different functions. This method can more accurately identify and distinguish potential malicious behaviors, providing a solid foundation for software detection.

[0065] The number of nodes in the function call graph of Android applications is often very large. Taking "a.envisionmobile.caa.apk" as an example, its function call graph contains 49,439 nodes and 106,096 edges. The huge number of nodes and edges not only places high demands on computing resources, but also may interfere with the accurate judgment of the model because it contains a lot of redundant information. This situation is particularly common in Android software development, because various functions are widely used in the development process, including other functions besides the API provided by the operating system, such as developer-defined functions. However, not all functions are necessary for software detection and analysis. Therefore, in order to improve efficiency and accuracy, this embodiment only selects the APIs in Table 2 for statistics and analysis.

[0066] Table 2 API types used in this example

[0067]

[0068] The APIs included in Table 2 provide rich functions and are closely related to user privacy and system resources. Such APIs are more meaningful for malware detection. In order to further screen out important APIs, this embodiment proposes a quantitative method to evaluate the importance of each API. By defining an importance score, the role of each API in software function implementation and security performance can be systematically quantified. The specific calculation method is as follows:

[0069]

[0070] Where n is the number of benign software training samples, m is the number of malware training samples, and d iAPIBis the in-degree of the API in the function call graph of the i-th benign software sample, d jAPIM is the in-degree of API in the function call graph of the jth malware sample, AvgIndgree APIB is the average in-degree of the API in the function call graph of the benign software sample, AvgIndgree APIM is the average in-degree of the API in the function call graph of the malware sample; S API is the API importance score.

[0071] Calculate the API importance score ranking: First calculate the in-degree of the API in each function call graph, and then calculate the average degree based on the number of samples of benign software and malware. By comparing the average degree of the API in benign samples and malicious samples, a difference can be obtained. The absolute value of this difference is the importance score of the API. The higher the score, the more important this API is in distinguishing benign software from malware.

[0072] Assess the importance of permissions: Permissions in Android software refer to access rights to specific features or information requested by applications. These permissions can control the extent to which applications can access personal data and the software and hardware of the device. For example, an application may need access to contacts, cameras, storage space, etc. Permissions can be divided into three types based on when they are granted and how they are controlled in the Android system: installation-time permissions, runtime permissions, and special permissions.

[0073] Installation-time permissions are granted when the application is installed. These permissions are usually the basic permissions required for the application to run. Each application will display basic permission requirements to the user when it is installed, such as permissions to access device status. If the user does not want to grant the application these permissions, the user will not be able to use the program normally.

[0074] Runtime permissions refer to permission requests sent to users when an application first accesses certain sensitive data or functions while the application is running. These permissions are not mandatory, and users can deny or allow these permission requests, and these permissions can be changed after they are granted.

[0075] Special permissions are advanced permissions that require explicit user authorization. These permissions can affect key device functions, such as modifying system settings. Users can grant or revoke these special permissions in device settings.

[0076] Some commonly used permissions in Android programs are shown in Table 3.

[0077] Table 3 Common permissions for Android software

[0078]

[0079] If an application needs to use certain permissions, it needs to declare them in the AndroidManifest.xml file. By decompiling the APK file of the application, you can see the permission-related declarations in the AndroidManifest.xml file. The manifest file of an Android application consists of some special tags and content, such as <uses-permission>Tag to declare the permissions required by the application. The "android.permission.INTERNET" permission is used to allow applications to access the Internet. When an application needs to download data from the network, communicate with a server, or perform other operations that require an Internet connection, it needs to declare this permission. "android.permission.GET_ACCOUNTS" is a dangerous permission in the Android system that allows applications to access account information that already exists on the device. This account information may include the user's email address, contact information, etc., and needs to be requested from the user at runtime. "android.permission.MOUNT_UNMOUNT_FILESYSTEMS" is used to allow applications to mount and unmount file systems. This permission is usually associated with accessing external storage devices or performing file operations.

[0080] By decompiling the APK file, we can get the AndroidManifest.xml file of the application, and thus determine the list of permissions requested by the application. Since there are a large number of permissions in the Android system, and some of them are basic permissions, their practical utility for distinguishing and detecting malware is limited. In order to improve the efficiency of the detection model and optimize the analysis process, a permission importance scoring mechanism is proposed to evaluate the importance of each permission. In this way, the number of dependent permission features can be effectively reduced, so that malware can be identified more accurately. The specific calculation method is as follows:

[0081]

[0082] Where n and m are the number of benign software training samples and malicious software training samples, respectively. is the number of occurrences of permission P in benign software samples, is the number of occurrences of permission P in the malware sample, Avgp B is the average number of occurrences of permission P in benign software samples, Avgp M is the average number of occurrences of permission P in malware samples, S P is the importance score of permission P.

[0083] Calculate the average number of times each permission appears in benign software samples and malware samples, and finally subtract the two values ​​to get the absolute value. This value is the final score of the permission. The larger the score of the permission, the more important the permission is.

[0084] Feature fusion and malware detection: After importance evaluation, the importance ranking of API and permissions was obtained. In order to make full use of the two software features, the feature fusion method is adopted to splice API and permissions into a one-dimensional vector as the feature representation of Android software. The representation of the two software feature values ​​is as follows:

[0085] API i =d i (7)

[0086]

[0087] For the API feature, the in-degree d of the API in the function call graph of the Android software is i As a feature value. For permission features, set the corresponding feature value based on whether the permission is declared in the AndroidManifest.xml file of the software. If the permission is declared, the corresponding feature value permission i is 1, otherwise it is 0.

[0088] For ease of understanding, let's take an example: first, sort the APIs and permissions from high to low according to their importance scores. Assume that the top five APIs are (API1, API2, API3, API4, API5) and the top five permissions are (permission1, permission2, permission3, permission4, permission5). If the in-degrees of the top five APIs in a software's function call graph are 2, 1, 6, 7, and 0, respectively, and among the top five permissions, permission2, permission3, and permission5 are declared in the AndroidManifest.xml file of this software, then the final feature vector of the software is represented as (2, 1, 6, 7, 0, 0, 1, 1, 0, 1).

[0089] 1DCNN module design:

[0090] 1DCNN is a type of convolutional neural network that can process sequence data. 1DCNN is very useful when processing sequence data because it can capture local patterns and features in the sequence. The design of 1DCNN enables it to more accurately identify local correlations when processing sequence data, and improves computational efficiency by reducing the number of model parameters.

[0091] 1DCNN is different from traditional two-dimensional convolutional neural networks. Two-dimensional convolutional neural networks perform convolution operations in two directions, while 1DCNN only performs convolution operations in one direction, usually the sequence axis or the time axis. 1DCNN has a wide range of applications, such as text analysis, genomics data mining, and time series prediction. By using convolution kernels of different sizes, 1DCNN can extract multi-scale features in sequence data, which makes it better at parsing the structure of input sequences and identifying patterns in them. The 1DCNN model structure in the ASP-Droid method is shown in the figure. Figure 4 shown.

[0092] The API features and permission features used in this article are carefully selected, and each feature contains valuable information for detection. In order to make the detection model more efficient, no pooling layer was added when designing the model. This was analyzed in subsequent experiments. The activation function ReLU is used between the convolutional layer and the fully connected layer. The mathematical principle is as follows:

[0093] f(x)=max(0,x) (9)

[0094] Among them, x is the input, and max(0,x) means taking the larger value between 0 and x. ReLU is a nonlinear function. By introducing nonlinear transformations, the detection model can learn and represent more complex relationships. This is very important for the model to capture the nonlinear relationship in the feature vector of Android software.

[0095] The loss function is a metric that quantifies how well the model fits the training data. By minimizing the loss function, the model will better fit the training data and improve its performance on the training set. The loss function used in the proposed model is the binary cross entropy loss (BCELoss), which measures the difference between the binary classification output of the model and the true label.

[0096] For a single sample, the calculation formula of BCELoss is as follows:

[0097]

[0098] in, is the binary classification output processed by the sigmoid function, indicating the probability that this sample belongs to the positive class, and y is the true label, which takes a value of 0 or 1. For batch training, the loss function averages the loss of each sample.

[0099] During the training process, the Adam optimizer is used to update the parameters and weights of the model to minimize the loss value. The advantage of the Adam algorithm is that it can adaptively adjust the learning rate of each parameter, and generally performs well and is suitable for a variety of deep learning tasks. It combines the historical information of the gradient and uses a larger learning rate for parameters with smaller gradients and a smaller learning rate for parameters with larger gradients, thereby converging more stably during training.

[0100] In this embodiment, in order to comprehensively evaluate the effectiveness of the proposed method, experiments were conducted on two different data sets and compared with other existing methods. All experiments in this embodiment use Accuracy, Precision, Recall, FPR, F1Score and AUC as indicators to judge the effectiveness of the detection model.

[0101] Experimental environment: In the experiment of this embodiment, Python programming language is used as the development tool, the decompilation tool of Android software is Androguard, the deep learning framework used is Pytorch, and the operating system is Linux.

[0102] Dataset: In order to evaluate the effect of the detection model proposed in this embodiment, experiments were conducted on two Android software datasets. The following is a brief introduction to these two datasets.

[0103] Andro-Dumpsys: This dataset was collected by Jae-wookJang et al. and contains both malware and benign software. The malware samples were obtained from the Korea Cybersecurity Agency, and the benign samples consisted of highly ranked software downloaded from the Google Store.

[0104] CICDataset: The samples of this dataset are collected from two public datasets: CICMaldroid2020 and CIC-InvesAndMal2019.

[0105] These two data sets are publicly provided by the Canadian Institute for Cybersecurity (CIC) and can be downloaded from the official website.

[0106] Table 4 Dataset sample distribution

[0107]

[0108] The sample distribution in the two datasets is shown in Table 4. For the above two datasets, benign samples and malicious samples are randomly divided into training set, validation set and test set, with proportions of 80%, 5% and 15%, respectively.

[0109] Android malware detection experiment: During the experiment, we first evaluated the importance of each API and permission to select the top-ranked features. The rankings of the two features on the two datasets are (partially) shown in Tables 5, 6, 7, and 8.

[0110] By analyzing the contents in the table, it can be observed that in the two different datasets, the API and permission features with the highest scores are highly consistent. In the Andro-Dumpsys dataset, 18 API features are under the Content package, and in the CICDataset dataset, 17 API features also belong to the Content category. In addition, in the ranking of permission feature scores of the two datasets, there are also multiple identical permission features, such as "android.permission.READ_PHONE_STATE", "android.permission.CHANGE_WIFI_STATE", etc. The scores of API features and permission features in the two datasets preliminarily indicate that the adopted method is effective in the task of Android malware detection.

[0111] After analyzing the ranking of feature importance, the 100 API features and 100 permission features with the highest scores were selected. In order to ensure the effectiveness of model training and avoid overfitting problems, an early stopping mechanism was adopted. In this way, not only can the complexity of the model be controlled, but also the model can be prevented from overfitting on the training data, thereby ensuring the generalization ability of the model on unknown data. ASP-Droid was compared with GR-AP, AndroIG, PerLeNet, and AndroidPM methods on two real Android software datasets. 1. The GR-AP method effectively captures the behavior patterns of malware by integrating API features and permission features and combining them with the gated recurrent unit (GRU) network model. AndroIG focuses on filtering static features such as API and permissions, and then uses these filtered features in combination with machine learning algorithms. In addition, PerLeNet and AndroidPM models both focus on using permission features for training and detection, and identify potential malicious behaviors by analyzing the permission set requested by the application. By comparing with these methods, the performance of the proposed method can be more comprehensively evaluated.

[0112] Table 5. Permission ranking in the Andro-Dumpsys training set

[0113]

[0114]

[0115] In order to comprehensively measure the performance of the detection model, 6 different evaluation indicators were used. All experiments were conducted independently 10 times, and the average value was taken as the result of each indicator. The specific experimental results are shown in Table 9. For easy observation, the optimal value of each indicator is marked in bold. From the experimental data, it can be seen that the ASP-Droid method proposed in this embodiment surpasses other baseline methods in all evaluation indicators of the CICDataset dataset, and achieves the best value for the Accuracy indicator on the Andro-Dumpsys dataset and the suboptimal value for the F1 indicator. PerLeNet performs well on the Andro-Dumpsys dataset. Table 6 API ranking in the Andro-Dumpsys training set

[0116]

[0117] Table 7 API ranking in the CICDataset training set

[0118]

[0119] Table 8 Permission ranking in the CICDataset training set

[0120]

[0121] Poor performance on the CICDataset dataset. AndroidPM performs averagely on the Andro-Dumpsys dataset and also performs poorly on the CICDataset dataset. This is mainly because these two methods rely on a single feature set and cannot fully describe the complex information of the software. In addition, from the experimental results, it can be found that the overall performance of the method combining API features and permission features on both datasets is better than that of the method using only permission features, which to a certain extent shows the effectiveness of feature fusion in Android malware detection. For example, the GR-AP and AndroidIG methods surpass other baseline methods in multiple indicators on the CICDataset dataset, and also perform well compared with other baseline methods on the Andro-Dumpsys dataset. This is due to the fact that the GR-AP and AndroidIG methods use both API and permission features, so that they can capture the feature information of the software more comprehensively. Compared with the GR-AP and AndroidIG methods, the ASP-Droid method performs better because in the feature selection process, not only multiple software features are integrated, but also the importance of these features is evaluated, which significantly improves the accuracy of malware detection.

[0122] In order to more comprehensively evaluate the performance of the method proposed in this embodiment and other methods in terms of generalization ability, this embodiment averages the results of the six indicators obtained by each method on the two data sets. The average value, as a key indicator for measuring the generalization level of the model, can provide a more balanced and objective performance evaluation.

[0123] Table 9 Comparative experimental results of ASP-Droid and baseline methods on two datasets

[0124]

[0125] This embodiment further visualizes these average results in the form of a graph. Figure 6 As shown in the figure, the generalization effect of the ASP-Droid method is better than the baseline method in multiple important indicators. The two data sets come from different sources and the distribution of samples is also different. The ASP-Droid method achieves better results under such circumstances. The comparative analysis of the above experimental results proves that the software feature selection method of this embodiment is effective, and the detection model of this embodiment also has good adaptability.

[0126] Ablation experiment: In the design process of ASP-Droid method, no pooling layer was added to the 1DCNN model. In order to verify the rationality of this design decision, this embodiment conducted an ablation experiment, that is, adding a pooling layer to the model and observing its impact on the model performance (named ASP-Droid-1). From the experimental results, it can be found that the overall performance of the 1DCNN model with the addition of the pooling layer has not improved. This is because the features of the software have been evaluated for importance, and the addition of the pooling layer may filter out some key information. Therefore, based on these experimental results, it can be proved that the design of the ASP-Droid model is reasonable.

[0127] After evaluating the importance of the API according to the function call graph, the ASP-Droid method considers two forms of representation of API feature values. The first is to determine whether the target API is contained in the function call graph. If the API is contained, the feature value corresponding to the API is set to 1, otherwise it is set to 0 (named ASP-Droid-2). The reason for considering this method is that the APIs contained in malware and benign software are different, and malware often uses specific APIs to complete some special operations. The second method is to describe the API features according to the in-degree of the API in the function call graph. By extracting the function call graph to calculate the in-degree of the selected API, the software features can be described more accurately. This embodiment conducts experiments on two data sets to compare the effects of the two methods. From the experimental results, it can be seen that the second method (ASP-Droid) has achieved the optimal values ​​in multiple important indicators, and the overall performance is better than the first method (ASP-Droid-2). The experimental results show that the second method makes full use of the information of the function call graph and can more effectively capture the characteristics of software behavior. Therefore, the second method is adopted in the method of this embodiment to represent the API feature value of the software.

[0128] In the ASP-Droid method, a strategy of combining API features with permission features is adopted to construct a feature representation of the software. In order to verify the effectiveness of feature fusion, this embodiment uses the permission feature of the software (named ASP-Droid-3) and the API feature (named ASP-Droid-4) to conduct experiments separately. The results are as follows: Figure 8 As shown in the figure. From the experimental results, it can be found that combining API features and permission features performs better than using only one feature. This is because API and permission contain different types of information respectively. The feature fusion method can more fully describe the software information, thereby improving the accuracy of detection. Therefore, the ASP-Droid model fuses API features and permission features to represent software features.

[0129] This embodiment proposes a method based on API calls and software permissions, and conducts in-depth research and improvement on the feature selection problem in software feature analysis. The ASP-Droid method includes four key steps: first, decompile the Android application to obtain its internal structure; second, evaluate the importance of the API by building a function call graph; then, analyze the importance of the permissions requested by the application; finally, use the 1DCNN model for training and malware detection. The most representative API and permission features are selected through a carefully designed feature selection strategy, which not only greatly reduces the number of features, but also significantly improves the efficiency of the detection model. In order to verify the effectiveness of the method, this embodiment compares it with other detection methods on two data sets. The experimental results show that the ASP-Droid method performs well in all performance indicators. In addition, through a series of ablation experiments, this embodiment further verifies the rationality of the method.

[0130] An Android malware detection system based on API and software permissions, comprising:

[0131] A data collection module is used to construct an APK file data set, wherein the APK file data set includes benign APK files and malicious APK files; and extract source code of each APK file in the APK file data set;

[0132] An API importance evaluation module is used to construct a function call graph corresponding to each APK file according to the extracted source code, calculate the API importance score corresponding to each API function contained in the function call graph, and sort each API function in descending order based on the calculated API importance score to obtain an API importance ranking table corresponding to each APK file;

[0133] A permission importance evaluation module, used to extract the permission list in the source code of each APK file, calculate the permission importance score corresponding to each permission statement in the permission list, sort each permission statement in descending order based on the calculated permission importance score, and obtain a permission importance ranking table for each APK file;

[0134] The malware detection module is used to construct a feature vector corresponding to each APK file according to the API importance ranking table and the permission importance ranking table; construct an initial malware detection model based on a one-dimensional convolutional neural network, train the malware detection model based on each feature vector, and obtain a trained malware detection model; perform predictive classification of the APK file to be identified based on the trained malware detection model, and obtain a malware detection result corresponding to the APK file to be identified.

[0135] An electronic device includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute the Android malware detection method based on API and software permissions.

[0136] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements an Android malware detection method based on an API and software permissions.

[0137] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An Android malware detection method based on API and software permissions, characterized in that: include: Constructing an APK file dataset, wherein the APK file dataset includes benign APK files and malicious APK files; Extracting source code of each APK file in the APK file dataset; Constructing a function call graph corresponding to each APK file based on the extracted source code, calculating an API importance score corresponding to each API function contained in the function call graph, and sorting each API function in descending order based on the calculated API importance score to obtain an API importance sorting table corresponding to each APK file; Extracting a permission list in the source code of each APK file, calculating a permission importance score corresponding to each permission declaration in the permission list, and sorting each permission declaration in descending order based on the calculated permission importance score to obtain a permission importance sorting table for each APK file; Constructing a feature vector corresponding to each APK file based on the API importance ranking table and the permission importance ranking table; Building an initial malware detection model based on a one-dimensional convolutional neural network, and training the malware detection model based on each feature vector to obtain a trained malware detection model; Based on the trained malware detection model, predictive classification of the APK file to be identified is performed to obtain a malware detection result corresponding to the APK file to be identified.

2. The method for detecting Android malware based on API and software permissions according to claim 1, characterized in that: The specific calculation formula of the API importance score is: Where n is the number of benign software training samples, m is the number of malware training samples, and d iAPIB is the in-degree of the API in the function call graph of the i-th benign software sample, is the in-degree of API in the function call graph of the jth malware sample, AvgIndgree APIB is the average in-degree of the API in the function call graph of the benign software sample, AvgIndgree APIM is the average in-degree of the API in the function call graph of the malware sample; S API is the API importance score.

3. The method for detecting Android malware based on API and software permissions according to claim 1, characterized in that: The specific calculation formula of the permission importance score is: Where n and m are the number of benign software training samples and malicious software training samples, respectively. is the number of occurrences of permission P in benign software samples, is the number of occurrences of permission P in the malware sample, Avgp B is the average number of occurrences of permission P in benign software samples, Avgp M is the average number of occurrences of permission P in malware samples, S P is the importance score of permission P.

4. The method for detecting Android malware based on API and software permissions according to claim 1, characterized in that: The process of constructing the feature vector specifically includes: Selecting a number of API functions and a number of permission declarations from the API importance ranking table and the permission importance ranking table respectively based on the importance ranking; A feature vector of the corresponding APK file is constructed based on the in-degree corresponding to the selected API function and the selected permission declaration.

5. The method for detecting Android malware based on API and software permissions according to claim 1, characterized in that: The training process of the malware detection model specifically includes: An initial malware detection model is constructed based on a one-dimensional convolutional neural network, the feature vector is input into the initial malware detection model for prediction and classification, and training is performed with the goal of minimizing the loss between the initial training result after classification and the software category corresponding to the input feature vector to obtain a trained malware detection model.

6. An Android malware detection system based on API and software permissions, characterized in that: include: A data collection module, used to construct an APK file data set, wherein the APK file data set includes benign APK files and malicious APK files; Extracting source code of each APK file in the APK file dataset; An API importance evaluation module is used to construct a function call graph corresponding to each APK file according to the extracted source code, calculate the API importance score corresponding to each API function contained in the function call graph, and sort each API function in descending order based on the calculated API importance score to obtain an API importance ranking table corresponding to each APK file; A permission importance evaluation module, used to extract the permission list in the source code of each APK file, calculate the permission importance score corresponding to each permission statement in the permission list, sort each permission statement in descending order based on the calculated permission importance score, and obtain a permission importance ranking table for each APK file; A malware detection module, used to construct a feature vector corresponding to each APK file according to the API importance ranking table and the permission importance ranking table; An initial malware detection model is constructed based on a one-dimensional convolutional neural network, and the malware detection model is trained based on each feature vector to obtain a trained malware detection model; and predictive classification of the APK file to be identified is performed based on the trained malware detection model to obtain a malware detection result corresponding to the APK file to be identified.

7. An electronic device, characterized in that: It includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute an Android malware detection method based on API and software permissions according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements an Android malware detection method based on API and software permissions as described in any one of claims 1-5.

Images