Android malicious software detection and classification method, device and system and storage medium
By adopting a model of fusion graph convolutional neural network and multi-view learning, integrating multiple features for Android malware detection, the problems of low detection accuracy and difficulty in fusion of multi-source features in the existing technology are solved, and more efficient and accurate malware detection is achieved.
Patent Information
- Application Number
- CN202411639668.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-18
- Publication Date
- 2025-03-11
AI Technical Summary
In the process of improving the detection speed, existing Android malware detection models often only use a single feature, which leads to reduced detection accuracy, difficulty in identifying new malware variants, and difficulty in effectively fusing multi-source heterogeneous features, resulting in the detection performance not reaching the ideal state.
The MVL-GCN model that integrates graph convolutional neural network and multi-view learning or the EMVL-JKDGCN model optimized based on directed jump knowledge graph convolutional neural network and feature view are trained by obtaining the historical behavior information of Android applications, and the software detection and classification model is input to the model for malware detection and classification.
By integrating multiple features, the accuracy of malware detection and the ability to identify new variants are improved, the detection performance is significantly improved, and the detection ability of malware on Android platform is enhanced.
Smart Images
Figure CN119598458A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of information security technology, and in particular relates to an Android malware detection and classification method and device, system, and storage medium. Background Art
[0002] With the popularity of Android mobile devices, malicious applications have shown a significant growth trend. Malicious applications can enable attackers to steal users' sensitive information, leading to significant personal property losses. In view of this, a detection mechanism that can effectively identify Android malware is proposed to protect user privacy and security. However, in order to improve the detection speed, the current Android malware detection model often only uses a single feature, which greatly weakens the accuracy of the method and limits its ability to identify new malware variants. In addition, integrating multi-source feature data to improve software detection performance is still a major challenge, because heterogeneous features from different sources are often difficult to be effectively integrated, resulting in detection performance that is not ideal. At the same time, the existing models are still insufficient in analyzing the chain reaction of function calls and the complex interaction between APIs. Summary of the invention
[0003] The technical problem to be solved by the present invention is to provide an Android malware detection and classification method and device, system, and storage medium.
[0004] To achieve the above object, the present invention adopts the following technical solution:
[0005] An Android malware detection and classification method, comprising:
[0006] Step S1, obtaining historical behavior information of Android applications;
[0007] Step S2: According to the historical behavior information of Android applications, the MVL-GCN model integrating graph convolutional neural network and multi-view learning or the EMVL-JKDGCN model based on directed jump knowledge graph convolutional neural network and feature view optimization is trained to obtain a software detection and classification model;
[0008] Step S3: input the real-time behavior information of the Android application into the software detection and classification model to implement malware detection and classification.
[0009] As a preferred embodiment, the MVL-GCN model includes: a data preprocessing module, a permission feature view module, an API call frequency feature view module, an opcode feature view module, a behavior feature view module and a multi-view fusion classification module; wherein the data preprocessing module is used to unpack and decompile the APKs file using the reverse tool apktool to obtain the AndroidManifest.xml and smali directories; the permission feature view module is used to extract permission information from the AndroidManifest.xml file, screen and vectorize it, and perform single-view learning on the extracted permission features after one-hot encoding; the API call frequency feature view module is used to extract the API call frequency of the application, and optimize the features through a dimensionality reduction strategy, and perform single-view learning on the optimized features; the opcode feature view module is used to extract Dalvik instructions, classify them into categories to obtain opcodes, and perform single-view learning on the opcodes after n-gram encoding; the behavior feature view module: extracts the FCG of the application, and uses Degree Centrality, ClosenessCentrality, PageRank and TF-IDF generate feature embeddings for each node in FCG. GCN is used to extract behavioral features in FCG, and the extracted behavioral features are subjected to single-view learning. The multi-view fusion classification module is used to integrate the learning results of the permission feature view module, API call frequency feature view module, operation code feature view module, and the feature view module and the multi-view fusion classification module to obtain the final classification decision.
[0010] Preferably, the EMVL-JKDGCN model is an improvement of the MVL-GCN model, which includes: a data preprocessing module, a permission feature view optimization module, an API call frequency feature view module, an operation code feature view module, a behavior feature view optimization module and an enhanced multi-view fusion classification module; wherein the permission feature view optimization module is used to extract permission-related information from the AndroidManifest.xml file, and filter and vectorize it, encode the obtained permission features using one-hot encoding, visualize the one-hot encoded permission features to generate an RGB-based QR code image, and perform single-view learning on the generated image; the behavior feature view optimization module is used to extract FCG for each APK, empower and strengthen the nodes in the graph through Degree Centrality, Closeness Centrality, PageRank and TF-IDF, extract the behavior features in the FCG through JKDGCN, and perform single-view learning on the generated behavior features; the enhanced multi-view fusion classification module is used to optimize the features by learning the weights of the views.
[0011] The present invention also provides an Android malware detection and classification device, comprising:
[0012] The acquisition module is used to obtain the historical behavior information of Android applications;
[0013] A training module is used to train the MVL-GCN model that integrates graph convolutional neural network and multi-view learning or the EMVL-JKDGCN model based on directed jump knowledge graph convolutional neural network and feature view optimization according to the historical behavior information of Android applications to obtain a software detection and classification model;
[0014] The processing module is used to input the real-time behavior information of the Android application into the software detection and classification model to realize malware detection and classification.
[0015] As a preferred embodiment, the MVL-GCN model includes: a data preprocessing module, a permission feature view module, an API call frequency feature view module, an opcode feature view module, a behavior feature view module and a multi-view fusion classification module; wherein the data preprocessing module is used to unpack and decompile the APKs file using the reverse tool apktool to obtain the AndroidManifest.xml and smali directories; the permission feature view module is used to extract permission information from the AndroidManifest.xml file, screen and vectorize it, and perform single-view learning on the extracted permission features after one-hot encoding; the API call frequency feature view module is used to extract the API call frequency of the application, and optimize the features through a dimensionality reduction strategy, and perform single-view learning on the optimized features; the opcode feature view module is used to extract Dalvik instructions, classify them into categories to obtain opcodes, and perform single-view learning on the opcodes after n-gram encoding; the behavior feature view module: extracts the FCG of the application, and uses Degree Centrality, ClosenessCentrality, PageRank and TF-IDF generate feature embeddings for each node in FCG. GCN is used to extract behavioral features in FCG, and the extracted behavioral features are subjected to single-view learning. The multi-view fusion classification module is used to integrate the learning results of the permission feature view module, API call frequency feature view module, operation code feature view module, and the feature view module and the multi-view fusion classification module to obtain the final classification decision.
[0016] Preferably, the EMVL-JKDGCN model is an improvement of the MVL-GCN model, which includes: a data preprocessing module, a permission feature view optimization module, an API call frequency feature view module, an operation code feature view module, a behavior feature view optimization module and an enhanced multi-view fusion classification module; wherein the permission feature view optimization module is used to extract permission-related information from the AndroidManifest.xml file, and filter and vectorize it, encode the obtained permission features using one-hot encoding, visualize the one-hot encoded permission features to generate an RGB-based QR code image, and perform single-view learning on the generated image; the behavior feature view optimization module is used to extract FCG for each APK, empower and strengthen the nodes in the graph through Degree Centrality, Closeness Centrality, PageRank and TF-IDF, extract the behavior features in the FCG through JKDGCN, and perform single-view learning on the generated behavior features; the enhanced multi-view fusion classification module is used to optimize the features by learning the weights of the views.
[0017] The present invention also provides an Android malware detection and classification system, comprising: a memory and a processor, wherein the memory stores a computer program executed by the processor, and the computer program executes an Android malware detection and classification method when executed by the processor.
[0018] The present invention also provides a storage medium, on which a computer program is stored, and the computer program executes the Android malware detection and classification method when running.
[0019] The MVL-GC model of the present invention obtains four types of features, namely, permissions, API calls, opcode sequences, and function call graphs (FCGs), through static analysis, feature extraction and screening, and single-view learning, so as to maximize the unique advantages of various features while ensuring that the features do not interfere with each other. In order to accurately describe the high-level behavioral characteristics of Android applications and parse function call relationships, the MVL-GCN model uses API node features extracted from FCG to enhance FCG analysis. FCG is regarded as a "digital fingerprint" that describes the behavior of Android applications. Then, based on GCN, behavioral feature vectors are extracted from FCG, and heterogeneous features from different sources are effectively integrated. By combining the permissions, opcodes, API calls, and behavioral feature vectors obtained by single-view learning, ensemble learning is used to obtain the final classification results. The performance of the MVL-GCN model in detecting different malware samples is significantly improved. The EMVL-JKDGCN model of the present invention strengthens the permission feature view module in the MVL-GCN model, and converts the original permission features into a QR code form by visualizing them. The feature view is optimized by using Conv2D and MaxPooling2D techniques to obtain features with higher dimensions and stronger representation capabilities, thereby improving the performance and generalization ability of the model. Secondly, a directed jump knowledge graph convolutional neural network is proposed to process FCG. Taking into account the directed nature of FCG, the EMVL-JKDGCN model extends GCN into a directed graph convolutional neural network (DGCN), incorporating information about the connection direction to update the node representation. Through a carefully designed adjacency matrix, DGCN can capture the input-output relationship of nodes in the information flow and reveal the key call path patterns inside the program. In addition, the model applies the jumping knowledge (Jumping Knowledge, JK) mechanism to increase the diversity of the network by retaining the graph embedding of the previous level and connecting it with the graph embedding of the current level. Finally, the EMVL-JKDGCN model achieves deep integration of features by assigning different weights to different views and outputs the final classification decision. The technical solution of the present invention is adopted to improve the detection ability of malware on the Android platform. BRIEF DESCRIPTION OF THE DRAWINGS
[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.
[0021] Figure 1 Flowchart of an Android malware detection and classification method according to an embodiment of the present invention. DETAILED DESCRIPTION
[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0023] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.
[0024] Embodiment 1:
[0025] like Figure 1 As shown, an embodiment of the present invention provides an Android malware detection and classification method, comprising:
[0026] Step S1, obtaining historical behavior information of Android applications;
[0027] Step S2: According to the historical behavior information of Android applications, the MVL-GCN model integrating graph convolutional neural network and multi-view learning or the EMVL-JKDGCN model based on directed jump knowledge graph convolutional neural network and feature view optimization is trained to obtain a software detection and classification model;
[0028] Step S3: input the real-time behavior information of the Android application into the software detection and classification model to implement malware detection and classification.
[0029] As an implementation method of an embodiment of the present invention, the MVL-GCN model includes: a data preprocessing module, a permission feature view module, an API call frequency feature view module, an operation code feature view module, a behavior feature view module and a multi-view fusion classification module; wherein the data preprocessing module is used to use the reverse tool apktool to unpack and decompile the APKs file to obtain the AndroidManifest.xml and smali directories; the permission feature view module is used to extract the permission information from the AndroidManifest.xml file, screen and vectorize it, and perform single-view learning on the extracted permission features after one-hot encoding; the API call frequency feature view module is used to extract the API call frequency of the application, and optimize the features through the dimension reduction strategy, and perform single-view learning on the optimized features; the operation code feature view module is used to extract the Dalvik instructions, and classify them into categories to obtain the operation codes, and perform single-view learning on the operation codes after n-gram encoding; the behavior feature view module: extracts the FCG of the application, and uses DegreeCentrality, Closeness Centrality, PageRank and TF-IDF generate feature embeddings for each node in FCG. GCN is used to extract behavioral features in FCG, and the extracted behavioral features are subjected to single-view learning. The multi-view fusion classification module is used to integrate the learning results of the permission feature view module, API call frequency feature view module, operation code feature view module, and the feature view module and the multi-view fusion classification module to obtain the final classification decision.
[0030] Furthermore, the behavior feature view module uses GCN to extract the behavior features in FCG as follows:
[0031] Each FCG is considered as a graph G = (V, E, A), where V and E represent the set of API nodes and API call relationships in an APK, respectively.
[0032] X=Concat[DC final ,CC final ,PR final ,TF-IDF final ]
[0033] Where X∈R n×d is the feature matrix of V, d and n are the dimensions of the feature vector and the node respectively, and each row x v ∈R dis the feature of node v. DCfinal is the degree centrality of all nodes in FCG, CCfinal is the closeness centrality of all nodes in FCG, PRfinal is the PageRank value of all nodes in FCG, and TF-IDFfinal is the term frequency-inverse document frequency of all nodes in FCG. Input layer H(0)=X,
[0034]
[0035] Among them, the adjacency matrix A∈R n×n is an n×n sparse matrix, where n is the number of nodes. It is the new adjacency matrix formed by adding the adjacency matrix of the graph to the self-loop. An L-layer GCN consists of several convolutional layers, and each graph convolutional layer constructs the embedding of each node by mixing the embeddings of the node's neighbors in the previous layer of the graph.
[0036] The inter-layer propagation of GCN is as follows:
[0037]
[0038]
[0039] in, is the degree matrix, the weight matrix W is trained using the Adam optimization method, l (l = 1, ..., l) represents the number of layers, σ is the ReLU activation function, and the output after the last layer is H ( L ).
[0040] The MVL-GCN model builds a 3-layer GCN model. The GCN training process uses the back-propagation algorithm and the gradient descent optimization algorithm to adjust the weight matrix W, so that the GCN can better adapt to the data and accurately output node embedding features.
[0041] Z= Concat [GMP(H (L) ),GAP(H (L) )]
[0042] Among them, Z is the initial FCG feature, GMP is the global maximum pooling, and GAP is the global average pooling.
[0043] Taking the initial FCG features as input, the input layer b0 consists of the initial FCG features with a size of F4×N.
[0044] f(b i+1 )=d×max(0,(b i W+b))
[0045] Among them, b irepresents the input of the FCG feature of the i-th layer, f(b i+1 ) represents the output of the FCG feature of the i-th layer; the forward calculation process of the model includes four linear transformation layers, and finally obtains the output f(b) based on the FCG behavior feature view final ).
[0046] Furthermore, a multi-view fusion classification module is used to fuse and classify views based on permission feature views, API call frequency views, operation code feature views, and FCG feature views.
[0047] Each view consists of several linear transformation layers, which extract higher-order features by reducing the number of neurons in the hidden layer. Each neuron in the middle layer uses the ReLU function as the activation function, and each view outputs features of the same dimension.
[0048] γ0=Concat[f(P final ),f(a final ),f(OP final ),f(b final )]
[0049] The view fusion and classification components concatenate the four types of features in the fully connected layer to obtain γ0, which is 128×N in size.
[0050] f(γ i+1 )=d×max(0,(γ i W+b))
[0051] Among them, γ i represents the input of the fusion feature of the i-th layer, f(γ i+1 ) represents the output of the fusion feature of the i-th layer. This process includes three rounds of linear transformation to obtain the fusion feature view f(γ final ).
[0052] Dropout is used to prevent overfitting in training, and the final output layer uses the sigmoid function for classification. During the training process, the Adamax optimizer is used to learn the parameters, and ReduceLROnPlateau reduces the learning rate based on certain conditions. When the loss function no longer improves, the learning rate will be reduced; the Loss function uses binary cross entropy.
[0053]
[0054] Among them, y represents the true label (0 or 1), Represents the predicted value of the model; for malware samples y = 1, the loss function only considers the part predicted to be 1; for benign software samples y = 0, the loss function only considers the part predicted to be 0.
[0055] As an implementation method of an embodiment of the present invention, the EMVL-JKDGCN model is an improvement of the MVL-GCN model, which includes: a data preprocessing module, a permission feature view optimization module, an API call frequency feature view module, an operation code feature view module, a behavior feature view optimization module and an enhanced multi-view fusion classification module; wherein the permission feature view optimization module is used to extract permission-related information from the AndroidManifest.xml file, filter and vectorize it, encode the obtained permission features using one-hot encoding, visualize the one-hot encoded permission features to generate an RGB-based QR code image, and perform single-view learning on the generated image; the behavior feature view optimization module is used to extract FCG for each APK, empower and enhance the nodes in the graph through Degree Centrality, Closeness Centrality, PageRank and TF-IDF, extract behavior features in FCG through JKDGCN, and perform single-view learning on the generated behavior features; the enhanced multi-view fusion classification module is used to optimize the features by learning the weights of the views.
[0056] Further, the permission feature view optimization module is used to visualize the one-hot feature vector as an RGB-based QR code image and use it for the new single view model. Step 1: Unpack and decompile the APK file by writing a script or using the apktool tool in the command line to extract the AndroidManifest.xml file. Step 2: One-hot encode the original permission features obtained from the androidmanifest.xml file using the androguard tool. Step 3: Convert the permission feature vector to a two-dimensional matrix. Since each APK contains permission feature vectors in the same order, the one-dimensional array of its permission attribute information can be converted into a two-dimensional matrix. For example, 144 original permission feature features are obtained in the dataset CIC-InvesAndMal2019, which can be converted into a matrix of 12 rows and 12 columns. If the number of original permission features is not enough to generate a square number, zero padding can be used at the end of the array to supplement it. Step 4: Visualize the obtained two-dimensional matrix and convert it into an RGB-based QR code image.
[0057] First, the input features are processed using the Conv2D layer. The Conv2D layer is a type of layer in a convolutional neural network. It captures specific features of an image by sliding a filter (also called a convolution kernel) over the input image. At each location, the convolution layer multiplies the input features and the filter element-wise and sums the product values to generate a convolutional feature map. Convolutional neural networks can achieve better learning by retaining important features as much as possible and filtering out redundant features.
[0058] Input image x∈R H×W×C , where H is the image height, W is the image width, and C is the number of input channels. The convolution kernel is where k H is the height of the convolution kernel, k w is the convolution kernel width, F is the number of output channels. The output feature map is y∈R H'×W'×F , whose size is determined by the input image and the convolution kernel.
[0059]
[0060] Where H' and W' are the image height and image width of the output feature map, respectively, P is the padding number, and S is the step size. During the calculation process, the input image is usually padded to keep the output the same as the input feature map. Padding can usually be done with a constant or 0.
[0061]
[0062] Where (i, j) is the position on the input image, c is the input channel index, and f is the output channel index; the MaxPooling2D layer is used to reduce the dimensionality of the convolutional feature map. The MaxPooling2D layer slides a window on the input feature map and selects the maximum value in the window area as the output. This can reduce the dimensionality, reduce the complexity of the model, and concentrate on more basic features. The sliding window size used by MaxPooling2D is (k H ,k w ), the step size is (S H ,S w ), the input feature map is y∈R H'×W'×F , the output feature map is y'∈R H”×W”×F . Each size of (k H ,k w ) is compressed into a scalar, thereby reducing the size of the feature map and the number of model parameters, which is beneficial to improving the generalization performance of the model.
[0063]
[0064] During the MaxPooling2D calculation process, for each sliding window on the input feature map, the maximum value is taken as the value of the corresponding position of the output feature map.
[0065]
[0066] Where (i,j) is the position on the input image and c is the channel index. Higher-level features are extracted by stacking multiple Conv2D layers and MaxPooling2D layers. Each Conv2D layer can use filters of different sizes to capture features of different scales and complexities. By using Conv2D layers and MaxPooling2D layers, important image features can be extracted from the permission features and further processed and learned in the multi-view fusion classification module. These layers can be reused across views to extract richer and more expressive features, thereby enhancing the performance of the model in the permission classification task. Next, the permission features are obtained by flattening the multi-dimensional input data into a one-dimensional vector using Flatten. Levy
[0067]
[0068] After linear transformation in the Dense layer, eigenvalues with better generalization ability are obtained. σ is the ReLU activation function, W is the weight matrix, and b is the bias vector.
[0069] Furthermore, the processing process of the behavior feature view optimization module is as follows:
[0070] Each FCG is considered as a graph G = (V, E), where V and E are the sets of nodes and edges respectively, and the vertex set V = (v1, v2, ..., v n ). If there is a directed edge between vertex i and vertex j, then e=(i,j), and (i,j)≠(j,i). Input layer H (0) =X
[0071] X=Concat[DC final ,CC final ,PR final ,TF-IDF final ]
[0072] Among them, DC final is the degree centrality of all nodes in FCG, CC final is the closeness centrality of all nodes in FCG, PR final is the PageRank value of all nodes in FCG, TF-IDF final is the term frequency-inverse document frequency of all nodes in the FCG,
[0073] AF (i,j)=A sym (i,j)
[0074] Among them, A F (i,j) is the first-order proximity matrix of FCG. It is 1 as long as there is a call relationship (i,j) or (j,i). The first-order proximity matrix only retains the undirected graph information, and the second-order is used to retain the directed information. A second-order adjacency matrix is established so that similar nodes can be connected to each other.
[0075]
[0076] In the directed graph FCG, for the API node v i and API node v j , define the second-order in-degree adjacency matrix A in (i,j) and the second-order out-degree adjacency matrix A out (i,j). API node v k If there are call relations (k,i) and (k,j) at the same time, then API node v i and API node v j There exists a second-order in-degree of 1. API node v k If there are call relations (i, k) and (j, k) at the same time, then API node v i and API node v j There exists a second-order out-degree of 1. (l+1) is the inter-layer propagation of JKDGCN,
[0077]
[0078] Among them, l (l = 1, ..., l) represents the number of layers, σ is the activation function, is the degree matrix, is the in-degree matrix, is the out-degree matrix, W (l) is the weight matrix.
[0079] By using the three-layer JKDGCN to obtain H (1) , H (2) , H (3) Concat, and obtain the initial FCG feature representation Z through the global maximum pooling layer and global average pooling.
[0080] H (final) =Concat[H (1) , H (2) ,H (3) ]
[0081] Z = Concat[GMP(H (final) ),GAP(H(final) )]
[0082] The initial FCG feature Z is used as input and then transformed by four rounds of Dense layers to obtain the output of the FCG-based behavioral feature view.
[0083] Furthermore, the enhanced multi-view fusion classification module is used to perform enhanced view fusion and classification based on the permission feature view, the API call frequency view, the operation code feature view, and the FCG feature view.
[0084] Each view is composed of several linear transformation layers, and higher-order features are extracted by reducing the number of neurons in the hidden layer. Each neuron in the middle layer uses the ReLU function as the activation function, and each view outputs features of the same dimension. In the fully connected layer, the importance of the features is adjusted by assigning different weights to different single-view features to obtain a more accurate and adaptable model.
[0085]
[0086] Among them, α, β, δ and They represent the view weight of permission features, the view weight of API call frequency, the view weight of operation code, and the view weight of behavior features. The view fusion and classification components multiply the four types of features with the weight matrix and then concatenate them to obtain Through By performing three rounds of linear transformation of the Dense layer, we can obtain the fusion feature f(γ final ).
[0087] During the training process, Adamax optimizer is used to learn parameters, and ReduceLROnPlateau is used to reduce the learning rate based on the loss function. Once the loss function is no longer improving, the learning rate will be reduced. The loss function uses binary cross entropy, and the final output layer uses sigmoid function for classification.
[0088] Embodiment 2:
[0089] The embodiment of the present invention also provides an Android malware detection and classification device, comprising:
[0090] The acquisition module is used to obtain the historical behavior information of Android applications;
[0091] A training module is used to train the MVL-GCN model that integrates graph convolutional neural network and multi-view learning or the EMVL-JKDGCN model based on directed jump knowledge graph convolutional neural network and feature view optimization according to the historical behavior information of Android applications to obtain a software detection and classification model;
[0092] The processing module is used to input the real-time behavior information of the Android application into the software detection and classification model to realize malware detection and classification.
[0093] As an implementation method of an embodiment of the present invention, the MVL-GCN model includes: a data preprocessing module, a permission feature view module, an API call frequency feature view module, an operation code feature view module, a behavior feature view module and a multi-view fusion classification module; wherein the data preprocessing module is used to use the reverse tool apktool to unpack and decompile the APKs file to obtain the AndroidManifest.xml and smali directories; the permission feature view module is used to extract the permission information from the AndroidManifest.xml file, screen and vectorize it, and perform single-view learning on the extracted permission features after one-hot encoding; the API call frequency feature view module is used to extract the API call frequency of the application, and optimize the features through the dimension reduction strategy, and perform single-view learning on the optimized features; the operation code feature view module is used to extract the Dalvik instructions, and classify them into categories to obtain the operation codes, and perform single-view learning on the operation codes after n-gram encoding; the behavior feature view module: extracts the FCG of the application, and uses DegreeCentrality, Closeness Centrality, PageRank and TF-IDF generate feature embeddings for each node in FCG. GCN is used to extract behavioral features in FCG, and the extracted behavioral features are subjected to single-view learning. The multi-view fusion classification module is used to integrate the learning results of the permission feature view module, API call frequency feature view module, operation code feature view module, and the feature view module and the multi-view fusion classification module to obtain the final classification decision.
[0094] As an implementation method of an embodiment of the present invention, the EMVL-JKDGCN model is an improvement of the MVL-GCN model, which includes: a data preprocessing module, a permission feature view optimization module, an API call frequency feature view module, an operation code feature view module, a behavior feature view optimization module and an enhanced multi-view fusion classification module; wherein the permission feature view optimization module is used to extract permission-related information from the AndroidManifest.xml file, filter and vectorize it, encode the obtained permission features using one-hot encoding, visualize the one-hot encoded permission features to generate an RGB-based QR code image, and perform single-view learning on the generated image; the behavior feature view optimization module is used to extract FCG for each APK, empower and enhance the nodes in the graph through Degree Centrality, Closeness Centrality, PageRank and TF-IDF, extract behavior features in FCG through JKDGCN, and perform single-view learning on the generated behavior features; the enhanced multi-view fusion classification module is used to optimize the features by learning the weights of the views.
[0095] Embodiment 3:
[0096] An embodiment of the present invention further provides an Android malware detection and classification system, comprising: a memory and a processor, wherein the memory stores a computer program executed by the processor, and the computer program executes an Android malware detection and classification method when executed by the processor.
[0097] Embodiment 4:
[0098] An embodiment of the present invention further provides a storage medium, on which a computer program is stored, and the computer program executes an Android malware detection and classification method when running.
[0099] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.
Claims
1. A method for detecting and classifying Android malware, characterized in that: include: Step S1, obtaining historical behavior information of Android applications; Step S2: According to the historical behavior information of Android applications, the MVL-GCN model integrating graph convolutional neural network and multi-view learning or the EMVL-JKDGCN model based on directed jump knowledge graph convolutional neural network and feature view optimization is trained to obtain a software detection and classification model; Step S3: input the real-time behavior information of the Android application into the software detection and classification model to implement malware detection and classification.
2. The Android malware detection and classification method according to claim 1, characterized in that: The MVL-GCN model includes: data preprocessing module, permission feature view module, API call frequency feature view module, opcode feature view module, behavior feature view module and multi-view fusion classification module; among them, the data preprocessing module is used to use the reverse tool apktool to unpack and decompile the APKs file to obtain AndroidManifest.xml and smali directory; the permission feature view module is used to extract permission information from the AndroidManifest.xml file, filter and vectorize it, and the extracted permission features are one-hot encoded for single-view learning; the API call frequency feature view module is used to extract the API call frequency of the application, and optimize the features through the dimensionality reduction strategy, and the optimized features are used for single-view learning; the opcode feature view module is used to extract Dalvik instructions, and classify them into categories to obtain opcodes, and the opcodes after n-gram encoding are used for single-view learning; the behavior feature view module: extracts the FCG of the application, and uses Degree Centrality and Closeness Centrality, PageRank and TF-IDF generate feature embeddings for each node in FCG. GCN is used to extract behavioral features in FCG, and the extracted behavioral features are subjected to single-view learning. The multi-view fusion classification module is used to integrate the learning results of the permission feature view module, API call frequency feature view module, operation code feature view module, and the feature view module and the multi-view fusion classification module to obtain the final classification decision.
3. The Android malware detection and classification method according to claim 2, characterized in that: The EMVL-JKDGCN model is an improvement of the MVL-GCN model, which includes: a data preprocessing module, a permission feature view optimization module, an API call frequency feature view module, an operation code feature view module, a behavior feature view optimization module and an enhanced multi-view fusion classification module; wherein the permission feature view optimization module is used to extract permission-related information from the AndroidManifest.xml file, filter and vectorize it, encode the obtained permission features using one-hot encoding, visualize the one-hot encoded permission features to generate an RGB-based QR code image, and perform single-view learning on the generated image; the behavior feature view optimization module is used to extract FCG for each APK, empower the nodes in the graph through Degree Centrality, Closeness Centrality, PageRank and TF-IDF, extract the behavior features in the FCG through JKDGCN, and perform single-view learning on the generated behavior features; the enhanced multi-view fusion classification module is used to optimize the features by learning the weights of the views.
4. An Android malware detection and classification device, characterized in that: include: The acquisition module is used to obtain the historical behavior information of Android applications; A training module is used to train the MVL-GCN model that integrates graph convolutional neural network and multi-view learning or the EMVL-JKDGCN model based on directed jump knowledge graph convolutional neural network and feature view optimization according to the historical behavior information of Android applications to obtain a software detection and classification model; The processing module is used to input the real-time behavior information of the Android application into the software detection and classification model to realize malware detection and classification.
5. The Android malware detection and classification device according to claim 4, characterized in that: The MVL-GCN model includes: data preprocessing module, permission feature view module, API call frequency feature view module, opcode feature view module, behavior feature view module and multi-view fusion classification module; among them, the data preprocessing module is used to use the reverse tool apktool to unpack and decompile the APKs file to obtain AndroidManifest.xml and smali directory; the permission feature view module is used to extract permission information from the AndroidManifest.xml file, filter and vectorize it, and the extracted permission features are one-hot encoded for single-view learning; the API call frequency feature view module is used to extract the API call frequency of the application, and optimize the features through the dimensionality reduction strategy, and the optimized features are used for single-view learning; the opcode feature view module is used to extract Dalvik instructions, and classify them into categories to obtain opcodes, and the opcodes after n-gram encoding are used for single-view learning; the behavior feature view module: extracts the FCG of the application, and uses Degree Centrality and Closeness Centrality, PageRank and TF-IDF generate feature embeddings for each node in FCG. GCN is used to extract behavioral features in FCG, and the extracted behavioral features are subjected to single-view learning. The multi-view fusion classification module is used to integrate the learning results of the permission feature view module, API call frequency feature view module, operation code feature view module, and the feature view module and the multi-view fusion classification module to obtain the final classification decision.
6. The Android malware detection and classification device according to claim 4, characterized in that: The EMVL-JKDGCN model is an improvement of the MVL-GCN model, which includes: a data preprocessing module, a permission feature view optimization module, an API call frequency feature view module, an operation code feature view module, a behavior feature view optimization module and an enhanced multi-view fusion classification module; wherein the permission feature view optimization module is used to extract permission-related information from the AndroidManifest.xml file, filter and vectorize it, encode the obtained permission features using one-hot encoding, visualize the one-hot encoded permission features to generate an RGB-based QR code image, and perform single-view learning on the generated image; the behavior feature view optimization module is used to extract FCG for each APK, empower the nodes in the graph through Degree Centrality, Closeness Centrality, PageRank and TF-IDF, extract the behavior features in the FCG through JKDGCN, and perform single-view learning on the generated behavior features; the enhanced multi-view fusion classification module is used to optimize the features by learning the weights of the views.
7. An Android malware detection and classification system, characterized in that: include: A memory and a processor, wherein the memory stores a computer program executed by the processor, and when the computer program is executed by the processor, the method for detecting and classifying Android malware according to any one of claims 1 to 3 is executed.
8. A storage medium, characterized in that: The storage medium stores a computer program, which, when running, executes the Android malware detection and classification method according to any one of claims 1 to 3.