Android malicious application detection method based on multi-view deep neural network

Abstract

The invention discloses an Android malicious application detection method based on a multi-view deep neural network, and relates to the technical field of information. The invention provides an Android malicious application detection method based on a multi-view deep neural network in view of the technical problems of numerous attack means, complex and changeable semantics, difficulty in ensuring the coverage rate of attack behaviors by executing detection only from a single view and the like of the current Android malicious application. According to the method, multi-view static feature information is organically fused, the synergistic effect of static features under all views is fully exerted, a target object is comprehensively described, limitation and fuzziness caused by application analysis from a single view are avoided, and finally accurate detection of malicious applications is achieved.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to an Android malicious application detection method based on a multi-view deep neural network. Background Art

[0002] At present, the endless stream of malicious Android application attacks poses a serious threat to the development of the Android application ecosystem. According to the AV-TEST report, a total of 1,303,394 malicious applications and 1,803,359 suspicious applications were detected on the Android system in 2023. [1] Such applications can steal privacy, steal banking / financial information, escalate permissions, and remotely control, causing adverse effects on users in many ways.

[0003] To solve the above problems, Daniel [2] et al. proposed a lightweight Android malicious application detection scheme called DREBIN, which collects application features from multiple aspects and performs extensive static analysis to achieve detection. [3] et al. first used multimodal deep learning for Android malicious application detection and proposed a novel Android malicious application detection framework to effectively distinguish malicious and benign applications. [4] et al. proposed a malicious application detection system based on machine learning, using feature selection based on linear regression to reduce the dimension of the feature vector, shorten the training time, and enable the classification model to be applied to the real-time malicious application detection system, with the highest accuracy increased to 0.961.

[0004] Among the above schemes, Drebin is the representative [2] , which detects malicious applications by extracting static feature information such as API usage, network address, component name, etc. from the Android application package APK. However, this solution does not fully build the correlation between the features of each dimension, so it is difficult to fully release the ability of the above feature information to characterize the maliciousness of application behavior, which ultimately affects its recognition effect on different types of malicious applications.

[0005] Inspired by deep learning technology, Zhu [5] et al. proposed a novel convolutional neural network (CNN) variant named MADRF-CNN. This scheme uses both maximum pooling and average pooling (MADRF) and can use multi-scale context information to capture the dependencies between different parts of the image (from the Dex file), showing a strong ability to detect malicious Android applications with an accuracy of up to 0.969. Zhang Jiashuang [6]He proposed an image classification model based on visual Transformer. To address the problem of Transformer's lack of inductive bias, he introduced a 2D Position Embedding strategy, which is significantly better than the traditional model. At the same time, he proposed a new visualization algorithm TFvisual to address the shortcomings of current visualization algorithms in terms of information loss and structural damage, which effectively improved information retention and structural integrity, and significantly improved the classification effect of the model.

[0006] The above two solutions are of great significance in the field of Android malicious application detection, but they are both based on image analysis and processing, which requires additional computing resources, including feature extraction, image generation and processing, and the process of converting the code into images may destroy the original semantics of the code, thus affecting the final detection effect. In summary, how to achieve lightweight and high-accuracy Android malicious application detection is one of the important research directions at present.

[0007] In summary, in order to purify the network environment, reduce users' economic losses and protect user data security, current Android malicious application detection solutions are actively exploring various strategies to achieve the goal of high accuracy and efficient detection. However, researchers often ignore the correlation between features, or do not fully consider the urgent need for rapid detection in actual application scenarios (such as high-precision static analysis, etc.), resulting in many solutions being unable to meet the detection needs of the real world. Summary of the invention

[0008] In view of the fact that the current Android malicious applications have many attack methods and complex and changeable semantics, it is difficult to ensure the coverage of attack behaviors by performing detection only from a single view. In this paper, an Android malicious application detection method based on a multi-view deep neural network is proposed. The multi-view deep neural network is used to organically integrate the static feature information of multiple views, give full play to the synergistic effect of the static features under each view, comprehensively characterize the target object, avoid the limitations and ambiguity brought by analyzing the application from a single view, and finally achieve accurate detection of malicious applications.

[0009] In order to achieve the above object, the technical solution adopted by the present invention is:

[0010] A method for detecting malicious Android applications based on a multi-view deep neural network combines extensive static program analysis and deep learning techniques to train a mathematical model that can effectively adapt to the task of detecting malicious Android applications. The steps are as follows:

[0011] Step 1: Extracting data features

[0012] Adopting a multi-view learning strategy, we extract different sets of features from the manifest and DEX code of a given Android app through extensive static analysis, and process the data from different perspectives or feature sets;

[0013] Step 2: Vectorization of data features

[0014] The feature vector lightweight processing mechanism is adopted, which is realized by converting the text data into a sparse numerical matrix, storing only the position and value of non-zero elements, and converting the high-dimensional and mostly zero text data into a sparse numerical matrix;

[0015] Step 3: Computational performance optimization

[0016] Use sparse tensor operations to optimize the model's calculation process and improve calculation efficiency; optimize the model's storage space by using sparse matrices;

[0017] Step 4: Training and testing of neural network model

[0018] The neural network model adopts a modular multi-layer perceptron (MLP) structure and introduces a multi-head self-attention mechanism, which can adapt to different task requirements and provide highly optimized solutions.

[0019] As a preferred technical solution of the present invention, the multi-view learning strategy in step 1 includes:

[0020] ①Module One: Permissions and Security, including the following related features:

[0021] Requested Permission: The set of permissions requested by the application;

[0022] Used Permissions: The set of permissions actually used in the code;

[0023] Restricted Api Set: The restricted API set used by the application;

[0024] Suspicious Api Set: The set of suspicious APIs used in the application;

[0025] ②Module Two: Application Structure and Components, including the following related features:

[0026] ActivitySet: A collection of activities defined in an application, recording all declared activity classes;

[0027] Service Set: The service set defined in the application, listing all declared services;

[0028] Broadcast Receiver Set: The set of broadcast receivers defined in the application;

[0029] Content Provider Set: A collection of content providers defined in the application, covering all declared content providers;

[0030] ③Module Three: Network and External Interactions, including the following related features:

[0031] URL Domain Set: The URL domain name set that appears in the application, recording the target domain name of the network request;

[0032] Hardware Components Set: The set of hardware features that the application declares to use;

[0033] Intent Filter Set: A collection of intent filters defined in an application that describes how the application responds to specific intents.

[0034] As a preferred technical solution of the present invention, the conversion process in step 2 is implemented by the following steps:

[0035] ① Feature extraction: First, the original text data is processed using Count Vectorizer to map each independent text item to a unique integer index;

[0036] ② Sparse matrix construction: After obtaining the numerical representation, for each text sample, create a two-dimensional matrix, where the rows represent the samples and the columns represent all possible feature indices; then, traverse each feature, and only when the feature appears in the text, record its corresponding row index and column index in the matrix, as well as the number of occurrences;

[0037] ③ Storage of indexes and values: In a sparse matrix, only the indexes and values ​​of non-zero elements are stored; the index information includes row index and column index, and the value is the number of times the feature appears;

[0038] ④Sparse tensor conversion: Convert this sparse matrix to a sparse tensor of PyTorch;

[0039] In this way, the original dense text data is converted into a sparse numerical matrix that only occupies storage space commensurate with its nonzero elements;

[0040] The storage formula of sparse matrix is:

[0041] Sparse Matrix=(Indices,Values,Shape) (1)

[0042] In formula (1), Indices represents the index of non-zero elements, Values ​​represents the value of non-zero elements, and Shape represents the dimension of the matrix; in this way, the model can process large-scale data sets with less memory and computing resources.

[0043] As a preferred technical solution of the present invention, the improvement and optimization steps in step three are as follows:

[0044] ① Improved computing efficiency

[0045] In deep learning models, sparse tensors are used directly for matrix multiplication and other operations without conversion to dense format; the formula for sparse tensor operations:

[0046] Sparse Operation(A,B)=Sparse Tensor(A)×Sparse Tensor(B) (2)

[0047] In formula (2), A and B are matrices converted into sparse tensors;

[0048] ②Memory and storage optimization

[0049] By using sparse matrices, model storage space is saved; storage optimization formula:

[0050]

[0051] Sparse matrices store only non-zero elements, significantly reducing storage requirements and enabling the model to handle larger datasets while maintaining efficient memory usage.

[0052] As a preferred technical solution of the present invention, the structure of the neural network in step 4 is:

[0053] (1) Modular sub-network structure

[0054] ① Sub-network design

[0055] The feature modules of different views are assigned to independent sub-networks for processing; each sub-network consists of multiple fully connected layers, combined with non-linear activation functions to enhance feature extraction capabilities;

[0056] The output of the subnetwork is calculated using the following formula:

[0057] h i =σ(W i xi +b i ) (4)

[0058] In formula (4), σ is the activation function, W i and b i are the weight matrix and bias vector respectively;

[0059] ②Fusion layer

[0060] The function of the fusion layer is to integrate the feature representations from different sub-networks into a unified feature vector for subsequent classification tasks; through linear transformation and weighted summation, the fusion layer can make full use of the feature information extracted by each sub-network.

[0061] The fusion process formula is:

[0062] f=Fusion(h1,h2,…,h n ) (5)

[0063] ③Output layer

[0064] The output layer uses the sigmoid activation function for binary classification; the sigmoid function maps the output of the fusion layer to the [0,1] interval, which is suitable for handling binary classification problems;

[0065] The formula for the output layer is:

[0066]

[0067] In formula (6), W o and b o is the parameter of the output layer;

[0068] (2) Multi-head self-attention mechanism

[0069] ① Self-attention calculation

[0070] The self-attention mechanism dynamically focuses on the most relevant features when processing data, and adjusts the feature weights by calculating the similarity between the query matrix Q, the key matrix K, and the value matrix V;

[0071] The calculation formula of self-attention is:

[0072]

[0073] In formula (7), QK T It represents the dot product similarity between the query and the key, and the softmax function is used to normalize the weight;

[0074] ②Multi-head mechanism

[0075] Multiple independent attention heads process the input features separately, learn different feature patterns, and then concatenate the outputs of each head and merge them through linear transformation;

[0076] The formula for the long mechanism is:

[0077] Multi Head(Q,K,V)=Concat(head1,…,head h )W O (8)

[0078] In formula (8), W O is the output linear transformation matrix;

[0079] (3) Vector fusion and classification

[0080] A multi-layer perceptron is used to further compress the vectors processed by the multi-head self-attention mechanism, and finally output the malicious application detection results.

[0081] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0082] 1. The present invention integrates feature views from different modules, such as permissions and security, application structure and components, network and external interactions, etc., to fully understand the behavior patterns of Android applications, capture richer feature semantic information, and ultimately achieve accurate Android malicious application detection.

[0083] 2. In the present invention, the multi-view method improves the expressiveness of features. By combining the multi-layer perceptron and the multi-head self-attention mechanism, the model can adaptively focus on the most important feature information in different views, while ignoring redundant or irrelevant features, and form a more accurate application behavior representation through weighted combination. This enhanced information expression capability is crucial for complex malicious application detection tasks. In addition, multi-view learning can effectively deal with the problem of uneven feature distribution. Even if some features are scarce in a specific view, the model can still obtain key information through other views.

[0084] 3. The present invention adopts a lightweight multi-layer perceptron model with a simple architecture and fewer layers and parameters. This design significantly reduces the computational and storage requirements of the model, while optimizing the number of parameters and computational complexity of the model, thereby achieving higher processing efficiency. In the feature extraction stage, Count Vectorizer is used to convert text features into numerical format, further reducing the reliance on complex feature engineering, making the model more flexible and adaptable. This lightweight feature not only improves the execution speed of the model, but also provides more space for subsequent optimization and iteration. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] Figure 1It is a schematic diagram of the structure of the neural network proposed in the present invention, showing the modular design of the model and the relationship between its various components.

[0086] Figure 2 The following is a comparison of memory usage of sparse matrices and dense matrices under cross validation (a) and a local enlarged view of sparse matrix memory usage (b).

[0087] Figure 3 It is a radar chart display comparing various model experiments. DETAILED DESCRIPTION

[0088] Example 1

[0089] This paper proposes a method for detecting malicious Android applications based on a multi-view deep neural network, which combines extensive static program analysis and deep learning technology to train a mathematical model that can effectively adapt to the task of detecting malicious Android applications. Figure 1 , the Android malicious application detection method mainly includes the following steps:

[0090] Step 1: Extracting data features

[0091] The present invention adopts a multi-view learning strategy, extracts different function sets from the manifest and DEX code of the application through extensive static analysis of a given Android application, and processes the data from different angles or feature sets. Multi-view learning is a powerful machine learning method that improves the performance of the learning model by integrating information from different views or feature sets. The views selected by the present invention are listed one by one in the following sections. These different views may reveal different aspects of the data. By integrating these views, the present invention can obtain a more comprehensive understanding and more accurate predictions.

[0092] 1.1Module One: Permissions and Security

[0093] Permission request is the most direct expression of the application's control over user privacy and device. It includes the following related features:

[0094] Requested Permission: The set of permissions requested by the application, including permissions to access contacts, location, etc. Requests for these permissions may indicate potential malicious behavior. For example, access to location permissions may be used to track user activities.

[0095] Used Permissions: The set of permissions actually used in the code, extracted by analyzing the bytecode of the application to ensure the accuracy of the security assessment.

[0096] Restricted Api Set: A set of restricted APIs used by applications. These APIs usually involve sensitive operations, such as reading user call records.

[0097] Suspicious API Set: A set of suspicious APIs used in the application. These APIs may be used by malicious applications to steal data.

[0098] 1.2Module Two: Application Structure and Components

[0099] The structure and components of an application are the basis of its functionality and behavior, and include the following related characteristics:

[0100] ActivitySet: A collection of activities defined in an application, recording all declared activity classes. Some activities may be associated with malicious behavior, such as automatically starting or hiding activities.

[0101] Service Set: A collection of services defined in an application, listing all declared services. Malicious applications may use background services to carry out persistent malicious activities.

[0102] Broadcast Receiver Set: A set of broadcast receivers defined in an application, including all registered broadcast receivers. Malicious applications may use broadcasts for remote control.

[0103] Content Provider Set: A collection of content providers defined in the application, covering all declared content providers. Some content providers may cause data leakage.

[0104] 1.3Module Three: Network and External Interactions

[0105] In the Internet age, the network behavior and external interactions of applications are important components of their security. This part of the view includes the following related features:

[0106] URL Domain Set: A collection of URL domain names that appear in an application, recording the target domain names of network requests. This is critical for detecting malicious network activities.

[0107] Hardware Components Set: The set of hardware features that the application declares to use, such as camera, Bluetooth, etc. Some hardware access requests may be associated with malicious behavior.

[0108] Intent Filter Set: A collection of intent filters defined in an application that describes how the application responds to specific intents. Malicious applications may disguise themselves as other applications.

[0109] By applying multi-view learning strategies to mobile application security assessment, the present invention can deeply analyze application behaviors from three different perspectives: permissions and security, application structure and components, and network and external interactions. This comprehensive approach not only improves the accuracy and flexibility of detecting malicious applications, but also enhances the model's adaptability to new threats. Each model focuses on capturing different key features of an application, thereby ensuring that the present invention can conduct a comprehensive security assessment of the application from a technical level. Such a feature division method, with its comprehensiveness, accuracy, flexibility, and adaptability, may become an effective solution for identifying and preventing security threats caused by malicious applications.

[0110] Step 2: Vectorization of data features

[0111] The present invention adopts a feature vector lightweight processing mechanism, which reduces the computing resources required for model processing and data storage by utilizing the sparsity of data. Specifically, the lightweight mechanism is implemented by converting text data into a sparse numerical matrix, storing only the position and value of non-zero elements. Its core lies in converting high-dimensional and mostly zero text data into a sparse numerical matrix. This conversion process is achieved by the following steps:

[0112] 2.1 Feature Extraction: First, use Count Vectorizer [7] The raw text data is processed to map each independent text item (such as a word or character) to a unique integer index. This step converts the unstructured text data into a structured numerical form, laying the foundation for subsequent sparse representation.

[0113] 2.2 Sparse Matrix Construction: After obtaining the numerical representation, the present invention only records the positions and values ​​of those features whose number of occurrences is greater than zero. Specifically, for each text sample, the present invention creates a two-dimensional matrix, where the rows represent the samples and the columns represent all possible feature indices. Then, the present invention traverses each feature and only records its corresponding row index and column index in the matrix, as well as the number of occurrences, when the feature appears in the text.

[0114] 2.3 Storage of indexes and values: In a sparse matrix, the present invention only stores the indexes and values ​​of non-zero elements. The index information includes the row index and the column index, and the value is the number of times the feature appears. This storage method greatly reduces memory usage because most features are zero in most samples, and zero values ​​do not need to be stored.

[0115] 2.4 Sparse Tensor Conversion: The present invention converts this sparse matrix into a sparse tensor of PyTorch. Sparse tensor is a type of tensor designed for sparse data, which only stores non-zero elements and their indices in memory, thereby further optimizing memory usage.

[0116] In this way, the original dense text data is converted into a sparse numerical matrix that only takes up storage space proportional to its non-zero elements. This lightweight representation not only reduces the memory footprint of the model, but also speeds up calculations, because many machine learning algorithms and libraries (such as PyTorch) are optimized for sparse data and can process sparse matrices more efficiently. This representation can significantly reduce memory usage while speeding up calculations.

[0117] The storage formula of sparse matrix is:

[0118] Sparse Matrix=(Indices,Values,Shape) (1)

[0119] In formula (1), Indices represents the index of non-zero elements, Values ​​represents the value of non-zero elements, and Shape represents the dimension of the matrix. In this way, the model can process large-scale data sets with less memory and computing resources.

[0120] Step 3: Computational performance optimization

[0121] 3.1 Improved computing efficiency

[0122] To further improve computational efficiency, the present invention uses sparse tensor operations to optimize the model's computational process. In deep learning models, sparse tensors can be used directly for matrix multiplication and other operations without converting to dense formats, thus avoiding unnecessary computation and memory usage.

[0123] The formula for sparse tensor operations is:

[0124] Sparse Operation(A,B)=Sparse Tensor(A)×Sparse Tensor(B) (2)

[0125] In formula (2), A and B are matrices converted into sparse tensors. With this method, the model can perform complex mathematical operations with higher efficiency, especially when processing high-dimensional sparse data.

[0126] 3.2 Memory and Storage Optimization

[0127] The lightweight mechanism of the present invention also includes optimization of storage space. By using sparse matrices, the model can save a lot of storage space, which is particularly important for deep learning models that need to store a large amount of model parameters and intermediate data.

[0128] The formula for storage optimization is:

[0129]

[0130] This ratio shows that sparse matrices only store non-zero elements, which greatly reduces the storage requirements. This optimization allows the model to handle larger datasets while maintaining efficient memory usage. Figure 2 The significant difference in memory usage between dense and sparse matrices is clearly demonstrated.

[0131] also, Figure 2 The use of cross-validation provides a solid foundation for this comparison. By training and testing on multiple different data subsets, cross-validation not only provides a more reliable performance evaluation, but also effectively avoids the bias caused by data partitioning. This method ensures that the performance of each matrix form in different situations has been fully tested, so it can be concluded that sparse matrices can save storage resources while still maintaining the high performance of the model.

[0132] Step 4: Model training and testing

[0133] 4.1 Neural Network Design

[0134] This paper proposes a new neural network model, which aims to efficiently and accurately classify malicious applications and benign applications. The model adopts a modular multi-layer perceptron (MLP) structure and significantly improves the ability to capture complex feature relationships by introducing a multi-head self-attention mechanism. The following is a detailed description of the neural network design of the present invention:

[0135] (1) Modular sub-network structure

[0136] ① Sub-network design

[0137] The present invention adopts a modular design concept, assigning feature modules of different views to independent sub-networks for processing. Each sub-network consists of multiple fully connected layers, combined with nonlinear activation functions (such as ReLU) to enhance feature extraction capabilities. The modular design allows the architecture to be flexibly expanded to adapt to different data sets and tasks.

[0138] The output of the subnetwork is calculated using the following formula:

[0139] h i =σ(W i x i +bi ) (4)

[0140] In formula (4), σ is the activation function, W i and b i are weight matrix and bias vector respectively. Through this design, the sub-network can effectively extract deep feature patterns from the input.

[0141] ②Fusion layer

[0142] The role of the fusion layer is to integrate the feature representations from different sub-networks into a unified feature vector for subsequent classification tasks. Through linear transformation and weighted summation, the fusion layer can make full use of the feature information extracted by each sub-network.

[0143] The fusion process formula is:

[0144] f=Fusion(h1,h2,…,h n ) (5)

[0145] This method ensures that the model can comprehensively consider the influence of multiple features and improve the accuracy of the final classification.

[0146] ③Output layer

[0147] The output layer uses the sigmoid activation function for binary classification. The sigmoid function maps the output of the fusion layer to the interval [0,1], which is suitable for handling binary classification problems. The output layer is optimized through training and performs well on the training data and has good generalization ability.

[0148] The formula for the output layer is:

[0149]

[0150] In formula (6), W o and b o are the parameters of the output layer.

[0151] (2) Multi-head self-attention mechanism

[0152] ① Self-attention calculation

[0153] The self-attention mechanism dynamically focuses on the most relevant features when analyzing data. Specifically, the self-attention mechanism adjusts the feature weights by calculating the similarity between the query matrix Q, the key matrix K, and the value matrix V. This process can capture the dependencies between input features, thereby improving the feature extraction ability of the model.

[0154] The calculation formula of self-attention is:

[0155]

[0156] In formula (7), QK T It represents the dot product similarity between the query and the key, and the softmax function is used to normalize the weights to ensure that the influence of each feature is reasonably adjusted.

[0157] ②Multi-head mechanism

[0158] To enhance the diversity of feature representation, the present invention adopts a multi-head self-attention mechanism. Multiple independent attention heads process input features separately, learn different feature patterns, and then concatenate the outputs of each head and merge them through linear transformation. In this way, the model can understand the data from multiple perspectives and enrich the feature representation.

[0159] The formula for the long mechanism is:

[0160] Multi Head(Q,K,V)=Concat(head1,…,head h )W O (8)

[0161] In formula (8), W O is the output linear transformation matrix. Through this method, the model can integrate multiple feature information and improve the richness of feature expression.

[0162] (3) Vector fusion and classification

[0163] The present invention continues to use the multi-layer perceptron to further compress the vectors processed by the multi-head self-attention mechanism, and finally outputs the malicious application detection results. The design of this part is similar to the modular sub-network structure.

[0164] Through the above-mentioned architecture design, the present invention not only significantly improves the memory and computing efficiency when processing high-dimensional sparse data, but also effectively improves the accuracy of feature extraction and the depth of feature semantic mining under different views through the combination of multi-layer perceptron and multi-head self-attention mechanism. This innovative architecture is particularly suitable for application scenarios that require efficient processing of large-scale data and complex feature relationships. Through modular design and flexible feature representation methods, the model can adapt to different task requirements and provide highly optimized solutions.

[0165] 4.2 Optimization and Training

[0166] This model is trained using the Adam optimizer, which is an adaptive learning rate optimization algorithm that can dynamically adjust the learning rate during training to accelerate the convergence process of the model. The initial value of the learning rate is set to 0.001, which has been experimentally verified to provide good convergence in most cases. In order to prevent overfitting, the present invention monitors the loss and accuracy of the validation set during training and implements an early stopping strategy. When the validation set loss does not improve within several consecutive epochs, the training will be terminated early to save computing resources and improve training efficiency.

[0167] Example 2

[0168] Comparative experiment

[0169] Table 1 Experimental configuration

[0170]

[0171] Table 2 Training results

[0172]

[0173] Note:

[0174] 1. The Drebin model is Arp D [2] A method proposed by et al.

[0175] 2. Model 0 is the model proposed by the present invention.

[0176] 3. The model Model 0 proposed in the present invention sets three views, namely Module one, Module two, and Module three. Figure 3 As shown in Table 1, Model 1, Model 2, and Model 3 are all based on Model 0, with views Module one, Module two, and Module three deleted respectively.

[0177] 4. Calculation formulas for each parameter:

[0178]

[0179] AUC-ROC=Area Under the Curve of Receiver Operating Characteristic(12)

[0180]

[0181] The meaning of each parameter in formula (9)-(13) is:

[0182] TP: Classifying real malicious apps as malicious apps

[0183] FP: Classifying real good apps as malicious apps

[0184] TN: Classify real good-intention apps as good-intention apps

[0185] FN: Classifying real malicious apps into good ones

[0186] The training results are shown in Table 2 and Figure 3 As shown in the figure, through experiments on multiple data sets, the model proposed in the present invention has shown excellent performance. Specifically, the accuracy of the model on the test set reached 97.25%. Compared with existing traditional methods (such as detection methods based on feature matching), the model proposed in the present invention has higher accuracy and robustness in malicious application detection tasks, especially when dealing with unbalanced data sets, it can better identify malicious applications, proving its effectiveness and reliability in practical applications.

[0187] References cited in the manual:

[0188] [1] "Malware," https: / / www.av-test.org / en / statistics / malware / , 2024.

[0189] [2]Arp D,Spreitzenbarth M,Hübner,Malte,et al.DREBIN:Effective andExplainable Detection of Android Malware in Your Pocket[C] / / Network&Distributed System Security Symposium.2014.DOI:10.14722 / ndss.2014.23247.

[0190] [3]Guen KT,Joong KB,Mina R,et al.A Multimodal Deep Learning Method for Android Malware Detection using Various Features[J].IEEE Transactions onInformation Forensics and Security,2018,PP:1-1.DOI:10.1109 / TIFS.2018.2866319.

[0191] [4]Ahin DZ,Kural OE,Akleylek S,et al.A novel permission-basedAndroid malware detection system using feature selection based on linearregression[J].Neural Computing and Applications,2021:1-16.DOI:10.1007 / s00521-021-05875-1.

[0192] [5]Zhu H, Wei H, Wang L, et al. An effective end-to-end android malware detection method [J]. Expert Systems with Applications, 2023, 218: 119593-.

[0193] [6] Zhang Jiashuang. VT-Droid: Research and application of visual detection of Android malicious applications based on transfer learning of visual Transformer model[D] Nanchang University, 2024. DOI: 10.27232 / d.cnki.gnchu.2024.003039.

[0194] [7]https: / / scikit-learn.org / stable / modules / generated / sklearn.feature_extraction.text.Count Vectorizer.html.

[0195] The above contents are merely examples and explanations of the concept of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the concept of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A method for detecting malicious Android applications based on a multi-view deep neural network, which combines extensive static program analysis and deep learning techniques to train a mathematical model that can effectively adapt to the task of detecting malicious Android applications, characterized in that: Here are the steps: Step 1: Extraction of data features Adopting a multi-view learning strategy, we extract different sets of features from the manifest and DEX code of a given Android app through extensive static analysis, and process the data from different perspectives or feature sets; Step 2: Vectorization of data features The feature vector lightweight processing mechanism is adopted, which is realized by converting the text data into a sparse numerical matrix, storing only the position and value of non-zero elements, and converting the high-dimensional and mostly zero text data into a sparse numerical matrix; Step 3: Computational performance optimization Use sparse tensor operations to optimize the model's calculation process and improve computing efficiency; By using sparse matrices, the storage space of the model is optimized; Step 4: Training and testing of neural network model The neural network model adopts a modular multi-layer perceptron (MLP) structure and introduces a multi-head self-attention mechanism, which can adapt to different task requirements and provide highly optimized solutions.

2. The Android malicious application detection method according to claim 1, characterized in that: The multi-view learning strategy in step 1 includes: ①Module One: Permissions and Security, including the following related features: Requested Permission: The set of permissions requested by the application; Used Permissions: The set of permissions actually used in the code; Restricted Api Set: The restricted API set used by the application; Suspicious Api Set: The set of suspicious APIs used in the application; ②Module Two: Application Structure and Components, including the following related features: ActivitySet: A collection of activities defined in an application, recording all declared activity classes; Service Set: The service set defined in the application, listing all declared services; Broadcast Receiver Set: The set of broadcast receivers defined in the application; Content Provider Set: A collection of content providers defined in the application, covering all declared content providers; ③Module Three: Network and External Interactions, including the following related features: URL Domain Set: The URL domain name set that appears in the application, recording the target domain name of the network request; Hardware Components Set: The set of hardware features that the application declares to use; Intent Filter Set: A collection of intent filters defined in an application that describes how the application responds to specific intents.

3. The Android malicious application detection method as claimed in claim 2, characterized in that: The conversion process in step 2 is achieved by the following steps: ① Feature extraction: First, the original text data is processed using Count Vectorizer to map each independent text item to a unique integer index; ② Sparse matrix construction: After obtaining the numerical representation, for each text sample, create a two-dimensional matrix, where the rows represent the samples and the columns represent all possible feature indices; then, traverse each feature, and only when the feature appears in the text, record its corresponding row index and column index in the matrix, as well as the number of occurrences; ③ Storage of indexes and values: In a sparse matrix, only the indexes and values ​​of non-zero elements are stored; the index information includes row index and column index, and the value is the number of times the feature appears; ④Sparse tensor conversion: Convert this sparse matrix to a sparse tensor of PyTorch; In this way, the original dense text data is converted into a sparse numerical matrix that only occupies storage space commensurate with its nonzero elements; The storage formula of sparse matrix is: Sparse Matrix=(Indices,Values,Shape) (1) In formula (1), Indices represents the index of non-zero elements, Values ​​represents the value of non-zero elements, and Shape represents the dimension of the matrix; in this way, the model can process large-scale data sets with less memory and computing resources.

4. The Android malicious application detection method as claimed in claim 3, characterized in that: The improvement and optimization steps in step 3 are as follows: ① Improved computing efficiency In deep learning models, sparse tensors are used directly for matrix multiplication and other operations without conversion to dense format; the formula for sparse tensor operations: Sparse Operation(A,B)=Sparse Tensor(A)×Sparse Tensor(B) (2) In formula (2), A and B are matrices converted into sparse tensors; ②Memory and storage optimization By using sparse matrices, model storage space is saved; storage optimization formula: Sparse matrices store only non-zero elements, significantly reducing storage requirements and enabling the model to handle larger datasets while maintaining efficient memory usage.

5. The Android malicious application detection method as claimed in claim 4, characterized in that: The structure of the neural network in step 4 is: (1) Modular sub-network structure ① Sub-network design The feature modules of different views are assigned to independent sub-networks for processing; each sub-network consists of multiple fully connected layers, combined with non-linear activation functions to enhance feature extraction capabilities; The output of the subnetwork is calculated using the following formula: h i =σ(W i x i +b i ) (4) In formula (4), σ is the activation function, W i and b i are the weight matrix and bias vector respectively; ②Fusion layer The function of the fusion layer is to integrate the feature representations from different sub-networks into a unified feature vector for subsequent classification tasks. Through linear transformation and weighted summation, the fusion layer can make full use of the feature information extracted by each sub-network. The fusion process formula is: f=Fusion(h1,h2,…,h n ) (5) ③Output layer The output layer uses the sigmoid activation function for binary classification; the sigmoid function maps the output of the fusion layer to the [0,1] interval, which is suitable for handling binary classification problems; The formula for the output layer is: In formula (6), W o and b o is the parameter of the output layer; (2) Multi-head self-attention mechanism ① Self-attention calculation The self-attention mechanism dynamically focuses on the most relevant features when processing data, and adjusts the feature weights by calculating the similarity between the query matrix Q, the key matrix K, and the value matrix V; The calculation formula of self-attention is: In formula (7), QK T It represents the dot product similarity between the query and the key, and the softmax function is used to normalize the weight; ②Multi-head mechanism Multiple independent attention heads process the input features separately, learn different feature patterns, and then concatenate the outputs of each head and merge them through linear transformation; The formula for the long mechanism is: Multi Head(Q,K,V)=Concat(head1,…,head h )W o (8) In formula (8), W o is the output linear transformation matrix; (3) Vector fusion and classification A multi-layer perceptron is used to further compress the vectors processed by the multi-head self-attention mechanism, and finally output the malicious application detection results.

Images