Sensitive API construction method for malicious software detection and computer program product

Abstract

The invention provides a sensitive API (Application Program Interface) construction method for malicious software detection, which comprises the following steps of: collecting and labeling Android software samples to obtain a plurality of APK (Android Package) files; reversely extracting static features from the plurality of APK files; constructing a sensitive API list to be selected; according to the to-be-selected sensitive API list, constructing a simplified sensitive API set by using a logistic regression classification model in combination with an information gain rate statistical method; the technical problems that in the prior art, the number of sensitive APIs listed in an existing Android official document is large, and use is inconvenient can be solved. Through test data verification, although the number of the constructed simplified sensitive API set is greatly reduced compared with that of the original sensitive APIs, the effectiveness of malicious software recognition is still kept, and the recognition accuracy of the malicious software is 90% or above.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information security detection, and in particular to a sensitive API construction method for malware detection and a computer program product. Background Art

[0002] With the rapid development of mobile Internet, Android has become the most widely used mobile operating system in the world, and is widely used in various mobile devices such as smartphones and tablets. However, the openness and popularity of Android make it a major target for malware attacks. In recent years, malware has shown a surge in number, continuous technological updates, and endless variants, which seriously threatens user privacy and data security. Traditional malware detection methods have limitations in dealing with these complex attacks and urgently need innovation and optimization.

[0003] At present, malware detection mainly relies on two methods: dynamic behavior analysis and static feature analysis. Dynamic behavior analysis detects malicious activities by monitoring the actual running behavior of the software. Although this method has advantages in accuracy, its real-time performance is poor and the computational overhead is large. Therefore, static feature analysis is more widely used. Static feature analysis identifies malware by studying the malware's code structure, API (application programming interface) call frequency, and permission requests.

[0004] In static feature detection, the use of sensitive APIs plays an important role. Researchers often analyze the calling frequency of sensitive APIs or simplify the function call graph into sensitive function subgraphs based on sensitive APIs. However, the number of sensitive APIs listed in the official Android documentation is huge, which makes subsequent use and analysis difficult. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention proposes a sensitive API construction method and a computer program product for malware detection to solve the technical problems in the prior art that the number of sensitive APIs listed in the current Android official documents is huge and inconvenient to use.

[0006] The technical solution adopted by the present invention is as follows:

[0007] In a first aspect, a sensitive API construction method for malware detection is provided, including: collecting and labeling Android software samples to obtain multiple APK files; reversely extracting static features from the multiple APK files, wherein the static features include API call information; constructing a list of candidate sensitive APIs based on the static features; and constructing a streamlined sensitive API set based on the list of candidate sensitive APIs using a logistic regression classification model combined with an information gain rate statistical method combined with the API call information.

[0008] Furthermore, static features are extracted from multiple APK files in reverse, including: decompiling and parsing each APK file, extracting API call information and function call relationships therefrom, and obtaining static features.

[0009] Furthermore, a list of sensitive APIs to be selected is constructed, including: collecting the mapping relationship between sensitive permissions and official APIs, determining which APIs are related to sensitive permissions; and marking the APIs related to sensitive permissions as sensitive APIs to be selected.

[0010] Furthermore, a logistic regression classification model is used in combination with an information gain rate statistical method to construct a streamlined sensitive API set, including: using a logistic regression classification model to screen the sensitive APIs to be selected to obtain a logistic regression sensitive API subset; using an information gain rate statistical method to screen the sensitive APIs to be selected to obtain an information gain rate API subset; taking the intersection of the two API subsets to obtain a streamlined sensitive API set.

[0011] Furthermore, a logistic regression classification model is used to screen the sensitive APIs to be selected, including:

[0012] Use the logistic regression classification model to calculate the contribution value of the selected sensitive APIs. When calculating the contribution value, optimize the weight and bias terms by minimizing the cross entropy loss function, introduce a positive class penalty factor to give a greater weight to malicious samples, and add an elastic network regularization rule to correct the logistic regression classification model to prevent overfitting of the model.

[0013] The calculated contribution value is converted into a sensitivity score; sensitive APIs are screened according to the obtained sensitivity score, a first sensitive API list is screened from the list of candidate sensitive APIs, the obtained first sensitive API list and the corresponding first sensitive score are saved, and a logistic regression sensitive API subset is obtained.

[0014] Furthermore, the information gain rate statistical method is used to screen the sensitive APIs to be selected, including:

[0015] Calculate the target entropy and conditional entropy of the sensitive API to be selected; calculate the information gain of the feature according to the target entropy and conditional entropy; calculate the split information corresponding to the information gain; calculate the information gain rate according to the information gain and the split information; convert the calculated information gain rate into a sensitivity score; filter the sensitive API according to the obtained sensitivity score, filter out a second sensitive API list from the list of sensitive APIs to be selected, save the obtained second sensitive API list and the corresponding second sensitive score, and obtain an information gain rate sensitive API subset.

[0016] Furthermore, the sensitivity scores obtained by logistic regression classification and information gain rate statistics were normalized.

[0017] Furthermore, the sensitive API construction method for malware detection also includes validating the reduced sensitive API set, including: feature vector-based detection and function call graph-based detection.

[0018] In a second aspect, a computer program product is provided, including a computer program / instruction, which, when executed by a processor, implements the steps of the sensitive API construction method for malware detection described in the first aspect.

[0019] In a third aspect, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the sensitive API construction method for malware detection as described in the first aspect of claim.

[0020] It can be seen from the above technical solution that the beneficial technical effects of the present invention are as follows:

[0021] 1. Although the streamlined sensitive API set constructed has significantly reduced the number of original sensitive APIs, its effectiveness in identifying malware is still retained, with an accuracy rate of over 90%.

[0022] 2. When constructing a streamlined set of sensitive APIs, the advantages of both logistic regression classification and information gain rate statistics are combined to retain features that are considered important in both methods. This can improve the accuracy of screening and ensure that the selected sensitive APIs have strong statistical correlation and can significantly improve the classification effect in model training. This can effectively avoid selecting features that only perform well under a certain method but may not be useful in the actual model, thereby reducing the risk of misselection. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the prior art description. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0024] Figure 1 This is a flow chart of a sensitive API construction method and a validity verification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following embodiments of the technical solution of the present invention are described in detail in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and are therefore only used as examples, and cannot be used to limit the protection scope of the present invention.

[0026] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by those skilled in the art to which the present invention belongs.

[0027] Example

[0028] This embodiment provides a sensitive API construction method for malware detection, such as Figure 1 As shown, the following steps are included:

[0029] Step 1: Collect and annotate Android software samples to obtain multiple APK files

[0030] Obtain a broad set of Android software samples from public data sources such as AndroZoo, Drebin, and Google Play, and derive multiple APK files to ensure a diverse range of sample types are covered.

[0031] To facilitate subsequent experiments and classification analysis, VirusTotal is used to determine accurate labels for each APK file. For example, the label can be annotated as "benign" or "malicious".

[0032] Step 2: Reverse extraction of static features from multiple APK files

[0033] Decompile and parse each APK (Android application package) file, extract API call information and function call relationships, and derive static features

[0034] In a specific implementation manner, the manner of decompiling and parsing each APK file is not limited and may be implemented in any achievable manner in the prior art, such as using Androguard; Androguard can parse the DEX file in the Android application and generate a code structure corresponding to the Smali file; by analyzing the Smali file, Androguard can identify the definition, calling relationship and basic opcode of each method, and then extract the API call information and construct a function call graph (FCG).

[0035] In some embodiments, Androguard first loads the APK file and parses the DEX file therein. The DEX file contains the bytecode information of the Android application, including all classes, methods, fields and their calling relationships. Androguard uses the internal DEX file parser to parse the classes and methods one by one, identify the start and end structure of each method, and then extract which APIs are called in the APK and obtain the API calling information.

[0036] During the parsing of the method body, Androguard identifies and extracts opcode sequences, especially function call instructions (such as invoke-virtual, invoke-static, invoke-direct, etc.), which are used to call other methods or functions and are the key to building call relationships. When Androguard encounters an invoke-* instruction, it extracts information such as the class name, method name, and parameter types of the called method to determine the call relationship between the current method (caller) and the target method (callee).

[0037] After extracting the calling relationships between all methods, Androguard regards each method as a node in the graph and the calling relationships as directed edges between nodes. Whenever a method calls another method, a directed edge is established between the caller and the callee, representing the call path. By traversing the calling relationships of all classes and methods in the application, Androguard generates the function call graph (FCG) of the entire application, and the static feature extraction is completed. The static features extracted in this step are the basis for subsequent analysis.

[0038] Step 3: Build a list of sensitive APIs to be selected

[0039] The mapping relationship between sensitive permissions and official APIs is collected to determine which APIs are related to sensitive permissions; then these APIs related to sensitive permissions are marked as sensitive APIs to be selected.

[0040] In this embodiment, sensitive APIs are defined as system APIs related to sensitive permissions. In this step, sensitive permissions marked as "Dangerous" are first collected from the Android official website, and then the mapping relationships between multiple sensitive permissions and APIs (such as AXplore, PSCout, SuSi, etc.) are collected. By comprehensively analyzing these mapping relationships, all API sets corresponding to sensitive permissions are extracted. In this embodiment, a total of about 50,000 sensitive APIs to be selected are obtained.

[0041] This step can obtain a list of sensitive APIs to be selected.

[0042] Step 4: Use the logistic regression classification model combined with the information gain rate statistical method to build a streamlined sensitive API set

[0043] Since the number of sensitive APIs collected for selection is large, it is difficult to use them further. For example, if the frequency of sensitive API calls is used as a feature, the resulting data dimension will be very large, resulting in excessive consumption of computing resources. Considering that sensitive APIs are usually linked to sensitive behaviors, their calls should be significantly different in benign and malicious samples, so they can be screened based on existing samples to obtain a streamlined set of sensitive functions for subsequent processing.

[0044] In this embodiment, the selected sensitive APIs are screened using the logistic regression classification model and the information gain rate statistical method in combination with the API call information in the static features obtained in step 2. After the respective API subsets are obtained, the intersection of the two API subsets is taken as the final streamlined sensitive API set. The details are as follows:

[0045] 1. Use the logistic regression classification model to screen the sensitive APIs to be selected and obtain the logistic regression sensitive API subset

[0046] The Logistic regression classification model is a simple and efficient binary classification algorithm. After training, the model can quantify the contribution of each API to the classification. Sensitive APIs can be screened based on the contribution value. In this embodiment, the contribution value is the regression coefficient of the logistic regression, that is, the calculated weight information. In this embodiment, the Logistic regression classification model is used to calculate the weight information of the selected sensitive APIs. The calculation formula is as follows:

[0047]

[0048] In the above formula, p = (y = 1 | X) is the probability that the sample belongs to the malicious category; X is an input matrix with the shape of the total number of samples and the number of sensitive APIs to be screened. Each row of the input matrix is ​​the API call frequency of a sample, and each column represents the call frequency of an API; w is the weight vector of each API, indicating its influence on the classification result; b is the bias term, which is used to adjust the overall offset of the model output; σ (z) is the Sigmoid function, which converts the output of the linear model into a probability value; e represents a natural constant. In the calculation, the labels of benign samples and malicious samples are y = 0 and y = 1 respectively.

[0049] In some embodiments, the Logistic regression classification model optimizes the weight w and the bias term b by minimizing the cross entropy loss function, which is calculated as follows:

[0050]

[0051] In the above formula, w is the optimization weight, b is the bias term, and y is i Represents the labels of benign samples and malicious samples, p i Indicates the probability that the sample belongs to the malicious category.

[0052] When using the above formula to optimize the weight w and bias term b, considering that the number of malicious samples in the samples used to screen sensitive APIs is significantly less than the number of benign samples, in order to weaken the impact of the class imbalance problem, a positive class penalty factor is introduced to give malicious samples a greater weight. The weight of the category is automatically adjusted according to the number of samples. The calculation formula of the positive class penalty factor is as follows:

[0053]

[0054] In the above formula, N is the total number of samples, c is the number of categories, and here the value is 2, n i is the number of samples of category i. After introducing the penalty factor, the loss function becomes:

[0055]

[0056] In the above formula, weight i The weight information calculated for sample i.

[0057] At the same time, in some embodiments, in order to control the complexity of the Logistic regression classification model and prevent the model from overfitting, regularization rules are added to the model to correct the model. There are two types of regularization rules: L1 regularization will directly compress unimportant weight information to 0, retain features that have a greater impact on classification, and facilitate the screening of APIs that have a more significant impact on classification results; the use of L2 regularization can prevent the weight from being too large and improve the stability of the model. In this embodiment, the elastic network regularization that combines the advantages of L1 and L2 regularization is used to correct the model. The calculation formula of the elastic network regularization R(w) is as follows:

[0058]

[0059] In the above formula, λ=1 / c represents the regularization strength, α represents the proportional coefficient controlling L1 and L2; ||w|| 1 is the result of the L1 regularization rule, ||w|| 2 2 is the result of the L2 regularization rule, w j Represents weight.

[0060] Finally, the loss function combined with elastic net regularization is:

[0061]

[0062] In the above formula, N is the total number of samples, weight i is the weight information calculated for sample i, y i Represents the labels of benign samples and malicious samples, p i represents the probability that the sample belongs to the malicious category, λ=1 / c represents the regularization strength, and α represents the proportional coefficient controlling L1 and L2; ||w|| 1 is the result of the L1 regularization rule, ||w|| 2 2 It is the result of the L2 regularization rule. Using this loss function, the penalty factor and regularization can be combined to weaken the impact of class imbalance in the sample data, while limiting the size of the weight to prevent the model from overfitting due to excessive focus on the minority class.

[0063] After obtaining the contribution value of each API, in order to facilitate subsequent further screening and processing, the contribution value is converted into the first sensitivity score between [0,1]. The calculation formula of the first sensitivity score is as follows:

[0064]

[0065] In the above formula, w max is the maximum contribution value.

[0066] Sensitive APIs are screened according to the obtained first sensitivity score, and sensitive APIs with first sensitivity scores greater than 0 are screened out from the candidate sensitive API list to obtain a first sensitive API list; the obtained first sensitive API list and the corresponding sensitivity scores are saved to obtain a logistic regression sensitive API subset.

[0067] 2. Use the information gain rate statistical method to screen the sensitive APIs to be selected and obtain the information gain rate API subset

[0068] Information gain rate is an algorithm based on information entropy, which is used to evaluate the relationship between features and target variables, and is particularly suitable for the selection of discrete features. It measures the amount of information provided by the feature to determine its contribution to the classification, and further penalizes features with more values, thereby obtaining a fairer evaluation index. In this embodiment, when using the information gain rate statistical method to screen the sensitive APIs to be selected, the target entropy H(y) of the sample data is first calculated, and the calculation formula is as follows:

[0069]

[0070] In the above formula, pi represents the probability of each possible value of the target label y.

[0071] Next, the conditional entropy of the candidate sensitive API is calculated to measure the uncertainty of the target label under given features. The formula for calculating the conditional entropy is:

[0072] H(y|X j )=∑P(X j =k)H(y|X j =k)

[0073] In the above formula, y represents the target label, X j represents the feature, and k represents the possible value of the feature.

[0074] After obtaining the target entropy and conditional entropy, the information gain Gain of the feature is calculated as follows:

[0075] Gain(X j )=H(y)-H(y|X j )

[0076] Information gain may be biased towards features with more values, so after obtaining the information gain, the split information corresponding to the information gain is calculated. The split information measures the complexity of the feature's own distribution and is used to penalize features with more values. It can correct features that are biased towards information gain. The calculation formula for the feature split information Split is as follows:

[0077]

[0078] In the above formula, k is the possible value of the feature, P(X j = k) is the feature X j The probability of taking the value k.

[0079] After obtaining the information gain and split information, calculate the corresponding information gain rate, and use the information gain rate GainRatio as the final screening indicator to eliminate the bias of the number of feature values ​​on the screening results. The calculation formula of the information gain rate is as follows:

[0080]

[0081] In the above formula, Gain represents information gain, Split represents split information, and X j Indicates characteristics.

[0082] After obtaining the information gain rate of each API, it is also converted into the corresponding sensitivity score and calculated using the following formula:

[0083]

[0084] Sensitive APIs are filtered according to the obtained second sensitivity score, and sensitive APIs with second sensitivity scores greater than 0 are filtered out from the list of candidate sensitive APIs to obtain a second sensitive API list; the obtained second sensitive API list and the corresponding sensitivity scores are saved to obtain an information gain rate sensitive API subset.

[0085] 3. Take the intersection of the two API subsets to get the final streamlined sensitive API set

[0086] After using the two methods to screen and obtain their respective API subsets, the intersection of the two API subsets is taken as the final streamlined sensitive API set. The streamlined sensitive API set constructed in step 4 combines the advantages of the two methods of logistic regression classification and information gain rate statistics. Specifically, the information gain rate pays more attention to the global statistical characteristics and is easy to select those features with special distribution or large noise influence; logistic regression can better capture the interaction effect between features through optimization during the training process, but if it relies too much on certain unstable features, it may lead to overfitting. By taking the intersection of the two API subsets, those features that are considered important in both methods are retained. This can improve the accuracy of screening and ensure that the selected sensitive APIs have strong statistical correlation and can significantly improve the classification effect in model training. It can effectively avoid selecting those features that only perform well under a certain method but may not be useful in the actual model, thereby reducing the risk of misselection.

[0087] In this example, the two methods of logistic regression classification and information gain rate statistics were combined to finally construct a streamlined sensitive API set with 3,885 sensitive APIs, which is a significant decrease compared to the original set of more than 50,000 sensitive APIs.

[0088] In some embodiments, to facilitate further screening of APIs, the sensitivity scores obtained by logistic regression classification and information gain rate statistics may be normalized, and the calculation formula is as follows:

[0089]

[0090] Step 5: Verify the effectiveness of the reduced sensitive API set

[0091] After the above steps are used to construct a streamlined sensitive API subset, in order to verify that the subset can effectively characterize the malicious behavior of malware while reducing the size of the set, the malware is detected using the current static features related to APIs. The static features related to APIs include API call information and function call graphs. Then, experiments are conducted on different data sets, as follows:

[0092] Experiments were conducted on CICAndMal2017, AndroZoo_2016, and AndroZoo_2017, with each dataset divided into 8:2, with the larger portion used as the training set and the smaller portion used as the test set. First, the number of sensitive API statistics was used as a feature, and the detection results obtained based on the simplified sensitive API set are shown in Table 1:

[0093] Table 1 Detection results obtained by using API statistics as features

[0094]

[0095] In Table 1, each dataset is tested using different detectors. The purpose is to measure the performance of the feature vectors obtained based on the reduced sensitive API set on different classifiers to illustrate its effectiveness. An API may be used in multiple forms in an APK, so the corresponding API feature vector can be constructed using the count features of the sensitive API. As can be seen from Table 1, malware can still be effectively detected based on the obtained API feature vectors. Using Rf as a detector on CICAndMal2017 can achieve an accuracy of 94%; using XGBoost as a detector on AndrZoo_2016 can achieve an accuracy of 97%; using Rf and XGBoost on AndrZoo_2017 can achieve an accuracy of 97%.

[0096] Then, the function call graph is used as a feature to conduct experiments on the same data set. Since there are too many nodes in the function call graph directly obtained, direct use will bring huge computational overhead. In this embodiment, some processing is performed on the function call graph, which specifically includes the following steps: First, the non-system API nodes in the call graph are uniformly abstracted as "SelfDefined" nodes to reduce the interference of user-defined nodes. Then, based on the streamlined sensitive API set, the sensitive API nodes in each FCG are located. For multiple connected components in each function call graph, the connected components that do not contain sensitive functions are not processed; for connected components containing sensitive functions, the sensitive API node is taken as the center, and the calling relationship of the 2 layers around the sensitive API node is retained through the neighborhood expansion method. Specifically, by traversing the sensitive API nodes, the calling relationships of these nodes and the 2 layers around them are retained, and other nodes and edges that are not within this range will be removed, thereby obtaining a simplified sensitive function call graph (SFCG). If a connected component becomes multiple subgraphs before and after simplification, a "SelfDefined" node is used to connect the nodes with zero in-degree in these subgraphs to ensure the connectivity of the subgraphs.

[0097] In order to classify the topological graph, the call graph needs to be converted into the corresponding graph embedding vector. GraphSAGE is used to combine the call graph and the node embedding information of the graph. It contains three hidden layers and an average pooling layer to convert topological graphs of different sizes into vectors of equal length. GraphSAGE transmits information through the neighbors of local sampled nodes, thus avoiding the limitation of processing the entire graph. Finally, different machine learning models are used for detection based on the obtained graph embedding vector. The detection results are shown in Table 2.

[0098] Table 2 Classification results using call graph as features

[0099]

[0100]

[0101] As can be seen from Table 2, using the reduced sensitive API set to simplify the original call graph to obtain the sensitive function subgraph, the graph embedding vector constructed by the subgraph can still effectively identify malware. Using Rf as a detector on CICAndMal2017 can achieve an accuracy of 92%; using XGBoost as a detector on AndrZoo_2016 can achieve an accuracy of 91%; using Rf and XGBoost on AndrZoo_2017 can achieve an accuracy of 92%.

[0102] From the above experiments, it can be seen that the streamlined sensitive API set constructed using this embodiment has an accuracy rate of over 90% in identifying malware. This shows that although the constructed streamlined sensitive API set has a significantly reduced number of sensitive APIs compared to the original ones, its effectiveness in identifying malware is still retained.

[0103] This embodiment also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the sensitive API construction method for malware detection described above.

[0104] This embodiment also provides an electronic device, including: one or more processors; a storage device for storing one or more programs; when the one or more programs are executed by one or more processors, the one or more processors implement the steps of the sensitive API construction method for malware detection described above.

[0105] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A sensitive API construction method for malware detection, characterized in that: include: Collect and annotate Android software samples to obtain multiple APK files; Reversely extract static features from multiple APK files, where the static features include API call information; Build a list of sensitive APIs to be selected based on static features; According to the list of candidate sensitive APIs, a streamlined sensitive API set is constructed by using a logistic regression classification model combined with an information gain rate statistical method and the API call information.

2. The sensitive API construction method for malware detection according to claim 1, characterized in that: Reverse extraction of static features from multiple APK files, including: decompiling and parsing each APK file, extracting API call information and function call relationships, and obtaining static features.

3. The sensitive API construction method for malware detection according to claim 1, characterized in that: Build a list of sensitive APIs to be selected, including: Collect the mapping relationship between sensitive permissions and official APIs, and determine which APIs are related to sensitive permissions; Mark APIs related to sensitive permissions as candidate sensitive APIs.

4. The sensitive API construction method for malware detection according to claim 1, characterized in that: A logistic regression classification model combined with information gain rate statistical method is used to construct a streamlined sensitive API set, including: Use the logistic regression classification model to screen the sensitive APIs to be selected and obtain the logistic regression sensitive API subset; Use the information gain rate statistical method to screen the sensitive APIs to be selected and obtain the information gain rate API subset; Take the intersection of the two API subsets to get the reduced sensitive API set.

5. The sensitive API construction method for malware detection according to claim 4, characterized in that: Use a logistic regression classification model to screen sensitive APIs, including: Use the logistic regression classification model to calculate the contribution value of the selected sensitive APIs. When calculating the contribution value, optimize the weight and bias terms by minimizing the cross entropy loss function, introduce a positive class penalty factor to give a greater weight to malicious samples, and add an elastic network regularization rule to correct the logistic regression classification model to prevent overfitting of the model. Convert the calculated contribution value into a sensitivity score; Sensitive APIs are screened according to the obtained sensitivity scores, a first sensitive API list is screened from the candidate sensitive API list, the obtained first sensitive API list and the corresponding first sensitivity scores are saved, and a logistic regression sensitive API subset is obtained.

6. The sensitive API construction method for malware detection according to claim 4, characterized in that: Use the information gain rate statistical method to screen the sensitive APIs to be selected, including: Calculate the target entropy and conditional entropy of the candidate sensitive API; Calculate the information gain of the feature according to the target entropy and the conditional entropy; Calculating the splitting information corresponding to the information gain; Calculate the information gain rate based on information gain and split information; Convert the calculated information gain rate into a sensitivity score; Sensitive APIs are screened according to the obtained sensitivity scores, a second sensitive API list is screened from the list of candidate sensitive APIs, the obtained second sensitive API list and the corresponding second sensitivity scores are saved, and an information gain rate sensitive API subset is obtained.

7. The sensitive API construction method for malware detection according to claim 5 or 6, characterized in that: The sensitivity scores obtained by logistic regression classification and information gain rate statistics were normalized.

8. The sensitive API construction method for malware detection according to claim 1, characterized in that: It also includes validating the reduced sensitive API set, including: feature vector-based detection and function call graph-based detection.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the sensitive API construction method for malware detection described in any one of claims 1-8 are implemented.

10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the sensitive API construction method for malware detection as described in any one of claims 1-8.

Images