Method for detecting unknown Android malicious application based on behavior characteristic text embedding and transfer learning

Abstract

The invention relates to an unknown Android id malicious application detection method based on behavior feature text embedding and transfer learning. The method comprises the following steps: collecting a real world unknown malicious software data set and an existing public data set; extracting permission, API calling and URL features; generating behavior description features in combination with a preset behavior description template; the behavior description features are embedded; removing non-malicious behaviors in malicious software behavior description characteristics in combination with similarity measurement; training an LSTM neural network by using an existing data set, and performing generalization ability enhancement on the model in combination with L1 regularization and a stacked auto-encoder; inputting an unknown malicious software data set into the model for detection; and repeating multiple iterations to obtain a final prediction effect. According to the method, behavior feature text embedding and transfer learning are used, NLP is combined, and the robustness of unknown malicious software classification can be remarkably improved by enhancing the generalization ability of a model trained by an existing data set.

Description

Technical Field

[0001] The present invention relates to the field of application detection methods, and in particular to a detection method for unknown Android malicious applications based on behavior feature text embedding and transfer learning. Background Art

[0002] Android malware is a major threat to the security of mobile devices. It not only threatens the personal privacy and financial security of users, but also causes problems such as device performance degradation, system crashes, and remote control of devices. For example, in 2021, the implementation of an important pipeline in the United States was attacked by the latest ransomware, and the entire pipeline operation was eventually shut down at high financial losses. As of now, the total number of Android malware has reached 35,083,006, and new malware has increased by 631,716 during 2024. While the number of new malware is showing a significant growth trend, a large number of malware that is still unknown to many existing detectors has emerged in the real world. Therefore, how to effectively detect unknown malware in the real world is an urgent problem to be solved.

[0003] In the field of Android malware detection, many research works have proposed detection methods with excellent effects based on recognized data sets. However, unknown malware continues to emerge in the real world, and the detection efficiency of these methods is at risk of failure. Unknown malware exists in the real world, and it is knowledge that the detector has never learned. Chen et al. found that after training a malware classifier with one year of data, the F1 value of the classifier dropped rapidly from 0.99 to 0.76 after 6 months of deployment in the face of new test samples. In order to simulate this scenario, the present invention collects real-world software datasets and ensures that the data in the dataset has not been learned by the model. At the same time, the application strategy of transfer learning provides a novel idea for identifying unknown malware in the real world. The core is to regard the malware detection model built based on the existing dataset as a source domain, and the detection task for unknown applications as a target domain, during which transfer learning technology can be used to effectively utilize the knowledge and experience of the source domain. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a detection method for unknown Android malicious applications based on behavioral feature text embedding and transfer learning in view of the above shortcomings.

[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0006] A method for detecting unknown Android malicious applications based on behavioral feature text embedding and transfer learning, characterized by comprising the following steps:

[0007] Step 1: Establish a malicious application sample data set and a benign application sample data set;

[0008] Step 2: Extract features for each APK sample in the dataset. The extracted features include permission information, API call records, and URL features in the source code.

[0009] Step 3: Set the behavior description template, insert the permission information, API call records, and URL features in the source code extracted in the previous step, and the official interpretable text of the corresponding permissions and API calls into the behavior description template to generate behavior description features;

[0010] Step 4: The behavior description features of all samples are embedded in text through the pre-trained embedding model BGE;

[0011] Step 5: Calculate the dot product similarity between the text after each malicious sample is embedded and the text after all benign samples are embedded, select the benign sample with the highest dot product similarity as the most similar sample, remove the benign behavior description features corresponding to the most similar sample from the behavior description features of each malicious sample, and obtain the processed malicious application sample data set;

[0012] Step 6: Establish an optimized LSTM classification model, and use the processed malicious application sample data set obtained in the previous step and the benign application sample data set in step 1 to train the optimized LSTM classification model to obtain a trained malicious application detection model. The loss function of the optimized LSTM classification model adopts the loss function after L1 regularization.

[0013] Step 7: Input the application to be detected into the malicious application detection model, and the model outputs the detection result.

[0014] Furthermore, the extraction method in step 2 specifically comprises the following steps:

[0015] Step 2-1, use Apktool to decompile the APK file, obtain the permissionandroid:name information in the Manifest.xml file of the original APK file as the permission feature of the APK file, and remove redundant fields and symbols for the permission feature;

[0016] Step 2-2: Use Apktool to decompile the obtained classes.dex file, extract the API call features and URL features of the APK, and when extracting the API call features, remove non-semantic or irrelevant API calls and retain only meaningful API call information.

[0017] Furthermore, the step 3 specifically includes the following steps:

[0018] Step 3-1, establish a behavior description template, and construct a suitable context for the features representing the application behavior in the template;

[0019] Step 3-2: Obtain interpretable instructions related to permissions and API calls according to the official developer documentation;

[0020] Step 3-3: Match the extracted features with the corresponding explainable descriptions one by one, and input them into the behavior description template established in step 3-1 to generate a complete behavior description feature.

[0021] Furthermore, the step 4 specifically includes the following steps:

[0022] Step 4-1: Input the behavior description features in the known data set into the pre-trained embedding model BGE to convert text embedding into vectors. The text embedding process formula is expressed as: is a known data set, x i represents the i-th sample in the dataset, N is the total number of samples, and the pre-trained embedding model BGEM is used to embed x i Convert to vector representation v i :v i =M(x i )for all i=1,2,…,N;

[0023] Step 4-2: Calculate the text similarity of the samples after text embedding, where the malware sample set is It contains M malware samples and the benign software sample set is It contains B benign software samples. For any pair of malware samples and benign software samples The dot product similarity between them is defined as: The most similar malware and benign software pairs are obtained based on the calculated similarity;

[0024] Step 4-3: For the most similar sample pair obtained in step 4-2, the behavior description features of each malware are compared with the corresponding most similar benign software, and the benign behavior description features corresponding to the most similar benign software in the behavior description features of the malicious sample are eliminated.

[0025] Furthermore, in step 5, the malicious application sample data set obtained after processing in the previous step and 20% of the samples in the benign application sample data set in step 1 are first input into the multi-layer stacked autoencoder neural network for sample reconstruction to obtain the reconstructed data set, and then the optimized LSTM classification model is trained together with other unreconstructed data sets.

[0026] The beneficial effects of the present invention are:

[0027] (1) The present invention adopts a training method that enhances the generalization ability of the model to combat unknown Android malware;

[0028] (2) The present invention designs and implements a feature optimization and enhancement method based on NLP, which converts features into vector expressions by using text embedding technology, and further implements filtering of easily obfuscated features of malware by using a text similarity measurement algorithm, which significantly reduces the resources used for feature extraction and extracts more representative features, thereby improving the detection effect of the model;

[0029] (3) The present invention designs and implements a behavior description template, which better integrates static features into a complete and comprehensive natural language text, and finally generates behavior description features;

[0030] (4) The present invention uses L1 regularization and stacked autoencoders to enhance the generalization ability of the model. The introduction of L1 regularization in model training can effectively make the model show strong dependence on a few key features when facing unknown malware in the real world, rather than relying on all features. SAE consists of multiple autoencoders, and the hidden layer of each autoencoder serves as the input layer of the next autoencoder, forming a multi-layer structure, and each layer can extract different features of the data. .

[0031] (5) A novel method based on behavioral feature text embedding and an improved transfer learning model is proposed to detect unknown Android malware in the real world. This method extracts permissions, API calls, and URLs from the target application to capture its behavior, and maps the behavioral features into natural language descriptions by combining the behavioral features with a tailored behavioral description template. This method encodes the behavioral description of the target application based on text embedding and calculates the semantic similarity of the feature text to further extract key features that affect the detection results. In order to enhance the robustness of the model to real-world unknown malware, this method integrates transfer learning and adopts L1 regularization in the training phase.

[0032] The present invention is described in detail below with reference to the accompanying drawings and examples. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flowchart of a method for detecting unknown Android malicious applications based on behavioral feature text embedding and improved transfer learning according to the present invention;

[0034] Figure 2 Building processes for data;

[0035] Figure 3 Generate flow charts for behavioral characterization;

[0036] Figure 4 Flowchart for eliminating malware that easily confuses benign behavior;

[0037] Figure 5 Flowchart for unknown malware detection based on model optimization;

[0038] Figure 6 This is a diagram of a behavior description template. DETAILED DESCRIPTION

[0039] The principles and features of the present invention are described below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0040] The present invention provides a detection method for unknown Android malicious applications based on behavioral feature text embedding and improved transfer learning. When the Android malware is not learned by the model, by generating behavioral description feature features and optimizing the features using NLP, a deep learning model is adopted in combination with an L1 regularization method and a stacked autoencoder, an Android unknown malware detection model of the present invention is obtained to predict whether an Android application is malware.

[0041] In order to make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions used in the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the present invention. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0042] The present invention provides a detection method for unknown Android malicious applications based on behavioral feature text embedding and improved transfer learning. The flow chart is as follows: Figure 1 As shown, including:

[0043] S1: Dataset collection;

[0044] In step S1, the present invention adopts an authoritative data set and a collected unknown malware data set, and finally constructs two data sets. The present invention names these two data sets as known data sets and unknown data sets, respectively. The known data set uses the Androzoo tool to collect 6,700 samples that appeared in the application market from 2020 to 2023, including 3,000 benign samples and 3,700 malware samples; at the same time, the present invention randomly collected an unknown data set, which includes 422 benign software and 615 malware. The present invention ensures that these software do not appear in the known data set. In addition, when labeling, the present invention will regard software with a malicious threat greater than 4 in VirtusTotal as malware according to the standard, and software with a malicious threat less than 4 as benign software.

[0045] S2: extract permissions, API calls, and URL features;

[0046] In order to extract features, the present invention uses the Apktool tool to decompile the APK file to obtain the Manifest.xml file containing the basic information of the APK. The Manifest.xml file contains the permission information of the APK. It is necessary to read the file and save the permission features to the corresponding txt; in order to delete the redundant fields in the permission features, it is necessary to first read the txt file corresponding to each APK that saves the permission information, use the common string replace method to replace the "android.permission." and "com.android.launcher.permission." fields with empty and convert the remaining permission information to lowercase; at the same time, the present invention uses the ApkTool tool to extract the API call features of the program and the URLs in the program source code. Among them, the API call features need to retain their class name, return value, and parameter information. In addition, all the features are stored in the permission.txt, api.txt, and url.txt files under the APK name directory.

[0047] S3: Generate behavior description features through behavior description template;

[0048] First, this step requires entering the Android developer's official website to obtain the description information of the permissions and the behavior logic description information of the API based on the permissions and API names. Then, the present invention designs a behavior description template, which integrates permissions, API calls, explainability information, and URLs. Specifically, the behavior description feature is a semantic-level feature that describes the behavior of an application. From the perspective of malware analysts, they can determine whether the application is malicious by analyzing the application behavior description. When an application wants to execute an API call, it needs to apply for relevant permissions. Based on this operating logic, the present invention first represents the logical order of permissions and associated API calls as a part. Then, the present invention constructs a suitable context in the template for features that represent application behavior. Not all API call features have behavior description information in official documents. The present invention inserts the parameters and return values ​​of these API calls into the template. In addition, the URL does not have specific description information, but considering that malware developers will put botnets into the source code, the present invention combines URL features in the template. Such as Figure 6 shown.

[0049] S4: Combine similarity metrics to eliminate non-malicious behaviors from malware behavior description features.

[0050] In order to perform similarity measurement and input it into the neural network training model, the behavior description features need to be embedded in text. The present invention uses the BGE pre-trained model to embed the behavior description features in text. The process can be expressed by a simple formula. is a known data set, x i Represents each sample in the dataset, and uses the pre-trained embedding model BGEM to embed x i Convert to vector representation v i :v i =M(x i )for all i=1,2,…,N. However, in the real world, some malware has highly similar behavior logic to benign software. These malware will imitate the interface and functions of benign software to deceive users to download and install. Therefore, we design an algorithm to remove easily confused benign behaviors in malware with high similarity to benign software. Suppose the malware sample set is Contains M malware samples, and the benign software sample set is Contains B benign software samples. For any pair of malware samples and benign software samples The dot product similarity between them is defined as: The most similar malware and benign software pairs are obtained by calculating the similarity. Based on the sample pairs of the similarity measure, the malware is further compared with its most similar benign software, and similar benign behaviors in the malware are deleted.

[0051] S5: Use L1 regularization and stacked autoencoders to optimize models trained on existing datasets.

[0052] In order to detect unknown malware, the present invention focuses on optimizing the generalization ability of the model. When training the model, the data set selected by the present invention is a known data set. In addition, the neural network used in the present invention is an LSTM neural network, which can pay attention to the contextual information of the behavior description features. In order to build the neural network, it is necessary to configure the correct torch environment and load the model. The present invention aims to achieve the malware classification task and selects binary cross entropy as the loss function during training:

[0053]

[0054] Among them, L represents the loss function, L represents the number of samples, and y i represents the true label of the i-th sample, p i It indicates the probability that the model predicts that the i-th sample is a positive class.

[0055] In order to enhance the generalization ability of the model, the present invention adds L1 regularization when training the model. Regularization constrains the complexity of the model by introducing an additional penalty term in the loss function, thereby improving the generalization ability of the model. L1 regularization adds a penalty term of the sum of the absolute values ​​of the weights in the loss function, so that some weights tend to zero. Therefore, the final loss function of the present invention is:

[0056]

[0057] In addition, the present invention enhances the generalization ability of the model by increasing the richness of samples. As a model architecture based on neural networks, the autoencoder realizes the compression and subsequent decompression process of data by learning feature vectors. The stacked encoder is composed of multiple autoencoders, and the hidden layer of each autoencoder serves as the input layer of the next autoencoder to form a multi-layer structure, and each layer can extract different features of the data. Therefore, the present invention selects 20% of the existing data set in the feature vector to reconstruct it and input it into the model for training. The present invention is optimized and adjusted during the training process, and the recommended parameters are finally obtained as shown in Table 1. After comparing different parameter experiments, it is found that the detection obfuscated malware model uses L1 regularization combined with binary cross loss function, the batch size is 62, the learning rate is defined as 1e-5, and the training rounds are 50.

[0058] Table 1 LSTM training parameters

[0059]

[0060]

[0061] In order to make the dataset simulation scenario of the present invention more realistic, the present invention randomly divides the extracted features into a training set and a test set with a ratio of 8:2, and then randomly selects the sample features in the dataset for uploading and training. After multiple rounds of training, the gradient of the unknown malware detection model is obtained.

[0062] S6: Combine transfer learning with unknown malware to verify its effectiveness.

[0063] In order to verify the detection effect of the model of the present invention on unknown malware, we combined the transfer learning method and regarded the model trained with the existing data set as the source model. At the same time, the present invention also inputs the unknown data set into the source model for evaluation after steps such as feature extraction. The evaluation indicators of the model are Accuracy, Precision, Recall and F1-score. The specific formula is:

[0064]

[0065] Among them, TP (true positive examples) is the number of samples predicted by the model to be positive examples and are actually positive examples; TN (true negative examples) is the number of samples predicted by the model to be negative examples and are actually negative examples; FP (false positive examples) is the number of samples predicted by the model to be positive examples but are actually negative examples; FN (false negative examples) is the number of samples predicted by the model to be negative examples but are actually positive examples.

[0066] Accuracy, Precision, Recall, and F1-score are important indicators used to evaluate model performance in the field of machine learning. Accuracy measures the accuracy of the model's predictions of all samples; Precision focuses on the proportion of samples predicted by the model as positive that are actually positive, reflecting the reliability of the prediction of positive examples; Recall focuses on the proportion of all true positive samples correctly predicted by the model, measuring the model's ability to find all true positive samples; and F1-score is the harmonic mean of Precision and Recall, which is used to balance the trade-off between the two and provides a comprehensive way to evaluate model performance.

[0067] The method provided by the present invention has the following advantages or beneficial technical effects:

[0068] Android malware is on the rise, posing a serious security threat to users' privacy and property. Many studies have achieved good detection results on known datasets, but the performance of these detectors is greatly reduced when facing malware that they have never learned. Our method can achieve better detection results when facing unknown malware, and our method has made a certain contribution to mobile network security threat detection.

[0069] The above is an example of the best implementation of the present invention, and the parts not described in detail are common knowledge of ordinary technicians in the field. The protection scope of the present invention shall be based on the content of the claims, and any equivalent transformation based on the technical enlightenment of the present invention is also within the protection scope of the present invention.

Claims

1. A detection method for unknown Android malicious applications based on behavioral feature text embedding and transfer learning, characterized in that: The following steps are involved: Step 1: Establish a malicious application sample data set and a benign application sample data set; Step 2: Extract features for each APK sample in the dataset. The extracted features include permission information, API call records, and URL features in the source code. Step 3: Set the behavior description template, insert the permission information, API call records, and URL features in the source code extracted in the previous step, and the official interpretable text of the corresponding permissions and API calls into the behavior description template to generate behavior description features; Step 4: The behavior description features of all samples are embedded in text through the pre-trained embedding model BGE; Step 5: Calculate the dot product similarity between the text after each malicious sample is embedded and the text after all benign samples are embedded, select the benign sample with the highest dot product similarity as the most similar sample, remove the benign behavior description features corresponding to the most similar sample from the behavior description features of each malicious sample, and obtain the processed malicious application sample data set; Step 6: Establish an optimized LSTM classification model, and use the processed malicious application sample data set obtained in the previous step and the benign application sample data set in step 1 to train the optimized LSTM classification model to obtain a trained malicious application detection model. The loss function of the optimized LSTM classification model adopts the loss function after L1 regularization. Step 7: Input the application to be detected into the malicious application detection model, and the model outputs the detection result.

2. According to claim 1, a detection method for unknown Android malicious applications based on behavioral feature text embedding and transfer learning is characterized in that: The extraction method in step 2 specifically comprises the following steps: Step 2-1, use Apktool to decompile the APK file, obtain the permissionandroid:name information in the Manifest.xml file of the original APK file as the permission feature of the APK file, and remove redundant fields and symbols for the permission feature; Step 2-2: Use Apktool to decompile the obtained classes.dex file, extract the API call features and URL features of the APK, and when extracting the API call features, remove non-semantic or irrelevant API calls and retain only meaningful API call information.

3. According to claim 1, a detection method for unknown Android malicious applications based on behavioral feature text embedding and transfer learning is characterized in that: The step 3 specifically comprises the following steps: Step 3-1, establish a behavior description template, and construct a suitable context for the features representing the application behavior in the template; Step 3-2: Obtain interpretable instructions related to permissions and API calls according to the official developer documentation; Step 3-3: Match the extracted features with the corresponding explainable descriptions one by one, and input them into the behavior description template established in step 3-1 to generate a complete behavior description feature.

4. According to the method for detecting unknown Android malicious applications based on behavioral feature text embedding and transfer learning according to claim 1, the step 4 specifically comprises the following steps: Step 4-1: Input the behavior description features in the known data set into the pre-trained embedding model BGE to convert text embedding into vectors. The text embedding process formula is expressed as: is a known data set, x i represents the i-th sample in the dataset, N is the total number of samples, and the pre-trained embedding model BGE M is used to embed x i Convert to vector representation v i :v i =M(x i ) for all i = 1, 2, ..., N; Step 4-2: Calculate the text similarity of the samples after text embedding, where the malware sample set is It contains M malware samples and the benign software sample set is It contains B benign software samples. For any pair of malware samples and benign software samples The dot product similarity between them is defined as: The most similar malware and benign software pairs are obtained based on the calculated similarity; Step 4-3: For the most similar sample pair obtained in step 4-2, the behavior description features of each malware are compared with the corresponding most similar benign software, and the benign behavior description features corresponding to the most similar benign software in the behavior description features of the malicious sample are eliminated.

5. According to the method for detecting unknown Android malicious applications based on behavioral feature text embedding and transfer learning described in claim 1, in step 5, the malicious application sample data set obtained after processing in the previous step and 20% of the samples in the benign application sample data set in step 1 are first input into a multi-layer stacked autoencoder neural network for sample reconstruction to obtain a reconstructed data set, and then the optimized LSTM classification model is trained together with other unreconstructed data sets.

Images