A method for identifying malicious app families based on multimodal feature fusion

Abstract

This invention relates to a method for identifying malicious app families based on multimodal feature fusion, belonging to the field of information security technology. The method preprocesses Android APKs, including unpacking and decompiling, to obtain bytecode files and smali code files. Bytecode image features, opcode sequence features, and control flow graph features are extracted respectively. Bytecode image features are extracted using an EfficientNetV2L convolutional neural network; opcode sequence features are extracted using the k-Shingles and SimHash algorithms; and control flow graph features are extracted using static analysis tools and capsule graph neural networks. The three features are then fused using low-rank multimodal methods, and a CNN-BiLSTM-Attention detection and classification model is constructed to identify and judge malicious app families. This invention improves the accuracy of identification and enhances the model's generalization ability.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a method for identifying malicious APP families based on multimodal feature fusion. Background Technology

[0002] In recent years, the number and types of malicious apps have exploded, and their spread and harm have been escalating. These malicious apps not only steal users' private information and spread malicious code, but may also launch cyberattacks, seriously threatening users' privacy and property security. Traditional malicious app detection methods mainly rely on signature matching and behavioral analysis, but they face problems such as difficulty in dealing with new types of malicious apps, high computational resource consumption, high false positive rates, and insufficient identification accuracy and generalization ability.

[0003] To address these issues, researchers have begun exploring the application of multimodal feature fusion techniques in malicious app detection. Multimodal feature fusion integrates feature information from different modalities, thus providing a more comprehensive characterization of the essential features of an app. In the field of malicious app detection, multimodal feature fusion can effectively improve recognition accuracy and generalization ability while reducing false positive rates. Currently, some researchers have attempted to combine features from multiple modalities to construct more complex and comprehensive malicious app identification models. These multimodal features encompass information from static to dynamic features, enabling a deeper exploration of the potential behavioral characteristics and patterns of malicious apps. However, existing multimodal feature fusion methods still have some problems, such as ineffective feature fusion methods and high model complexity, requiring further research and improvement. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a method for identifying malicious app families based on multimodal feature fusion.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A method for identifying malicious app families based on multimodal feature fusion, the method comprising the following steps:

[0007] S1: Data preprocessing, including using tools to unpack Android APK files and decompile DEX bytecode files;

[0008] S2: Bytecode image feature extraction. The bytecode file classes.dex obtained by unpacking the Android APK file is converted into an RGB image, and the EfficientNetV2L convolutional neural network is used to extract features to obtain bytecode image features.

[0009] S3: Opcode sequence feature extraction. The smali files in all directories obtained by decompiling the bytecode file classes.dex are extracted from the smali files. The opcodes are then mapped to the instructions using an opcode lookup table to obtain the opcode sequence of the method code block. The opcode sequences extracted from all method code blocks are concatenated to obtain the original opcode sequence of the Android application. The k-Shingles algorithm is then used to transform the original sequence into a shingle set, and the SimHash algorithm is used to map the shingle set into a signature vector, thus obtaining the opcode sequence features.

[0010] S4: Control Flow Graph Feature Extraction. From all the smali files in the directories obtained after decompiling classes.dex, a static analysis tool is used to extract the control flow graph from the smali code. Based on all the Dalvik instructions provided by the Android open-source project team, their nodes and edges are converted into vector representations that can be used as neural network inputs. Then, through a capsule graph neural network, the control flow graph feature vectors are obtained.

[0011] S5: Multimodal feature fusion. This involves low-rank multimodal fusion of bytecode image features, opcode sequence features, and control flow graph features. For the feature vectors of the three modalities—bytecode image features F1, opcode sequence features F2, and control flow graph features F3—the low-rank decomposition factor L between any two vectors is calculated. 12 L 13 L 23 The fused feature vector F is obtained. f =F1+F2+F3+L 12 +L 13 +L 23 ;

[0012] S6: Detection and classification model. Using a publicly available malicious APK dataset, the model dataset is obtained by filtering the labels and constructing a CNN-BiLSTM-Attention detection and classification model.

[0013] Furthermore, S2 specifically refers to:

[0014] The contents of the unpacked classes.dex file are read byte by byte into a byte array, and then divided into three-byte blocks, with each block corresponding to a pixel.

[0015] Based on the number of data blocks, the byte array is converted into an RGB image with the same length and width, and redundant bytes are discarded.

[0016] The resulting RGB images are resized to a uniform size and saved as PNG image files;

[0017] The pre-trained EfficientNetV2L convolutional neural network is used to extract features from RGB images, and the extracted image features are reduced to 512-dimensional feature vectors through a fully connected layer to obtain the bytecode image features F1.

[0018] Furthermore, S3 specifically refers to:

[0019] Traverse the smali files obtained by decompiling classes.dex, extract all instruction opcodes in the method code block of each smali file, and obtain the original opcode sequence.

[0020] The k-Shingles algorithm is used to map the extracted original opcode sequence to a set of k-Shingles, and then the SimHash algorithm is used to convert the set of k-Shingles into a 512-dimensional signature vector.

[0021] Furthermore, in step S3, extracting the original opcode sequence specifically involves:

[0022] For the `method` instruction in the smali file, unnecessary operand parts are ignored, and the opcode part of the instruction is retained to extract all instructions. The instructions are then mapped according to the Dalvik instruction lookup table provided by the Android open-source project team to obtain the opcode sequence of the method code block. Finally, the opcode sequences extracted from all `method` code blocks are concatenated to obtain the opcode sequence of the Android application.

[0023] Furthermore, in step S3, converting the original opcode sequence into a 512-dimensional signature vector specifically involves:

[0024] Based on all the Dalvik instructions provided by the Android open-source project team, the raw opcode sequence of an Android application is considered as a document consisting of 256 opcodes, with a document character set size of 256. A document is considered as a string, and k-Shingles are used to represent the document using a set of substrings. Let document d consist of N words, D = (w1, w2, ..., w...). N ), where w n Let n represent the nth word in document D, where n∈[1,N]; the k-shingle of a document is defined as any substring of length k in the document, i.e., the k-shingle is expressed as:

[0025] k-shingle=(w n w n+1 , ..., w n+k-1 )

[0026] Where n∈[1, N-k+1], the k-shingle set is used to represent the document; k is chosen as 4 to convert the opcode document into a set of opcode shingle substrings; a hash function is used to map all 4-shingle substrings in the opcode document to a hash bucket of five bytes, that is, the 4-shingle substrings are mapped to [0, 2]. 40 -1]; then the SimHash algorithm is applied to the k-Shingles set, let S = {S1, S2, ..., S...} n} is the set of k-Shingles derived from the original opcode sequence, where each S i It is an opcode of length 4, Shingle; for each S i Randomly generate a high-dimensional vector a i ∈R d Where d is a large dimension, 1024; define the accumulator vector A∈R d And initialize it as a zero vector; for each S in set S i , the corresponding vector a i Add to A:

[0027]

[0028] To obtain the SimHash signature, each dimension of A is quantized into a binary value by comparing it with a threshold of 0, using the following formula:

[0029] SimHash(A)=(sign(A1),sign(A2),…,sign(A d ))

[0030] Where sign(x) i ) is a sign function; when x≥0, sign(x) i When x < 0, sign(x) = 1. i ) = 0;

[0031] Then use 512 random projection vectors d1, d2, ..., d 512 Each d j ∈R d , each d j Perform a dot product with the accumulator vector A, and assign 0 or 1 based on the sign of the dot product result:

[0032] h j =sign(d j ·A)

[0033] Where h j It is the j-th dimension of the 512-dimensional eigenvector; the final 512-dimensional eigenvector F2 is given by the following formula:

[0034] F2 = (h1, h2, ..., h 512 ).

[0035] Furthermore, S4 specifically includes:

[0036] Static analysis tools were used to extract the control flow graph from the smali code, and the nodes and edges of the control flow graph were converted into vector representations, with the node type encoded as a one-hot vector.

[0037] The control flow graph is processed by a capsule graph neural network to obtain graph embedding vectors, and then the final 512-dimensional control flow graph feature vectors are obtained through a fully connected layer.

[0038] Furthermore, in step S4, extracting the control flow graph from the smali code and converting it into a vector specifically involves:

[0039] Static analysis tools were used to extract the control flow graph from the smali code files. The control flow graph consists of nodes and edges, where each node represents a basic block, i.e., a linear block of code without any jump target; it includes an API or method call; the edges between nodes represent program jumps from one basic block to another, with jump statements being conditional jumps and unconditional jumps; the nodes of the control flow graph depict entry and exit blocks for control flow in addition to the basic blocks; based on all Dalvik instructions provided by the Android open-source project group, a 256-dimensional instruction vector was designed; for each node, its type is encoded as a one-hot vector, where C is the set of nodes in the graph, and |C| is the number of nodes; each node v i ∈C is represented as a vector y i .

[0040] Furthermore, in step S4, the feature vector obtained through the capsule diagram neural network is specifically as follows:

[0041] Graph convolutional layers use an adjacency matrix G and node feature vectors y. i To calculate the hidden state of a node; let W g It is the weight matrix of the graph convolutional layer; node v i Hidden state r i Represented as:

[0042] r i =σ(Gy i W g )

[0043] Where σ is the ReLU nonlinear activation function; the capsule layer uses a dynamic routing mechanism to aggregate the hidden states of nodes; each capsule c j To represent the existence of a specific feature; let p iIt is node v i Primary capsules, g j It is a graph capsule; dynamic routing is represented as:

[0044]

[0045] Where λ ij From node v i To capsule c j The routing coefficients are learned through an iterative process:

[0046]

[0047] g′ j =p i W j

[0048] Among them W j This is the weight matrix from the primary capsule to the graph capsule, g' j This is the mapped feature vector; to obtain the final feature vector, a fully connected layer is applied to the output of the graph capsule layer; the output vector V of the graph capsule layer... c From all the capsules g j It is obtained by splicing together, let W be. f and b f These are the weights and biases of the fully connected layer; the final 512-dimensional feature vector F3 is expressed as:

[0049] F3 = W f V c +b f .

[0050] Furthermore, S5 specifically includes:

[0051] Feature fusion is performed using a low-rank multimodal fusion method, where F1, F2, and F3 are feature vectors from the three modalities, respectively; F1 corresponds to the bytecode image feature vector, F2 to the opcode sequence feature vector, and F3 to the control flow graph feature vector; for two modalities F1 and F2, L 12 It is the decomposition of F1×F2, expressed as:

[0052]

[0053] Where U1 and V2 are low-rank factors; for the eigenvectors of the three modes, F1 and F2, F2 and F3, and F1 and F3 obtain low-rank decomposition factors, and the fused eigenvector is expressed as:

[0054] F f =F1+F2+F3+L 12 +L 13 +L 23

[0055] Where L 12 L 13 L 23 It is the corresponding low-rank decomposition factor; after low-rank multimodal feature fusion, a 512-dimensional fused feature is obtained.

[0056] Furthermore, S6 specifically includes:

[0057] We collected open-source data from VirusShare and other third-party data to build a malicious APK dataset. We uploaded it to an online security scanning website to obtain analysis reports from various antivirus products on each type of malware. We then used an automatic malware tagging tool to classify malware samples into families based on their category and behavior to obtain tags. We removed malware that could not be detected by various antivirus software and malware whose families contained fewer than 20 malicious applications. We then selected the tagged malware as the model dataset.

[0058] The model's input layer corresponds to a 512-dimensional sample feature vector; a BiLSTM layer is added after the convolutional and pooling layers, and an attention layer is added after the BiLSTM layer. Let the output feature sequence of the BiLSTM layer be matrix B = (b1, b2, ..., b...). N )∈R N×D B is used as the input to the Attention layer, where the query vector Q is... a Key vector K a and input vector V a The fact that they are all equal is a self-attention mechanism; its calculation process is expressed as follows:

[0059]

[0060] O = SV a

[0061] In the formula Q a =K a =V a =B, M is the attention score matrix, and O is the attention layer output; the extracted bytecode image feature dimension is 512, the opcode sequence feature and control flow graph feature dimension are both 512, the multimodal feature fusion part is set to output dimension of 512, and the model input layer neurons are set to 512; the dataset software sample family category is 10, so the number of model output layer neurons is 10.

[0062] The beneficial effects of this invention are as follows:

[0063] (1) By fusing multimodal features, we can gain a more comprehensive and in-depth understanding of the behavioral characteristics of malicious app families, thereby improving the accuracy of identification. Compared with using only a single modality feature, fusing multiple features can more effectively capture the potential behavioral characteristics and patterns of malicious apps, reducing false positives and false negatives.

[0064] (2) Multimodal feature fusion can enhance the generalization ability of the model, enabling it to better cope with new malicious app families. As malicious app families continue to evolve, single-modal features may be insufficient to cope with new threats, while multimodal feature fusion can provide richer information, making the model more robust.

[0065] (3) By performing low-rank decomposition on the features, the impact of noise can be effectively reduced, thereby reducing the false alarm rate. False alarms can confuse users and reduce their trust in malicious app detection tools. Therefore, reducing the false alarm rate is crucial for improving user experience and the practicality of malicious app detection tools.

[0066] (4) The feature extraction and fusion method used in this invention has high efficiency, can quickly process a large number of malicious APP samples, and achieve real-time detection. This is of great significance for timely identification and prevention of the spread of malicious APPs.

[0067] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0068] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0069] Figure 1 This is a flowchart of the present invention;

[0070] Figure 2 This is a schematic diagram of the system architecture of the present invention;

[0071] Figure 3 This is a schematic diagram of the feature extraction and fusion architecture of the present invention;

[0072] Figure 4 A schematic diagram of the bytecode image feature extraction process in this invention. Detailed Implementation

[0073] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0074] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0075] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "front," and "rear" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0076] Please refer to the figure. Figures 1-4 The purpose of this invention is to provide a method for identifying malicious app families based on multimodal feature fusion. By fusing the bytecode image features, opcode sequence features, and control flow graph features of malicious apps, and constructing a detection and classification model, the method can identify and judge malicious app families.

[0077] The technical solution of the present invention includes the following steps:

[0078] 1. Data preprocessing: Unpack and decompile the Android APK file to obtain bytecode files and smali code files.

[0079] 2. Feature extraction: Extract bytecode image features, opcode sequence features, and control flow graph features respectively.

[0080] 3. Multimodal feature fusion: The three extracted features are fused using low-rank multimodal fusion to obtain fused features.

[0081] 4. Detection and Classification: A CNN-BiLSTM-Attention model is constructed based on fused features to classify malicious app families.

[0082] The specific implementation of the present invention is as follows:

[0083] S1: Data Preprocessing Module. This module uses the Apktool and baksmali tools. Apktool is used to unpack the APK file to obtain the bytecode file. baksmali is used to decompile the DEX bytecode file to obtain the smali code file.

[0084] S2: Bytecode Image Feature Extraction Module. This module converts the bytecode file classes.dex obtained from unpacking the Android APK file into an RGB image, and then uses an EfficientNetV2L convolutional neural network to extract bytecode image features.

[0085] S3: Opcode Sequence Feature Extraction Module. Extracts instruction opcodes from the smali files in all directories obtained after decompiling classes.dex to form the original opcode sequence. The k-Shingles and SimHash algorithms are then used to map the opcode sequence into a signature vector.

[0086] S4: Control Flow Graph Feature Extraction Module. This module extracts the control flow graph from all smali files in the directories obtained after decompiling classes.dex. The nodes and edges are then converted into vector representations that can be used as input to a neural network. These vectors are then processed by a capsule graph neural network to obtain graph embedding vectors.

[0087] S5: Feature Fusion Module. This module performs multimodal fusion of three features: bytecode image features, opcode sequence features, and control flow graph features. A low-rank multimodal fusion method is used for feature fusion.

[0088] S6: Detection and Classification Module. A malicious APK dataset was constructed based on VirusShare2020-2022 and other third-party data. 7705 malicious Android APK files were selected and used to build a CNN-BiLSTM-Attentin model.

[0089] S1: The data preprocessing module specifically includes the following steps:

[0090] S1-1: Unpacking and Decompiling: First, use the Apktool tool to unpack the Android installation package file to obtain the global configuration file AndroidManifest.xml, the DEX bytecode file classes.dex, and other resource files. Read all the contents of the DEX file byte by byte and save them for subsequent bytecode image construction. Then, use the baksmali tool to decompile the DEX bytecode file to obtain the smali code file.

[0091] S2: The bytecode image feature extraction module specifically includes the following steps:

[0092] S2-1: Bytecode Image Construction: First, read all contents of the DEX file classes.dex byte by byte into a byte array, and divide the byte array into three-byte data blocks, so that each data block corresponds to one pixel. Then, based on the number of data blocks, convert the byte array into an RGB image with the same length and width, discarding a very small number of redundant bytes. Finally, store the resulting image as a PNG image.

[0093] S2-2: Extracting Bytecode Image Features: The feature extraction model is initialized using the EfficientNetV2L pre-trained model on the ImageNet dataset, and the output layer is modified specifically for the bytecode image feature extraction task. The optimal size of the EfficientNetV2L input image is 480*480 pixels with 1792 channels. Therefore, this invention uniformly scales the bytecode image to 480*480 pixels as the model input. In the model output layer, global average pooling is applied to the 1792-channel feature map output by EfficientNetV2L to obtain the vector F. oe ∈R 1792 To reduce feature dimensionality and storage, vector F is... oe Then, a 512-dimensional feature vector F1 is obtained by passing it through a fully connected layer with 512 neurons. This feature vector is then used as the bytecode image feature.

[0094] S3: The opcode sequence feature extraction module specifically includes the following steps:

[0095] S3-1: Original Opcode Sequence: First, decompile the DEX bytecode file classes.dex to obtain the smali directory. Then, traverse each directory and its subdirectories, dividing the content of each smali file into method code blocks. For each method code block, ignore the operands and extract all instructions. Map the instructions according to the instruction opcode lookup table to obtain the opcode sequence of that method code block. Finally, concatenate the opcode sequences extracted from all method code blocks to obtain the opcode sequence of the Android application.

[0096] S3-2: Transformation into a shingle set: Based on all Dalvik instructions provided by the Android open-source project team, the raw opcode sequence of an Android application can be considered as a document composed of 256 opcodes, with a document character set size of 256. A document can be considered as a string, and k-Shingles are used to represent the document using a set of substrings. Let document D consist of N words, D = (w1, w2, ..., w...). N ), where w n Let n represent the nth word in document D, where n ∈ [1, N]. The k-shingle of a document is defined as any substring of length k in the document, i.e., the k-shingle can be represented as:

[0097] k-shingle=(w n w n+1 , ..., w n+k-1 )

[0098] Where n∈[1, N-k+1], the k-shingle set is used to represent the document. This invention chooses k=4 to convert the opcode document into a set of opcode shingle substrings. A hash function is used to map all 4-shingle strings in the opcode document to a hash bucket of five bytes, that is, the 4-shingle substrings are mapped to [0, 2]. 40 -1].

[0099] S3-3: Calculate the signature vector: This invention uses the SimHash algorithm. Let S = {S1, S2, ..., S...} n} is the set of k-Shingles derived from the original opcode sequence, where each S i It is a 4-bit opcode called Shingle. For each S... i Randomly generate a high-dimensional vector a i ∈R d Where d is a large dimension, 1024. Define the accumulator vector A∈R. d And initialize it as a zero vector. For each S in set S i , the corresponding vector a i Add to A:

[0100]

[0101] To obtain the SimHash signature, each dimension of A is quantized into a binary value by comparing each dimension with a threshold of 0. The formula is:

[0102] SimHash(A)=(sign(A1),sign(A2),…,sign(A d ))

[0103] Where sign(x) i ) is a sign function; when x≥0, sign(x) i When x < 0, sign(x) = 1. i ) = 0.

[0104] Then use 512 random projection vectors d1, d2, ..., d 512 Each d j ∈R d , each d j Perform a dot product with the accumulator vector A, and assign 0 or 1 based on the sign of the dot product result:

[0105] h j =sign(d j ·A)

[0106] Where h j It is the j-th dimension of the 512-dimensional feature vector. The final 512-dimensional feature vector F2 is given by the following formula:

[0107] F2 = (h1, h2, ..., h 512 )

[0108] S4: The control flow graph feature extraction module specifically includes the following steps:

[0109] S4-1: Graph Extraction: First, decompile the DEX bytecode file classes.dex to obtain the smali directory. Then, traverse each directory and its subdirectories to obtain the method code blocks (smali code) under all smali files. Use the AmanDroid tool to extract the control flow graph. The control flow graph consists of nodes and edges, where each node represents a basic block, i.e., a linear code block without any jump target, such as an API or method call. The edges between nodes represent program jumps from one basic block to another; jump statements can be conditional jumps and unconditional jumps, etc. The nodes of the control flow graph depict entry and exit blocks, in addition to the basic blocks, where control flow enters and leaves.

[0110] S4-2: Graph Vectorization: After converting the source code into a graph, the next step is to convert its nodes and edges into vector representations that can be used as input to a neural network. Based on all the Dalvik instructions provided by the Android open-source project team, a 256-dimensional instruction vector was designed. Therefore, for each node, its type is encoded as a one-hot vector, where C is the set of nodes in the graph, and |C| is the number of nodes. Each node v i∈C is represented as a vector y i .

[0111] S4-3: Graph Embedding Vectors: Graph convolutional layers use the adjacency matrix G and node feature vectors y. i To calculate the hidden state of a node. Let W g This is the weight matrix of the graph convolutional layer. Node v i Hidden state r i It can be represented as:

[0112] r i =σ(Gy i W g )

[0113] Where σ is the ReLU non-linear activation function. The capsule layer uses a dynamic routing mechanism to aggregate the hidden states of nodes. Each capsule c... j It indicates the existence of a specific feature or concept. Let p i It is node v i Primary capsules, g j It is a graph capsule. Dynamic routing can be represented as:

[0114]

[0115] Where λ ij From node v i To capsule c j The routing coefficients are learned through an iterative process:

[0116]

[0117] g′ j =p i W j

[0118] Among them W j This is the weight matrix from the primary capsule to the graph capsule, g' j This is the mapped feature vector. To obtain the final feature vector, a fully connected layer needs to be applied to the output of the graph capsule layer. The output vector V of the graph capsule layer is... c From all the capsules g j It is obtained by splicing together, let W be. f and b f These are the weights and biases of the fully connected layer. The final 512-dimensional feature vector F3 can be expressed as:

[0119] F3 = W f V c +b f

[0120] S5: The feature fusion and recognition module specifically includes the following steps:

[0121] S5-1: Multimodal Feature Fusion: Feature fusion is performed using a low-rank multimodal fusion method. F1, F2, and F3 are known feature vectors from the three modalities. F1 corresponds to the bytecode image feature vector, F2 to the opcode sequence feature vector, and F3 to the control flow graph feature vector. For two modalities F1 and F2... 12 The decomposition of F1×F2 can be expressed as:

[0122]

[0123] Where U1 and V2 are low-rank factors. For the eigenvectors of the three modes, F1 and F2, F2 and F3, and F1 and F3 obtain low-rank decomposition factors, and the fused eigenvector can be expressed as:

[0124] Ff = F1 + F2 + F3 + L 12 +L 13 +L 23

[0125] Where L 12 L 13 L 23 This is the corresponding low-rank decomposition factor. After low-rank multimodal feature fusion, a 512-dimensional fused feature is obtained.

[0126] S6: The detection and classification module includes the following steps:

[0127] S6-1: Obtaining the Training Dataset: A malicious APK dataset was constructed by collecting VirusShare2020-2022 and other third-party data. This dataset was uploaded to VirusTotal's official website to obtain analysis reports from various antivirus products for each type of malware. The malware samples were then categorized into families using the automatic malware tagging tool AVclass2 based on their type and behavior to obtain labels. Malware that could not be detected by various antivirus software and malware families containing fewer than 20 malicious applications were removed, resulting in 7705 tagged malware belonging to 10 families. Specifically, this includes: Multi.Generic family (1518), SMS.Fakeapp family (992), DroidKungFu family (936), Agent.aas family (781), Fakemoney family (772), GriftHorse family (646), Dropper family (558), GenericML family (537), Airpush family (490), and RuMMS family (475).

[0128] S6-2: Detection Model: Construct a CNN-BiLSTM-Attention model, with the input layer corresponding to a fused feature vector of 512 dimensions. Add a BiLSTM layer after the convolutional and pooling layers, and add the Attention layer after the BiLSTM layer. Let the output feature sequence of the BiLSTM layer be matrix B = (b1, b2, ..., b...). N )∈R N×D B is used as the input to the Attention layer, where the query vector Q is... a Key vector K a and input vector V a The fact that they are all equal is due to the self-attention mechanism. The calculation process is as follows:

[0129]

[0130] O = MV a

[0131] In the formula Q a =K a =V a =B, M is the attention score matrix, and O is the attention layer output. The bytecode image features extracted in this invention have a dimension of 512, the opcode sequence features and control flow graph features also have a dimension of 512, and the multimodal feature fusion part has an output dimension of 512. Therefore, the number of neurons in the model's input layer should be set to 512. The dataset software sample family has 10 categories, so the number of neurons in the model's output layer is 10.

[0132] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for identifying a malicious APP family based on multi-modal feature fusion, characterized in that: The method comprises the following steps: S1: data preprocessing, including unpacking the Android APK file using a tool and decompiling the DEX bytecode file; S2: bytecode image feature extraction, converting the bytecode file classes.dex obtained by unpacking the Android APK file into an RGB image, using an EfficientNetV2L convolutional neural network for feature extraction to obtain the bytecode image features; S3: opcode sequence feature extraction, extracting instruction opcodes from smali files under all file directories obtained by decompiling the bytecode file classes.dex, and mapping instructions according to the instruction opcode reference table to obtain opcode sequences of method code blocks; splicing the opcode sequences extracted from all method code blocks to obtain the original opcode sequence of the Android application, and then using the k-Shingles algorithm to convert the original sequence into a shingle set and the SimHash algorithm to map the shingle set into a signature vector to obtain the opcode sequence feature; S4: control flow graph feature extraction, using a static analysis tool to extract a control flow graph from Smali code in smali files under all file directories obtained by decompiling classes.dex; according to all Dalvik instructions provided by the Android open source project group, converting the nodes and edges into vector representations that can be used as input to a neural network; and then passing through a capsule graph neural network to obtain a control flow graph feature vector; S5: Multimodal feature fusion, which performs low-rank multimodal fusion of bytecode image features, opcode sequence features, and control flow graph features, and combines the feature vectors of the three modalities with the bytecode image features. opcode sequence characteristics Control Flowchart Features Calculate the low-rank factorization factor between any two vectors. , , The fused feature vector is obtained. ; S6: detection classification model, using a publicly available malicious APK dataset, filtering data by obtaining labels as a model dataset, and constructing a CNN-BiLSTM-Attention detection classification model; specifically: Collect open source data from VirusShare and other third party data to build a malicious APK dataset, upload it to an online security scanning website to obtain analysis reports of various antivirus products on each type of malware, and use an automatic malware labeling tool to classify malware samples by category and behavior to obtain labels, and remove malware that cannot be detected by various antivirus software and remove families that contain less than 20 malicious applications, and select labeled malware as a model dataset; The input layer of the model corresponds to the sample feature vector with 512 dimensions; a BiLSTM layer is added after the convolutional layer and the pooling layer, and an Attention layer is added after the BiLSTM layer, and the output feature sequence of the BiLSTM layer is denoted as matrix , As the input of the Attention layer, the query vector , the key vector and the input vector are equal, which is a self-attention mechanism; the calculation process is represented as: In the formula is an attention score matrix, is an attention layer output; the extracted bytecode image feature dimension is 512, the opcode sequence feature and the control flow graph feature dimension are both 512, the output dimension of the multi-modal feature fusion part is set to 512, the model input layer neuron is set to 512; the software sample family category of the data set is 10, and the number of model output layer neurons is 10.

2. The method of claim 1, wherein the method comprises: S2 specifically comprises: Reading the contents of the unpacked classes.dex file into a byte array by bytes, and dividing each data block into three bytes, each data block corresponding to a pixel point; According to the number of data blocks, the byte array is converted into an RGB image with the same length and width, and the excess bytes are discarded; The obtained RGB image is adjusted to a uniform size and stored as a PNG format picture file; The RGB image is subjected to feature extraction using a pre-trained EfficientNetV2L convolutional neural network, and the extracted image features are reduced to 512-dimensional feature vectors through a fully connected layer to obtain the bytecode image features .

3. The method of claim 2, wherein the method comprises: S3 specifically comprises: Iterating through the smali files obtained by decompiling classes.dex, extracting all instruction opcodes in the method code blocks in each smali file to obtain the original opcode sequence; The extracted original operation code sequence is mapped into a k-Shingles set using the k-Shingles algorithm, and the k-Shingles set is converted into a 512-dimensional signature vector using the SimHash algorithm.

4. The method of claim 3, wherein the method comprises: In the S3, the original operation code sequence is extracted specifically as follows: For the method instruction in the smali file, the unnecessary operand part is ignored, the opcode part of the instruction is retained, and all instructions are extracted; according to the all Dalvik instruction table given by the Android open source project group, the instructions are mapped to obtain the operation code sequence of the method code block, and finally the operation code sequences extracted in all method code blocks are spliced to obtain the operation code sequence of the Android application program.

5. The method of claim 3, wherein the method comprises: In the S3, the original operation code sequence is converted into a 512-dimensional signature vector specifically as follows: Based on all the Dalvik instructions provided by the Android open-source project team, the raw opcode sequence of an Android application is considered as a document consisting of 256 opcodes, with a document character set size of 256; a document is considered as a string, and k-Shingles are used to represent the document using a set of substrings; let the document... Depend on Composed of words, ,in Document The first in One word, The k-shingle definition of a document is any number of characters of length 10 ... The substring, i.e., the k-shingle, is represented as: wherein , the k-shingle set is used to represent the document; k is chosen to be 4 to transform the opcode document into a set of opcode shingle substrings; a hash function is used to map all 4-shingle substrings in the opcode document into a number of hash buckets of five bytes, i.e., the 4-shingle substrings are mapped to [0, 2 40 -1]; then the SimHash algorithm is applied to the k-Shingles set, let be the k-Shingles set obtained from the original opcode sequence, where each is an opcode Shingle of length 4; for each , a high-dimensional vector is randomly generated, where is a large dimension, 1024; define an accumulator vector and initialize it to a zero vector; for each in the set , the corresponding vector is added to : To get the SimHash signature, each dimension is quantized to a binary value by comparing it to a threshold 0 comparison, formula: ​ wherein is a sign function, when when ; reusing 512 random projection vectors , ,… each dot product each with an accumulator vector and assign 0 or 1 depending on the sign of the dot product result: in It is the 512-dimensional eigenvector of the eigenvector. Each dimension; the final 512-dimensional feature vector It is given by the following formula: 。 6. The method of claim 1, wherein the method comprises: The S4 is specifically as follows: A static analysis tool is used to extract the control flow graph from the smali code, and the nodes and edges of the control flow graph are converted into vector representation, and the node type is encoded into a One-hot vector; The control flow graph is processed by a capsule graph neural network to obtain a graph embedding vector, and a final 512-dimensional control flow graph feature vector is obtained through a fully connected layer.

7. The method of claim 6, wherein the method comprises: In the S4, the control flow graph is extracted from the smali code and converted into a vector specifically as follows: A static analysis tool is used on the smali code file to extract the control flow graph; the control flow graph is composed of nodes and edges, and each node represents a basic block, that is, a straight-line type code without any jump target; includes an API or method call; edges between nodes represent program jumps from one basic block to another, and the jump statements are conditional and unconditional jumps; the nodes of the control flow graph depict entry and exit blocks in addition to basic blocks; a 256-dimensional instruction vector is designed according to all Dalvik instructions given by the Android Open Source Project; for each node, its type is encoded as a One-hot vector, is a set of nodes in the graph, is the number of nodes; each node is represented as a vector .

8. The method of claim 6, wherein the method comprises: In the S4, the feature vector is obtained through the capsule graph neural network specifically as follows: The graph convolution layer uses an adjacency matrix and node feature vectors to compute a hidden state of a node; let be a weight matrix of the graph convolution layer; the hidden state of the node is represented as: wherein is a Relu non-linear activation function; the capsule layer uses a dynamic routing mechanism to aggregate the hidden states of the nodes; each capsule represents the presence of a particular feature; let be the primary capsules of the nodes , be the graph capsules; the dynamic routing is represented as: wherein is the routing coefficient from node to capsule which is learned through an iterative process: where is the weight matrix from the primary capsule to the graph capsule, is the mapped feature vector; to obtain the final feature vector, a fully connected layer is applied on the output of the graph capsule layer; the output vector of the graph capsule layer is obtained by concatenating all the graph capsules , denoted as and are the weights and biases of the fully connected layer; the final 512-dimensional feature vector is represented as: 。 9. The method of claim 1, wherein the method comprises: The S5 is specifically as follows: using a low-rank multi-modal fusion method for feature fusion, are feature vectors from three modalities respectively; corresponding bytecode image feature vector, corresponding opcode sequence feature vector, corresponding control flow graph feature vector; for two modalities and is a decomposition of denoted as:​ wherein and are low-rank factors; between the eigenvectors of the three modalities, with with with the low-rank decomposition factors are obtained, and the eigenvectors are fused and represented as: wherein , , are the corresponding low-rank decomposition factors; after low-rank multi-modal feature fusion, 512-dimensional fusion features are obtained.

Images