Android application detection method and system based on differential embedding and program product

Abstract

The invention provides an Android application detection method and system based on differential embedding and a program product, and relates to the technical field of Android applications. According to the method, a function call graph is constructed through static analysis, important function nodes with discrimination are recognized in combination with a malicious sample training set, then key sub-graphs with neighborhood structures are extracted and reserved, and core call relations related to malicious behaviors are effectively reserved while original graph redundancy is greatly reduced; further, differentiated semantic embedding strategies are designed for internal function nodes and external function nodes, the former is based on statistical characteristics of instruction types, and the latter is based on character numeralization characteristics of semantic segmentation of method names, so that functional semantics of different nodes are described more accurately; and finally, the key sub-graphs with simple structures and rich semantics and the nodes of the key sub-graphs are embedded into the neural network of the input graph for classification, so that the accuracy, the robustness and the calculation efficiency of Android application malicious detection are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of Android application technology, and in particular to an Android application detection method, system, and program product based on differentiated embedding. Background Technology

[0002] As a mainstream mobile operating system globally, Android's security detection is crucial for preventing malware attacks, protecting user privacy, and maintaining device security. Existing Android malware detection methods mainly fall into two categories: those based on behavioral features and those based on structural information. However, the former often ignores the internal structural relationships of applications, making it difficult to comprehensively characterize malicious behavior; while the latter, although reflecting the program's call logic, suffers from two major drawbacks: first, the original function call graph is usually large in scale with numerous redundant nodes, leading to high computational overhead and low efficiency when used directly for analysis; second, existing graph embedding methods fail to fully exploit the semantic information of function nodes, especially neglecting to differentiate between internal and external functions, resulting in insufficient feature representation capabilities and affecting detection accuracy. Summary of the Invention

[0003] This invention aims to solve the technical problems existing in the above-mentioned related technologies, and proposes an Android application detection method, system and program product based on differentiated embedding, which can significantly reduce the redundancy of function call graphs while deeply integrating structural information and semantic features, thereby improving the accuracy and efficiency of malware detection.

[0004] The solution to the technical problem of this invention is as follows: This invention provides an Android application detection method based on differential embedding, comprising the following steps: Static analysis is performed on the Android application to be tested to generate a function call graph, where nodes represent functions and directed edges represent the call relationships between functions. Based on a training set containing malicious samples, statistical analysis is performed on the function nodes in the function call graph to identify important function nodes that are discriminative in malicious behavior, including internal function nodes and external function nodes. The internal function node refers to the function defined by the Android application to be detected, and the external function node refers to the function called by the Android application to be detected, whose specific implementation is not in the current application file. Centered on the important function node, extract the key subgraph containing its neighborhood structure from the function call graph; For the internal and external function nodes in the key subgraph, a differentiated embedding strategy is adopted, including: performing semantic type statistics on the internal function nodes based on their bytecode instructions, and accumulating the semantic segment characters of the external function nodes based on their method names, so as to generate the main body of the embedding vector respectively. The key subgraph and the embedding vectors corresponding to each node are input into the graph neural network model, which outputs the detection result of whether the Android application is benign or malicious.

[0005] Furthermore, the step of performing statistical analysis on function nodes in the function call graph based on a training set containing malicious samples to identify important function nodes that are discriminative in malicious behavior includes the following steps: Calculate the coverage rate and malicious tendency score of each function node in the malicious sample, and perform initial screening based on a preset threshold; For the function nodes after initial screening, various statistical testing methods are used to calculate their association strength with malicious tags. The association strengths are then normalized and fused to obtain a comprehensive score. The statistical testing methods include chi-square test, information gain, and Fisher score.

[0006] Based on the comprehensive score, the function nodes with the highest ranking are selected as the important function nodes according to a preset proportion; the preset proportion is dynamically adjusted according to the distribution of training set samples.

[0007] Furthermore, the step of extracting a key subgraph containing its neighborhood structure from the function call graph, centered on the important function node, includes the following steps: Under multiple candidate hop counts, the utility index of the corresponding subgraph is calculated respectively. The utility index is used to measure the balance between the preservation of the connection relationship between important function nodes and the subgraph size. The subgraph corresponding to the candidate hop count that maximizes the utility index is selected as the key subgraph.

[0008] Furthermore, the utility index is calculated based on the retention ratio of the connection relationships between important function nodes, the retention ratio of subgraph nodes, and the retention ratio of subgraph edges; The utility index satisfies the following calculation formula: ; in, For the first The utility index of the key subgraph for jumping. The percentage of connections between important function nodes that are retained. Preserve the scale for the corresponding subgraph nodes. Preserve the proportions of the corresponding subgraph edges.

[0009] Furthermore, the retention ratio of the connection relationships between the important function nodes is calculated as follows: In the critical subgraph with a jump count of n, count whether the connection relationship between any two important function nodes in the original function call graph is preserved. If it is preserved, it is counted as a valid connection. Divide the number of valid connections by the total number of connections between all important function node pairs in the original function call graph to obtain the retention ratio of the connection relationships between the important function nodes.

[0010] Further, generating embedding vectors for the internal function nodes includes the following steps: Obtain the bytecode instruction sequence of the internal function node, classify and count the instructions according to the predefined instruction types, and normalize the occurrence frequency of each type of instruction as the main part of the embedding vector of the internal function node; The predefined instruction types include move, return, jump, conditional judgment, data acquisition, data storage, and function call.

[0011] Further, generating an embedding vector for the external function node includes the following steps: The complete method name of the external function node is segmented according to semantic structure. A specified number of segments are selected, and the characters of each segment are numerically processed and accumulated. The accumulated result is normalized and used as the main part of the embedding vector of the external function node. The segmentation based on semantic structure includes segmentation based on package name, class name, method name, and parameter signature.

[0012] Furthermore, the graph neural network model includes, but is not limited to, at least one of graph convolutional networks, graph attention networks, and GraphSAGE.

[0013] On the other hand, this application provides an Android application detection system based on differential embedding, including the following modules: The function call graph construction module is used to perform static analysis on the Android application to be tested and generate a function call graph, where nodes represent functions and directed edges represent the call relationships between functions. The important function identification module is used to perform statistical analysis on the function nodes in the function call graph based on a training set containing malicious samples, and to identify important function nodes that are discriminative in malicious behavior, including internal function nodes and external function nodes. The internal function node refers to the function defined by the Android application to be detected, and the external function node refers to the function called by the Android application to be detected, whose specific implementation is not in the current application file. The key subgraph extraction module is used to extract key subgraphs containing the neighborhood structure of the function call graph, with the important function node as the center. The differential embedding generation module is used to employ a differential embedding strategy for the internal function nodes and external function nodes in the key subgraph, including: performing semantic type statistics on the internal function nodes based on their bytecode instructions, and accumulating the semantic segment characters of the external function nodes based on their method names, so as to generate the main body of the embedding vector respectively. The malicious application classification module is used to input the key subgraph and the embedding vectors corresponding to each node into the graph neural network model, and output the detection result of whether the Android application is benign or malicious.

[0014] On the other hand, this application provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned Android application detection method based on differential embedding.

[0015] The beneficial effects of this invention are as follows: This application provides an Android application detection method, system, and program product based on differentiated embedding. This method constructs a function call graph through static analysis and identifies important discriminative function nodes by combining a malicious sample training set. It then extracts key subgraphs that retain their neighborhood structure, effectively preserving core call relationships related to malicious behavior while significantly reducing redundancy in the original graph. Furthermore, this method designs differentiated semantic embedding strategies for internal and external function nodes—the former based on statistical features of instruction types, and the latter based on character numerical features of semantic segmentation of method names, thereby more accurately characterizing the functional semantics of different nodes. Finally, the concise and semantically rich key subgraphs and their nodes are embedded into the input graph neural network for classification, significantly improving the accuracy, robustness, and computational efficiency of malware detection. This application also provides corresponding systems and program products, whose beneficial effects are the same as those of the above method, and will not be elaborated upon here.

[0016] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0017] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0018] Figure 1This is a flowchart of the Android application detection method based on differential embedding provided in this application; Figure 2 This is a structural diagram of the Android application detection system based on differential embedding provided in this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0020] The present application will be further described below with reference to the accompanying drawings and specific embodiments. The described embodiments should not be considered as limitations on the present application, and all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present application.

[0021] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0022] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0023] As one of the world's most popular mobile operating systems, Android's openness and extensive application ecosystem make it a prime target for malware attacks. With its widespread use, the number of malware programs on the Android platform is constantly increasing, posing a serious threat to users' device security and personal information security. Malware takes many forms, including but not limited to viruses, worms, adware, spyware, and ransomware. These malware programs attack user devices in various ways, such as stealing personal information, sending spam text messages, and downloading applications without authorization, causing significant inconvenience and losses to users.

[0024] To address these challenges, researchers have proposed various methods for detecting Android malware. These methods can be broadly categorized into two types: detection methods based on behavioral characteristics and detection methods based on structural information.

[0025] Behavioral feature-based detection methods primarily focus on application behavior such as permission requests, API calls, and network traffic. While these methods can capture some surface-level behavioral patterns, they often overlook the application's structural information. This structural information is crucial for understanding application behavior patterns and detecting malicious activity. Therefore, behavioral feature-based methods may not be able to comprehensively and accurately identify malware in certain situations.

[0026] In function call graph-based detection methods, the function call graph can well reflect the structural information of the application. By analyzing the call relationships between functions, the behavioral patterns of the application can be understood more comprehensively. However, existing function call graph-based detection methods have some shortcomings: (1) Too many nodes lead to high model overhead: Function call graphs usually contain a large number of nodes. Directly analyzing the entire graph will lead to excessive model overhead and high computational complexity; (2) Insufficient node feature extraction: Existing graph node embedding methods fail to fully extract the semantic information of function nodes, resulting in insufficient analysis of application behavior. In particular, there is a lack of targeted processing methods to accurately express the functional and semantic differences between internal functions (with bytecode implementation) and external functions (with only method signatures).

[0027] Therefore, to address the aforementioned problems, this invention provides an Android application detection method, system, and program product based on differentiated embedding. This invention constructs a function call graph through static analysis and identifies key function nodes with discriminative power in malicious behavior based on training set statistics. Using these nodes as centers, it adaptively extracts key subgraphs that preserve neighborhood structure, effectively removing redundancy and focusing on malicious-related call relationships. Furthermore, it designs differentiated embedding strategies for internal function nodes (including bytecode implementation) and external function nodes (only method signatures) within the subgraphs—the former uses frequency statistics of Dalvik instruction types for semantic encoding, while the latter uses semantic segmentation of method names and ASCII numerical representation for functional characterization, thereby accurately characterizing the semantic features of different types of nodes. Finally, it embeds the compact and semantically rich key subgraphs and their nodes into the input graph neural network for end-to-end classification, significantly improving the accuracy, robustness, and computational efficiency of detection.

[0028] First, the Android application detection method based on differential embedding provided in this application will be described in detail below with reference to the accompanying drawings.

[0029] Reference Figure 1 The implementation process of the Android application detection method based on differential embedding provided in this application includes, but is not limited to, the following steps.

[0030] Step S110: Perform static analysis on the Android application to be tested to generate a function call graph, where nodes represent functions and directed edges represent the call relationships between functions.

[0031] In step S110, the Android application to be detected is transformed into a structured graph representation. Through static analysis of the application's bytecode file, all functions and their inter-function call relationships are extracted. A complete function call graph is constructed, with functions as nodes and function calls as directed edges. This process provides fundamental structured data support for subsequent malicious behavior analysis, enabling the application's internal logic and execution flow to be systematically modeled and processed in graph form.

[0032] Step S120: Based on the training set containing malicious samples, perform statistical analysis on the function nodes in the function call graph to identify important function nodes that are discriminative in malicious behavior, including internal function nodes and external function nodes.

[0033] Internal function nodes refer to functions defined by the Android application itself, while external function nodes refer to functions called by the Android application but whose implementations are not in the current application file.

[0034] Specifically, internal function nodes refer to functions defined by the Android application itself. The implementation code of these functions is contained within the current application, and analyzing their bytecode instructions provides a deeper understanding of the application's specific behavior and logic. External function nodes, on the other hand, refer to functions called by the Android application but whose implementations are not in the current application file. These typically involve system APIs or third-party libraries, and their functional characteristics are expressed by semantically segmenting and numerically accumulating the method names. The significance of distinguishing between these two types of function nodes lies in more accurately characterizing the application's behavioral patterns, thereby improving the accuracy and reliability of malware detection. This is because internal functions reveal the application's own operations and intentions, while external functions reflect how the application interacts with the outside world.

[0035] In step S120, function nodes highly correlated with malicious behavior are mined from a large number of training samples (including benign and malicious applications). By statistically analyzing the frequency of each function node in malicious and benign samples, and combining it with indicators such as coverage and malicious tendency, function nodes that frequently appear in malware and have strong discriminative capabilities are selected as important function nodes. These nodes are considered potential key malicious behavior carriers, providing a target basis for subsequent focused analysis.

[0036] Step S130: Using important function nodes as the center, extract the key subgraphs containing their neighborhood structures from the function call graph.

[0037] In step S130, a smaller but more information-dense subgraph is cropped from the original, massive function call graph. A key subgraph is formed by preserving the neighborhood structure (i.e., surrounding functions with which it has call relationships) within a certain range, centered on the identified important function nodes. This significantly reduces redundant nodes and edges in the graph while retaining the contextual call relationships closely related to the key functions.

[0038] Step S140: For the internal function nodes and external function nodes in the key subgraph, a differentiated embedding strategy is adopted, including: performing semantic type statistics on internal function nodes based on their bytecode instructions, and accumulating the semantic segmented character values ​​of external function nodes based on their method names, so as to generate the main body of the embedding vector respectively.

[0039] In step S140, efforts are made to generate low-dimensional vector representations with semantic expressive capabilities for each type of node in the key subgraph. Since internal function nodes contain specific bytecode implementations, their embeddings are based on frequency statistics and normalization of seven semantic instruction categories (such as move, jump, data fetch, etc.) in the Dalvik instruction sequence; while external function nodes typically come from system APIs or third-party libraries, and their implementations are not visible. Therefore, their embeddings are based on semantic segmentation of the complete method name (such as package name, class name, method name), with the ASCII values ​​of each segment accumulated and normalized. This differentiation strategy fully considers the differences in information availability between the two types of nodes, enabling the embedding vectors to more accurately reflect their respective functional semantics.

[0040] Step S150: Input the key subgraph and the embedding vectors corresponding to each node into the graph neural network model, and output the detection result of whether the Android application is benign or malicious.

[0041] In step S150, the key subgraph (containing the topological structure of nodes and edges) generated in the previous step and the semantic embedding vector corresponding to each node are fed into a pre-trained graph neural network model as input. The model classifies the entire subgraph by aggregating neighbor information and learning joint structure-semantic features, ultimately outputting a judgment result indicating whether the Android application is benign or malicious. This step achieves end-to-end mapping from structured semantic graphs to security labels, enabling intelligent identification of malware.

[0042] In some embodiments of this application, step S120 involves statistically analyzing the function nodes in the function call graph based on a training set containing malicious samples to identify important function nodes that are discriminative in malicious behavior, including the following steps.

[0043] Step S210: Calculate the coverage rate of each function node in the malicious sample and its malicious tendency score, and perform initial screening based on a preset threshold.

[0044] In step S210, the correlation between each function node and malicious behavior is first quantified. Coverage is determined by calculating their frequency of occurrence in known malicious samples, and their malicious tendency score is evaluated as a basis for initial screening. Coverage reflects the extent to which a function node is used in malicious applications, while the malicious tendency score measures more deeply whether the function is prone to appearing in malicious scenarios. Based on these two indicators, combined with pre-set thresholds, function nodes with low correlation and potentially no significant discriminative ability can be filtered out, thereby narrowing the scope of subsequent analysis and improving processing efficiency.

[0045] Step S220: For the function nodes after initial screening, use multiple statistical test methods to calculate their association strength with malicious tags, normalize each association strength and then fuse them to obtain a comprehensive score.

[0046] The statistical testing methods include the chi-square test, information gain, and Fisher score.

[0047] In step S220, for the function nodes retained after the initial screening, different statistical tests such as the chi-square test, information gain, and Fisher score are further applied to accurately assess the strength of the relationship between these nodes and malicious labels. Each statistical method reveals the characteristics of the relationship between variables from different perspectives. For example, the chi-square test focuses on the independence between categorical variables, information gain measures the ability to reduce uncertainty, and the Fisher score emphasizes the effectiveness of class distinction. After normalizing the association strengths obtained from various tests, a comprehensive score is formed. This not only comprehensively reflects the importance of the function nodes but also balances the biases introduced by different test methods, providing a more reliable basis for the final selection.

[0048] Step S230: Sort by comprehensive score and select the function nodes with the highest ranking according to a preset proportion as important function nodes.

[0049] The preset ratio is dynamically adjusted based on the distribution of training set samples.

[0050] In step S230, all candidate function nodes are sorted according to the comprehensive score calculated in the previous step, and the nodes with the highest scores are selected as important function nodes according to a pre-set proportion (e.g., 5%). This pre-set proportion is not fixed but is flexibly adjusted according to the specific distribution of benign and malicious samples in the training set to ensure that the selected nodes are both highly representative and adaptable to data changes. The important function nodes selected in this way play a core role in the entire function call graph and are crucial for identifying malicious software behavior. This method ensures that even with datasets of different characteristics, it can effectively focus on the most indicative function nodes, improving the accuracy and robustness of the detection model.

[0051] In some embodiments of this application, statistical analysis is performed on the function call graphs corresponding to each sample in a training set containing both benign and malicious samples to identify important function nodes that can discriminate malicious behavior: First, the statistics of each function node are analyzed. The number of times it appears in benign and malicious samples respectively is denoted as . and Secondly, calculate the coverage ratio of this node in all training samples, i.e. ,in The total number of samples in the training set is determined; next, their malicious intent score is calculated. This reflects the relative probability of the node appearing in a malicious application; subsequently, a threshold is set. (For example If satisfied Then the node The candidate function nodes are included in the set. Finally, the association strength between the candidate nodes and the malicious labels is evaluated by three statistical methods: chi-square test, information gain and Fisher score. The scores of each method are independently normalized and summed to obtain a comprehensive score. The nodes are then sorted in descending order of the score, and the nodes with the highest ranking (e.g., the top 5%) are selected as the final important function nodes for subsequent extraction of key subgraphs.

[0052] In some embodiments of this application, step S130 involves extracting a key subgraph containing the neighborhood structure of an important function node from the function call graph, including the following steps.

[0053] Step S310: Calculate the utility index of the corresponding subgraph under multiple candidate hop counts.

[0054] The utility index is used to measure the balance between the preservation of connectivity between important function nodes and the size of the subgraph.

[0055] In step S310, the optimal neighborhood range (i.e., hop count) is determined for extracting the key subgraph. Specifically, the system expands the neighborhood of each important function node in the original function call graph with different hop counts (e.g., 1 hop, 2 hops, 3 hops, etc.), generating multiple candidate subgraphs. Here, an n-hop neighborhood node of a node refers to a node whose hop count from that node does not exceed n. For each candidate hop count corresponding to the subgraph, a "utility index" is calculated. This index comprehensively considers two core factors: first, the extent to which the subgraph retains the interconnections between important function nodes (reflecting the integrity of the malicious behavior context); and second, the overall size of the subgraph (i.e., the number of nodes and edges, affecting subsequent computational overhead). By introducing the utility index, this step achieves a quantitative evaluation of the trade-off between information preservation and computational efficiency, avoiding blindly expanding or shrinking the neighborhood range.

[0056] Step S320: Select the subgraph corresponding to the candidate hop count that maximizes the utility index as the key subgraph.

[0057] In step S320, after calculating the utility index for each candidate hop number, the hop number with the highest utility index is selected, and its corresponding neighborhood subgraph is used as the final key subgraph. This selection strategy ensures that the extracted subgraph retains sufficient information about the relationships between important function nodes while controlling the complexity and size of the subgraph as much as possible, thus achieving the best balance between structural information integrity and model processing efficiency. The resulting key subgraph not only focuses on local call structures highly related to malicious behavior but also possesses good computability, laying a high-quality input foundation for subsequent differential embedding and graph neural network classification.

[0058] In some embodiments of this application, the utility index is calculated based on the retention ratio of the connection relationship between important function nodes, the retention ratio of subgraph nodes, and the retention ratio of subgraph edges.

[0059] Specifically, when calculating the utility index, the first step is to assess the retention rate of connections between important function nodes. This means that during the generation of key subgraphs with different hop counts, the system checks whether the connections between any two important function nodes in the original function call graph are fully preserved. This process is achieved by counting the number of valid connections and dividing it by the total number of connections between all pairs of important function nodes in the original graph. This ensures that the key subgraphs fully reflect the interaction patterns between important function nodes, which is crucial for identifying malicious behavior, as malicious software often manifests in specific interactions between these function nodes.

[0060] Next, the node retention rate and edge retention rate of the subgraph are calculated. These two metrics measure how many nodes and edges from the original function call graph are retained during the construction of the key subgraph. This step is important because it provides information about the size of the subgraph. Ideally, we want to retain as much important structural information as possible while minimizing unnecessary redundancy. Therefore, by comparing the node and edge retention rates, we can quantify the compactness of the subgraph and its similarity to the original graph at different hop counts, thus providing a basis for subsequently selecting the optimal hop count.

[0061] In some embodiments of this application, if two nodes in a graph are interconnected, there must be some kind of relationship between them. Malicious behavior often manifests in the interactions between important function nodes. The more connections between important functions retained in a subgraph, the more complete the key malicious information is retained. Therefore, when selecting the hop count n, the following three indicators are considered: the proportion of important function relationships retained R(n), the proportion of nodes retained N(n), and the proportion of edges retained E(n). As n increases, all three indicators increase, eventually leveling off. This invention makes a compromise when selecting n, aiming to make "the indicator R(n) containing key malicious information as large as possible" and "the indicators N(n) and E(n) representing the graph size as small as possible," with the former being relatively more important. Therefore, the utility index... The following calculation formula (1) must be satisfied: (1); In formula (1), For the first The utility index of the key subgraph for jumping. The percentage of connections between important function nodes that are retained. Preserve the scale for the corresponding subgraph nodes. Preserve the proportions of the corresponding subgraph edges.

[0062] Formula (1) above is used to calculate the utility index of the key subgraph generated under different hop counts, in order to measure its comprehensive performance in retaining key malicious behavior information and control graph size. The first term of the formula significantly amplifies the importance of the integrity of key call relationships by taking the logarithm of the retention ratio of important function nodes and multiplying it by 10, ensuring that the subgraph can effectively retain the interaction structure between core functions in malicious behavior; the second term reflects the overall size and complexity of the subgraph by taking the logarithm of the geometric mean of the retention ratio of subgraph nodes and edges, which plays a role in suppressing over-expansion. The entire formula achieves a trade-off between "information retention" and "structural simplicity" through the difference between the two terms: when the subgraph retains a large number of key connections and is of moderate size, the utility index is high; conversely, if the connection relationships are severely lost or the subgraph is too large, the utility index decreases. Therefore, this formula provides a quantitative basis for selecting the optimal hop count, thereby improving computational efficiency while ensuring detection accuracy.

[0063] In some embodiments of this application, the retention ratio of the connection relationship between important function nodes is calculated according to the following steps.

[0064] Step S410: In the critical subgraph with a hop count of n, count whether the connection relationship between any two important function nodes in the original function call graph is preserved. If it is preserved, it is counted as a valid connection.

[0065] In step S410, it is evaluated whether the call relationships (i.e., structural dependencies) between important function nodes in the original function call graph are effectively preserved in the key subgraph extracted with hop count n. Specifically, malicious behavior is often not carried out by isolated functions, but through coordinated calls between multiple key functions (e.g., data is transferred out immediately after sensitive permission requests). Therefore, determining whether the directed or undirected connection between any two important function nodes that exists in the original graph still exists in the key subgraph is the core indicator for measuring whether the subgraph preserves the context of key malicious behavior. The preserved connections are marked as "valid connections," laying the foundation for subsequent quantification of the information fidelity of the subgraph.

[0066] Step S420: Divide the number of valid connections by the total number of connections between all important function node pairs in the original function call graph to obtain the retention ratio of connection relationships between important function nodes.

[0067] In step S420, a normalized retention ratio is obtained by calculating the ratio of the "number of effective connections" to the "total number of connections between all important function node pairs in the original graph". This ratio intuitively reflects the extent to which the key subgraph maintains the original interaction structure between important functions. The higher the retention ratio, the more completely the extracted subgraph inherits the call chain of potential malicious behavior, thus helping the graph neural network to more accurately identify malicious patterns; conversely, if the ratio is too low, misjudgment may occur due to broken structural information. As a core component of the utility index indicator(n), this index directly participates in the selection of the optimal hop number n, ensuring the best balance between subgraph size and the integrity of malicious information, taking into account both detection accuracy and computational efficiency.

[0068] In some embodiments of this application, step S140, generating an embedding vector for an internal function node, includes the following steps: obtaining the bytecode instruction sequence of the internal function node, classifying and statistically analyzing the instructions according to predefined instruction types, and normalizing the frequency of each type of instruction as the main body of the embedding vector of the internal function node. The predefined instruction types include move, return, jump, conditional judgment, data acquisition, data storage, and function call.

[0069] Specifically, a numerical feature representation with semantic expressive capabilities is constructed for internal function nodes. Since internal function nodes originate from the code implementation of the Android application under test, their complete bytecode instruction sequences are readily available. Therefore, the behavioral characteristics of functions can be characterized by in-depth analysis of their instruction composition. Specifically, firstly, the Dalvik bytecode instruction sequence corresponding to each internal function node is obtained; then, each instruction in the sequence is categorized according to seven predefined semantic instruction types—including move, return, jump, conditional judgment, data acquisition, data storage, and function call; next, the frequency of each type of instruction in the function is counted, forming a seven-dimensional original frequency vector. Finally, this frequency vector is normalized to eliminate the scaling effect caused by differences in function length, thus obtaining a stable and comparable embedding vector body. This process transforms the underlying execution logic of functions into structured semantic features, enabling graph neural networks to more accurately identify function patterns related to malicious operations based on these behaviorally information-rich embeddings, significantly improving the model's ability to understand and discriminate internal code functions.

[0070] In some embodiments of this application, step S140, generating an embedding vector for an external function node, includes the following steps: segmenting the complete method name of the external function node according to its semantic structure; selecting a specified number of segments; numerically processing and accumulating the characters in each segment; and normalizing the accumulated result to use as the main part of the embedding vector of the external function node. Segmenting according to semantic structure includes segmenting by package name, class name, method name, and parameter signature.

[0071] Specifically, this paper constructs a numerical embedding representation for external function nodes that reflects their functional semantics. Since external function nodes typically originate from system APIs or third-party libraries, their implementation code is not in the bytecode of the current Android application, and their instruction sequence cannot be obtained. Therefore, the same instruction-based embedding method as for internal functions cannot be used. To address this, this application instead utilizes the structured semantic information contained in their complete method names. Specifically, firstly, the complete method name of the external function (e.g., "android.content.Context.startActivity") is segmented according to its natural semantic structure, including components such as package name, class name, method name, and parameter signature. Then, a specified number (e.g., 7) of semantic segments are selected from right to left; if insufficient, empty strings are added, and excess segments are discarded to ensure consistency of the input dimensions. Next, for each selected semantic segment, the ASCII values ​​of all its characters are summed to obtain a numerical value representing the semantic strength of that segment. Finally, the vector composed of these summed values ​​is normalized to eliminate dimensional differences, forming a stable and comparable embedding vector body. This process cleverly transforms the invisible implementation of external functions into semantically discriminative feature vectors, enabling them to effectively participate in the context modeling of malicious behavior in graph neural networks, thereby compensating for the shortcomings of traditional methods in utilizing external call information.

[0072] In some embodiments of this application, a low-dimensional embedding vector is generated for each function node in the key subgraph of the function call graph, using a nine-dimensional vector. The first seven digits are represented. The eighth bit is specifically used to describe the attribute information of a function. Used as a node type identifier (1 for inner function nodes, 0 for outer function nodes), the ninth bit. Used as an importance identifier (1 for important function nodes, 0 otherwise).

[0073] For internal function nodes, the first seven features are obtained by acquiring their Dalvik instruction sequences and statistically analyzing them according to seven semantic instruction types: move, return, jump, conditional statement, data fetch, data storage, and function call, to obtain the frequency of each type of instruction. ,in After normalization, it constitutes It satisfies the following calculation formula (2): (2); In formula (2), where, and They represent The minimum and maximum values; For external function nodes, the first seven features are obtained by acquiring their complete method names (including package name, class name, method name, etc.), segmenting them into multiple sections according to semantic structure, and retaining the first seven sections from right to left (padding if insufficient, discarding if excessive). The ASCII codes of each character in each section are summed to obtain... ,in Referring to formula (2), after normalization, it constitutes This enables the encoding of semantic features that differentiate between internal and external function nodes.

[0074] In some embodiments of this application, the graph neural network model includes, but is not limited to, at least one of graph convolutional networks, graph attention networks, and GraphSAGE.

[0075] Specifically, Graph Convolutional Networks (GCNs) are used for structure-aware feature aggregation and learning of key subgraphs. By iteratively aggregating the embedding information of other nodes in the neighborhood of each node, it deeply fuses local topology with node semantic features, thereby generating more discriminative high-order node representations. Since malicious behavior often manifests in specific function call patterns or paths, GCNs can effectively capture anomalous combinations in these local structures, improving the model's ability to identify overall malicious software behavior patterns. Its concise and efficient convolutional mechanism is also suitable for processing compressed key subgraphs, ensuring both performance and computational efficiency.

[0076] This application introduces an attention mechanism to dynamically evaluate the importance of different neighboring nodes to the central node in a key subgraph. Compared to methods that aggregate neighbor information equally, GAT can adaptively assign weights to different adjacency functions based on the node embedding content—for example, certain external functions related to sensitive API calls may be more indicative in malicious scenarios, and GAT can automatically assign them higher attention scores. This differentiated aggregation approach allows the model to focus more on the call relationships that are truly crucial to classification decisions, enhancing sensitivity and interpretability to complex and covert malicious behaviors, and is particularly suitable for key subgraph structures with mixed internal and external functions and semantically heterogeneous structures.

[0077] This application presents GraphSAGE, which offers an inductive learning capability that allows it to generalize to novel application graph structures not seen during the training phase. By sampling a fixed number of neighbors and using learnable aggregation functions (such as mean, LSTM, or pooling) to generate node representations, it avoids dependence on the full graph Laplacian matrix, making it more suitable for handling large-scale or dynamically changing function call subgraphs. In this approach, GraphSAGE efficiently extracts general behavioral patterns from key subgraphs and maintains good detection performance when facing new Android applications, improving the scalability and practicality of the entire malware detection system.

[0078] Secondly, refer to Figure 2 This application provides an Android application detection system based on differentiated embedding, which includes the following modules.

[0079] The function call graph construction module is used to perform static analysis on the Android application to be tested and generate a function call graph, where nodes represent functions and directed edges represent the call relationships between functions. The important function identification module is used to perform statistical analysis on function nodes in the function call graph based on a training set containing malicious samples, and to identify important function nodes that are discriminative in malicious behavior, including internal function nodes and external function nodes. Among them, internal function nodes refer to functions defined by the Android application itself to be detected, while external function nodes refer to functions called by the Android application to be detected whose specific implementations are not in the current application file; The key subgraph extraction module is used to extract key subgraphs containing the neighborhood structure of important function nodes in the function call graph. The differential embedding generation module is used to employ a differential embedding strategy for internal and external function nodes in the key subgraph, including: performing semantic type statistics on internal function nodes based on their bytecode instructions, and accumulating semantic segmented character values ​​on external function nodes based on their method names, so as to generate the main body of the embedding vector respectively. The malicious application classification module is used to input the key subgraph and the embedding vectors corresponding to each node into the graph neural network model, and output the detection result of whether the Android application is benign or malicious.

[0080] Furthermore, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the aforementioned Android application detection method based on differentiated embedding.

[0081] In summary, the Android application detection method, system, and program products based on differentiated embedding provided in this application have the following technical effects.

[0082] First, a function call graph is constructed through static analysis, and important function nodes with high discriminative power in malicious behavior are identified by statistical analysis of the training set, achieving accurate localization of key behavioral features of malware. Second, key subgraphs are formed by adaptively extracting neighborhood structures centered on these important function nodes. This significantly reduces the size of the original graph and computational redundancy while effectively preserving the core call relationships that reflect malicious logic, balancing detection efficiency and information integrity. Third, differentiated semantic embedding strategies are designed for internal function nodes (including bytecode implementation) and external function nodes (only method signatures). The former characterizes its execution behavior based on the frequency statistics of Dalvik instruction types, while the latter characterizes its functional intent based on the semantic segmentation of method names and character numerical representation. This fully explores the semantic information of different types of nodes, making up for the shortcomings of the "one-size-fits-all" approach of traditional embedding methods. Finally, the concise and semantically rich key subgraphs and their nodes are embedded into input graph neural network models such as GCN, GAT, or GraphSAGE. By leveraging the powerful structural awareness and feature aggregation capabilities of graph models, high-precision end-to-end classification of benign or malicious attributes of Android applications is achieved. The overall solution deeply integrates program structure, behavioral semantics, and machine learning technologies, which improves detection accuracy while ensuring the feasibility of actual deployment, providing an efficient, robust, and scalable technical path for security protection on the Android platform.

[0083] It should be noted that in all specific embodiments of this application, all data processing activities related to user identity or personal characteristics, such as user information, user behavior data, historical data, and location information, will be conducted in accordance with the principles of legality, legitimacy, and necessity. All data collection, use, storage, and processing will be subject to compliance with applicable national and regional laws, regulations, and industry standards, and informed consent from users will be obtained in a clear and explicit manner before processing. For the processing of sensitive personal information, separate consent from users will be obtained through prominent means such as pop-up prompts and independent confirmation pages. If any processing conflicts with laws and regulations, the laws and regulations will prevail, and necessary data processing will only be carried out within the scope permitted by laws and regulations, ensuring that all data-based applications, analyses, and technical implementations are conducted within the scope permitted by laws and regulations.

[0084] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0085] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of ordinary skill of an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary skill. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.

[0086] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several programs to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0087] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequential list of executable programs for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, a program execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can retrieve and execute a program from or in conjunction with such a program execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain, store, communicate, propagate, or transmit a program for use by or in conjunction with a program execution system, apparatus, or device.

[0088] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Additionally, computer-readable media can even be paper or other suitable media on which programs can be printed, for example, by optically scanning the paper or other media, then editing, interpreting, or, if necessary, processing it in a suitable manner to obtain the program electronically, and then storing it in computer memory.

[0089] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable program execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0090] In the foregoing description of this specification, the reference to terms such as "one embodiment / implementation," "another embodiment / implementation," or "certain embodiments / implementations," etc., indicates that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in an embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0091] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0092] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A method for detecting Android applications based on differential embedding, characterized in that, Includes the following steps: Static analysis is performed on the Android application to be tested to generate a function call graph, where nodes represent functions and directed edges represent the call relationships between functions. Based on a training set containing malicious samples, statistical analysis is performed on the function nodes in the function call graph to identify important function nodes that are discriminative in malicious behavior, including internal function nodes and external function nodes. The internal function node refers to the function defined by the Android application to be detected, and the external function node refers to the function called by the Android application to be detected, whose specific implementation is not in the current application file. Centered on the important function node, extract the key subgraph containing its neighborhood structure from the function call graph; For the internal and external function nodes in the key subgraph, a differentiated embedding strategy is adopted, including: performing semantic type statistics on the internal function nodes based on their bytecode instructions, and accumulating the semantic segment characters of the external function nodes based on their method names, so as to generate the main body of the embedding vector respectively. The key subgraph and the embedding vectors corresponding to each node are input into the graph neural network model, which outputs the detection result of whether the Android application is benign or malicious.

2. The Android application detection method based on differentiated embedding according to claim 1, characterized in that, The step of statistically analyzing the function nodes in the function call graph based on a training set containing malicious samples to identify important function nodes that are discriminative in malicious behavior includes the following steps: Calculate the coverage rate and malicious tendency score of each function node in the malicious sample, and perform initial screening based on a preset threshold; For the function nodes after initial screening, various statistical testing methods are used to calculate their association strength with malicious tags. The association strengths are then normalized and fused to obtain a comprehensive score. The statistical testing methods include chi-square test, information gain, and Fisher score. Based on the comprehensive score, the function nodes with the highest ranking are selected as the important function nodes according to a preset proportion; the preset proportion is dynamically adjusted according to the distribution of training set samples.

3. The Android application detection method based on differentiated embedding according to claim 1, characterized in that, The step of extracting a key subgraph containing the neighborhood structure of the function call graph, centered on the important function node, includes the following steps: Under multiple candidate hop counts, the utility index of the corresponding subgraph is calculated respectively. The utility index is used to measure the balance between the preservation of the connection relationship between important function nodes and the subgraph size. The subgraph corresponding to the candidate hop count that maximizes the utility index is selected as the key subgraph.

4. The Android application detection method based on differentiated embedding according to claim 3, characterized in that, The utility index is calculated based on the retention ratio of the connection relationships between important function nodes, the retention ratio of subgraph nodes, and the retention ratio of subgraph edges; The utility index satisfies the following calculation formula: ； in, For the first The utility index of the key subgraph for jumping. The percentage of connections between important function nodes that are retained. Preserve the scale for the corresponding subgraph nodes. Preserve the proportions of the corresponding subgraph edges.

5. The Android application detection method based on differentiated embedding according to claim 4, characterized in that, The retention ratio of the connection relationships between the important function nodes is calculated as follows: In the critical subgraph with a jump count of n, count whether the connection relationship between any two important function nodes in the original function call graph is preserved. If it is preserved, it is counted as a valid connection. Divide the number of valid connections by the total number of connections between all important function node pairs in the original function call graph to obtain the retention ratio of the connection relationships between the important function nodes.

6. The Android application detection method based on differentiated embedding according to claim 1, characterized in that, Generating embedding vectors for the internal function nodes includes the following steps: Obtain the bytecode instruction sequence of the internal function node, classify and count the instructions according to the predefined instruction types, and normalize the occurrence frequency of each type of instruction as the main part of the embedding vector of the internal function node; The predefined instruction types include move, return, jump, conditional judgment, data acquisition, data storage, and function call.

7. The Android application detection method based on differentiated embedding according to claim 1, characterized in that, Generating an embedding vector for the external function node includes the following steps: The complete method name of the external function node is segmented according to semantic structure. A specified number of segments are selected, and the characters of each segment are numerically processed and accumulated. The accumulated result is normalized and used as the main part of the embedding vector of the external function node. The segmentation based on semantic structure includes segmentation based on package name, class name, method name, and parameter signature.

8. The Android application detection method based on differentiated embedding according to claim 1, characterized in that, The graph neural network model includes, but is not limited to, at least one of graph convolutional networks, graph attention networks, and GraphSAGE.

9. An Android application detection system based on differentiated embedding, characterized in that, Includes the following modules: The function call graph construction module is used to perform static analysis on the Android application to be tested and generate a function call graph, where nodes represent functions and directed edges represent the call relationships between functions. The important function identification module is used to perform statistical analysis on the function nodes in the function call graph based on a training set containing malicious samples, and to identify important function nodes that are discriminative in malicious behavior, including internal function nodes and external function nodes. The internal function node refers to the function defined by the Android application to be detected, and the external function node refers to the function called by the Android application to be detected, whose specific implementation is not in the current application file. The key subgraph extraction module is used to extract key subgraphs containing the neighborhood structure of the function call graph, with the important function node as the center. The differential embedding generation module is used to employ a differential embedding strategy for the internal function nodes and external function nodes in the key subgraph, including: performing semantic type statistics on the internal function nodes based on their bytecode instructions, and accumulating the semantic segment characters of the external function nodes based on their method names, so as to generate the main body of the embedding vector respectively. The malicious application classification module is used to input the key subgraph and the embedding vectors corresponding to each node into the graph neural network model, and output the detection result of whether the Android application is benign or malicious.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the Android application detection method based on differential embedding as described in any one of claims 1 to 8.

Images