Mobile malicious software detection method based on heterogeneous flow fusion
By employing a heterogeneous flow fusion approach, utilizing a heterogeneous information network of control flow, data flow, and ICC flow, along with context-aware HIN embedding and a channel attention-based DNN classifier, the problem of insufficient detection accuracy in existing technologies is addressed, achieving more efficient malware detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-30
- Publication Date
- 2026-03-27
AI Technical Summary
Existing malware detection methods fail to fully utilize the collaborative capabilities of heterogeneous stream semantics and lack context awareness, resulting in insufficient detection accuracy.
A heterogeneous flow fusion approach is adopted, which explicitly models the heterogeneous information network (HIN) of control flow, data flow and ICC flow, and combines the context-aware HIN embedding method (flow2vec) and the channel attention-based DNN classifier to fuse multi-flow information for malware detection.
It achieves more efficient malware detection, improves detection accuracy, and outperforms existing methods, especially in detection performance under various malicious scenarios.
Smart Images
Figure CN121744313A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of network security, and particularly relates to a mobile malicious software detection method based on heterogeneous flow fusion. BACKGROUND
[0002] Android is the platform with the highest market share of mobile operating systems in the world, and the openness of development makes the Android platform an intrusion target for various malicious software and other potentially harmful applications. These applications steal user privacy, abuse short messages / calls, secretly subscribe to premium services, etc. At the same time, the characteristics of Android malware are also evolving, which requires the use of effective and reliable detection technology in the Android ecosystem.
[0003] Static analysis techniques usually extract control flow, data flow and inter-component communication (ICC) as basic products for checking the intrinsic semantics of application behavior to discover hidden malicious activities. Control flow determines the execution order of program statements, data flow tracks the path of data, and ICC manages the interaction between different application components. These three flow-related semantic information are intrinsically related to various APIs, involving trigger conditions, data transmission and communication patterns, which are key indicators for evaluating the maliciousness of application behavior. Therefore, effectively utilizing these flow-related semantics is crucial for achieving accurate malware detection.
[0004] Existing malware detection schemes have not fully utilized the synergistic capabilities of heterogeneous flow semantics, and have not combined context awareness to achieve deep fusion of multi-flow information. Specifically, flow-based methods usually only utilize part of the flow information in the application, focusing only on the use features of sensitive data flow, without involving the semantic association of control flow and ICC flow. ICC feature detection alone cannot capture the transmission trajectory of sensitive data in the data flow. Relying on control flow analysis and taint tracking to identify specific malicious behaviors (virtualization applications, logic bombs) alone does not establish semantic complementary relationships between multiple flows, which can easily lead to incomplete analysis and missed hidden malicious behaviors.
[0005] Non-flow-based methods lack fine-grained program clues: traditional permission analysis methods only rely on permission combinations to judge, and cannot reflect the dynamic behavior intention of the application; machine learning (ML) based methods, although integrating multiple features, do not design special representation models for flow semantics, making it difficult to preserve the structure and context information of the flow; large language model (LLM) based methods (such as AppPoet) detect through multi-view prompting engineering, but do not introduce context constraints of heterogeneous flows, and lack the ability to capture fine-grained flow semantics.
[0006] Therefore, the above methods have not achieved the fusion of heterogeneous flow semantics of "control flow-data flow-ICC flow", and lack context awareness, resulting in limited detection accuracy. SUMMARY
[0007] In order to solve the problem that the existing method is difficult to fully utilize the heterogeneous flow information and lacks context awareness ability, resulting in insufficient detection accuracy, the application combines the semantic information of the heterogeneous flow to provide a reliable research direction for more effective capture of malicious behavior, and further proposes a mobile malware detection method based on heterogeneous flow fusion.
[0008] In order to achieve the above purpose, the technical scheme adopted by the application is:
[0009] A mobile malware detection method based on heterogeneous flow fusion utilizes the semantic information of three flow-related Control-flow, Data-flow and ICC-flow to accurately analyze the application program, and the specific steps are as follows:
[0010] (1) The relationship between entities (API, App, Cond, Action, Comp) from different flows is modeled by using a heterogeneous information network (HIN) explicitly, and the semantic correlation of the heterogeneous flow is retained;
[0011] (2) A meta-path group is constructed for each flow view (Control-flow, Data-flow, ICC-flow), each group containing a content-oriented (describing flow components / structure) and an action-oriented (describing flow usage patterns) meta-path, and the semantic correlation between applications is established;
[0012] (3) The context-aware HIN embedding method (flow2vec) distinguishes the semantic of HIN entities of different flows based on context constraints through the process of "anchor node optimization HIN structure-meta path group guided random walk-Skip-gram learning representation";
[0013] (4) The semantic embedding of each view is fused and its contribution is weighted by a channel attention-based DNN classifier to realize accurate detection.
[0014] As a preferred technical scheme of the application, step (1) obtains flow-based feature raw data through a data collection component by using a static analysis tool, including:
[0015] 1) Extract Control-flow view information: use the Soot framework to obtain the conditions of control-sensitive API execution;
[0016] 2) Extract Data-flow view information: run FlowDroid to collect the intra-component and inter-component data flow paths of each application, then obtain a pair of APIs (i.e. source API and sink API) from each path, and record the application using the API;
[0017] 3) Extract ICC view information: Run IccTA to get ICC links from the application, and extract the Intent and source component operations from each ICC link;
[0018] Based on the above raw data, meaningful features are automatically extracted, and various relationships between different types of entities are analyzed.
[0019] The entity types described in step (1) include API (program programming interface), App (application), Cond (condition), Action (operation), and Comp (component), and there are seven relationships between them, namely R1: contains, R2: triggers, R3: uses, R4: flows to, R5: sets, R6: declares, and R7: initiates, wherein App is connected to Cond, API, Action, and Comp through R1, R3, R5, and R6, respectively, Cond is connected to API through R2, Comp is connected to Action through R7, and API is connected through R4; The network mode of the working HIN enables the application to comprehensively represent by simultaneously merging information from multiple views.
[0020] As a preferred technical solution of the present application, in step (2), different types of semantic information are aggregated from HIN, and then the meta-paths are grouped into three different but related views, namely control flow, data flow, and ICC; Each group includes a content-oriented meta-path (MP1) and an action-oriented meta-path (MP2), which work together to capture various relationships within the view.
[0021] As a preferred technical solution of the present application, in step (3), the context-aware HIN embedding method (flow2vec) distinguishes the semantics of HIN entities based on the context constraints of different flows, and learns accurate application representations by jointly using multiple meta-paths, which consists of the following three parts:
[0022] 1) HIN graph optimization: By cloning "anchor nodes", re-establishing connections based on meta-path group semantic constraints, and correcting the structural accuracy of HIN, the optimized HIN is generated by identifying anchor nodes, obtaining front and rear dependencies, cloning and reconnecting, removing redundancies, and deleting original anchor nodes, which avoids information redundancy and ensures that the association of entities in HIN conforms to the actual flow context;
[0023] 2) Meta-path group guided random walk: By guiding random walk through "meta-path groups", a node sequence containing multi-view semantics is generated, and the generated sequence can simultaneously capture the structural and semantic relationships of the application in control flow, data flow, and ICC flow;
[0024] 3) Skip-gram-based representation model: First, the input is a large number of node sequences generated by random walks guided by metapath groups; then, the Skip-gram model is used with the training objective of "predicting target nodes through context nodes" to learn the vector features of nodes; finally, all nodes in HIN are mapped to a fixed-dimensional vector space, where the vector of APK is the final representation of the application, which can be directly used as the input of the subsequent malware classification model.
[0025] As a preferred technical solution of the present invention, in step (4), the channel attention-based DNN classifier extracts each feature vector from the flow view as a different channel, and then uses channel attention to adaptively reweight each feature vector to fuse semantics; the input of the channel attention-based DNN classifier is the feature vectors of the three views generated by flow2vec: each view (control flow, data flow, ICC flow) corresponds to a vector of 1 channel, which is represented as a matrix. ,in , representing 3 channels, This represents the dimension of each vector.
[0026] First, the feature vectors from the three views are processed using both average pooling and max pooling operations. Semantic information aggregation is performed to generate two intermediate vectors: and Then, the two vectors are added element-wise to generate weight information; the feature vectors are fused using the weight information and a channel attention mechanism, and the fused feature vector is output. ; final fusion characteristics It is fed into a 6-layer multilayer perceptron (MLP) and outputs malware detection results.
[0027] This invention proposes a mobile malware detection method based on heterogeneous flow fusion, where each flow type provides a unique view for characterizing application behavior. For example, data flow paths can explicitly track how sensitive data moves from a source to a receiver, providing important insights into potential data leaks. Each individual view is capable of analyzing specific characteristics of malware, but is limited by its evaluation scope. Therefore, integrating the semantics of multiple flow types promises to leverage their complementary advantages, enhance the understanding of application behavior, and uncover malicious information hidden in application code.
[0028] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0029] (1) Innovative heterogeneous flow fusion framework: The proposed MalFlows is the first Android malware detection technology that fully aggregates the semantics of heterogeneous flows such as "control flow-data flow-ICC flow". Through HIN modeling and flow2vec embedding, it solves the problem that existing methods only utilize single flow information.
[0030] (2) Efficient context-aware HIN embedding: This invention designs a new context-aware HIN embedding method called flow2vec, which distinguishes the semantics of HIN entities based on the context constraints of different flows and learns accurate application representations by jointly using multiple meta-paths.
[0031] (3) Precise channel attention fusion: The channel attention-based model can adaptively weight the contributions of each view, maintaining high detection accuracy under different malicious scenarios. A comprehensive evaluation of more than 31,000 real-world applications and more than 20 million program flow instances shows that MalFlows outperforms existing data flow-based detection methods. Attached Figure Description
[0032] Figure 1 This is a diagram of the overall architecture of MalFlows.
[0033] Figure 2 The network mode is HIN.
[0034] Figure 3 This is a schematic diagram of the metapath.
[0035] Figure 4 This is a deep neural network classifier based on the attention mechanism.
[0036] Figure 5 This is the APK information table.
[0037] Figure 6 This is the HIN node relationship table.
[0038] Figure 7 This is the HIN information table.
[0039] Figure 8 This is the result of the Data-flow walkthrough.
[0040] Figure 9 This is the feature vector of Data-flow. Detailed Implementation
[0041] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings.
[0042] Example 1
[0043] This invention proposes a mobile malware detection method (MalFlows) based on heterogeneous stream fusion, and the overall architecture adopted is shown in the attached figure. Figure 1 As shown, they are introduced below:
[0044] 1. Data Collection: Data collection is primarily handled by a data collection component that uses readily available static analysis tools to obtain flow-based features. Specifically, MalFlows uses IccTA to collect explicit and implicit ICC links. Additionally, it uses FlowDroid to collect sensitive data flow paths within and between components. Furthermore, it uses the Soot framework to obtain conditional statements for protected sensitive APIs. Based on this raw data, MalFlows automatically extracts meaningful features (e.g., trigger conditions, sensitive APIs) and then analyzes various relationships (e.g., condition-trigger-API) between different types of entities (e.g., conditions, APIs).
[0045] 1) Extracting Control-flow view information: The Soot framework is used to obtain the conditions for executing control-sensitive APIs. Specifically, the application code is first converted into Soot's internal representation, Jimple. Then, the sensitive APIs are located in the Jimple code based on their API signatures. The triggering conditions and their triggering semantics are extracted according to the AppScalpel strategy implemented by the Soot API.
[0046] 2) Extracting Data-flow view information: The use of sensitive data within an application is one of the most important clues for identifying hidden malicious activity. This invention uses FlowDroid to collect data flow paths within and between components of each application. Then, it retrieves a pair of APIs (i.e., a source API and a receiver API) from each path and records the applications that use the APIs.
[0047] 3) Extracting ICC View Information: The ICC mechanism can be exploited by malware to launch stealth attacks, such as data leaks, code obfuscation, and privilege escalation. To enhance the detectability of MalFlows' ICC-based malicious behavior, this invention runs IccTA to obtain ICC links from the application and extracts the Intent and source component operations from each ICC link.
[0048] 2. Network Model Based on Heterogeneous Information
[0049] To describe the rich relationships between extracted Android entities, it is crucial to model them appropriately for better analysis and processing of diverse relationships. Therefore, this invention employs a Hierarchical Interconnected Network (HIN) capable of incorporating different types of features. The HIN not only provides a network structure for data association but also offers a high-level abstraction of these associations. The definition of the HIN and its network graph is presented below:
[0050] 1) Network Architecture Generation: This invention features 5 entity types (API (Programming Interface), App (Application), Cond (Cond), Action (Run), and Comp (Component)) and 7 relationships between them (R1: Containment, R2: Trigger, R3: Use, R4: Flow, R5: Setting, R6: Declaration, R7: Initiation). App connects to Cond, API, Action, and Comp via R1, R3, R5, and R6 respectively; Cond connects to API via R2; Comp connects to Action via R7; and API connects via R4. The working HIN network pattern enables applications to be comprehensively represented by simultaneously incorporating information from multiple views.
[0051] 2) Meta-path design: Different types of entities and relationships prompt this invention to use machine-readable representations to enrich the semantics of similarity between applications. Similarity is the basis for measuring the maliciousness of applications.
[0052] Given a network pattern with different types of entities and relationships, this invention enumerates numerous meta-paths. Based on expert domain knowledge, this invention designs six meaningful meta-paths to characterize the relevance between applications. To aggregate different types of semantic information from the HIN, the meta-paths are then grouped into three distinct but related views: control flow, data flow, and ICC. Each group includes a content-oriented meta-path (e.g., MP1) and an action-oriented meta-path (e.g., MP2), which work together to capture various relationships within the view. This invention selects two of the most representative meta-paths to demonstrate the effectiveness of MalFlows.
[0053] The network modes of the above HIN are as follows: Figure 2 As shown in the attached diagram, the metapath is... Figure 3 As shown.
[0054] 3. Meta-path walking sampling
[0055] This invention designs a novel context-aware HIN embedding method called flow2vec, which distinguishes the semantics of HIN entities based on contextual constraints of different flows and learns accurate application representations by jointly using multiple meta-paths.
[0056] To measure the relevance of entities in the constructed HIN, an effective representation learning method must be employed, which efficiently aggregates structural and semantic relationships across various flows. This method mainly consists of the following three parts:
[0057] 1) HIN Graph Optimization: The original HIN easily overlooks contextual constraints between entities, leading to semantic confusion. By cloning "anchor nodes" and re-establishing connections based on the semantic constraints of meta-path groups, the structural accuracy of the HIN is corrected. This is achieved by identifying anchor nodes, obtaining dependencies, cloning and reconnecting, removing redundancy, and deleting original anchor nodes to avoid information redundancy and generate an optimized HIN. Ultimately, this ensures that the associations of entities in the HIN conform to the actual flow context; for example, the same API may be split into different nodes in different applications, avoiding semantic confusion across applications.
[0058] 2) Random walk guided by meta-path groups: A single meta-path can only capture the relationship in one dimension of the HIN, failing to cover the complementary semantics of multiple views (control flow, data flow, ICC flow), and traditional random walks are prone to missing key structural information. Based on the optimized HIN, random walks guided by "meta-path groups" generate node sequences containing multi-view semantics. The generated sequences can simultaneously capture the structural and semantic relationships applied in control flow, data flow, and ICC flow.
[0059] 3) Skip-gram-based representation model: The core of the Skip-gram model's embedding learning is to transform the discrete node sequences generated by random walks into low-dimensional, computationally achievable vector representations that preserve the semantic and structural relationships of the nodes. In its implementation, the input is a large sequence of nodes generated by a random walk guided by metapath groups; then, the Skip-gram model is used, with the training objective of "predicting target nodes through context nodes," to learn the vector features of the nodes; finally, all nodes in the HIN are mapped to a fixed-dimensional vector space, where the APK vector is the final representation of the application, which can be directly used as input for subsequent malware classification models.
[0060] 4. DNN classifier based on attention mechanism
[0061] To leverage the semantic advantages of heterogeneous streams for application behavior analysis, this invention designs a channel attention-based DNN classifier. For an application, each feature vector extracted from the stream view is treated as a distinct channel, and then each feature vector is adaptively reweighted using channel attention to fuse semantics. This process enhances the most informative representation while suppressing less relevant ones, resulting in a more comprehensive and discriminative fused representation for accurate malware classification.
[0062] The classifier's input is the feature vectors from three views generated by flow2vec: each view (control flow, data flow, ICC flow) corresponds to a vector with one channel, and the whole thing is represented as a matrix. ,in , representing 3 channels, This represents the dimension of each vector. By leveraging the "dynamic weighting" characteristic of channel attention, the problem of varying contribution levels of different views under different malicious behavior scenarios is addressed.
[0063] 1) Heterogeneous Stream Fusion Based on Attention Mechanism: This invention first processes the feature vectors from three views using both average pooling and max pooling operations. Semantic information aggregation is performed. Average pooling preserves overall information and avoids feature loss, while max pooling captures the most important features. These operations generate two intermediate vectors: and Then, the two vectors are added element-wise to generate weight information. The feature vectors are then fused using the weight information and a channel attention mechanism, and the fused feature vector is output. .
[0064] 2) Malware classifier: fused features The data is fed into a 6-layer Multilayer Perceptron (MLP) and outputs malware detection results. During training, the cross-entropy function is used as the loss function. To avoid overfitting, a random dropout regularization method is employed during model training, causing the model to randomly skip some units during training. The final model outputs mobile application detection results.
[0065] A DNN classifier based on the attention mechanism is attached. Figure 4 As shown.
[0066] A comprehensive evaluation of over 31,000 real-world applications and over 20 million process flow instances in this invention demonstrates that MalFlows outperforms existing data flow-based detection methods. The detection results are shown in the table below:
[0067] Detection method / Evaluation index Accuracy Precision Recall F1 score Drebin 93.97% 94.30% 92.40% 93.33% HinDroid 95.33% 95.26% 95.57% 95.42% MaMaDroid 91.14% 94.96% 91.85% 93.37% AppPoet 95.81% 91.28% 94.99% 93.10% MalFlows (Ours) 98.34% 98.98% 98.64% 98.81%
[0068] Example 2
[0069] Application examples:
[0070] 1. Data Extraction: Input an APK file, the Data Collection component extracts information, and the output consists of data related to Data-flow, Control-flow, and ICC views. The results are stored in [location missing]. Figure 5The data is stored in a table (where controllowinfo represents the data table storing control flow information). After extraction, the data undergoes simple processing to extract the node information related to building the HIN and save it. Figure 6 The data table (where apk_api represents the relationship table between APK and API).
[0071] 2. Constructing a Heterogeneous Information Network Model: The node relationship table output by the Data Collection component is used as input to construct the HIN. The HIN contains 5 entity types (API, App, Cond, Action, Comp) and 7 relationships between them, thereby constructing a network model to achieve a comprehensive representation of the application. The constructed HIN is as follows: Figure 7 As shown, this includes the number of nodes and the number of edges between nodes.
[0072] 3. Meta-path walk-based data acquisition (flow2vec): Based on the constructed HIN, the heterogeneous graph is first optimized using anchor nodes to avoid semantic confusion across applications. Combined with random walks guided by meta-path groups, a node sequence containing multi-view (control flow, data flow, ICC flow) semantics is generated and saved in a txt file, such as... Figure 8 The random walk results are generated from the Data-flow view. Then, based on the Skip-gram representation model, the discrete node sequences generated by the random walk are transformed into low-dimensional, computable vector representations that preserve node semantics. Finally, a 128-vector is generated for each node in the view, and the output is saved in a txt file, such as... Figure 9 The node feature vector representation of the Data-flow view in China.
[0073] 4. Attention-based DNN classifier: The input is the feature vector matrix of three views (control flow, data flow, and ICC flow) generated by flow2vec. A channel attention mechanism is used to assign different weights to the three views of each APK, combining the feature information. Then, the feature vectors of the three views are fused according to their weights to obtain a feature vector that integrates the information from the three views. This fused feature vector is fed into the neural network for detection, and the final output is the application's detection result.
Claims
1. A method for detecting mobile malware based on heterogeneous stream fusion, characterized in that, By utilizing the semantic information related to three types of flows—control flow, data flow, and ICC flow—the application can be accurately analyzed. The specific steps are as follows: (1) The heterogeneous information network (HIN) is used to explicitly model the relationships between entities (API, App, Cond, Action, Comp) from different streams, preserving the semantic relevance of heterogeneous streams; (2) Build metapath groups for each flow view (control flow, data flow, ICC flow). Each group contains content-oriented (describes flow components / structure) and action-oriented (describes flow usage patterns) metapaths to establish semantic relevance between applications. (3) The context-aware HIN embedding method (flow2vec) distinguishes the semantics of HIN entities in different flows based on context constraints through the process of "anchor node optimization of HIN structure - meta-path group guided random walk - Skip-gram learning representation". (4) Accurate detection is achieved by fusing the semantic embeddings of each view and weighting their contributions through a channel attention-based DNN classifier.
2. The mobile malware detection method based on heterogeneous stream fusion as described in claim 1, characterized in that, Step (1) Obtain raw feature data based on the stream using static analysis tools through the data collection component, including: 1) Extract Control-flow view information: Use the Soot framework to obtain the conditions for executing control-sensitive APIs; 2) Extract Data-flow view information: Run FlowDroid to collect the data flow paths within and between components of each application, then obtain a pair of APIs (i.e., source API and receiver API) from each path, and record the applications that use the APIs; 3) Extract ICC view information: Run IccTA to obtain ICC links from the application, and extract the Intent and source component operations from each ICC link; Based on the above raw data, meaningful features are automatically extracted, and then various relationships between different types of entities are analyzed.
3. The mobile malware detection method based on heterogeneous stream fusion as described in claim 2, characterized in that, The entity types mentioned in step (1) include: API (Programming Interface), App (Application), Cond (Condition), Action (Run), and Comp (Component). There are 7 relationships between them, namely R1: contain, R2: trigger, R3: use, R4: flow, R5: set, R6: declare, and R7: initiate. Among them, App is connected to Cond, API, Action, and Comp through R1, R3, R5, and R6 respectively. Cond is connected to API through R2, Comp is connected to Action through R7, and API is connected through R4. The working HIN network mode enables the application to be fully represented by simultaneously merging information from multiple views.
4. The mobile malware detection method based on heterogeneous stream fusion as described in claim 3, characterized in that, In step (2), in order to aggregate different types of semantic information from HIN, the metapaths are then grouped into three different but related views: control flow, data flow, and ICC; each group includes a content-oriented metapath (MP1) and an action-oriented metapath (MP2), which work together to capture various relationships within the view.
5. The mobile malware detection method based on heterogeneous stream fusion as described in claim 4, characterized in that, In step (3), the context-aware HIN embedding method (flow2vec) distinguishes the semantics of HIN entities based on the context constraints of different flows, and learns accurate application representations by jointly using multiple meta-paths. It consists of the following three parts: 1) HIN Graph Optimization: By cloning "anchor nodes" and re-establishing connections based on the semantic constraints of metapath groups, the structural accuracy of the HIN is corrected. By identifying anchor nodes, obtaining dependencies, cloning and reconnecting, removing redundancy, and deleting original anchor nodes, information redundancy is avoided, and an optimized HIN is generated. Finally, it is ensured that the association of entities in the HIN conforms to the actual flow context. 2) Meta-path group-guided random walk: Random walks are guided by "meta-path groups" to generate a sequence of nodes containing multi-view semantics. The generated sequence can simultaneously capture the structural and semantic relationships applied in control flow, data flow, and ICC flow. 3) Skip-gram-based representation model: First, the input is a large number of node sequences generated by random walks guided by metapath groups; then, the Skip-gram model is used with the training objective of "predicting target nodes through context nodes" to learn the vector features of nodes; finally, all nodes in HIN are mapped to a fixed-dimensional vector space, where the vector of APK is the final representation of the application, which can be directly used as the input of the subsequent malware classification model.
6. The mobile malware detection method based on heterogeneous stream fusion as described in claim 5, characterized in that, In step (4), the channel attention-based DNN classifier extracts each feature vector from the flow view as a different channel, and then adaptively reweights each feature vector using channel attention to fuse semantics. The input to the channel attention-based DNN classifier is the feature vectors of the three views generated by flow2vec: each view (control flow, data flow, ICC flow) corresponds to a vector of one channel, and the whole is represented as a matrix. ,in , representing 3 channels, This represents the dimension of each vector.
7. The mobile malware detection method based on heterogeneous stream fusion as described in claim 6, characterized in that, In step (4), the feature vectors from the three views are first processed using both average pooling and max pooling operations. Semantic information aggregation is performed to generate two intermediate vectors: and Then, the two vectors are added element-wise to generate weight information; the feature vectors are fused using the weight information and a channel attention mechanism, and the fused feature vector is output. ; final fusion characteristics It is fed into a 6-layer multilayer perceptron (MLP) and outputs malware detection results.