Android malicious software detection method based on multi-evidence fusion mixed heterogeneous graph

Abstract

The invention relates to an Android malicious software detection method based on a multi-evidence fusion mixed heterogeneous graph. The method comprises the following steps: collecting an Android application data set and preprocessing the Android application data set; extracting a function call graph and a runtime event graph of the application program through static analysis and dynamic analysis respectively; utilizing a multi-evidence similarity fusion mechanism, combining code semantics, permission consistency and time frequency characteristics, associating static function nodes with dynamic event nodes, and constructing a hybrid heterogeneous graph; performing feature coding on nodes and edges in the graph; a deep learning framework is built, an improved reliability calibration heterogeneous graph model is adopted, and the model comprises confidence calibration attention and a reliability gating mechanism; and a final classifier is obtained through model iteration training. According to the method, the static structure and the dynamic behavior characteristics can be effectively fused, the noise is suppressed through the reliability of the automatic calibration edge, and the accuracy and robustness of Android malicious software detection are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of interdisciplinary technology of network security and artificial intelligence, and specifically relates to an Android malware detection method based on multi-evidence fusion and hybrid heterogeneous graphs. Background Technology

[0002] The Current State of Android Malware Threats: As a mainstream mobile operating system globally, Android holds a huge market share, making it a primary target for malware attacks. With the continuous evolution of malware technology, its attack methods are becoming increasingly sophisticated, including stealing user privacy, damaging system data, and committing financial fraud, posing a serious challenge to users' data and financial security.

[0003] Limitations of Existing Detection Technologies Current Android malware detection methods are mainly divided into three categories: static analysis, dynamic analysis, and hybrid analysis. However, each has its own obvious limitations: (1) Static analysis: Detection is performed by examining the application's code structure (such as control flow graphs and API calls). However, when faced with advanced escape techniques such as code obfuscation, packing, and dynamic loading, static features are easily hidden or altered, leading to detection failure; (2) Dynamic analysis: Detection is performed by monitoring the application's runtime behavior in a sandbox environment. Although it can capture real behavior, it is limited by code coverage, making it difficult to trigger all malicious paths, and it is easily circumvented by anti-sandbox technologies.

[0004] The shortcomings of existing hybrid analysis and graph methods (the core pain point this invention aims to address): To overcome the limitations of single analysis methods, researchers have proposed hybrid analysis methods that combine static and dynamic features. However, existing technologies suffer from the following key problems:

[0005] Shallow fusion mechanisms: Most existing hybrid analysis methods only employ simple feature splicing or shallow fusion mechanisms. This approach cannot effectively capture the complex causal relationships and temporal correlations between static code structure and dynamic runtime behavior, resulting in the continued existence of the "semantic gap."

[0006] Fragmentation and Noise Issues in Graph Structure Construction: Although graph structures are widely used to represent program features, existing graph construction methods are often limited to a single perspective (static or dynamic only) or lack fine-grained association evaluation when constructing hybrid graphs. When simply connecting static function nodes with dynamic event nodes, a large number of spurious associations are often introduced due to a lack of reliability verification, resulting in a large number of unreliable edges in the graph structure.

[0007] Graph representation learning lacks reliability modeling: Traditional graph neural networks (such as GCN and GraphSAGE) typically assume that all edges are equally reliable when dealing with such mixed graphs. They lack an automatic evaluation mechanism for edge confidence and directly perform message passing on noisy graphs, causing noise to spread as the number of layers increases, ultimately affecting the model's accuracy and generalization ability in detecting malware.

[0008] Therefore, how to construct a unified graph that can deeply integrate static and dynamic features and automatically calibrate the reliability of edges to suppress noise during the model learning process is a technical problem that urgently needs to be solved in the field of Android malware detection. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to provide an Android malware detection method based on multi-evidence fusion and hybrid heterogeneous graphs, which addresses the above-mentioned shortcomings.

[0010] To solve the above technical problems, the present invention adopts the following solution:

[0011] An Android malware detection method based on multi-evidence fusion and heterogeneous graphs includes the following steps:

[0012] Step 1: Create a dataset by collecting APK applications containing both malicious and benign Android software to build a training set;

[0013] Step 2: Perform dual feature extraction on the APKs in the dataset. Extract the function call graph through static analysis and prune it based on the file I / O API list obtained from dynamic analysis. Then, capture file operation and time series information in the sandbox environment through dynamic analysis to construct a runtime event graph.

[0014] Step 3: Connect the nodes in the extracted function call graph and the nodes in the dynamic event graph with heterogeneous edges, calculate the multi-evidence similarity between static function nodes and dynamic event nodes in terms of semantics, permissions and time frequency, establish cross-view connections based on similarity thresholds, and merge the function call graph and runtime event graph into a unified hybrid heterogeneous graph.

[0015] Step 4: Encode the features of the nodes and edges in the hybrid heterogeneous graph and convert them into vector representations that the model can process;

[0016] Step 5: Construct a malware detection model and build a reliability-calibrated heterogeneous graph Transformer model. This model includes an RCHGTConv encoder, a type-aware hybrid pooling module, and a classifier. The RCHGTConv encoder introduces a confidence-calibrated attention mechanism and a reliability gating mechanism to automatically evaluate and distinguish the reliability of edges during information propagation and output heterogeneous node features. The type-aware hybrid pooling module is used to aggregate the output heterogeneous node features to generate a global vector representation that can characterize the structure and behavior information of the entire graph. The classifier is used to predict the global vector representation and output the classification result of the APK application.

[0017] Step 6: Train the malware detection model using the training set, calculate the loss function, and update the model parameters through multiple iterations to obtain the trained detection model. Finally, use the trained detection model to detect whether the Android application under test is malicious.

[0018] Furthermore, step 2 specifically includes the following steps:

[0019] Step 2-1: Use the Androguard reverse engineering tool to decompile the APK file and parse the Dalvik bytecode to construct a preliminary static function call graph;

[0020] Step 2-2: Execute the APK in the sandbox environment, monitor system API calls through Hook technology, record file read, write, creation, deletion and other operations and corresponding timestamps, obtain file operation and time sequence information in the sandbox environment, and dynamically analyze and generate a list containing file I / O related APIs;

[0021] Step 2-3: Then, using the list of file I / O related APIs generated by dynamic analysis as a guide, K-top pruning is performed on the preliminary static function call graph obtained in Step 2-1, retaining only the key API nodes related to file I / O operations and their K most related neighbor nodes (K=2), to obtain the final static function call graph after compression.

[0022] Step 2-4: Filter the original event logs of file operations and time series obtained in Step 2-2 based on the preset sensitive path whitelist, remove system-level file activities with no distinguishability, retain key file operation sequences, and generate a dynamic runtime event graph containing event nodes and file nodes.

[0023] Furthermore, step 3 specifically includes the following steps:

[0024] Step 3-1: Utilize the pre-trained code model CodeBERT to vectorize and encode the function signatures of the static function call graph and the event operation descriptions of the dynamic runtime event graph, respectively, and calculate their cosine similarity as semantic similarity evidence; extract the set of static permissions required for function calls and the set of dynamic permissions required for event runtime, and evaluate the evidence of permission consistency by determining whether there is an intersection between the two; count the number of occurrences and duration of events during sandbox operation, and perform log normalization based on the maximum number of occurrences and the maximum duration to obtain frequency evidence reflecting the stability of event behavior;

[0025] Step 3-2: The obtained semantic similarity evidence, authorization consistency evidence, and stability frequency evidence are weighted and summed according to preset weight coefficients to obtain a comprehensive similarity score, and a similarity filtering threshold is set.

[0026] Step 3-3: Traverse all possible function pairs in the static function call graph and event pairs in the dynamic runtime event graph. When the overall similarity score exceeds the similarity filtering threshold, establish a heterogeneous edge fx_event between the corresponding function and event node to represent a strong association.

[0027] Steps 3-4: Check the file path involved in the event. If the path belongs to the preset sensitive file whitelist, then establish a heterogeneous edge fx_file between the function node and the file node, and finally form a hybrid heterogeneous graph containing three types of nodes: Function, Event, and File, and five types of edges: call, access, next, fx_event, and fx_file.

[0028] Furthermore, step 4 specifically includes the following steps:

[0029] Step 4-1: Vectorize the various node features in the hybrid heterogeneous graph obtained in Step 3-4. The Function node features include structural features such as the number of calls and in-degree, as well as semantic features obtained by processing the function signature through a document embedding algorithm. The Event node features include operation type represented by one-hot encoding, normalized occurrence frequency, and normalized timestamp features. The File node features include one-hot encoded features of the file path suffix and normalized access frequency features.

[0030] Step 4-2: Embed the edge features in the hybrid heterogeneous graph and unify the feature space; specifically, the call edge, access edge, and fx_file edge are directly represented using relation type embedding vectors; the time-series next edge is concatenated with the relation type embedding vector and the time interval feature of the event occurrence; the heterogeneous edge fx_event is concatenated with the relation type embedding vector and the comprehensive similarity value calculated in step 3-2 to retain confidence information.

[0031] Step 4-3: Construct a linear projection layer to map all node feature vectors and edge feature vectors of different dimensions described in Steps 4-1 and 4-2 to a feature space of uniform dimension.

[0032] Furthermore, the malware detection model workflow in step 5 specifically includes the following steps:

[0033] Step 5-1: In the RCHGTConv encoder, the first RCHGTConv encoding layer processes the input data sequentially using a message passing mechanism based on confidence-calibrated attention and a reliability gating mechanism. After inter-layer regularization, the output data is input into the next RCHGTConv encoding layer for processing, and the output data is input into a type-aware hybrid pooling module.

[0034] The message passing mechanism based on confidence-calibrated attention is used to introduce the comprehensive similarity or frequency stability retained in the edge features in step 4 as a confidence factor into the attention calculation process. The influence of the confidence factor is adjusted by learnable weight parameters so that when calculating the attention weight between nodes, the edge with a high confidence factor can obtain a higher aggregation weight.

[0035] A reliability gating mechanism is used to suppress noise propagation. This mechanism introduces a gating module after the message aggregation stage. It uses a multilayer perceptron to process the features of source nodes, target nodes, and edges, and calculates the gating coefficient by combining the deterministic measure of the edges. The gating coefficient is used to dynamically adjust the intensity of information propagation, attenuating the information transmitted by edges with low confidence or high uncertainty, thereby blocking the spread of noise between graph network layers.

[0036] Inter-layer regularization constraints are used to calculate the L2 norm distance between node representation vectors between adjacent graph convolutional layers, and this distance is added as a penalty term to the optimization objective, forcing the model to maintain the stability of the underlying semantics while learning higher-order features;

[0037] Step 5-2: The type-aware hybrid pooling module aggregates the heterogeneous node features in the output to generate a global vector representation that can characterize the structure and behavior information of the entire graph and inputs it into the classifier.

[0038] Step 5-3: The classifier makes predictions on the global vector representation input to the classifier and outputs the classification result of the APK application.

[0039] Furthermore, step 5-2 specifically includes the following steps:

[0040] In the graph reading stage, a type-aware hybrid pooling strategy is adopted. Average pooling and max pooling operations are performed on the Function node set, Event node set and File node set in the graph respectively. The pooling results of each type are concatenated to form a global vector representation that can comprehensively reflect the graph structure, behavior patterns and key resource information.

[0041] Furthermore, step 5-3 specifically includes the following steps:

[0042] The global vector representation of the full image obtained in step 5-2 is input into the fully connected layer classifier. After linear transformation and Sigmoid activation function processing, the predicted probability value of the Android application as malware is output. If the predicted probability value is greater than the preset judgment threshold, the application is judged as malware; otherwise, it is judged as benign software.

[0043] The beneficial effects of this invention are as follows:

[0044] (1) This invention deeply integrates static and dynamic features through a multi-evidence similarity fusion mechanism, effectively solving the semantic gap problem in traditional hybrid analysis. Unlike the simple feature splicing or shallow fusion in the prior art, this invention comprehensively calculates multi-dimensional evidence such as code semantics, permission consistency and time frequency stability, and establishes a strong association between static function nodes and dynamic event nodes, thereby organically combining the static code logic structure and the dynamic runtime behavior sequence in the same graph structure, and more comprehensively and accurately depicting the complex behavior patterns of Android malware;

[0045] (2) This invention proposes a hybrid heterogeneous graph construction method that combines static code structure and dynamic runtime behavior, realizing a unified representation of the all-round behavioral patterns of Android applications. While retaining the structural features of the function call graph extracted by static analysis, this method introduces the runtime event sequence and file access path captured in dynamic analysis, and constructs a unified graph containing three node types (Function, Event, and File) and five edge types (call, next, access, fx_event, and fx_file), thereby overcoming the limitations of single static analysis being unable to perceive runtime behavior and single dynamic analysis having incomplete path coverage;

[0046] (3) This invention proposes a reliability-calibrated heterogeneous graph Transformer (RCHGT) model, which effectively suppresses noise interference in the heterogeneous graph construction process through confidence calibration and gating mechanisms. To address the spurious associations that may arise in cross-view fusion, the model automatically adjusts attention weights using edge similarity or frequency evidence, and dynamically adjusts the information propagation intensity in conjunction with a reliability gating mechanism, automatically attenuating the influence of low-confidence or high-uncertainty edges, significantly improving the robustness of the model when processing noisy mixed graphs;

[0047] (4) This invention designs a type-aware feature encoding and hybrid pooling strategy to solve the feature overwhelming problem caused by the imbalance of the number of different types of nodes in heterogeneous graphs. By adopting differentiated encoding schemes for Function, Event and File nodes and performing aggregation pooling respectively, it avoids the small number of key dynamic behavior nodes being covered by a large number of static function nodes, and ensures that the generated graph global vector can reflect the overall structural features and key malicious behavior features of the application in a balanced and clear manner.

[0048] The present invention will now be described in detail with reference to the accompanying drawings and examples. Attached Figure Description

[0049] Figure 1 The overall flowchart of the Android malware detection method based on multi-evidence fusion and hybrid heterogeneous graphs of the present invention is shown.

[0050] Figure 2 The flowchart for static feature extraction is shown;

[0051] Figure 3 The flowchart of dynamic feature extraction is shown;

[0052] Figure 4 A schematic diagram illustrating the construction principle of hybrid heterogeneous graphs is shown;

[0053] Figure 5 The network structure diagram of the reliability calibration heterogeneous graph Transformer (RCHGT) model is shown. Detailed Implementation

[0054] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are for illustrative purposes only and are not intended to limit the scope of the invention.

[0055] This invention provides an Android malware detection method based on multi-evidence fusion and hybrid heterogeneous graphs. Addressing the issues of insufficient fusion depth of static and dynamic features and noise interference during graph construction in existing hybrid analysis methods, this invention extracts static function call graphs and dynamic runtime event graphs, constructs a hybrid heterogeneous graph using a multi-evidence similarity fusion mechanism, and trains it using a reliability calibration heterogeneous graph Transformer (RCHGT) model. The resulting Android malware detection model is used to predict whether an Android APK is malware.

[0056] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions used in this invention will be described clearly and completely below with reference to the accompanying drawings. The examples given are only for explaining this invention and are not intended to limit the scope of this invention.

[0057] This invention provides an Android malware detection method based on multi-evidence fusion and hybrid heterogeneous graphs, the flowchart of which is shown below. Figure 1 As shown, it includes:

[0058] S1: Dataset collection;

[0059] In step S1, this invention uses a publicly available mainstream dataset and an independently collected unknown dataset to construct two datasets, totaling 18,284 samples. Dataset 1 is the CICmalDroid dataset built by the Canadian Cyber ​​Security Institute, used for the main training and performance evaluation of the model. Dataset 2 is a dataset of unknown applications released after 2024, collected using the AndroZoo platform, used to verify the model's cross-distribution generalization ability. Dataset 1, CICmalDroid, includes 17,247 samples (4,042 benign samples and 13,205 malicious samples), covering malware samples from different malware families such as Adware, Banking, SMS, and Riskware. Dataset 2 includes 1,037 samples, including 422 benign applications and 615 malicious applications. These samples differ significantly from Dataset 1 in terms of time distribution and source, and are used to simulate unknown threats in real-world scenarios.

[0060] S2-A: Extracting static function call graph features;

[0061] To extract static code structure features, this invention uses the Androguard reverse engineering tool to process APK files, generating a function call graph (FCG) and pruning key nodes. Specifically, a Python environment needs to be configured and the Androguard library installed. The Androguard analysis module is used to decompile the APK file, extracting a DEX file and parsing its Dalvik bytecode. By traversing all functions in the application, their internal instructions are analyzed to establish directed connections between callers and callees, thus constructing the original function call graph. In this graph, each node stores rich metadata, including the complete function signature, class name, method name, parameter types, return type, and corresponding source code line number; each edge represents the call dependency between functions. To remove redundant information and focus on logic related to malicious behavior, this invention implements a K-top pruning strategy. This strategy relies on a list of file I / O-related APIs generated by dynamic analysis (S2-B). The specific steps are as follows: Read the JSON file containing a list of dynamic I / O APIs, and locate these API nodes and their call chains in the static graph. For each key I / O API node, retain only its top K neighbor nodes with the strongest correlation (i.e., the closest call relationship) (K=2 in this embodiment). Simultaneously, constrain the graph size, limiting the maximum number of nodes to 500 and the maximum number of edges to 1500. After pruning, a simplified function call graph stored in GML format is finally output as the static basis for subsequent graph fusion.

[0062] S2-B: Extracting features from a dynamic runtime event graph;

[0063] To extract runtime dynamic behavior features, this invention uses the AndroPyTool automated analysis tool to build a sandbox environment in a Docker container to simulate and monitor APK files. The system environment needs to be configured with Docker installed. The image is pulled using the command `docker pull alexmyg / andropytool` to build an isolated Android runtime environment. A batch script is written, and the analysis process is started using the command `docker run -v [local data directory]: / data [image name] -s [APK directory]`. During sandbox operation, Hook technology is used to monitor all system API calls related to application behavior, focusing on capturing file operation behaviors, including file reading, writing, creation, modification, and deletion operations, and recording detailed log information, including API name, parameters, return value, and precise timestamp of the operation. To eliminate system-level noise and retain discriminative behavior sequences, this invention performs whitelist-based path filtering on the raw logs. First, the generated dynamic log file is read, and its file operation records are traversed. Next, a sensitive path whitelist is set, retaining only operations involving the following directories: / data / data / , / sdcard / , / storage / emulated / , and / data / system / . Sensitive file operations with specific suffixes are also retained, such as .xml, .db, .dex, .apk, and .jar. After filtering out meaningless low-level system file accesses, the remaining event sequences are constructed into a runtime event graph, containing event nodes and file nodes, as well as access edges representing operation relationships and next edges representing temporal relationships. Simultaneously, a Feature.json file containing the names of all triggered file I / O APIs is exported to assist in the static pruning in step S2-A.

[0064] S3: Construct a hybrid heterogeneous graph based on multi-evidence similarity fusion.

[0065] To bridge the semantic gap between static and dynamic analysis, this invention employs a multi-evidence similarity fusion mechanism in step S3 to deeply integrate the static function call graph with the dynamic runtime event graph. The core of this process lies in calculating the comprehensive similarity between static function nodes and dynamic event nodes, which is determined by evidence from three dimensions: semantic similarity, permission consistency, and frequency stability. First, the pre-trained code language model CodeBERT is used to vectorize the function signature information and the event operation description text, respectively, and the cosine similarity between their feature vectors is calculated to capture the semantic consistency of the operation. Second, the permission set required for the static declaration of the function and the permission set required for the event runtime trigger are extracted. If there is an intersection, it indicates that the static code has the legal permission to execute the dynamic behavior, and the permission consistency score is set to a high value (0.9); otherwise, it is set to a low value (0.1), thus filtering out false associations caused by missing permissions. Finally, the number of occurrences and duration of events during sandbox operation are statistically analyzed to calculate the frequency stability index, which reflects the salience and stability of dynamic behavior during operation. The formula for calculating the comprehensive similarity $S(f, e)$ is shown below:

[0066]

[0067] in, This represents the semantic cosine similarity between the function signature and the event description. This represents the permission consistency score. This indicates a frequency stability index. , , These represent the weighting coefficients for each dimension of evidence. Regarding the frequency stability index, to reduce the impact of random noise, this invention employs a maximum value normalization method, the specific calculation formula of which is as follows:

[0068]

[0069] in, and These represent the number of times the current event has occurred and its duration, respectively. and These represent the maximum number of occurrences and the maximum duration of all events, respectively.

[0070] After calculating the combined similarity between each pair of static function nodes and dynamic event nodes, this invention sets a similarity threshold. (Based on the results of the threshold experiment, the final value is taken as follows) When the overall similarity When a static function and a dynamic event are strongly correlated, a heterogeneous edge `fx_event` is established between them. Further, the file paths involved in the connected events are checked. If the path belongs to a pre-defined sensitive file whitelist, another heterogeneous edge `fx_file` is established between the function node and the corresponding file node. Through these steps, a unified hybrid heterogeneous graph is finally constructed, containing three node types (Function, Event, and File) and five edge types (call, access, next, fx_event, and fx_file), thus fully preserving and associating the code structure and runtime behavior patterns of the Android application.

[0071] S4: Vectorize the features of graph nodes and edges.

[0072] To ensure the constructed hybrid heterogeneous graph can be effectively processed by subsequent deep learning models, this invention performs feature extraction and vectorization encoding on the heterogeneous nodes and edges in step S4, aiming to convert unstructured graph data into numerical vectors containing rich semantic and structural information. For the three different types of nodes in the hybrid heterogeneous graph, this invention designs differentiated feature encoding schemes to fully capture their respective attribute information. For Function nodes, their features consist of two parts: structural features and semantic features. Structural features include the function's in-degree, out-degree, and total number of calls in the call graph; semantic features are 128-dimensional vectors generated by encoding the complete signature of the function (including class name, method name, and parameter list) using the Doc2Vec model. Finally, the structural and semantic features are concatenated to form the initial feature vector of the Function node. For Event nodes, their features aim to describe the nature of runtime behavior, specifically including operation types (read, write, open, delete) represented by 4-dimensional one-hot vectors, normalized occurrence frequency reflecting activity level, and normalized timestamp features reflecting relative position in the execution sequence. For a File node, its features are used to characterize the attributes of the accessed resource, including the file path suffix encoded using one-hot vectors and the normalized access frequency feature that reflects the file's popularity.

[0073] To preserve the diversity of relationships and key numerical attributes in the graph structure, this invention also performs fine-grained encoding on the five types of edges. For the three basic edge types—call, access, and fx_file—the focus is primarily on the connection relationship itself. This invention assigns a learnable type embedding vector to each relationship type to represent the general semantics of that type of relationship. For the next edge, in addition to using relationship type embedding, temporal information is explicitly introduced. Specifically, the time interval Δ between two adjacent events is calculated. The data is encoded using a multilayer perceptron (MLP) and then concatenated with the relation embedding vector, enabling the model to perceive the temporal tightness of malicious behavior. For the fx_event edge, to preserve the multi-evidence fusion result calculated in step S3, the calculated comprehensive similarity score is... As a scalar feature concatenated with the relation embedding vector, this design enables subsequent models to perceive the confidence level of the association. Finally, since different types of nodes and edges have inconsistent feature dimensions after initial encoding, in order to meet the input requirements of subsequent Transformer models, this invention constructs a linear projection layer. All the aforementioned node feature vectors and edge feature vectors are input into this projection layer, uniformly mapping them to a feature space of the same dimension (hidden layer dimension is 128), ultimately generating a feature matrix for model input.

[0074] S5: Build a Transformer model for reliability calibration heterogeneous graphs;

[0075] To effectively handle hybrid heterogeneous graphs containing multi-source heterogeneous information and potential noise, this invention proposes and constructs a Reliability-Calibrated Heterogeneous Graph Transformer (RCHGT) model. This model is an improvement on the standard Heterogeneous Graph Transformer (HGT) architecture, aiming to enhance the robustness of feature learning by explicitly modeling edge confidence. The RCHGT architecture consists of multiple stacked RCHGTConv encoding layers, each integrating a confidence-calibrated attention (CCA) mechanism and a reliability gating (RG) mechanism. We choose to use a two-layer stacked RCHGTConv as the main encoder, with the hidden layer dimension set to 128. To construct this model, a graph neural network environment needs to be configured based on the PyTorch Geometric framework. During model training, this invention aims to achieve a binary classification task; therefore, binary cross-entropy is chosen as the basic classification loss function, and inter-layer regularization constraints are introduced to prevent overfitting.

[0076] In designing the attention computation for the RCHGTConv encoding layer, this invention introduces a CCA mechanism to enable the model to perceive the reliability of different heterogeneous edges. Traditional attention mechanisms only focus on the semantic relevance between nodes, while the CCA mechanism incorporates the comprehensive similarity or frequency stability index calculated in step S3 as a confidence factor. Specifically, the source node features, target node features, and edge features are first mapped to query vectors, key vectors, and message vectors respectively through linear transformations. Then, when calculating the attention score, not only is the inner product of the query vector and the key vector calculated, but an edge confidence term adjusted by learnable weights is also explicitly added. Thus, edges with high confidence (i.e., high similarity or high frequency stability) will receive greater weight in attention allocation, thereby dominating the information aggregation process. The mathematical expression of this mechanism, after normalization using the Softmax function, generates calibrated attention weights.

[0077] To further suppress noise propagation caused by low-confidence edges, this invention introduces an RG mechanism after attention aggregation. Although CCA adjusts the aggregation weights, unreliable edges may still transmit harmful information. The RG mechanism uses a multilayer perceptron to dynamically calculate the gating coefficient for information transmission. This perceptron receives features from the source node, target node, and edges as input, and combines them with the edge determinism metric to output a scalar value between 0 and 1. This value serves as the gating coefficient, directly applied to the aggregated message vector to attenuate low-confidence or high-uncertainty information streams. Finally, the gated feature vector is residually concatenated with the original node features, and through layer normalization, the updated node embedding is output.

[0078] After extracting deep features from the graph nodes, this invention employs a type-aware hybrid pooling strategy to generate a global representation of the entire graph. Considering the large number of Function nodes and the relatively small number of Event and File nodes, direct global pooling would obscure crucial dynamic behavioral features. Therefore, this strategy first performs independent pooling operations on the three types of nodes: Function, Event, and File. For each type, average pooling is performed simultaneously to capture global trends, and max pooling is performed to highlight salient features. The two are then concatenated to obtain the representation vector for that type. Finally, the representation vectors of the three types are concatenated and passed through a multilayer perceptron classifier to output the final malware prediction probability.

[0079] S6: Input the processed features into the built model for training and optimization;

[0080] The model architecture and initialization parameter information configured in step S5 are saved, and then the Reliability Calibration Heterogeneous Graph Transformer (RCHGT) model is used for end-to-end training. During the training process, the parameters were optimized and adjusted, and the final recommended parameters are shown in Table 1. After comparing different parameters, it was found that the Android malware detection model uses a loss function combining binary cross-entropy (BCE) and inter-layer regularization, a batch size of 32, a learning rate of 0.001, a hidden layer dimension of 128, and 20 training epochs.

[0081] Table 1 Training parameter configuration of RCHGT model

[0082] parameter value Batch size 32 Training rounds 20 Learning rate 0.001 Hidden layer dimensions 128 loss function BCEWithLogitsLoss+L2Regularization

[0083] To make the simulated scenarios in this invention more realistic and the evaluation more rigorous, the sample features in the CICMalDroid dataset are randomly split into training, validation, and test sets in a 7:1:2 ratio. The training set is used for gradient updates of the model, the validation set is used to monitor performance fluctuations and hyperparameter fine-tuning during training, and the test set is used for final performance evaluation. During training, mixed heterogeneous graph samples in the training set are randomly selected and loaded in batches. After multiple rounds of iterative training, the optimal gradient and weight parameters of the RCHGT detection model are obtained by minimizing the total loss function.

[0084] S7: After multiple rounds of training, an Android malware detection model is obtained. The model's evaluation metrics are Accuracy, Precision, Recall, and F1-score. The specific formulas are:

[0085]

[0086]

[0087]

[0088]

[0089] Wherein, TP (True Positive Examples) is the number of samples that the model predicts as positive and that are actually positive; TN (True Negative Examples) is the number of samples that the model predicts as negative and that are actually negative; FP (False Positive Examples) is the number of samples that the model predicts as positive but that are actually negative; and FN (False Negative Examples) is the number of samples that the model predicts as negative but that are actually positive.

[0090] Accuracy, Precision, Recall, and F1-score are important metrics used in machine learning to evaluate model performance. Accuracy measures the accuracy of a model's predictions across all samples; Precision focuses on the proportion of samples predicted as positive that were actually positive, reflecting the reliability of the positive predictions; Recall focuses on the proportion of all true positive samples correctly predicted by the model, measuring the model's ability to identify all true positives; and F1-score is the harmonic mean of Precision and Recall, used to balance the trade-offs between the two, providing a comprehensive way to evaluate model performance.

[0091] The method provided by this invention has the following advantages or beneficial technical effects:

[0092] Android malware evades detection using techniques such as code obfuscation, posing an increasingly serious threat. To address the problems of shallow feature fusion and high noise in graph construction inherent in existing hybrid analysis methods, this invention proposes a detection method based on multi-evidence fusion and a hybrid heterogeneous graph. This method utilizes multi-dimensional evidence such as code semantics, permission consistency, and frequency stability to deeply fuse static function calls and dynamic runtime events, constructing a unified hybrid heterogeneous graph that effectively bridges the semantic gap between static and dynamic analysis. Based on this, this invention designs a Reliability Calibration Heterogeneous Graph Transformer (RCHGT) model, which automatically identifies and suppresses noise interference through confidence calibration and gating mechanisms. This invention significantly improves the detection accuracy and robustness against complex and unknown Android malware.

[0093] The above description provides examples of the preferred embodiments of the present invention. Parts not detailed herein are common knowledge to those skilled in the art. The scope of protection of the present invention is determined by the claims. Any equivalent modifications based on the technical teachings of the present invention are also within the scope of protection of the present invention.

Claims

1. An Android malware detection method based on multi-evidence fusion and heterogeneous graphs, comprising the following steps: Step 1: Create a dataset by collecting APK applications containing both malicious and benign Android software to build a training set; Step 2: Perform dual feature extraction on the APKs in the dataset. Extract the function call graph through static analysis and prune it based on the file I / O API list obtained from dynamic analysis. Then, capture file operation and time series information in the sandbox environment through dynamic analysis to construct a runtime event graph. Step 3: Connect the nodes in the extracted function call graph and the nodes in the dynamic event graph with heterogeneous edges, calculate the multi-evidence similarity between static function nodes and dynamic event nodes in terms of semantics, permissions and time frequency, establish cross-view connections based on similarity thresholds, and merge the function call graph and runtime event graph into a unified hybrid heterogeneous graph. Step 4: Encode the features of the nodes and edges in the hybrid heterogeneous graph and convert them into vector representations that the model can process; Step 5: Construct a malware detection model and build a reliability-calibrated heterogeneous graph Transformer model. This model includes an RCHGTConv encoder, a type-aware hybrid pooling module, and a classifier. The RCHGTConv encoder introduces a confidence-calibrated attention mechanism and a reliability gating mechanism to automatically evaluate and distinguish the reliability of edges during information propagation and output heterogeneous node features. The type-aware hybrid pooling module is used to aggregate the output heterogeneous node features to generate a global vector representation that can characterize the structure and behavior information of the entire graph. The classifier is used to predict the global vector representation and output the classification result of the APK application. Step 6: Train the malware detection model using the training set, calculate the loss function, and update the model parameters through multiple iterations to obtain the trained detection model. Finally, use the trained detection model to detect whether the Android application under test is malicious.

2. The Android malware detection method based on multi-evidence fusion and heterogeneous graphs according to claim 1, wherein step 2 specifically includes the following steps: Step 2-1: Use the Androguard reverse engineering tool to decompile the APK file and parse the Dalvik bytecode to construct a preliminary static function call graph; Step 2-2: Execute the APK in the sandbox environment, monitor system API calls through Hook technology, record file read, write, creation, deletion and other operations and corresponding timestamps, obtain file operation and time sequence information in the sandbox environment, and dynamically analyze and generate a list containing file I / O related APIs; Step 2-3: Then, using the list of file I / O related APIs generated by dynamic analysis as a guide, K-top pruning is performed on the preliminary static function call graph obtained in Step 2-1, retaining only the key API nodes related to file I / O operations and their K most related neighbor nodes (K=2), to obtain the final static function call graph after compression. Step 2-4: Filter the original event logs of file operations and time series obtained in Step 2-2 based on the preset sensitive path whitelist, remove system-level file activities with no distinguishability, retain key file operation sequences, and generate a dynamic runtime event graph containing event nodes and file nodes.

3. The Android malware detection method based on multi-evidence fusion and heterogeneous graphs according to claim 1, wherein step 3 specifically includes the following steps: Step 3-1: Use the pre-trained code model CodeBERT to vectorize the function signatures of the static function call graph and the event operation descriptions of the dynamic runtime event graph, and calculate the cosine similarity between the two as semantic similarity evidence; extract the set of static permissions required for function calls and the set of dynamic permissions required for event runtime, and evaluate the evidence of permission consistency by judging whether there is an intersection between the two. The number of occurrences and duration of events during the sandbox operation were statistically analyzed, and logarithmic normalization was performed based on the maximum number of occurrences and the maximum duration to obtain frequency evidence reflecting the stability of event behavior. Step 3-2: The obtained semantic similarity evidence, authorization consistency evidence, and stability frequency evidence are weighted and summed according to preset weight coefficients to obtain a comprehensive similarity score, and a similarity filtering threshold is set. Step 3-3: Traverse all possible function pairs in the static function call graph and event pairs in the dynamic runtime event graph. When the overall similarity score exceeds the similarity filtering threshold, establish a heterogeneous edge fx_event between the corresponding function and event node to represent a strong association. Steps 3-4: Check the file path involved in the event. If the path belongs to the preset sensitive file whitelist, then establish a heterogeneous edge fx_file between the function node and the file node, and finally form a hybrid heterogeneous graph containing three types of nodes: Function, Event, and File, and five types of edges: call, access, next, fx_event, and fx_file.

4. The Android malware detection method based on multi-evidence fusion and heterogeneous graphs according to claim 3, wherein step 4 specifically includes the following steps: Step 4-1: Vectorize the various node features in the hybrid heterogeneous graph obtained in Step 3-4. The Function node features include structural features such as the number of calls and in-degree, as well as semantic features obtained by processing the function signature through a document embedding algorithm. The Event node features include operation type represented by one-hot encoding, normalized occurrence frequency, and normalized timestamp features. The File node features include one-hot encoded features of the file path suffix and normalized access frequency features. Step 4-2: Embed the edge features in the hybrid heterogeneous graph and unify the feature space; specifically, the call edge, access edge, and fx_file edge are directly represented using relation type embedding vectors; the time-series next edge is concatenated with the relation type embedding vector and the time interval feature of the event occurrence; the heterogeneous edge fx_event is concatenated with the relation type embedding vector and the comprehensive similarity value calculated in step 3-2 to retain confidence information. Step 4-3: Construct a linear projection layer to map all node feature vectors and edge feature vectors of different dimensions described in Steps 4-1 and 4-2 to a feature space of uniform dimension.

5. The Android malware detection method based on multi-evidence fusion and heterogeneous graphs according to claim 4, wherein the malware detection model workflow in step 5 specifically includes the following steps: Step 5-1: In the RCHGTConv encoder, the first RCHGTConv encoding layer processes the input data sequentially using a message passing mechanism based on confidence-calibrated attention and a reliability gating mechanism. After inter-layer regularization, the output data is input into the next RCHGTConv encoding layer for processing, and the output data is input into a type-aware hybrid pooling module. The message passing mechanism based on confidence-calibrated attention is used to introduce the comprehensive similarity or frequency stability retained in the edge features in step 4 as a confidence factor into the attention calculation process. The influence of the confidence factor is adjusted by learnable weight parameters so that when calculating the attention weight between nodes, the edge with a high confidence factor can obtain a higher aggregation weight. The reliability gating mechanism is used to suppress noise propagation. This mechanism introduces a gating module after the message aggregation stage. It uses a multilayer perceptron to process the features of the source node, target node and edges and combines the deterministic measure of the edges to calculate the gating coefficient. The gating coefficient is used to dynamically adjust the intensity of information propagation and attenuate the information transmitted by edges with low confidence or high uncertainty, thereby blocking the spread of noise between graph network layers. Inter-layer regularization constraints are used to calculate the L2 norm distance between node representation vectors between adjacent graph convolutional layers, and this distance is added as a penalty term to the optimization objective, forcing the model to maintain the stability of the underlying semantics while learning higher-order features; Step 5-2: The type-aware hybrid pooling module aggregates the heterogeneous node features in the output to generate a global vector representation that can characterize the structure and behavior information of the entire graph and inputs it into the classifier. Step 5-3: The classifier makes predictions on the global vector representation input to the classifier and outputs the classification result of the APK application.

6. The Android malware detection method based on multi-evidence fusion and heterogeneous graphs according to claim 5, wherein step 5-2 specifically includes the following steps: In the graph reading stage, a type-aware hybrid pooling strategy is adopted. Average pooling and max pooling operations are performed on the Function node set, Event node set and File node set in the graph respectively. The pooling results of each type are concatenated to form a global vector representation that can comprehensively reflect the structure, behavior pattern and key resource information of the entire graph.

7. The Android malware detection method based on multi-evidence fusion and heterogeneous graphs according to claim 5, wherein step 5-3 specifically includes the following steps: The global vector representation of the full image obtained in step 5-2 is input into the fully connected layer classifier. After linear transformation and Sigmoid activation function processing, the predicted probability value of the Android application as malware is output. If the predicted probability value is greater than the preset judgment threshold, the application is judged as malware; otherwise, it is judged as benign software.

Images