Android malware detection method and system based on SMOTE determination

Abstract

The application provides an Android malicious software detection method and system based on SMOTE judgment, and belongs to the technical field of malicious software detection. The method comprises the following steps: defining input features as 470-dimensional dynamic execution behavior frequency vectors; constructing a pretreatment process composed of variance selection, standardization, feature selection and dimension reduction modules; executing rules including R1 space isolation rules, R2 algorithm adaptation logic gates and R3 experimental comparison basis; adopting a double-layer structure of outer layered cross-validation and inner random division; searching for hyperparameters with the maximum weighted recall rate as the target; constructing a preset causal argumentation system, quantifying the failure mechanism and marginal gain of SMOTE under different algorithm configurations; and generating a decision mechanism comprising preferred strategies, alternative strategies, limit strategies and blacklist interception. The application realizes accurate description of malicious software behavior semantics, unbiased evaluation results and reproducible experimental full process, and provides empirical evidence for industrial deployment.

Description

Technical Field

[0001] This invention relates to the field of malware detection technology, and more specifically to an Android malware detection method and system based on SMOTE determination. Background Technology

[0002] With Android's established monopoly in the global mobile market, malware targeting the platform (such as adware, banking trojans, and risky software) has experienced explosive growth, seriously threatening user privacy and device security. To combat the increasingly sophisticated obfuscation and countermeasures of malicious code, detection solutions based on dynamic behavior analysis have gradually become mainstream. This type of technology typically uses sandbox environments like CopperDroid to execute the application under test, extracting high-dimensional feature vectors including system calls, Binder IPC communication, and complex behavioral patterns, and then constructing machine learning models for classification and identification. However, due to the extremely uneven distribution of benign samples and various malicious samples in the real network environment, and the high sparsity of dynamic features, conventional classification models are prone to bias towards the majority class during training, resulting in low recall rates for malicious families with sparse sample sizes but high harm, becoming a core bottleneck restricting the improvement of detection accuracy.

[0003] In existing technologies, the following shortcomings exist when dealing with the aforementioned high-dimensional sparsity and class imbalance problems: First, the application of SMOTE technology lacks empirical guidance. Existing technologies often blindly use SMOTE to generate synthetic samples, but in high-dimensional sparse dynamic behavior spaces, KNN interpolation based on Euclidean distance is prone to generating invalid "pseudo-samples." Empirical data shows that in 75% of experimental configurations, SMOTE leads to performance degradation or only marginal improvement, with an average loss of about 6.14 percentage points, and there is a lack of adaptation rules for different algorithms; Second, algorithm selection and imbalance handling are also problematic. The existing technologies suffer from several issues. First, there's a mismatch in mechanisms. They fail to recognize the built-in gradient boosting and class weighting capabilities of random forest models like XGBoost and Random Forest. Forcibly adding external SMOTE is not only redundant but also interferes with the model's fit to the original distribution (e.g., XGBoost achieves 95.40% recall without SMOTE). Second, the evaluation process suffers from serious data leakage risks. Preprocessing steps often prefit the entire dataset, compromising the closure of cross-validation, leading to inflated and unreproducible performance, and lacking a unified benchmark framework to support industrial application. Furthermore, current research lacks a unified evaluation benchmark for high-dimensional sparse binary / frequency features. Different studies use varying preprocessing procedures, data partitioning methods, and random seeds, making horizontal comparisons of experimental results difficult. Moreover, preprocessing steps (e.g., standardization, dimensionality reduction) often introduce data leakage by prefitting the entire dataset, resulting in inflated reported detection accuracy and hindering the industrial application of these technologies. Summary of the Invention

[0004] The purpose of this invention is to provide an Android malware detection method and system based on SMOTE judgment, in order to solve the technical problems of existing malware detection methods lacking empirical guidance, mismatch between algorithm selection and unbalanced processing mechanisms, and serious data leakage risks in the evaluation process.

[0005] To achieve the above objectives, this invention provides an Android malware detection method based on SMOTE determination. The method includes: using a pre-defined Android malware detection system, loading a dataset containing multiple types of samples, defining the input features as a 470-dimensional dynamic execution behavior frequency vector, wherein the behavior frequency vector consists of system call frequencies, Binder call frequencies, and composite behavior frequencies extracted from the CopperDroid sandbox; using a Scikit-learn Pipeline to construct a preprocessing flow consisting of variance selection, standardization, feature selection, and dimensionality reduction modules, and configuring pre-defined constraints; and embedding SMOTE into Scikit-learn. The pipeline executes usage rules including R1 spatial isolation rules, R2 algorithm adaptation logic gates, and R3 experimental comparison criteria. It employs a two-layer structure of outer-layer hierarchical cross-validation and inner-layer random partitioning, setting strictly decoupled random seed sequences to ensure reproducibility of the experimental process and unbiased evaluation results. It deploys multiple algorithm configurations, including Naive Bayes, Support Vector Machine, Random Forest, and XGBoost, utilizing the Optuna framework and combining TPE sampling and median pruning strategies to maximize weighted recall through hyperparameter search. Based on the evaluation results of multiple algorithm configurations, a pre-defined causal argumentation system is constructed to quantify the failure mechanism and marginal gain of SMOTE under different algorithm configurations. Based on the output of the pre-defined causal argumentation system, a decision mechanism including preferred strategy, alternative strategy, extreme strategy, and blacklist interception is generated to guide the deployment and updating of the pre-defined Android malware detection system model.

[0006] Optionally, the generation rules for the 470-dimensional dynamic execution behavior frequency vector include: executing the APK in the VMI environment through the CopperDroid sandbox and writing the runtime behavior to a JSON log; parsing the JSON log and aggregating multiple semantically related underlying system calls into a composite behavior record; assigning a predefined template to each composite behavior record and naming the predefined template "behavior domain (sub-action 1_sub-action 2...)"; incrementing the corresponding composite behavior dimension count by 1 when the set of sub-actions required by the predefined template is fully observed once in an analysis session; after parsing the JSON logs of each APK, generating a feature matrix according to the frequency of statistical analysis of a fixed 470-column schema, where columns 1-139 are system calls and columns 140-470 are the mixed feature dimensions of Binder calls and composite behaviors.

[0007] Optionally, the preset constraints include that all preprocessing modules can only perform fit operations within the training fold of nested cross-validation, and only perform transform operations on the validation and testing folds. Prefit operations on the entire dataset are prohibited. The preprocessing flow adopts different combinations for different algorithms, including: for the support vector machine algorithm configuration, an aggressive PCA dimensionality reduction strategy is adopted to limit the number of principal components to the range of 10 to 100 dimensions; for the random forest or XGBoost algorithm configuration, PCA or Truncated SVD dimensionality reduction is disabled to avoid loss of feature space information of the random forest model.

[0008] Optionally, the R1 spatial isolation rules include: fixing the SMOTE in the preprocessing flow after the preprocessor and before the classifier; only when the data fold is an inner CV training fold, the preprocessing flow instantiates the SMOTE object and calls the fitting resampling method; and skipping the SMOTE when the validation fold and test fold data flow pass through the preprocessing flow, thus preventing the synthesis of the entire dataset from the program structure.

[0009] Optionally, the R2 algorithm adaptation logic gate includes: if the received algorithm is Naive Bayes, XGBoost, Random Forest, or the algorithm is a support vector machine using an RBF kernel, the determination result is to disable SMOTE; only when the algorithm is a support vector machine using a linear kernel and the preprocessing process includes aggressive PCA dimensionality reduction, the determination result is to enable SMOTE.

[0010] Optionally, the two-layer structure of outer-layer hierarchical cross-validation and inner-layer random partitioning is adopted, and a strictly decoupled random seed sequence is set, including: the random seed of the outer-layer hierarchical cross-validation is set fold by fold to 43, 44, 45, 46, 47; the random seed of the inner-layer random partitioning is generated according to a preset calculation formula; the basic seed of Python, NumPy and Optuna TPESampler is uniformly determined to be 42, so as to ensure the comparability between different algorithm configurations.

[0011] Optionally, the hyperparameter search for XGBoost includes: setting the search range for the number of weak classifiers (n_estimators) to [50, 500], the learning rate (learning_rate) to a logarithmic uniform distribution of [0.01, 0.3], and the maximum tree depth (max_depth) to [3, 12]; enabling the Optuna MedianPruner pruning strategy, setting 50 trials for each algorithm configuration, and using maximizing the weighted recall as the optimization objective.

[0012] Optionally, the construction of a pre-defined causal argumentation system quantifies the failure mechanism and marginal gain of SMOTE under different algorithm configurations, including: for Naive Bayes, high-dimensional sparse features violate the conditional independence assumption, causing SMOTE to distort the probability distribution and degrade performance; for Support Vector Machine, the RBF kernel has fitted the nonlinear boundary, causing SMOTE to introduce noise, and the linear kernel combined with aggressive PCA loses information, resulting in SMOTE being able to partially compensate for the recall rate; for Random Forest model, the implicit feature selection of Random Forest model is better than preprocessing dimensionality reduction, and the Bootstrap mechanism has handled the imbalance, resulting in external SMOTE only achieving marginal improvement.

[0013] Optionally, the generation of a decision-making mechanism including a preferred strategy, alternative strategies, extreme strategies, and blacklist interception guides the deployment and updating of the preset Android malware detection system model. This includes: the preferred strategy loading a model configuration with XGBoost and F-test wide search without SMOTE; the alternative strategy loading a model configuration with a simple random forest setup without SMOTE; the extreme strategy enabling SMOTE based on the preferred strategy, where the extreme strategy is only applicable to specific scenarios with strict requirements for malicious sample recall and tolerable increased computational overhead; and triggering a blacklist interception algorithm configuration request when a request is detected to carry a Naive Bayes algorithm or a full dataset SMOTE instruction.

[0014] On the other hand, the present invention provides an Android malware detection system based on SMOTE determination. The Android malware detection system includes a control module, the control module including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the Android malware detection method based on SMOTE determination according to any one of the above.

[0015] Furthermore, this invention uses R3 experiments as a comparison basis and solidifies the judgment threshold of the R2 algorithm adaptation logic gate based on empirical data from 48 sets of control experiments. It clarifies the necessity of disabling SMOTE in high-dimensional sparse scenarios for Naive Bayes, tree models, and RBF kernel SVM, as well as the rule for enabling SMOTE in linear SVM under specific dimensionality reduction conditions. This overcomes the blindness of selecting sampling strategies based on experience in the prior art.

[0016] Through the above technical solutions, this invention achieves the goal of accurately characterizing the semantics of malicious software behavior in a high-dimensional sparse data space by constructing a 470-dimensional dynamic behavior frequency feature vector and excluding static and network flow features. By establishing R1 spatial isolation rules and nested cross-validation mechanisms, the preprocessing module is strictly constrained to fit only within the training iteration, completely eliminating the risk of data leakage and achieving unbiased evaluation results and reproducible experimental processes. By establishing R2 algorithm adaptation logic gates and enabling SMOTE differently based on the inherent characteristics of Naive Bayes, SVM, and Random Forest models, mismatch between algorithms and sampling mechanisms is avoided, and XGBoo is utilized. The built-in gradient boosting and class weighting mechanisms of ST achieve a weighted recall rate of 95.40% without relying on external resampling. Through 48 sets of comparative experiments, a causal explanation chain of "feature characteristics → algorithm behavior → SMOTE effect → performance results" is constructed, quantifying the failure mechanism of SMOTE in high-dimensional sparse scenarios and providing empirical evidence for industrial deployment. Finally, by integrating the preferred strategy, alternative strategies and blacklist interception hierarchical decision-making mechanism, the detection system achieves synergistic optimization of low-latency inference on the edge and high-precision detection in the cloud, significantly improving the engineering implementation capability and robustness of Android malware detection.

[0017] Other features and advantages of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 This is a category distribution diagram of the CICMalDroid2020 dataset in this invention; Figure 2 This is a flowchart illustrating the Android malware detection method based on SMOTE determination according to the present invention. Figure 3 This is a comparison chart of the recall rates of the Naive Bayes model with and without SMOTE in this invention; Figure 4 This is a comparison chart of the support vector machine model with and without SMOTE weighted recall in this invention; Figure 5 This is a comparison chart of the recall rates of the random forest model in this invention with and without SMOTE weighted recall. Figure 6 This is a comparison chart of the XGBoost model with and without SMOTE weighted recall in this invention; Figure 7 This is a flowchart illustrating the decision-making mechanism in this invention. Detailed Implementation

[0019] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0020] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0021] First Embodiment Please refer to Figure 2 This invention provides an Android malware detection method based on SMOTE determination. The Android malware detection method may include: Step S100: Using a pre-set Android malware detection system, load a dataset containing multiple types of samples, and define the input features as a 470-dimensional dynamic execution behavior frequency vector. The behavior frequency vector consists of the system call frequency, Binder call frequency, and composite behavior frequency extracted from the CopperDroid sandbox.

[0022] Please refer to Figure 1 In a preferred embodiment of the present invention, the dataset can be the CICMalDroid2020 dataset created by the Canadian Cyber ​​Security Institute. This dataset, collected through the CopperDroid virtual machine dynamic analysis system, contains 11,598 successfully executed samples, categorized into five types: Adware (1253), Banking (2100), Riskware (2546), SMSmalware (3904), and Benign (1795). Specifically, the present invention uses the feature_vectors_syscallsbinders_frequency_5_Cat.csv feature table to establish a fixed column order schema for all dynamic behaviors appearing in the 11,598 samples of the entire dataset, totaling 470 columns. Columns 1–139 represent system call frequencies; columns 140–470 are composed of Binder calls and composite behaviors combined according to the fixed feature names of CICMalDroid2020 (331 dimensions).

[0023] The 470-dimensional dynamic execution behavior frequency feature vector was extracted from the CopperDroid sandbox, without using static Manifest features or network PCAP features. The feature matrix... ,element For the sample Behavior during dynamic analysis The frequency of non-negative integers (e.g., highly sparse). The specific 470-dimensional features consist of three parts: system calls (139 dimensions, e.g., the frequency of open, read, mprotect, etc.); Binder calls (IPC / RPC) (included in the 470 dimensions, e.g., the frequency of getDisplayInfo, etc.); and composite behaviors (included in the 470 dimensions, e.g., the frequency of aggregation patterns such as FS_ACCESS(CREATE__READ__WRITE).

[0024] In this embodiment of the invention, the generation rule for the 470-dimensional dynamic execution behavior frequency vector may include: Step S110: Execute the APK in the VMI environment through the CopperDroid sandbox and write the runtime behavior to the JSON log.

[0025] Step S120: Parse the JSON log and aggregate multiple semantically related underlying system calls into a single composite behavior record.

[0026] In a preferred embodiment of the present invention, after the CopperDroid sandbox reconstructs IPC / RPC and OS layer primitive events from the JSON log, it aggregates multiple semantically related underlying system calls into a single composite behavior record.

[0027] Step S130: Assign a predefined template to each composite behavior record and name the predefined template "behavior domain (sub-action 1_sub-action 2...)".

[0028] In a preferred embodiment of the present invention, the sub-actions are connected by double underscores. Common fields include FS_ACCESS (file access), NET (network access), FS_PIPE, etc., for example, FS_ACCESS(CREATE__READ__WRITE), NET(TCP_CONNECT__SEND) and FS_PIPE(READ__WRITE).

[0029] For example, a file access composite behavior template can be defined as FS_ACCESS(CREATE_READ_WRITE). When the sandbox logs observe that an APK sequentially calls the open(O_CREAT), read(), and write() system calls, it is determined that this template has been triggered once, and the FS_ACCESS dimension count is incremented by 1. Similarly, a network composite behavior template can be defined as NET(TCP_CONNECT_SEND). The count is triggered when the socket(AF_INET, SOCK_STREAM), connect(), and sendto() sequence is observed.

[0030] Step S140: When the set of sub-actions required by the predefined template is fully observed once in an analysis session, the corresponding composite behavior dimension count is incremented by 1.

[0031] In a preferred embodiment of the present invention, within a single dynamic analysis session of the same APK, whenever the set of sub-actions required by the predefined template is fully observed once, the count of the corresponding composite behavior dimension is incremented by 1, and the count of untriggered composite behavior dimensions is incremented by 0.

[0032] Step S150: After parsing the JSON logs of each APK, generate a feature matrix according to the frequency of statistical analysis of a fixed 470-column schema. Columns 1-139 are system calls, and columns 140-470 are mixed feature dimensions of Binder calls and composite behaviors.

[0033] In a preferred embodiment of the present invention, after parsing the JSON logs of each APK, the frequency is statistically analyzed according to the aforementioned fixed 470 schema columns to obtain... In this invention, steps S100–S700 are all performed on this 470-dimensional frequency vector, without introducing static Manifest or PCAP columns, such as the label vector: .

[0034] After generating the feature matrix, outlier filtering is performed on the data to remove invalid samples with a dynamic analysis time of less than 5 seconds or a total number of system calls of less than 10. For missing values ​​in the feature matrix, a zero-value imputation strategy is adopted to ensure that unobserved behavioral features do not affect the consistency of the model's input dimensions in the highly sparse 470-dimensional vector.

[0035] Define the characteristic matrix ,in This represents the total number of samples (e.g., 11598). It is a non-negative integer, representing the first... The sample at the th Frequency of behavior; define label vector It is used for training a five-class classification model.

[0036] Step S200: Using Scikit-learn Pipeline, construct a preprocessing workflow consisting of variance selection, standardization, feature selection, and dimensionality reduction modules, and configure preset constraints.

[0037] In a preferred embodiment of the present invention, the preprocessing process may include variance thresholding → standardization (Z-score) / Min-Max / Robust normalization → feature selection (F-test / Chi-square) → dimensionality reduction (PCA / Truncated SVD), with different combinations of algorithms used for different configurations.

[0038] In this embodiment of the invention, the preset constraints may include that all preprocessing modules can only perform the fit operation within the training fold of nested cross-validation, and only perform the transform operation on the validation and testing folds, prohibiting the prefit operation on the entire dataset, and the preprocessing flow adopts different combinations for different algorithms, which may include: Step S210: For the support vector machine algorithm configuration, an aggressive PCA dimensionality reduction strategy is adopted to limit the number of principal components to the range of 10 to 100 dimensions.

[0039] Step S220: For the Random Forest or XGBoost algorithm configuration, disable PCA or Truncated SVD dimensionality reduction to avoid loss of feature space information in the Random Forest model.

[0040] It should be noted that the variance selection module sets a threshold of 0.0 to eliminate invalid features that are all zero or constant; the standardization module uses the Z-score standardization method to transform the feature values ​​into a distribution with a mean of 0 and a variance of 1, eliminating the impact of differences in the magnitude of frequency of different behaviors on the SVM distance-sensitive algorithm; the feature selection module uses the F-test method to select the top-k most discriminative features by calculating the correlation score between the feature and the target variable, where the value of k is used as a hyperparameter for dynamic optimization in the Optuna framework; the dimensionality reduction module sets the number of principal components n_components to be adjustable between 10 and 100 dimensions when PCA is enabled, and ensures that the cumulative explained variance ratio is not less than 85%.

[0041] Step S300: Embed SMOTE into the Scikit-learn Pipeline and execute the usage rules, which include R1 spatial isolation rules, R2 algorithm adaptation logic gates, and R3 experimental comparison criteria.

[0042] In this embodiment of the invention, the R1 space isolation rule may include: Step S310: Fix SMOTE in the preprocessing flow, after the preprocessor and before the classifier.

[0043] Step S320: The preprocessing flow instantiates the SMOTE object and calls the fitting resampling method only when the data is folded into an inner CV training fold.

[0044] Step S330: When the verification and test fold data streams pass through the preprocessing flow, SMOTE is skipped to prevent the synthesis of the entire dataset from the program structure.

[0045] In this embodiment of the invention, the R2 algorithm adaptation logic gate may include: Step S301: If the received algorithm is Naive Bayes, XGBoost, Random Forest, or Support Vector Machine with RBF kernel, the result is to disable SMOTE.

[0046] Step S302: SMOTE is enabled only if the algorithm is a support vector machine with a linear kernel and the preprocessing procedure includes aggressive PCA dimensionality reduction.

[0047] In a preferred embodiment of the present invention, during deployment, the following R2 algorithm is used to determine whether to enable SMOTE: if the algorithm is Naive Bayes (NB), SMOTE is forcibly disabled; if the algorithm is XGBoost or Random Forest (RF), SMOTE is forcibly disabled; if the algorithm is Support Vector Machine (SVM) and uses an RBF kernel, SMOTE is disabled; if the algorithm is Support Vector Machine (SVM) and uses LinearSVC with aggressive PCA dimensionality reduction, SMOTE can be optionally enabled (for example, the expected return is about 1.56 percentage points higher).

[0048] In addition, based on the comparison criteria of R3 experiments, each algorithm-preprocessing configuration was trained and evaluated under two conditions: with and without SMOTE, for a total of 24×2=48 sets of experiments. The experimental results were used to adjust the logic gate threshold of the R2 algorithm.

[0049] Specifically, the R3 experiments can be compared by performing two training processes—"SMOTE enabled" and "SMOTE disabled"—on 24 different algorithm configurations under the same nested cross-validation framework, resulting in 48 control experiments. Experimental data shows that in 75% of the configuration combinations, enabling SMOTE leads to a decrease in weighted recall or only a marginal improvement of less than 0.5 percentage points, with an average performance loss of approximately 6.14 percentage points. Based on this empirical data, the threshold for determining the appropriate logic gate for the R2 algorithm is established: when the algorithm is Naive Bayes, SMOTE causes a performance decrease of up to 25.42 percentage points; when the algorithm is XGBoost or Random Forest, the performance improvement brought by SMOTE is no more than 0.11 percentage points; and only when the algorithm is linear SVM combined with aggressive PCA dimensionality reduction can SMOTE bring a positive gain of approximately 1.56 percentage points.

[0050] It should be noted that the R1 spatial isolation rules and the R2 algorithm adaptation logic gates are strongly bound at the implementation layer to the S2Pipeline, S4 nested CV, and S7 deployment interfaces, rather than being independent text rules. The binding relationship is as follows: (1) R1 spatial isolation rule Scikit-learn Pipeline position binding: SMOTE is the SMOTE step of Imbalanced-learn (e.g., k_neighbors=5), fixed after the embedding preprocessor fit / transform and before the classifier fit; after the outer / inner CV partition is completed, fit_resample is only called on the inner training fold subset, and the verification fold and test fold data do not go through SMOTE, thus structurally preventing full synthesis.

[0051] (2) R1 spatial isolation rule Random seed binding: SMOTE's random_state inherits the inner fold seed (e.g., 42 + inner_fold_index + 1), ensuring that repeated experiments on the same fold are reproducible and decoupled from the outer evaluation fold seed (e.g., 43–47).

[0052] (3) R2 algorithm adapted to logic gates Configuration metadata binding: Inputting (model_type, preprocessing, config_id), the output is passed through the logic gate function g(·) before constructing the Scikit-learn Pipeline. ;when Or forced when SVM kernel type is RBF Only when And preprocessing is allowed when it includes aggressive PCA (e.g., C10 / C12, etc.). .

[0053] (4) R2 algorithm adapts to logic gates Empirical threshold binding: The decision table for g(·) is solidified by the weighted recall comparison results of 48 groups and written into the decision-making mechanism; during deployment, if a request... However, it conflicts with g(·), and the blacklist module directly intercepts and returns the reason for disabling.

[0054] (5) Joint constraint between R1 space isolation rule and R2 algorithm adaptation logic gate: Only when the R2 algorithm adaptation logic gate output Furthermore, the Scikit-learn Pipeline only instantiates the SMOTE branch when the current data is folded into the inner training fold; otherwise, the SMOTE step is skipped to ensure that both algorithm misfit and space out-of-bounds risks are simultaneously intercepted by the R2 algorithm's adaptation logic gate.

[0055] Step S400: A two-layer structure of outer-layer stratified cross-validation and inner-layer random partitioning is adopted, and a strictly decoupled random seed sequence is set to make the experimental process reproducible and the evaluation results unbiased.

[0056] In this embodiment of the invention, a two-layer structure of outer-layer hierarchical cross-validation and inner-layer random partitioning is adopted, and a strictly decoupled random seed sequence is set, which may include: Step S410: The random seed for the outer layer cross-validation is set fold by fold to 43, 44, 45, 46, 47.

[0057] Step S420: The random seeds for the inner layer are generated according to a preset calculation formula.

[0058] In a preferred embodiment of the present invention, the inner 5-fold random partition (e.g., test_size=0.2) is used for HPO, and the random seed is generated independently according to the inner fold index (e.g., 42+inner_fold_index+1), decoupled from the outer seed.

[0059] Step S430: The base seed for Python, NumPy, and Optuna TPESampler is uniformly set to 42 to ensure comparability between different algorithm configurations.

[0060] Specifically, the outer layer of hierarchical cross-validation is used to evaluate the model's generalization performance, ensuring that the proportion of samples from each of the five classes in each compromise is consistent with the original dataset. The inner layer of random partitioning is used for hyperparameter optimization (HPO), and its training subset is further divided into a sub-training set and a validation set. All preprocessing module steps S200's fit operations are strictly limited to the inner training subset, and the fitted transformation parameters are then applied to the inner validation set and the outer test set. This strict isolation of "training-validation-test" prevents test set information from leaking prematurely into the model training, ensuring that performance metrics such as 95.29% accurately reflect the model's performance on unknown data, rather than being an overfitting result.

[0061] Step S500: Deploy a variety of algorithm configurations including Naive Bayes, Support Vector Machine, Random Forest and XGBoost. Utilize the Optuna framework, combining TPE sampling and median pruning strategies, to perform hyperparameter search with the goal of maximizing weighted recall.

[0062] In a preferred embodiment of the present invention, the 24 configuration groups may include: (1) Naive Bayes: BernoulliNB, GaussianNB, MultinomialNB, combined with Chi-square / F-test / PCA / Robust, etc. (e.g., C01–C08). (2) Support Vector Machine (SVM): LinearSVC, RBFSVC, combined with PCA and F-test (e.g., C09–C14). (3) Random Forest (RF): Simple, PCA, TruncatedSVD, F-test selection (e.g., C15–C21). (4) XGBoost: Simple, F-test selection (e.g., C22–C24); each configuration has two hyperparameter ranges: aggressive dimensionality reduction and wide search space.

[0063] Hyperparameter optimization can include: (1) Framework: Optuna, TPE sampling (e.g., seed=42); Pruning: Median pruning (e.g., MedianPruner, n_startup_trials=5); (2) Number of trials: 50 trials per configuration; Optunatrial-level pruning is used as EarlyStopping (e.g., XGBoost does not set early_stopping_rounds separately). (3) Objective: Maximize weighted recall.

[0064] In this embodiment of the invention, performing hyperparameter search on XGBoost may include: Step S510: Set the search range of the number of weak classifiers (n_estimators) to [50, 500], the learning rate (learning_rate) to a logarithmic uniform distribution of [0.01, 0.3], and the maximum tree depth (max_depth) to [3, 12].

[0065] Step S520: Enable the Optuna MedianPruner pruning strategy, set 50 trials for each algorithm configuration, and use maximizing weighted recall as the optimization objective.

[0066] In a preferred embodiment of the present invention, the hyperparameter search space of the four major algorithms can be represented by the following table:

[0067] Specifically, for the random forest configuration, set the n_estimators search range to [50, 500], max_depth to [5, 50] or None, and the bootstrap parameter in... The optimal selection was performed to verify the Bagging mechanism's ability to handle imbalanced data. For the Support Vector Machine configuration, the penalty factor C was set to a log-uniform distribution of [0.1, 100], and the gamma parameter of the RBF kernel was set to a log-uniform distribution of [1e-4, 1]. During the optimization process, Optuna's MedianPruner pruning strategy was enabled, and n_startup_trials=5 was set. That is, after 5 random trials, if the median performance of the current trial is lower than the historical median, the trial is terminated early, thereby concentrating computational resources on searching for high-potential parameter regions and improving the efficiency of hyperparameter optimization.

[0068] Step S600: Based on the evaluation results of multiple algorithm configurations, construct a pre-defined causal argumentation system to quantify the failure mechanism and marginal gain of SMOTE under different algorithm configurations.

[0069] In this embodiment of the invention, constructing a pre-defined causal argumentation system to quantify the failure mechanism and marginal gain of SMOTE under different algorithm configurations may include: Step S610: For Naive Bayes, high-dimensional sparse features violate the conditional independence assumption, causing SMOTE to distort the probability distribution and degrade performance.

[0070] Please refer to Figure 3In a preferred embodiment of the present invention, SMOTE leads to performance degradation in all Naive Bayes NB configurations, with the most severe degradation occurring in BernoulliNB+Chi-square+SMOTE, dropping from 60.30% to 34.88%. The causal chain at this point is: high-dimensional sparse features → strong correlation between features → violation of the NB independence assumption → SMOTE distorts the probability distribution → performance drops precipitously.

[0071] Step S620: For support vector machines, the RBF kernel has fitted the nonlinear boundary, which causes noise to be introduced by SMOTE. The linear kernel combined with aggressive PCA loses information, which causes SMOTE to partially compensate for the recall rate.

[0072] Please refer to Figure 4 In a preferred embodiment of the present invention, the linear kernel and the RBF kernel respond differently to SMOTE. The RBF kernel is more stable (e.g., a decrease of 0.10–0.76 percentage points), while the linear kernel shows a slight improvement in SMOTE under aggressive dimensionality reduction (e.g., an increase of about 1.56 percentage points). At this time, the causal chain is: malicious boundary nonlinearity → linear kernel underfitting → aggressive PCA losing information → SMOTE can partially compensate, the RBF kernel has fitted the nonlinear boundary, and SMOTE introduces noise.

[0073] Step S630: For the random forest model, the implicit feature selection of the random forest model is better than the preprocessing dimensionality reduction. The bootstrap mechanism has already handled the imbalance, so the external SMOTE only achieves marginal improvement.

[0074] Please refer to Figure 5 In a preferred embodiment of the present invention, Simple and F-test selection configurations reach 94.86%–94.94%, SMOTE only marginally improves performance by 0.06–0.07 percentage points, and PCA / SVD dimensionality reduction consistently reduces performance. At this time, the causal chain is as follows: RF implicit feature selection is better than preprocessing dimensionality reduction, the Bootstrap mechanism has handled imbalance, and the external SMOTE functions overlap.

[0075] Please refer to Figure 6 In a preferred embodiment of the present invention, for XGBoost, the highest performance is 95.40% (e.g., F-test + SMOTE), which is only 0.11 percentage points higher than without SMOTE. The causal chain is as follows: gradient boosting and built-in scale_pos_weight class weighting have been processed to address imbalance → external SMOTE and built-in mechanism have overlapping functions → built-in mechanism is better than external resampling.

[0076] Therefore, the failure of SMOTE mainly stems from the following mechanisms: First, the Curse of Pseudo-proximity: In a 470-dimensional space, data points are extremely sparse, making it difficult for the KNN algorithm based on Euclidean distance to find true "neighbors," resulting in meaningless samples generated by interpolation in the feature space. Second, the violation of feature independence: SMOTE assumes that feature dimensions are independent of each other, but in the system call sequence, there are strong semantic connections between calls (e.g., open is always followed by read), and artificial synthesis destroys this original connection. Third, the complexity of the decision boundary: The behavioral boundary of malware is highly nonlinear and fragmented, and simple linear interpolation cannot simulate complex adversarial evolutionary behavior, but instead introduces noise into the fuzzy decision boundary.

[0077] Step S700: Based on the output of the preset causal argumentation system, generate a decision mechanism that includes the preferred strategy, alternative strategies, extreme strategies, and blacklist interception to guide the deployment and updating of the preset Android malware detection system model.

[0078] Please refer to Figure 7 In this embodiment of the invention, a decision-making mechanism is generated, including a preferred strategy, alternative strategies, extreme strategies, and blacklist interception, to guide the deployment and updating of a preset Android malware detection system model. This mechanism may include: Step S710: The preferred strategy is to load the XGBoost model configuration with F-test wide search and no SMOTE.

[0079] In a preferred embodiment of the present invention, for the P0 preferred strategy, C24 (e.g., XGBoost + F-test wide search + SMOTE disabled) can be configured, with a weighted recall rate of 95.29%, which is suitable for production deployment.

[0080] Step S720: Load the alternative strategy: Random Forest with a simple configuration and no SMOTE model configuration.

[0081] In a preferred embodiment of the present invention, for the P1 alternative strategy, C15 can be configured (e.g., RFSimple+ disables SMOTE), with a weighted recall rate of 94.86%, which is suitable for scenarios with high interpretability requirements.

[0082] Step S730: The extreme strategy enables SMOTE on top of the preferred strategy. The extreme strategy is only applicable to specific scenarios where there are hard requirements for the recall rate of malicious samples and the increased computational overhead can be tolerated.

[0083] In a preferred embodiment of the present invention, for the P2 extreme strategy, a model configuration of XGBoost combined with F-test wide search and SMOTE enabled can be loaded (e.g., C24+SMOTE configuration). Under this strategy, the weighted recall rate can reach 95.40%, an improvement of 0.11 percentage points compared to the preferred strategy. This strategy is only applicable to specific scenarios where there are extremely stringent requirements for recall rate in very small classes (e.g., Banking), and where system resources are sufficient and can tolerate higher false positive rates and computational overhead. It is not a recommended configuration for regular production environments and is only applicable to specific scenarios where there are extremely stringent requirements for recall rate in very small classes (e.g., Banking) (e.g., specific compliance requirements in financial security), and where system computing power is redundant and can tolerate higher false positive rates and computational overhead. By setting this extreme strategy, the present invention can flexibly balance detection accuracy and system overhead according to the resource constraints and security requirements of actual business scenarios.

[0084] Step S740: When a request is detected to carry the Naive Bayes algorithm or the SMOTE instruction for the full dataset, a blacklist interception algorithm configuration request is triggered.

[0085] Specifically, upon receiving a detection request, the decision-making mechanism first parses the algorithm identifier and preprocessing instructions in the request header. If the instructions violate the R2 algorithm adaptation logic gate rules (e.g., using Naive Bayes or full SMOTE), a blacklist interception is triggered, returning an HTTP 403 status code and the reason for disabling. If the instructions comply with the rules, the system is routed to the appropriate strategy based on the current system load and security level requirements: regular traffic is routed to the preferred strategy (e.g., XGBoost without SMOTE), high interpretability requirements are routed to the alternative strategy (e.g., RF without SMOTE), and extreme compliance requirements are routed to the extreme strategy (e.g., XGBoost with SMOTE). In an edge-cloud collaborative scenario, the edge device only deploys the fixed preferred strategy model and performs low-latency inference; the cloud server is responsible for executing the full training process of the R1 spatial isolation rules and R2 algorithm adaptation logic gates, periodically generating model update packages and distributing them to the edge device to achieve online evolution of detection capabilities.

[0086] In a preferred embodiment of the present invention, steps S100-S700 can be mapped to two types of engineering deployment forms; SMOTE is not enabled during the inference stage, and the SMOTE and R1 spatial isolation rules and R2 algorithm adaptation logic gates only apply to offline training and model updates.

[0087] In one specific implementation, for mobile devices (e.g., on-device inference), the P0 preferred policy model (e.g., C24, XGBoost+F-test, without SMOTE) output in the terminal deployment step S700 is used for local inference; an optional on-device agent collects dynamic behavior logs compatible with the CopperDroid sandbox and compresses them into 470-dimensional vectors before sending them for inspection; the on-device only performs transform and predict, without performing SMOTE or full retraining; if incremental updates are required, the logs must be sent back to the cloud and the training data must be resampled only on the server according to the R1 spatial isolation rule.

[0088] In one specific implementation, for cloud-based (e.g., SaaS detection service) scenarios, users upload APKs or behavior vectors to the detection API; the cloud-based CopperDroid sandbox cluster performs feature extraction in step S100, and outputs five-class labels and confidence scores after the pre-processor is fitted in step S200 and the optimal classifier in step S700; model training, 48 sets of comparative experiments, and OptunaHPO are completed on an offline GPU cluster; before creating the pipeline, the training task scheduler calls the R2 algorithm adaptation logic gate g(·) to determine the SMOTE branch, and the R1 spatial isolation rule is automatically guaranteed by the nested CV framework.

[0089] Accordingly, this invention provides an Android malware detection method based on SMOTE determination. The method includes: using a pre-defined Android malware detection system, loading a dataset containing multiple types of samples, defining the input features as a 470-dimensional dynamic execution behavior frequency vector, where the behavior frequency vector consists of system call frequencies, Binder call frequencies, and composite behavior frequencies extracted from the CopperDroid sandbox; using a Scikit-learn Pipeline to construct a preprocessing flow consisting of variance selection, standardization, feature selection, and dimensionality reduction modules, and configuring pre-defined constraints; and embedding SMOTE into Scikit-learn. The pipeline executes usage rules including R1 spatial isolation rules, R2 algorithm adaptation logic gates, and R3 experimental comparison criteria. It employs a two-layer structure of outer-layer hierarchical cross-validation and inner-layer random partitioning, setting strictly decoupled random seed sequences to ensure reproducibility of the experimental process and unbiased evaluation results. It deploys multiple algorithm configurations, including Naive Bayes, Support Vector Machine, Random Forest, and XGBoost, utilizing the Optuna framework and combining TPE sampling and median pruning strategies to maximize weighted recall through hyperparameter search. Based on the evaluation results of multiple algorithm configurations, a pre-defined causal argumentation system is constructed to quantify the failure mechanism and marginal gain of SMOTE under different algorithm configurations. Based on the output of the pre-defined causal argumentation system, a decision mechanism including preferred strategy, alternative strategy, extreme strategy, and blacklist interception is generated to guide the deployment and updating of the pre-defined Android malware detection system model. This invention achieves the goal of accurately characterizing the semantics of malware behavior in a high-dimensional sparse data space. It strictly constrains the preprocessing module to fit only within the training iteration, completely eliminating the risk of data leakage. It achieves unbiased evaluation results and reproducible experimental processes. By utilizing the gradient boosting and class weighting mechanisms built into XGBoost, it achieves a weighted recall rate of 95.40% without relying on external resampling. It quantifies the failure mechanism of SMOTE in high-dimensional sparse scenarios, providing empirical evidence for industrial deployment. It realizes the collaborative optimization of low-latency inference on the edge and high-precision detection in the cloud, significantly improving the engineering implementation capability and robustness of Android malware detection.

[0090] Second Embodiment The present invention also provides an Android malware detection system based on SMOTE determination. The Android malware detection system includes a control module, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the Android malware detection method based on SMOTE determination described above.

[0091] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0092] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0093] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0094] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0095] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0096] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0097] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0098] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0099] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for detecting Android malware based on SMOTE determination, characterized in that, The Android malware detection method includes: Using a pre-set Android malware detection system, a dataset containing multiple types of samples is loaded, and the input features are defined as a 470-dimensional dynamic execution behavior frequency vector. The behavior frequency vector is composed of system call frequency, Binder call frequency, and composite behavior frequency extracted from the CopperDroid sandbox. Using Scikit-learn Pipeline, a preprocessing workflow consisting of variance selection, standardization, feature selection, and dimensionality reduction modules is constructed, and preset constraints are configured. Embed SMOTE into the Scikit-learn Pipeline to execute usage rules including R1 spatial isolation rules, R2 algorithm adaptation logic gates, and R3 experimental comparison criteria. A two-layer structure of outer-layer stratified cross-validation and inner-layer random partitioning is adopted, and a strictly decoupled random seed sequence is set to make the experimental process reproducible and the evaluation results unbiased. We deploy a variety of algorithm configurations, including Naive Bayes, Support Vector Machine, Random Forest and XGBoost, and use the Optuna framework to search for hyperparameters by combining TPE sampling and median pruning strategies to maximize weighted recall. Based on the evaluation results of multiple algorithm configurations, a pre-defined causal argumentation system is constructed to quantify the failure mechanism and marginal gain of SMOTE under different algorithm configurations. Based on the output of the pre-set causal argumentation system, a decision-making mechanism is generated, which includes the preferred strategy, alternative strategies, extreme strategies, and blacklist interception, to guide the deployment and updating of the pre-set Android malware detection system model.

2. The Android malware detection method based on SMOTE determination according to claim 1, characterized in that, The generation rules for the 470-dimensional dynamic execution behavior frequency vector include: Execute the APK in a VMI environment using the CopperDroid sandbox and write runtime behavior to a JSON log; Parse the JSON logs and aggregate multiple semantically related underlying system calls into a single composite behavior record; Assign a predefined template to each composite behavior record and name the predefined template "behavior domain (sub-action 1_sub-action 2...)"; When the set of sub-actions required by the predefined template is fully observed once in an analysis session, the corresponding composite behavior dimension count is incremented by 1; After parsing the JSON logs of each APK, a feature matrix is ​​generated according to the frequency of statistical analysis of a fixed 470-column schema. Columns 1-139 represent system calls, and columns 140-470 represent the mixed feature dimensions of Binder calls and composite behaviors.

3. The Android malware detection method based on SMOTE determination according to claim 1, characterized in that, The preset constraints include that all preprocessing modules can only perform the fit operation within the training fold of nested cross-validation, and only perform the transform operation on the validation and testing folds. Prefitting on the entire dataset is prohibited. The preprocessing flow uses different combinations for different algorithms, including: For the support vector machine algorithm configuration, an aggressive PCA dimensionality reduction strategy is adopted to limit the number of principal components to the range of 10 to 100 dimensions; For Random Forest or XGBoost algorithm configurations, disable PCA or Truncated SVD dimensionality reduction to avoid loss of feature space information in the Random Forest model.

4. The Android malware detection method based on SMOTE determination according to claim 1, characterized in that, The R1 spatial isolation rules include: SMOTE is fixed in the preprocessing flow, positioned after the preprocessor and before the classifier. The preprocessing flow instantiates the SMOTE object and calls the fit resampling method only when the data is folded into the inner CV training fold; When the verification and test fold data flows through the preprocessing process, SMOTE is skipped, thus eliminating the need for full dataset synthesis from the program structure.

5. The Android malware detection method based on SMOTE determination according to claim 4, characterized in that, The R2 algorithm is compatible with the following logic gates: If the received algorithm is Naive Bayes, XGBoost, Random Forest, or Support Vector Machine with RBF kernel, the result is to disable SMOTE. SMOTE is enabled only when the algorithm is a support vector machine with a linear kernel and the preprocessing flow includes aggressive PCA dimensionality reduction.

6. The Android malware detection method based on SMOTE determination according to claim 1, characterized in that, The two-layer structure employing outer-layer hierarchical cross-validation and inner-layer random partitioning, with strictly decoupled random seed sequences, includes: The random seed for the outer layer stratified cross-validation is set fold by fold to 43, 44, 45, 46, 47; The random seeds for the inner layer are generated according to a preset calculation formula; The base seed for Python, NumPy, and Optuna TPESampler is uniformly set to 42 to ensure comparability between different algorithm configurations.

7. The Android malware detection method based on SMOTE determination according to claim 1, characterized in that, Hyperparameter search for XGBoost includes: Set the search range for the number of weak classifiers (n_estimators) to [50, 500], the learning rate (learning_rate) to a log-uniform distribution of [0.01, 0.3], and the maximum tree depth (max_depth) to [3, 12]. The Optuna MedianPruner pruning strategy was enabled, with 50 trials set for each algorithm configuration, and the optimization objective was to maximize the weighted recall rate.

8. The Android malware detection method based on SMOTE determination according to claim 1, characterized in that, The aforementioned construction of a pre-defined causal argumentation system quantifies the failure mechanism and marginal gain of SMOTE under different algorithm configurations, including: For Naive Bayes, high-dimensional sparse features violate the conditional independence assumption, leading to SMOTE distorting the probability distribution and degrading performance. For support vector machines, the RBF kernel has already fitted the nonlinear boundary, which causes noise to be introduced into SMOTE. The linear kernel combined with aggressive PCA loses information, which causes SMOTE to partially compensate for the recall rate. For the random forest model, implicit feature selection is superior to preprocessing dimensionality reduction, and the bootstrap mechanism has already addressed the imbalance, resulting in the external SMOTE only achieving marginal improvement.

9. The Android malware detection method based on SMOTE determination according to claim 1, characterized in that, The generation of a decision-making mechanism, including preferred strategy, alternative strategy, extreme strategy, and blacklist interception, guides the deployment and updating of the pre-defined Android malware detection system model, including: The preferred strategy is to load a model configuration with XGBoost, F-test wide search, and no SMOTE. Alternative strategies include loading a simple random forest configuration without SMOTE model configuration; The extreme strategy enables SMOTE based on the preferred strategy. The extreme strategy is only applicable to specific scenarios where there are hard requirements for the recall rate of malicious samples and the increased computational overhead can be tolerated. When a request is detected to contain the Naive Bayes algorithm or the SMOTE instruction for the full dataset, a blacklist blocking algorithm configuration request is triggered.

10. An Android malware detection system based on SMOTE determination, characterized in that, The Android malware detection system includes a control module, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the Android malware detection method based on SMOTE determination according to any one of claims 1-9.

Images