Android malware family classification method based on meta-learning

Abstract

The application discloses an Android malware family classification method based on meta learning, and specifically comprises the following steps: step 1, collecting an initial sample data set and preprocessing to obtain Android malware grayscale images; step 2, extracting a global aggregated feature embedding vector set based on spatial cross Mamba feature coding for all Android malware grayscale images in the sample data set; step 3, performing heterogeneous graph structure reasoning on the global aggregated feature embedding vector set; and step 4, performing multi-task joint loss constraint optimization training on a final node feature matrix to provide a classification decision result for inferring the Android malware family attribution of unknown sample data. The method solves the problems of high cost of manual data collection, missing long-distance context association of sequences, blurred classification surface and low classification accuracy caused by high variation of Android malware families in a data-deficient environment.

Description

Technical Field

[0001] This invention belongs to the field of computer mobile security malicious code detection technology, specifically involving a method for classifying Android malware families based on meta-learning. Background Technology

[0002] Currently, the Android ecosystem is facing a massive influx of malware, with millions of new variants emerging each year, testing traditional defense mechanisms. Therefore, the ability to quickly and accurately classify Android malware families in data-scarce environments plays a crucial role in mobile security defense. Traditional malware detection or classification methods heavily rely on large-scale datasets, requiring tens of millions of labeled samples to achieve high accuracy. However, when a new Android malware family emerges, only a very small number of samples are often available. This data scarcity and highly limited sample size pose a significant challenge to traditional deep learning models that rely on massive amounts of data for training.

[0003] With the widespread application of deep learning technology in cybersecurity, researchers are constantly trying to introduce more complex deep neural network architectures (e.g., convolutional neural networks, Transformer, or BERT) to learn features from opcode sequences for mobile security detection, which is in a rapidly developing stage, and applying them to the analysis of malicious behavior in Android applications and the classification of Android malware families. However, due to the extremely long opcode sequences, and the limited processing length of deep neural networks, truncating the extremely long sequences will lead to the loss of key semantic features; otherwise, it will increase computational complexity and severely reduce the model's learning performance. To address this, Gu J et al. proposed a lightweight embedding model based on CodeBERT and TextCNN in their paper GSEDroid: GNN-based Android malwaredetection framework using lightweight semantic embedding. This model uses an API call graph that integrates permission and opcode semantic features to represent Android .apk files, ultimately completing the classification of Android malware families. However, this method has shortcomings: it heavily relies on large-scale training datasets, and when faced with novel Android malware families containing only a few known samples, its few-sample generalization ability is insufficient and the recognition accuracy is not high. Vasan D et al., in their paper IMCFN: Image-based malware classification using fine-tuned convolutional neural network architecture, effectively identified Android malware families by directly utilizing convolutional neural networks, treating hexadecimal bytecode sequences as image textures. However, this method has its limitations: it is inherently limited by local receptive fields and computational complexity, making it difficult to maintain long-distance spatial dependencies between two-dimensional images and ultra-long bytecode sequences.

[0004] The classification of Android malware families faces challenges such as over-reliance on large initial samples, a lack of samples from novel malware families, and the difficulty in effectively representing extremely long sequences. Current research methods, relying solely on traditional sequence models or single deep neural networks, may suffer from reduced learning capacity for global feature diversity due to sequence truncation. This fails to capture long-term spatial dependencies and effectively clarify the decision-making boundary in environments with few samples and high variation among Android malware families, thus impacting the effectiveness of mining long-term contextual associations of deep feature semantic information and overall classification performance. This leads to problems such as high costs for manual data collection and feature engineering in low-sample scenarios, missing associated features due to contextual truncation of extremely long sequences, blurred classification boundaries due to high variation among Android malware families, and low accuracy in multi-classification. Summary of the Invention

[0005] The purpose of this invention is to provide a meta-learning-based method for classifying Android malware families, which solves the problems of high cost of manual data collection in data-scarce environments, lack of long-distance contextual associations in sequences, and fuzzy classification surface and low classification accuracy caused by the high degree of variation of Android malware families.

[0006] The technical solution adopted in this invention is: an Android malware family classification method based on meta-learning, specifically as follows: Step 1: Collect the initial sample dataset and preprocess it to obtain grayscale images of Android malware; Step 2: Extract a global aggregated feature embedding vector set based on spatial cross-Mamba feature encoding from all grayscale images of Android malware in the sample dataset obtained in Step 1; Step 3: Perform heterogeneous graph structure inference on the global aggregated feature embedding vector set obtained in Step 2; Step 4: Perform multi-task joint loss constraint optimization training on the final node feature matrix obtained in Step 3 to provide classification decision results for inferring the family affiliation of Android malware in unknown sample data.

[0007] The invention is further characterized in that: Step 1 is as follows: Download 20-50 mixed families of Android malware (both similar and dissimilar) from the Androzoo public dataset, containing a total of 800-2000 Android malware files with the .apk extension. Simultaneously generate... Android malware family classification label encoding, with encoding numbers ranging from '1' to '...'. 'in, The value range is 20~50; all downloaded Android malware and the corresponding Android malware family classification label codes are used as the initial sample dataset; by performing pixelation conversion in units of 8-bit binary combinations, each Android malware in the initial sample dataset is directly mapped to grayscale pixel values, converted into an Android malware grayscale image with the suffix .png, and the resolution of the Android malware grayscale image is uniformly normalized to 128×128 pixels; finally, the preprocessing of the initial sample dataset is realized, and two-dimensional Android malware grayscale images are obtained; all two-dimensional Android malware grayscale images and the corresponding Android malware family classification label codes are used as the sample dataset.

[0008] Step 2 is as follows: Step 2.1: Serialize all the grayscale images of two-dimensional Android malware in the sample dataset obtained in Step 1. First, divide each grayscale image of two-dimensional Android malware into a sequence composed of flattened patches, i.e. ,in The total length of the sequence is represented by the first line; then each flattened patch is projected into the D-dimensional latent space to obtain the flattened patch sequence, thus realizing the vectorized representation of each Android malware grayscale image. Step 2.2: Perform multi-directional and multi-view dynamic feature extraction on the flattened patch sequence obtained in Step 2.1 by spatial cross Mamba feature encoding to obtain the global aggregated feature embedding vector.

[0009] Step 2.2 specifically involves: Step 2.2.1: For spatial cross Mamba feature encoding, the flattened patch sequence is used as the input sequence; the spatial geometric vertical and horizontal axes of the Android malware grayscale image are reconstructed into a spatial manifold sequence with four scanning directions; the four scanning directions correspond to: horizontal forward (→), horizontal backward (←), vertical forward (↓) and vertical backward (↑), and an independent continuous-time linear time-invariant state-space model is established for each direction; The continuous-time linear time-invariant state-space model is a cross-adaptive mapping in four scanning directions from the input sequence to the hidden state and from the hidden state to the output sequence. The transition process from the input sequence to the hidden state in the four scanning directions is represented as follows: (1) in, Indicates hidden state For continuous variables The derivative; This indicates control of four scanning directions. The evolution matrix of state evolution; Indicates the current sampling At any given moment, four scanning directions The continuous hidden state below; Indicates four scanning directions The input matrix for integrating new control information; Indicates the current sampling At any given moment, corresponding to the four scanning directions The input patch feature sequence; The transition process from the hidden state to the output sequence in the four scanning directions is represented as follows: (2) in, Indicates the current sampling At any given moment, corresponding to the four scanning directions The output sequence below; This represents the output projection matrix that maps the hidden state to the final vector representation under the four scanning directions. It is used to map the high-dimensional spatial state features back to the target feature space. Step 2.2.2: Using a step size of The zero-order hold performs a discretization transformation on the continuous-time linear time-invariant state-space model in the four scanning directions, specifically as follows: First, assume the current sampling time And input within each sampling interval Keep constant, that is By analytically solving formula (1), the discretized state transition matrix and input matrix are obtained, as follows: (3) in, This indicates the four corresponding scanning directions. Discretized state transition matrix; Indicates the step size; This indicates the four corresponding scanning directions. Discretized input matrix; Then, based on the discretized matrices obtained in the four scanning directions, the hidden state is updated in parallel. The hidden state update is represented as: (4) in, This indicates the four corresponding scanning directions. In the The hidden status of global signatures of Android malware updated at each time step; This indicates the four corresponding scanning directions. In the previous time step, the global signature of Android malware was hidden. This indicates the four corresponding scanning directions. The feature vector of the Android malware grayscale image flattening patch sequence input at the current time step; Finally, based on the updated hidden state in the four scanning directions The output projection matrices for the four scanning directions are respectively After mapping, the final output for the four scanning directions is obtained, represented as: (5) in, This indicates the four corresponding scanning directions. In the The feature vector of an Android malware enhancement patch that incorporates directional context information at each time step; Step 2.2.3: The four scanning directions obtained after discretization are finally output. Through formulas (4) and (5), the recursive state propagation is performed step by step along the four spatial arrangement directions of the flattened patch sequence to obtain the complete enhanced feature sequence spliced ​​in the four scanning directions, as follows: , , , ; Then, a spatial cross-attention gating mechanism is used to perform multi-view global spatial feature fusion and alignment on the enhanced feature sequences in the four scanning directions; allowing the enhanced feature sequences in the four scanning directions to... , , , As the input to the spatial cross-attention gating mechanism, among which, This indicates the total number of image patches segmented from a grayscale image of Android malware; The dimension of a single patch feature sequence is perfectly aligned with the dimension of the input patch feature sequence. By concatenating the inputs to the spatial cross-attention gating mechanism, the global feature matrix is ​​obtained, represented as: (6) in, Represents the global feature matrix; These represent the enhanced feature sequences in the four scanning directions, respectively. The obtained global feature matrix is ​​then combined with three independent adaptive linear projections to generate query feature, key feature, and value feature matrices, as follows: (7) in, These represent the query feature matrix, key feature matrix, and value feature matrix, respectively. These represent the adaptive projection weight matrices, respectively. Subsequently, by scaling the dot product attention operation, the spatial dependency weights between the patch feature sequences in the four scanning directions are calculated, resulting in the four scanning direction cross-attention weight matrix that highlights the cross-directional code block association features of Android malware, as shown below: (8) in, This represents the cross-attention weight matrix for the four scanning directions; Represents the transpose of the key feature matrix; Indicates the scaling factor; Represents the normalization function; To avoid feature redundancy interference in a single scanning direction, adaptive gating weights for four scanning directions are introduced. The feature contribution ratios of the four scanning directions are adaptively adjusted, and the feature sequences of the four scanning directions are weighted and aggregated. This weighted aggregation process is expressed as follows: (9) in, This represents the omnidirectional enhanced feature sequence after weighted aggregation; This represents the adaptive gating weights for the four scanning directions; This indicates a sequence splitting operation in four scanning directions; Finally, the weighted aggregation result Y is expanded point-by-point according to the spatial arrangement order of the input patch feature sequences, and the output is an omnidirectional enhanced feature sequence with the same length as the input sequence. Each of them All of them contain context-aware information about the grayscale images of Android malware in global spatiotemporal and multi-perspective dimensions; Step 2.2.4: The obtained omnidirectional enhanced feature sequence Global pooling is performed, and adaptive fusion weight parameters are introduced to automatically adapt to the feature distribution of different types of Android malware, thereby achieving spatial dimensionality reduction and semantic aggregation of the associated features between feature sequences of various enhancement patches. Among them, omnidirectional enhancement feature sequences The global pooling process, which involves performing global pooling operations, is represented as follows: (10) in, This represents the omnidirectional enhanced feature sequence after global pooling; This represents the omnidirectional enhanced feature sequence after average pooling; This represents the omnidirectional enhanced feature sequence after max pooling; This represents the adaptive fusion weight parameters. ; Then, an adaptive fully connected linear transformation is used to map the globally pooled omnidirectional augmented feature sequence to the target dimension of the output. The adaptive fully connected linear transformation process is expressed as: (11) in, This represents the output global aggregated feature embedding vector. ; Represents the adaptive weight matrix; Represents the bias vector of adaptive behavior; This outputs a fixed-length global aggregated feature embedding vector. This enables the vectorized representation of each Android malware grayscale image; finally, a global aggregated feature embedding vector set is generated for all Android malware grayscale images.

[0010] Step 3 specifically involves: Step 3.1: Construct a heterogeneous directed topological graph using the global aggregated feature embedding vector set output in Step 2 to obtain the heterogeneous adjacency matrix; Step 3.2: The heterogeneous adjacency matrix obtained in Step 3.1 By performing sparsification optimization and matrix stability correction on the adaptive heterogeneous topology graph structure, a heterogeneous normalized adjacency matrix is ​​obtained. Step 3.3: Convert the heterogeneous normalized adjacency matrix obtained in Step 3.2 into a single matrix. Enter the constructed heterogeneous graph neural network and perform direct-guided feature iterative inference based on the heterogeneous directed topological graph structure.

[0011] Step 3.1 specifically involves: Step 3.1.1: Construct a heterogeneous directed topology graph based on meta-tasks; Step 3.1.1 specifically refers to: The global aggregated feature embedding vector set output from step 2 is used as the total meta-task pool. Independent meta-tasks are randomly sampled from the total meta-task pool according to the pre-set N-way K-shot rule of meta-learning. Each meta-task contains a specified number of support sets and query sets. For each sampled meta-task, a heterogeneous directed graph is constructed for that meta-task in a completely direct manner. ;in, This represents the set of sample data nodes, where each sample data node... For a single sample data point from the current meta-task support set or query set, each sample data node... The initial state is set to the global aggregated feature embedding vector obtained in step 2. ; This represents a collection of hyperprototype nodes for a malware family, with each hyperprototype node... This corresponds to a global central anchor point for a known Android malware family within the current meta-task. Step 3.1.2: Perform adaptive similarity measurement calculation through the constructed heterogeneous directed topology graph to obtain the heterogeneous adjacency matrix between the sample data and the malware family superprototype; Step 3.1.2 specifically involves: First, the generalized edge weights between any two nodes in a heterogeneous topology graph are calculated using the heterogeneous node adaptive similarity calculation operator. Define variables and These represent the sets of nodes in a heterogeneous topology graph. Any two nodes in the node and nodes Generalized edge weights between Represented as: (12) in, Represents a node and nodes The weights of heterogeneous topological edges between nodes, especially when nodes and nodes When all nodes are sample data nodes, Transform into homogeneous topological edge weights between sample data nodes When node For sample data nodes and nodes When it is a hyperprototype node of a malware family. Transformed into heterogeneous topological edge weights between sample data and malware family hyperprototypes ; Represents the natural exponential function; This represents an adaptive distance adjustment factor, used to dynamically adjust the scaling scale for measuring feature distances in the latent space; Represents the generalized distance metric function in the projected latent space; and These represent the feature linear mapping layers adaptively selected based on the type of the node; and Representing nodes respectively and nodes The corresponding feature vector, especially when the node is a sample data node. The corresponding global aggregated feature embedding vector When the node is a malware family hyperprototype node The time corresponds to the first one initially obtained from the support set. The central vector of an Android malware family; Indicates a function to indicate the type of heterogeneous nodes; It represents the topological impedance coefficient, used to adjust the diffusion intensity of information flow between heterogeneous and homogeneous edges; For the current meta-task, the generalized edge weights are then filled into the dimension. The matrix, where, This indicates the total number of sample data nodes within the current meta-task; This indicates the total number of malware family hyperprototype nodes within the current meta-task; Finally, the first row / column of the matrix The bits correspond sequentially to all sample data nodes, and then... Each bit corresponds sequentially to a superprototype node of all malware families, achieving an ordered mapping of heterogeneous nodes and obtaining a heterogeneous adjacency matrix. .

[0012] Step 3.2 specifically involves: By analyzing the heterogeneous adjacency matrix output in step 3.1 Adaptive tensor truncation is performed, and an adaptive topological similarity-gated filtering mechanism is introduced. For the adaptive topological similarity gated filtering mechanism, an activation threshold needs to be dynamically calculated based on the mean and standard deviation of the edge weights between all nodes in the current meta-task. When the elements in the heterogeneous adjacency matrix When the topological edge is low-confidence, it indicates that the topological edge belongs to a low-confidence association, and the topological edge is directly cleared to zero; when In this case, the directed edge is retained to achieve adaptive sparsity of the heterogeneous graph topology; The heterogeneous adjacency matrix after implementing the adaptive topological similarity gated filtering mechanism is symmetrically smoothed using a dynamic Laplacian regularization operator, resulting in a symmetrically smoothed heterogeneous normalized adjacency matrix. Symmetric smoothing correction is expressed as: (13) in, This represents the heterogeneous normalized adjacency matrix after symmetric smoothing correction; This represents the degree matrix of the heterogeneous adjacency matrix after filtering. This represents the identity matrix with the same dimension as the heterogeneous adjacency matrix.

[0013] Step 3.3 specifically involves: Step 3.3.1: Constructing a heterogeneous graph neural network and its final objective function ; Step 3.3.1 specifically refers to: The constructed heterogeneous graph neural network structure includes a first input layer, a first graph convolutional layer, a first activation function layer, a first heterogeneous topology gating correction layer, a second graph convolutional layer, a first classification mapping layer, and a first output layer. The parameters for each layer are as follows: The feature dimension of the input to the first convolutional layer is... The output feature dimension is The feature dimension of the input to the first activation function layer is consistent with the feature dimension of the output of the first convolutional layer, and the output feature dimension is perfectly aligned with the input dimension. LeakyReLU is selected as the sole activation function. The input to the first heterogeneous topology gating correction layer... Features of individual sample data nodes and Features of several malware family hyperprototype nodes, totaling [number missing]. There are nodes; the input feature dimension is . Output a The heterogeneous topological gated modified adjacency matrix of dimension 1; the input of the second graph convolutional layer contains two parts, one being the feature dimension 1. The first is the node feature tensor, and the second is the output of the first heterogeneous topology gated correction layer. An adjacency matrix of dimension 1, the output dimension is 1. ,in This represents the total number of malware family categories corresponding to the current meta-task; all graph convolutional layers use LeakyReLU as their activation function; the input to the first classification mapping layer is the output from the second graph convolutional layer. Extracted from the feature tensor of the dimensional node Each sample data node corresponds to 3D eigenvalue submatrix, output A similarity probability matrix of dimension; the first output layer input is the output of the second graph convolutional layer. The query set samples extracted from the feature tensor of the dimensional nodes 3D feature vectors, outputting the corresponding query set samples dimensional probability prediction vector; The input to the first input layer of the heterogeneous graph neural network consists of two parts. First, the global aggregated feature embedding vector set obtained in step 2 is concatenated with the malware family hyperprototype anchor feature vector according to the node sorting rules to generate the initial heterogeneous topology graph feature matrix. Secondly, the heterogeneous normalized adjacency matrix obtained in step 3.2. The first output layer outputs the sample data of each query set to be tested under the current meta-task, obtained through direct feature inference in the unlabeled blind testing state. The probability prediction vector for Android malware family classification is obtained by taking the maximum value index of the probability vector and finally obtaining the predicted discrete Android malware family category label. The final objective function of the heterogeneous graph neural network adopts a collaborative objective function based on uncertain dynamic weight learning, expressed as: (14) in, This represents the final objective function of the heterogeneous graph neural network; This represents the cross-entropy classification loss calculated on the query set; This represents the boundary adaptive center constraint loss used to mitigate the problem of ambiguous classification surfaces caused by the high variation of malware families. and These represent the adaptive variance parameters that the quality graph neural network learns adaptively during the multi-task joint loss constraint training process, which are used to dynamically calibrate the gradient weights of the two losses, and are used to automatically find the optimal decision surface constraint in a blind test environment without relying on manual parameter tuning. Step 3.3.2: The heterogeneous graph neural network constructed in Step 3.3.1 is used for global feature propagation and interaction across sample data nodes and malware family hyperprototype nodes through layer-by-layer forward propagation to obtain the final node feature matrix. ; Step 3.3.2 specifically involves: In each graph convolutional layer of the heterogeneous graph neural network constructed in step 3.3.1, the direct-guided feature iterative inference is achieved by introducing an adaptive gated residual update mechanism to nonlinearly aggregate the feature information of the current local neighborhood sample data nodes and the high-order malware family superprototype nodes, so as to update the feature representation of the current node in real time. The matrix update of the current node's feature representation is expressed as follows: (15) in, Indicates the first The node feature matrix of the layer; Represents the initial node feature matrix; For non-linear activation functions, LeakyReLU activation function is used; This represents the heterogeneous normalized adjacency matrix after symmetric smoothing correction; Indicates the first The node feature matrix of the layer; and They represent the first Layer-parallel adaptive, mutually independent feature transformation weight parameter matrices; This indicates that the elements of the matrix are multiplied at corresponding positions. Represents a matrix of all 1s with the same dimension as the node feature matrix; Indicates the first The adaptive topological feature flow gating matrix of the layer; After forward propagation computation of the heterogeneous graph neural network, the feature matrix of the initial heterogeneous topological graph is obtained. go through After layer graph convolution and adaptive gated residual update iteration processing, the final output is Vidi The final node feature matrix integrates macroscopic spatial topological correlation information across sample data and achieves semantic aggregation. .

[0014] Step 4 is as follows: Step 4.1: Analyze the final node feature matrix obtained in Step 3. Perform multi-task joint loss constraint optimization training with boundary adaptive center constraints; Step 4.1 specifically involves: The final node feature matrix output from step 3 Extract the final feature representation vector for each query set sample data node. The final feature representation vector is extracted using the collaborative objective function formula (14) adopted in step 3.3.1. Perform joint constraint optimization training; During the joint constraint optimization training process, the cross-entropy classification loss in formula (14) The optimization is represented as: (16) in, This represents the cross-entropy classification loss calculated on the query set; This represents the set of query set sample data in the current meta-task; Indicates the first Sample data of a query set to be tested; Indicates the first The real Android malware family tags corresponding to the sample data of each query set; This represents the final feature representation vector corresponding to the query set sample data after iterative inference in the heterogeneous graph network. This indicates the feature vector of the superprototype anchor point of the Android malware family corresponding to the real label of the query set sample data; Indicates the first [item] within the current meta-task Feature vectors of superprototype anchor points of Android malware families; Dynamic constraints are achieved through joint constraint optimization training to dynamically update the parameters of a heterogeneous graph neural network. These dynamic constraints utilize a boundary adaptive center constraint loss. The optimization is represented as: (17) in, This represents the boundary adaptive center constraint loss; Indicates the first [item] within the current meta-task A family of Android malware supports a set of sample data; Indicates the first The cardinality of the sample data set supported by each Android malware family; Indicates the first The first malware family support set One sample data; Indicates the first Feature vectors of superprototype anchor points of Android malware families; Indicates that for the first A dynamic intra-class variance tolerance boundary that adaptively adjusts the mutation frequency of each Android malware family applies a centripetal constraint to Android malware families with different mutation characteristics. Based on the dynamic constraints of dynamically updating the parameters of the obtained heterogeneous graph neural network, variant sample data that were originally skewed by the high degree of variation in malware families are forcibly compressed around the hyperprototype anchor points of their respective malware families. This maximizes the separation of geometric boundaries between different malware families in the feature manifold space, realizing the transformation of the classification decision surface from fuzzy to clear. Finally, the optimized feature representation vector of each query set sample data node is obtained. ; Step 4.2: For each query set of sample data to be classified, provide classification decision results to infer the Android malware family affiliation of the unknown sample data; Step 4.2 specifically involves: Based on the final optimized feature representation vector obtained in step 4.1 For each query set sample data to be classified, the final optimized feature representation vector after inference from the heterogeneous graph neural network is fed into the Softmax classifier. The multi-class Android malware family label is determined by selecting the index corresponding to the highest similarity score in the output predicted probability vector, as shown below: (18) in, Indicates the first The final multi-class malware family labels corresponding to each query set sample data; Indicates the argument operator; This represents a prediction vector that indicates the probability of a sample belonging to each category. This represents the category index within the current meta-task context; Ultimately, the classification decision output is a defined multi-class family label result for each unknown Android malware query set sample data. This label serves as the final output data for automatically classifying malware families and identifying malicious behaviors from Android malware sample data.

[0015] The beneficial effects of this invention are: (1) Achieving adaptive sparsity reduction and matrix stability correction of unsupervised heterogeneous topological graph structures under blind testing. The method of this invention constructs a heterogeneous graph neural network without relying on query set sample labels and only with a small amount of sample data. By introducing adaptive topological similarity gated filtering and dynamic Laplace smoothing correction mechanism, sample data nodes and malware family hyperprototype nodes are constructed simultaneously in the latent space to eliminate low-confidence redundant edge noise. Using stable malware family hyperprototype nodes as topological gravity centers, the distance between mutated sample data and the original malware family is forcibly narrowed, constructing a highly cohesive and mutation-resistant joint topological network, eliminating the ambiguity of the decision surface caused by the high mutation rate of Android malware families.

[0016] (2) Efficiently and automatically captures multi-axis long-distance dependencies within grayscale images of malicious software and macroscopic topological semantic associations across sample data. The method of this invention organically integrates spatial cross-Mamba feature encoding with heterogeneous graph neural networks. Spatial cross-Mamba feature encoding adopts a four-directional cross-scanning strategy with horizontal and vertical bidirectional approaches, which extracts spatial texture distortions caused by obfuscation methods while ensuring long-distance logical associations of sequences. Combined with the adaptive gated residual update mechanism inside the heterogeneous graph neural network, it realizes high-quality direct-feature iterative inference. No manual feature engineering is required throughout the process. Compared with the benchmark model under the same sample size and the same meta-task configuration, it has stronger cross-sample data feature transmission ability, global topological understanding ability, and anti-obfuscation mutation ability. (3) Maximize the separation of different Android malware families under extreme constraints of few samples to improve the automatic classification accuracy of unknown new variants. To address the shortcomings of high mutation rate of malware families leading to blurred classification surfaces and low classification accuracy with few samples, the method of this invention extracts deep and complex features without relying on a large amount of labeled data through grayscale image mapping. In the multi-task joint loss constraint optimization training, a collaborative objective function of uncertainty dynamic weight learning is introduced. By applying centripetal geometric constraints to each mutated malware family through boundary adaptive center constraint loss, a wide geometric isolation zone is cut out in the feature manifold space, which effectively solves the problems of information loss, feature oversmoothing and adversarial high mutation in the few sample environment, and achieves high classification accuracy of malware family attribution for unknown sample data.

[0017] (4) The method of the present invention converts the initial small amount of sample data into grayscale images of Android malware, adopts spatial cross Mamba feature encoding and constructs a heterogeneous graph neural network, which alleviates the problem of scarce sample data of Android malware families, and solves the problems of high cost of manual data collection, lack of long-distance contextual association of sequences, and high variation of Android malware families leading to blurred classification surface and low classification accuracy in a data-scarce environment. Attached Figure Description

[0018] Figure 1 This is a flowchart of the few-sample Android malware family classification method based on meta-learning of the present invention; Figure 2 This refers to the process of converting Android malware into a grayscale image in the method of this invention; Figure 3 yes Figure 2 The image is converted to grayscale from the original image. Figure 4 This is a schematic diagram of the heterogeneous graph neural network structure in the method of this invention; Figure 5 This is the clarity evaluation diagram of the decision surface of the Android malware family metric space in Embodiment 1 of the present invention. Detailed Implementation

[0019] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0020] This invention provides a meta-learning-based method for classifying Android malware families, referring to... Figure 1Specifically, the process involves: First, using preprocessed grayscale images of Android malware as input to a few-shot meta-learning model. A global aggregated feature embedding vector, highlighting both the horizontal and vertical axes and capable of combating spatial texture distortion caused by high variation within malware families, is extracted using spatial cross-Mamba feature encoding. Then, a heterogeneous graph neural network is constructed. This global aggregated feature embedding vector is input into a two-layer topological space containing sample data and malware family hyperprototypes, where cross-node direct-path feature iterative inference is performed. A multi-task meta-learning collaborative objective function based on uncertain dynamic weight learning is introduced to train the heterogeneous graph neural network with multi-task joint loss constraints. Finally, on a clear classification decision surface, a malware family classification decision result for unknown Android malware sample data is generated.

[0021] The method of the present invention specifically includes the following steps: Step 1: Collect the initial sample dataset and preprocess it to obtain grayscale images of Android malware, such as... Figures 1-3 As shown; Step 1 is as follows: Download 20-50 mixed families of Android malware (both similar and dissimilar) from the Androzoo public dataset, containing a total of 800-2000 Android malware files with the .apk extension. Simultaneously generate... ( The value ranges from 20 to 50) Android malware family classification tag codes, with the code number ranging from '1' to '20'. The initial sample dataset is composed of all downloaded Android malware and their corresponding Android malware family classification label codes. Each Android malware in the initial sample dataset is directly mapped to a grayscale pixel value (ranging from 0 to 255) by pixelating in 8-bit binary combinations, resulting in a grayscale image of Android malware with a .png extension. The resolution of the grayscale image is then uniformly normalized to 128×128 pixels. This preprocessing of the initial sample dataset yields two-dimensional Android malware grayscale images. All two-dimensional Android malware grayscale images and their corresponding Android malware family classification label codes are then used as the sample dataset.

[0022] Step 2: Extract a global aggregated feature embedding vector set based on spatial cross-Mamba feature encoding from all grayscale images of Android malware in the sample dataset obtained in Step 1; Step 2 is as follows: Step 2.1: Serialize all the two-dimensional Android malware grayscale images in the sample dataset obtained in Step 1. First, divide each two-dimensional Android malware grayscale image into a sequence composed of flattened patches, i.e. ,in The total length of the sequence is represented by the first line; then each flattened patch is projected into the D-dimensional latent space to obtain the flattened patch sequence, thus realizing the vectorized representation of each Android malware grayscale image. Step 2.2: Perform multi-directional and multi-view dynamic feature extraction on the flattened patch sequence obtained in Step 2.1 using spatial cross Mamba feature encoding to obtain a global aggregated feature embedding vector; Step 2.2 specifically involves: Step 2.2.1: For spatial cross Mamba feature encoding, the flattened patch sequence is used as the input sequence; the spatial geometric vertical and horizontal axes of the Android malware grayscale image are reconstructed into a spatial manifold sequence with four scanning directions; the four scanning directions correspond to: horizontal forward (→), horizontal backward (←), vertical forward (↓) and vertical backward (↑), and an independent continuous-time linear time-invariant state-space model is established for each direction; The continuous-time linear time-invariant state-space model is a cross-adaptive mapping in four scanning directions from the input sequence to the hidden state and from the hidden state to the output sequence. The transition process from the input sequence to the hidden state in the four scanning directions is represented as follows: (1) in, Indicates hidden state For continuous variables The derivative; Indicates control of four scanning directions The evolution matrix of state evolution; Indicates the current sampling At any given moment, four scanning directions The continuous hidden state below; Indicates four scanning directions The input matrix for integrating new control information; Indicates the current sampling At any given moment, corresponding to the four scanning directions The input patch feature sequence; The transition process from the hidden state to the output sequence in the four scanning directions is represented as follows: (2) in, Indicates the current sampling At any given moment, corresponding to the four scanning directions The output sequence below; This represents the output projection matrix that maps the hidden state to the final vector representation under the four scanning directions. It is used to map the high-dimensional spatial state features back to the target feature space. Step 2.2.2: Using a step size of The zero-order hold performs a discretization transformation on the continuous-time linear time-invariant state-space model in the four scanning directions, specifically as follows: First, assume the current sampling time And input within each sampling interval Keep constant, that is By analytically solving formula (1), the discretized state transition matrix and input matrix are obtained, as follows: (3) in, This indicates the four corresponding scanning directions. Discretized state transition matrix; Indicates the step size; This indicates the four corresponding scanning directions. Discretized input matrix; Then, based on the discretized matrices obtained in the four scanning directions, the hidden state is updated in parallel. The hidden state update is represented as: (4) in, This indicates the four corresponding scanning directions. In the The hidden status of global signatures of Android malware updated at each time step; This indicates the four corresponding scanning directions. In the previous time step, the global signature of Android malware was hidden. This indicates the four corresponding scanning directions. The feature vector of the Android malware grayscale image flattening patch sequence input at the current time step; Finally, based on the updated hidden state in the four scanning directions The output projection matrices for the four scanning directions are respectively After mapping, the final output for the four scanning directions is obtained, represented as: (5) in, This indicates the four corresponding scanning directions. In the The feature vector of an Android malware enhancement patch that incorporates directional context information at each time step; Step 2.2.3: The four scanning directions obtained after discretization are finally output. Through formulas (4) and (5), the recursive state propagation is performed step by step along the four spatial arrangement directions of the flattened patch sequence to obtain the complete enhanced feature sequence spliced ​​in the four scanning directions, as follows: , , , .

[0023] Then, a spatial cross-attention gating mechanism is used to perform multi-view global spatial feature fusion and alignment on the enhanced feature sequences in the four scanning directions; allowing the enhanced feature sequences in the four scanning directions to... , , , As the input to the spatial cross-attention gating mechanism, among which, This indicates the total number of image patches segmented from a grayscale image of Android malware; The dimension of a single patch feature sequence is perfectly aligned with the dimension of the input patch feature sequence. By concatenating the inputs to the spatial cross-attention gating mechanism, the global feature matrix is ​​obtained, represented as: (6) in, Represents the global feature matrix; These represent the enhanced feature sequences in the four scanning directions, respectively. The obtained global feature matrix is ​​then combined with three independent adaptive linear projections to generate query feature, key feature, and value feature matrices, as follows: (7) in, These represent the query feature matrix, key feature matrix, and value feature matrix, respectively. These represent the adaptive projection weight matrices, respectively. Subsequently, by scaling the dot product attention operation, the spatial dependency weights between the patch feature sequences in the four scanning directions are calculated, resulting in the four scanning direction cross-attention weight matrix that highlights the cross-directional code block association features of Android malware, as shown below: (8) in, This represents the cross-attention weight matrix for the four scanning directions; Represents the transpose of the key feature matrix; Indicates the scaling factor; Represents the normalization function; To avoid feature redundancy interference in a single scanning direction, adaptive gating weights for four scanning directions are introduced. The feature contribution ratios of the four scanning directions are adaptively adjusted, and the feature sequences of the four scanning directions are weighted and aggregated. This weighted aggregation process is expressed as follows: (9) in, This represents the omnidirectional enhanced feature sequence after weighted aggregation; This represents the adaptive gating weights for the four scanning directions; This indicates a sequence splitting operation in four scanning directions; Finally, the weighted aggregation result Y is expanded point-by-point according to the spatial arrangement order of the input patch feature sequences, and the output is an omnidirectional enhanced feature sequence with the same length as the input sequence. Each of them All of them contain context-aware information about the grayscale images of Android malware in global spatiotemporal and multi-perspective dimensions; Step 2.2.4: The obtained omnidirectional enhanced feature sequence Global pooling is performed, and adaptive fusion weight parameters are introduced to automatically adapt to the feature distribution of different types of Android malware, thereby achieving spatial dimensionality reduction and semantic aggregation of the associated features between feature sequences of various enhancement patches. Among them, omnidirectional enhancement feature sequences The global pooling process, which involves performing global pooling operations, is represented as follows: (10) in, This represents the omnidirectional enhanced feature sequence after global pooling; This represents the omnidirectional enhanced feature sequence after average pooling; This represents the omnidirectional enhanced feature sequence after max pooling; This represents the adaptive fusion weight parameters. ; Then, an adaptive fully connected linear transformation is used to map the globally pooled omnidirectional augmented feature sequence to the target dimension of the output. The adaptive fully connected linear transformation process is expressed as: (11) in, This represents the output global aggregated feature embedding vector. ; Represents the adaptive weight matrix; This represents the bias vector of adaptive behavior.

[0024] This outputs a fixed-length global aggregated feature embedding vector. This allows for the vectorized representation of each Android malware grayscale image. Finally, a global aggregated feature embedding vector set is generated for all Android malware grayscale images.

[0025] Step 3: Perform heterogeneous graph structure inference on the global aggregated feature embedding vector set obtained in Step 2; Step 3 specifically involves: Step 3.1: Construct a heterogeneous directed topological graph using the global aggregated feature embedding vector set output in Step 2 to obtain the heterogeneous adjacency matrix; Step 3.1 specifically involves: Step 3.1.1: Construct a heterogeneous directed topology graph based on meta-tasks; Step 3.1.1 specifically refers to: The global aggregated feature embedding vector set output from step 2 is used as the total meta-task pool. Independent meta-tasks are randomly sampled from the total meta-task pool according to the pre-set N-way K-shot rule of meta-learning. Each meta-task contains a specified number of support sets and query sets. For each sampled meta-task, a heterogeneous directed graph is constructed for that meta-task in a completely direct manner. ;in, This represents the set of sample data nodes, where each sample data node... For a single sample data point from the current meta-task support set or query set, each sample data node... The initial state is set to the global aggregated feature embedding vector obtained in step 2. ; This represents a collection of hyperprototype nodes for a malware family, with each hyperprototype node... This corresponds to a global central anchor point of a known Android malware family in the current meta-task; the exclusive representation of this global central anchor point of the malware family is the anchor point feature vector, which is the globally aggregated feature embedding vector of all sample data in the corresponding malware family support set. Direct mean generation is performed, and the generated anchor feature vector is directly used as the initial state of the malware family hyperprototype node in the heterogeneous directed topology graph. This is used to provide stable guidance on the original attributes of the Android malware family at the topology level to resist feature drift caused by the high variation of the Android malware family. Step 3.1.2: Perform adaptive similarity measurement calculation through the constructed heterogeneous directed topology graph to obtain the heterogeneous adjacency matrix between the sample data and the malware family superprototype; Step 3.1.2 specifically involves: For the constructed heterogeneous directed topology graph, the initial connectivity is defined by a heterogeneous adjacency matrix based on dynamic spatial mapping. First, the generalized edge weights between any two nodes in the heterogeneous topology graph are calculated using an adaptive similarity calculation operator for heterogeneous nodes. For heterogeneous nodes of different types (sample data and malware family superprototype nodes), the similarity calculation operator uses cosine similarity calculation with adaptive offset. For homogeneous nodes of the same type (sample data and sample data), the similarity calculation operator uses normalized similarity calculation with mid-class distance penalty. For homogeneous nodes of the same type (malware family superprototype nodes and malware family superprototype nodes), there is no similarity calculation operator, and the generalized edge weights are 0.

[0026] To standardize the calculation of generalized edge weights between heterogeneous nodes, we define variables. and These represent the sets of nodes in a heterogeneous topology graph. Any two nodes in the node and nodes Generalized edge weights between Represented as: (12) in, Represents a node and nodes The weights of heterogeneous topological edges between nodes, especially when nodes and nodes When all nodes are sample data nodes, Transform into homogeneous topological edge weights between sample data nodes When node For sample data nodes and nodes When it is a hyperprototype node of a malware family. Transformed into heterogeneous topological edge weights between sample data and malware family hyperprototypes When node For malware family hyperprototype nodes and nodes When it is a hyperprototype node of a malware family. Forced to be set to 0 to avoid invalid obfuscation of global central anchors from different malware families; Represents the natural exponential function; This represents an adaptive distance adjustment factor, used to dynamically adjust the scaling scale for measuring feature distances in the latent space; Represents the generalized distance metric function in the projected latent space; and These represent the feature linear mapping layers adaptively selected based on the type of the node; and Representing nodes respectively and nodes The corresponding feature vector, especially when the node is a sample data node. The corresponding global aggregated feature embedding vector When the node is a malware family hyperprototype node The time corresponds to the first one initially obtained from the support set. The central vector of an Android malware family; Indicates a function to indicate the type of heterogeneous nodes, especially when the node... and nodes When the nodes belong to different types of heterogeneous nodes (sample data and malware family hyperprototype nodes), the function outputs a value of 1; when the node... and nodes When the nodes belong to the same type and are homogeneous (sample data and sample data, or malware family superprototype node and malware family superprototype node), the function outputs a value of 0; It represents the topological impedance coefficient, which is used to adjust the diffusion intensity of information flow between heterogeneous and homogeneous edges.

[0027] For the current meta-task, the generalized edge weights are then filled into the dimension. The matrix, where, This indicates the total number of sample data nodes within the current meta-task; This indicates the total number of malware family hyperprototype nodes within the current meta-task; Finally, the first row / column of the matrix The bits correspond sequentially to all sample data nodes, and then... Each bit corresponds sequentially to a superprototype node of all malware families, achieving an ordered mapping of heterogeneous nodes and obtaining a heterogeneous adjacency matrix. This heterogeneous adjacency matrix helps the heterogeneous graph neural network constructed later to autonomously explore the structural relationships between different Android malware variants without prior knowledge of sample data labels, thus alleviating the ambiguity of the decision surface caused by the high degree of variation in Android malware families.

[0028] Step 3.2: Calculate the heterogeneous adjacency matrix obtained in Step 3.1. Perform sparsification optimization and matrix stability correction on the adaptive heterogeneous topology graph structure to obtain the heterogeneous normalized adjacency matrix. Step 3.2 specifically involves: By analyzing the heterogeneous adjacency matrix output in step 3.1 Adaptive tensor truncation is performed, and an adaptive topological similarity gated filtering mechanism is introduced to maintain the sparsity of the topological graph structure and minimize computational noise. For the adaptive topological similarity gated filtering mechanism, an activation threshold needs to be dynamically calculated based on the mean and standard deviation of the edge weights between all nodes in the current meta-task. When the elements in the heterogeneous adjacency matrix When the topological edge is low-confidence, it indicates that the topological edge belongs to a low-confidence association, and the topological edge is directly cleared to zero; when In this case, the directed edge is retained to achieve adaptive sparsity of the heterogeneous graph topology, ensuring that highly variable sample data nodes can eliminate noise interference and stably anchor to the super-prototype node of their respective malware family.

[0029] To ensure numerical stability and generalization performance during subsequent information transmission, a dynamic Laplacian regularization operator is used to perform symmetric smoothing correction on the heterogeneous adjacency matrix after implementing the adaptive topological similarity gated filtering mechanism, ultimately obtaining the symmetric smoothed corrected heterogeneous normalized adjacency matrix. Symmetric smoothing correction is expressed as: (13) in, This represents the heterogeneous normalized adjacency matrix after symmetric smoothing correction; This represents the degree matrix of the heterogeneous adjacency matrix after filtering. Represents the identity matrix with the same dimension as the heterogeneous adjacency matrix, used to introduce self-loop topology into heterogeneous topological graph structures to maintain the feature independence of the nodes' own characteristics.

[0030] Here, the sparsification and smoothing correction process of the heterogeneous graph topology is based entirely on the double-layer similarity gated filtering expansion of the feature space and the hyperprototype space, without relying on any malware family labels of the query set samples to prevent label leakage.

[0031] Step 3.3: Convert the heterogeneous normalized adjacency matrix obtained in Step 3.2 into a single matrix. Enter the constructed heterogeneous graph neural network and perform direct-guided feature iterative inference based on the heterogeneous directed topological graph structure.

[0032] Step 3.3 specifically involves: The heterogeneous normalized adjacency matrix output in step 3.2 Enter the constructed heterogeneous graph neural network; Step 3.3.1: Constructing a heterogeneous graph neural network and its final objective function ; Step 3.3.1 specifically refers to: like Figure 4 As shown, the constructed heterogeneous graph neural network structure includes a first input layer, a first graph convolutional layer, a first activation function layer, a first heterogeneous topology gating correction layer, a second graph convolutional layer, a first classification mapping layer, and a first output layer. The parameters for each layer are as follows: The feature dimension of the input to the first convolutional layer is... The output feature dimension is The feature dimension of the input to the first activation function layer is consistent with the feature dimension of the output of the first convolutional layer, and the output feature dimension is perfectly aligned with the input dimension. LeakyReLU is selected as the sole activation function. The input to the first heterogeneous topology gating correction layer... Features of individual sample data nodes and Features of several malware family hyperprototype nodes, totaling [number missing]. There are nodes; the input feature dimension is . Output a The heterogeneous topological gated modified adjacency matrix of dimension 1; the input of the second graph convolutional layer contains two parts, one being the feature dimension 1. The first is the node feature tensor, and the second is the output of the first heterogeneous topology gated correction layer. An adjacency matrix of dimension 1, the output dimension is 1. ,in This represents the total number of malware family categories corresponding to the current meta-task; all graph convolutional layers use LeakyReLU as their activation function; the input to the first classification mapping layer is the output from the second graph convolutional layer. Extracted from the feature tensor of the dimensional node Each sample data node corresponds to 3D eigenvalue submatrix, output A similarity probability matrix of dimension; the first output layer input is the output of the second graph convolutional layer. The query set samples extracted from the feature tensor of the dimensional nodes 3D feature vectors, outputting the corresponding query set samples dimensional probability prediction vector; The input to the first input layer of the heterogeneous graph neural network consists of two parts. First, the global aggregated feature embedding vector set obtained in step 2 is concatenated with the malware family hyperprototype anchor feature vector according to the node sorting rules to generate the initial heterogeneous topology graph feature matrix. Secondly, the heterogeneous normalized adjacency matrix obtained in step 3.2. The first output layer outputs the sample data of each query set to be tested under the current meta-task, obtained through direct feature inference in the unlabeled blind testing state. The probability prediction vector for Android malware family classification is obtained by taking the maximum value index of the probability vector and finally obtaining the predicted discrete Android malware family category label. The final objective function of the heterogeneous graph neural network adopts a collaborative objective function based on uncertain dynamic weight learning, expressed as: (14) in, This represents the final objective function of the heterogeneous graph neural network; This represents the cross-entropy classification loss calculated on the query set; This represents the boundary adaptive center constraint loss used to mitigate the problem of ambiguous classification surfaces caused by the high variation of malware families. and These represent the adaptive variance parameters that the quality graph neural network learns adaptively during the multi-task joint loss constraint training process, which are used to dynamically calibrate the gradient weights of the two losses, and are used to automatically find the optimal decision surface constraint in a blind test environment without relying on manual parameter tuning. Step 3.3.2: The heterogeneous graph neural network constructed in Step 3.3.1 is used for global feature propagation and interaction across sample data nodes and malware family hyperprototype nodes through layer-by-layer forward propagation to obtain the final node feature matrix. ; Step 3.3.2 specifically refers to: In each graph convolutional layer of the heterogeneous graph neural network constructed in step 3.3.1, the direct-guided feature iterative inference is achieved by introducing an adaptive gated residual update mechanism to nonlinearly aggregate the feature information of the current local neighborhood sample data nodes and the high-order malware family superprototype nodes, so as to update the feature representation of the current node in real time. The matrix update of the current node's feature representation is expressed as follows: (15) in, Indicates the first The node feature matrix of the layer; Represents the initial node feature matrix; For non-linear activation functions, LeakyReLU activation function is used; This represents the heterogeneous normalized adjacency matrix after symmetric smoothing correction; Indicates the first The node feature matrix of the layer; and They represent the first Layer-parallel adaptive, mutually independent feature transformation weight parameter matrices; This indicates that the elements of the matrix are multiplied at corresponding positions. Represents a matrix of all 1s with the same dimension as the node feature matrix; Indicates the first The layer's adaptive topological feature flow gating matrix is ​​calculated by performing a nonlinear projection mapping on the feature matrix of the current layer node. It is used to dynamically adjust the information fusion ratio between macroscopic spatial topological neighborhood association information and the node's own original behavioral features, in order to prevent oversmoothing and feature collapse caused by the high mutation of malware families.

[0033] After forward propagation computation of the heterogeneous graph neural network, the feature matrix of the initial heterogeneous topological graph is obtained. go through After layer graph convolution and adaptive gated residual update iteration processing, the final output is Vidi The final node feature matrix integrates macroscopic spatial topological correlation information across sample data and achieves semantic aggregation. .

[0034] Step 4: Perform multi-task joint loss constraint optimization training on the final node feature matrix obtained in Step 3 to provide classification decision results for inferring the family affiliation of Android malware in unknown sample data.

[0035] Step 4 is as follows: Step 4.1: Analyze the final node feature matrix obtained in Step 3. Perform multi-task joint loss constraint optimization training with boundary adaptive center constraints; Step 4.1 specifically involves: The final node feature matrix output from step 3 Extract the final feature representation vector for each query set sample data node. The final feature representation vector is extracted using the collaborative objective function formula (14) adopted in step 3.3.1. Joint constraint optimization training is performed; this training process involves updating the parameters of the heterogeneous graph neural network by using multi-task loss during the iterative training of the random task flow of meta-learning.

[0036] During the joint constraint optimization training process, the cross-entropy classification loss in formula (14) The optimization is represented as: (16) in, This represents the cross-entropy meta-classification loss calculated on the query set, used to guide the network to optimize meta-classification performance across sample data nodes; This represents the set of query set sample data in the current meta-task; Indicates the first Sample data of a query set to be tested; Indicates the first The real Android malware family tags corresponding to the sample data of each query set; This represents the final feature representation vector corresponding to the query set sample data after iterative inference in the heterogeneous graph network. This indicates the feature vector of the superprototype anchor point of the Android malware family corresponding to the real label of the query set sample data; Indicates the first [item] within the current meta-task Feature vectors of superprototype anchor points of Android malware families; Dynamic constraints are achieved through joint constraint optimization training to dynamically update the parameters of a heterogeneous graph neural network. These dynamic constraints utilize a boundary adaptive center constraint loss. The optimization is represented as: (17) in, This represents the boundary adaptive center constraint loss; Indicates the first [item] within the current meta-task A family of Android malware supports a set of sample data; Indicates the first The cardinality of the sample data set supported by each Android malware family; Indicates the first The first malware family support set One sample data; Indicates the first Feature vectors of superprototype anchor points of Android malware families; Indicates that for the first A dynamic intra-class variance tolerance boundary that adaptively adjusts the mutation frequency of each Android malware family applies a centripetal constraint to Android malware families with different mutation characteristics. Based on the dynamic constraints of dynamically updating the parameters of the obtained heterogeneous graph neural network, variant sample data that were originally skewed by the high degree of variation in malware families are forcibly compressed around the hyperprototype anchor points of their respective malware families. This maximizes the separation of geometric boundaries between different malware families in the feature manifold space, realizing the transformation of the classification decision surface from fuzzy to clear. Finally, the optimized feature representation vector of each query set sample data node is obtained. ; Step 4.2: For each query set of sample data to be classified, provide classification decision results to infer the Android malware family affiliation of the unknown sample data; Step 4.2 specifically involves: Based on the final optimized feature representation vector obtained in step 4.1 For each query set sample data to be classified, the final optimized feature representation vector after inference from the heterogeneous graph neural network is fed into the Softmax classifier. The multi-class Android malware family label is determined by selecting the index corresponding to the highest similarity score in the output predicted probability vector, as shown below: (18) in, Indicates the first The final multi-class malware family labels corresponding to each query set sample data; Indicates the argument operator; This represents a prediction vector that indicates the probability of a sample belonging to each category. This represents the category index within the current meta-task context; Ultimately, the classification decision output is a defined multi-class family label result for each unknown Android malware query set sample data. This label serves as the final output data for automatically classifying malware families and identifying malicious behaviors from Android malware sample data.

[0037] Example 1 The experimental effects of the present invention will be further explained below in conjunction with evaluation experiments.

[0038] 1. Evaluate the experimental environment: The hardware environment for the evaluation experiment was: an Intel Core i7-9700 CPU, a Gigabyte RTX4060 graphics card, and 64GB of RAM.

[0039] The software environment for the evaluation experiment was: Anaconda3 2025.06-1, CUDA 11.8.1, cuDNN 8.9.6, Python 3.13, and the deep learning framework Tensorflow 2.13.

[0040] Evaluation of the experimental sample dataset: The initial sample dataset size consisted of 30 selected Android malware families, containing a total of 1,200 original .apk files. The sample dataset was split at the category level, with 60% (18 families) selected as the meta-training set, 20% (6 families) as the meta-validation set, and the remaining 20% ​​(6 families) as the meta-test set.

[0041] During the verification process of each meta-task scenario, the above subset is resampled based on the N-way K-shot setting. The N-way K-shot setting specifically includes six types: 5-way 1-shot, 5-way 5-shot, 10-way 1-shot, 10-way 5-shot, 20-way 1-shot, and 20-way 5-shot. For the currently selected N malware family categories, K malware samples with known labels are randomly selected from each family as the support set, and a fixed number of Q (=15) samples are randomly selected from the remaining samples from each family as the query set. Verification is performed using a method in which the meta-support set and meta-query set are completely mutually exclusive, and the meta-test set and meta-training set are completely mutually exclusive.

[0042] The performance metrics are: accuracy, classification precision, recall, F1 score, and inference latency.

[0043] 1) Accuracy: Represents the proportion of samples correctly classified by the model out of the total number of samples, expressed as: (19) in, Indicates accuracy; The true class is the number of unknown query set samples that actually belong to the current target Android malware family and are correctly predicted as belonging to that target malware family. The true negative class is the number of unknown query set samples that do not actually belong to the current target Android malware family but are correctly predicted as other non-target malware families. The false positive category represents the number of unknown query set samples that do not actually belong to the current target Android malware family but are incorrectly predicted as belonging to that target malware family. The false negative class represents the number of unknown query set samples that actually belong to the current target Android malware family but are incorrectly predicted as other non-target malware families.

[0044] 2) Classification accuracy: This represents the proportion of correctly predicted positive samples out of the total number of samples predicted as positive, expressed as: (20) in, Indicates the classification accuracy.

[0045] 3) Recall: Represents the proportion of correctly predicted positive samples out of the total number of actual positive samples, expressed as: (twenty one) in, This indicates the recall rate.

[0046] 4) F1 score: Represents the harmonic mean of classification precision and recall. The score ranges from 0 to 1, with values ​​closer to 1 indicating better model performance, expressed as: (twenty two) Where F1 represents the F1 score.

[0047] 5) Inference Latency: This represents the average computation time consumed by direct behavioral inference in the inference and classification phases for performing graph convolution iteration processing on a single Android malware query set sample and determining the Android malware family affiliation. It is expressed as: (twenty three) in, Indicates a delay in reasoning; Indicates the total reasoning time; This represents the total number of unknown query set samples that participated in the evaluation.

[0048] 2. Evaluation of experimental content and result analysis: Evaluation Experiment 1: The probability density distribution of intra- and inter-class geometric distances was statistically and jointly quantitatively evaluated using a metric space probability manifold. This provides an intuitive visual basis for qualitatively and quantitatively evaluating the classification surface clarity capability of the method of this invention when facing highly variable 30 Android malware families. The results are as follows: Figure 5 .

[0049] from Figure 5 It can be seen that even under the extreme constraints of few samples and high variation among Android malware families, the intra-class distance probability density curve representing the same type of Android malware family exhibits an extremely high peak value and converges densely to the left, with the value significantly approaching zero. This quantitatively proves that its intra-class variance is extremely small and its clustering is high. Conversely, the inter-class distance probability density curve representing different types of Android malware families drifts significantly to the right in a higher-dimensional space. A wide geometric separation band exists between the two curves, and their inter-class boundaries are clearly visible. The overlapping area of ​​the curves approaches zero. The method of this invention is not affected by the constraints of few samples or feature drift, and can accurately extract the essential features of Android malware. It effectively overcomes the shortcomings of traditional models such as feature overlap and fuzzy classification surfaces, and provides clear qualitative inferences about multiple malware families for unknown or detected Android variant samples.

[0050] Evaluation Experiment 2: The proposed method was tested against existing pre-trained benchmark models (BiLSTM-MAML, CNN-GCN, and Trans-GAT) with the same initial sample data and N-way K-shot meta-task configuration on a meta-test set. The accuracy under the same N-way K-shot task configuration was calculated. Specifically, the BiLSTM-MAML model is a benchmark model that uses a model-independent meta-learning paradigm, employing a bidirectional long short-term memory network as a feature encoder for fine-tuning with a small number of samples through two-layer training with numerous meta-tasks; the CNN-GCN model uses a CNN as a pre-feature encoder, then performs a single-layer graph convolution operation on the topology graph, aggregating neighborhood features in the graph space to complete the classification; and the Trans-GAT model uses a Transformer as a pre-feature encoder, followed by a Graph Attention Network (GAT) to construct the topology graph, dynamically aggregating the association information between sample nodes through the graph attention mechanism to complete the few-shot classification.

[0051] Table 1 shows the experimental comparison results between three benchmark models (BiLSTM-MAML, CNN-GCN, and Trans-GAT) and the method of this invention.

[0052] As shown in Table 1, the accuracy of the method presented in this invention is higher in all evaluated meta-task scenarios. In the 5-way 5-shot task, the method achieved a classification accuracy of 97.18%; when the classification complexity increased to the 20-way 5-shot task, the method achieved a classification accuracy of 89.45%. Compared with the three benchmark models BiLSTM-MAML, CNN-GCN, and Trans-GAT, the method achieved higher classification accuracy in all classification meta-task scenarios, objectively demonstrating that multi-axis cross-selective scanning and heterogeneous space calibration operators can effectively improve the learning performance of multi-classification models and their meta-relation inference capabilities in low-shot environments.

[0053] Evaluation Experiment 3: The present invention's method was tested on the meta-test set using existing benchmark models such as BiLSTM-MAML, CNN-GCN, and Trans-GAT under the same initial sample data volume and N-way K-shot meta-task configuration. The inference latency and time complexity in the inference classification stage were calculated under the same N-way K-shot task configuration.

[0054] Table 2 shows the experimental comparison results between the three benchmark models (BiLSTM-MAML, CNN-GCN, and Trans-GAT) and the method of this invention.

[0055] As shown in Table 2, the inference latency of the method of this invention maintains highly stable computational speed and low latency characteristics under various task configurations. In the 5-way 5-shot task scenario, the inference latency of a single unknown Android malware query set sample obtained by the method of this invention is only 48.7ms. Compared with the Trans-GAT benchmark model based on the Transformer architecture, which has higher computational complexity, the method of this invention achieves lower inference time and shortens processing latency, objectively verifying the advantages of the multi-axis cross-selective scanning operator. The linear complexity advantage effectively ensures the computational efficiency of the Android malware family classification method and the real-time response speed of online classification inference.

[0056] Evaluation Experiment 4: The results of the present invention were compared with those of the existing pre-trained Android malware family classification methods in a labeled small sample environment. The performance metrics included: computational accuracy, classification precision, recall, F1 score, and inference latency.

[0057] Table 3. Experimental comparison results between two small-sample Android malware family classification methods (CNN-Transformer, AndroFIM) and the present invention.

[0058] The existing few-shot Android malware classification method (CNN-Transformer) comes from the paper "Research on Deep Learning-Based Android Malware Detection Systems" (International Journal of Digital Crime and Forensics; https: / / doi.org / 10.4018 / IJDCF.401332). Another comparative few-shot Android malware family classification method (AndroFIM) comes from the paper "Androfim: few-shot android malware family detection based on image representation" (Cybersecurity; https: / / doi.org / 10.1186 / s42400-025-00358-5).

[0059] As can be seen from Table 3, the method of the present invention outperforms in all evaluation metrics. Compared with the hybrid backbone network-based methods such as CNN-Transformer and AndroFIM, the method of the present invention can capture deeper bytecode complex semantic patterns in environments with scarce sample data, thereby effectively improving the multi-axis feature transmission effect and multi-class detection performance in environments with few samples.

[0060] According to the verification experiments, after performing few-shot meta-learning using initial sample data containing 1,200 original .apk files from 30 malware families, the final Android malware family classification inference model can achieve a classification accuracy of 97.18% under the 5-way 5-shot task configuration. This is higher than the three benchmark models BiLSTM-MAML, CNN-GCN, and Trans-GAT under the same meta-task scenario configuration, and the classification accuracy is improved by nearly 12.06% compared with the current few-shot Android malware family classification method (AndroFIM). The method of this invention converts the initial small amount of sample data into grayscale images of Android malware, introduces spatial cross-Mamba feature encoding and constructs a heterogeneous graph neural network, which alleviates the problem of scarce sample data of Android malware families. It solves the problems of high cost of manual data collection in data-scarce environments, lack of long-distance contextual association of sequences, and fuzzy classification surface and low classification accuracy caused by the high variation of Android malware families.

[0061] Example 2 The meta-learning-based method for classifying Android malware families is as follows: Step 1: Collect the initial sample dataset and preprocess it to obtain grayscale images of Android malware; Step 2: Extract a global aggregated feature embedding vector set based on spatial cross-Mamba feature encoding from all grayscale images of Android malware in the sample dataset obtained in Step 1; Step 3: Perform heterogeneous graph structure inference on the global aggregated feature embedding vector set obtained in Step 2; Step 4: Perform multi-task joint loss constraint optimization training on the final node feature matrix obtained in Step 3 to provide classification decision results for inferring the family affiliation of Android malware in unknown sample data.

[0062] Example 3 The meta-learning-based method for classifying Android malware families is as follows: Step 1: Collect the initial sample dataset and preprocess it to obtain grayscale images of Android malware; Step 1 is as follows: Download 20-50 mixed families of Android malware (both similar and dissimilar) from the Androzoo public dataset, containing a total of 800-2000 Android malware files with the .apk extension. Simultaneously generate... Android malware family classification label encoding, with encoding numbers ranging from '1' to '...'. 'in, The value range is 20~50; all downloaded Android malware and the corresponding Android malware family classification label codes are used as the initial sample dataset; by performing pixelation conversion in units of 8-bit binary combinations, each Android malware in the initial sample dataset is directly mapped to grayscale pixel values, converted into an Android malware grayscale image with the suffix .png, and the resolution of the Android malware grayscale image is uniformly normalized to 128×128 pixels; finally, the preprocessing of the initial sample dataset is realized, and two-dimensional Android malware grayscale images are obtained; all two-dimensional Android malware grayscale images and the corresponding Android malware family classification label codes are used as the sample dataset.

[0063] Step 2: Extract a global aggregated feature embedding vector set based on spatial cross-Mamba feature encoding from all grayscale images of Android malware in the sample dataset obtained in Step 1; Step 3: Perform heterogeneous graph structure inference on the global aggregated feature embedding vector set obtained in Step 2; Step 4: Perform multi-task joint loss constraint optimization training on the final node feature matrix obtained in Step 3 to provide classification decision results for inferring the family affiliation of Android malware in unknown sample data.

[0064] Example 4 The meta-learning-based method for classifying Android malware families is as follows: Step 1: Collect the initial sample dataset and preprocess it to obtain grayscale images of Android malware; Step 2: Extract a global aggregated feature embedding vector set based on spatial cross-Mamba feature encoding from all grayscale images of Android malware in the sample dataset obtained in Step 1; Step 2 is as follows: Step 2.1: Serialize all the grayscale images of two-dimensional Android malware in the sample dataset obtained in Step 1. First, divide each grayscale image of two-dimensional Android malware into a sequence composed of flattened patches, i.e. ,in The total length of the sequence is represented by the first line; then each flattened patch is projected into the D-dimensional latent space to obtain the flattened patch sequence, thus realizing the vectorized representation of each Android malware grayscale image. Step 2.2: Perform multi-directional and multi-view dynamic feature extraction on the flattened patch sequence obtained in Step 2.1 by spatial cross Mamba feature encoding to obtain the global aggregated feature embedding vector.

[0065] Step 3: Perform heterogeneous graph structure inference on the global aggregated feature embedding vector set obtained in Step 2; Step 4: Perform multi-task joint loss constraint optimization training on the final node feature matrix obtained in Step 3 to provide classification decision results for inferring the family affiliation of Android malware in unknown sample data.

[0066] Example 5 The meta-learning-based method for classifying Android malware families is as follows: Step 1: Collect the initial sample dataset and preprocess it to obtain grayscale images of Android malware; Step 2: Extract a global aggregated feature embedding vector set based on spatial cross-Mamba feature encoding from all grayscale images of Android malware in the sample dataset obtained in Step 1; Step 3: Perform heterogeneous graph structure inference on the global aggregated feature embedding vector set obtained in Step 2; Step 3 specifically involves: Step 3.1: Construct a heterogeneous directed topological graph using the global aggregated feature embedding vector set output in Step 2 to obtain the heterogeneous adjacency matrix; Step 3.2: The heterogeneous adjacency matrix obtained in Step 3.1 By performing sparsification optimization and matrix stability correction on the adaptive heterogeneous topology graph structure, a heterogeneous normalized adjacency matrix is ​​obtained. Step 3.3: Convert the heterogeneous normalized adjacency matrix obtained in Step 3.2 into a single matrix. Enter the constructed heterogeneous graph neural network and perform direct-guided feature iterative inference based on the heterogeneous directed topological graph structure.

[0067] Step 4: Perform multi-task joint loss constraint optimization training on the final node feature matrix obtained in Step 3 to provide classification decision results for inferring the family affiliation of Android malware in unknown sample data.

[0068] Example 6 The meta-learning-based method for classifying Android malware families is as follows: Step 1: Collect the initial sample dataset and preprocess it to obtain grayscale images of Android malware; Step 2: Extract a global aggregated feature embedding vector set based on spatial cross-Mamba feature encoding from all grayscale images of Android malware in the sample dataset obtained in Step 1; Step 3: Perform heterogeneous graph structure inference on the global aggregated feature embedding vector set obtained in Step 2; Step 4: Perform multi-task joint loss constraint optimization training on the final node feature matrix obtained in Step 3 to provide classification decision results for inferring the family affiliation of Android malware in unknown sample data; Step 4 is as follows: Step 4.1: Analyze the final node feature matrix obtained in Step 3. Perform multi-task joint loss constraint optimization training with boundary adaptive center constraints; Step 4.2: For each query set of sample data to be classified, provide classification decision results that infer the family affiliation of unknown sample data to Android malware.

Claims

1. A meta-learning-based method for classifying Android malware families, characterized in that, Specifically: Step 1: Collect the initial sample dataset and preprocess it to obtain grayscale images of Android malware; Step 2: Extract a global aggregated feature embedding vector set based on spatial cross-Mamba feature encoding from all grayscale images of Android malware in the sample dataset obtained in Step 1; Step 3: Perform heterogeneous graph structure inference on the global aggregated feature embedding vector set obtained in Step 2; Step 4: Perform multi-task joint loss constraint optimization training on the final node feature matrix obtained in Step 3 to provide classification decision results for inferring the family affiliation of Android malware in unknown sample data.

2. The Android malware family classification method based on meta-learning according to claim 1, characterized in that, Step 1 is as follows: Download 20-50 mixed families of Android malware (both similar and dissimilar) from the Androzoo public dataset, containing a total of 800-2000 Android malware files with the .apk extension. Simultaneously generate... Android malware family classification label encoding, with encoding numbers ranging from '1' to '...'. 'in, The value range is 20~50; all downloaded Android malware and the corresponding Android malware family classification label codes are used as the initial sample dataset; by performing pixelation conversion in units of 8-bit binary combinations, each Android malware in the initial sample dataset is directly mapped to grayscale pixel values, converted into an Android malware grayscale image with the suffix .png, and the resolution of the Android malware grayscale image is uniformly normalized to 128×128 pixels; finally, the preprocessing of the initial sample dataset is realized, and two-dimensional Android malware grayscale images are obtained; all two-dimensional Android malware grayscale images and the corresponding Android malware family classification label codes are used as the sample dataset.

3. The Android malware family classification method based on meta-learning according to claim 2, characterized in that, Step 2 is as follows: Step 2.1: Serialize all the grayscale images of two-dimensional Android malware in the sample dataset obtained in Step 1. First, divide each grayscale image of two-dimensional Android malware into a sequence composed of flattened patches, i.e. ,in The total length of the sequence is represented by the first line; then each flattened patch is projected into the D-dimensional latent space to obtain the flattened patch sequence, thus realizing the vectorized representation of each Android malware grayscale image. Step 2.2: Perform multi-directional and multi-view dynamic feature extraction on the flattened patch sequence obtained in Step 2.1 by spatial cross Mamba feature encoding to obtain the global aggregated feature embedding vector.

4. The Android malware family classification method based on meta-learning according to claim 3, characterized in that, Step 2.2 specifically involves: Step 2.2.1: For spatial cross Mamba feature encoding, the flattened patch sequence is used as the input sequence; the spatial geometric vertical and horizontal axes of the Android malware grayscale image are reconstructed into a spatial manifold sequence with four scanning directions; the four scanning directions correspond to: horizontal forward →, horizontal reverse ←, vertical forward ↓ and vertical reverse ↑, and an independent continuous-time linear time-invariant state space model is established for each direction; The continuous-time linear time-invariant state-space model is a cross-adaptive mapping in four scanning directions from the input sequence to the hidden state and from the hidden state to the output sequence. The transition process from the input sequence to the hidden state in the four scanning directions is represented as follows: （1） in, Indicates hidden state For continuous variables The derivative; This indicates control of four scanning directions. The evolution matrix of state evolution; Indicates the current sampling At any given moment, four scanning directions The continuous hidden state below; Indicates four scanning directions The input matrix for integrating new control information; Indicates the current sampling At any given moment, corresponding to the four scanning directions The input patch feature sequence; The transition process from the hidden state to the output sequence in the four scanning directions is represented as follows: （2） in, Indicates the current sampling At any given moment, corresponding to the four scanning directions The output sequence below; This represents the output projection matrix that maps the hidden state to the final vector representation under the four scanning directions. It is used to map the high-dimensional spatial state features back to the target feature space. Step 2.2.2: Using a step size of The zero-order hold performs a discretization transformation on the continuous-time linear time-invariant state-space model in the four scanning directions, specifically as follows: First, assume the current sampling time And input within each sampling interval Keep constant, that is By analytically solving formula (1), the discretized state transition matrix and input matrix are obtained, as follows: （3） in, This indicates the four corresponding scanning directions. Discretized state transition matrix; Indicates the step size; This indicates the four corresponding scanning directions. Discretized input matrix; Then, based on the discretized matrices obtained in the four scanning directions, the hidden state is updated in parallel. The hidden state update is represented as: （4） in, This indicates the four corresponding scanning directions. In the The hidden status of global signatures of Android malware updated at each time step; This indicates the four corresponding scanning directions. In the previous time step, the global signature of Android malware was hidden. This indicates the four corresponding scanning directions. The feature vector of the Android malware grayscale image flattening patch sequence input at the current time step; Finally, based on the updated hidden state in the four scanning directions The output projection matrices for the four scanning directions are respectively After mapping, the final output for the four scanning directions is obtained, represented as: （5） in, This indicates the four corresponding scanning directions. In the The feature vector of an Android malware enhancement patch that incorporates directional context information at each time step; Step 2.2.3: The four scanning directions obtained after discretization are finally output. Through formulas (4) and (5), the recursive state propagation is performed step by step along the four spatial arrangement directions of the flattened patch sequence to obtain the complete enhanced feature sequence spliced ​​in the four scanning directions, as follows: , , , ; Then, a spatial cross-attention gating mechanism is used to perform multi-view global spatial feature fusion and alignment on the enhanced feature sequences in the four scanning directions; allowing the enhanced feature sequences in the four scanning directions to... , , , As the input to the spatial cross-attention gating mechanism, among which, This indicates the total number of image patches segmented from a grayscale image of Android malware; The dimension of a single patch feature sequence is perfectly aligned with the dimension of the input patch feature sequence. By concatenating the inputs to the spatial cross-attention gating mechanism, the global feature matrix is ​​obtained, represented as: （6） in, Represents the global feature matrix; These represent the enhanced feature sequences in the four scanning directions, respectively. The obtained global feature matrix is ​​then combined with three independent adaptive linear projections to generate query feature, key feature, and value feature matrices, as follows: （7） in, These represent the query feature matrix, key feature matrix, and value feature matrix, respectively. These represent the adaptive projection weight matrices, respectively. Subsequently, by scaling the dot product attention operation, the spatial dependency weights between the patch feature sequences in the four scanning directions are calculated, resulting in the four scanning direction cross-attention weight matrix that highlights the cross-directional code block association features of Android malware, as shown below: （8） in, This represents the cross-attention weight matrix for the four scanning directions; Represents the transpose of the key feature matrix; Indicates the scaling factor; Represents the normalization function; To avoid feature redundancy interference in a single scanning direction, adaptive gating weights for four scanning directions are introduced. The feature contribution ratios of the four scanning directions are adaptively adjusted, and the feature sequences of the four scanning directions are weighted and aggregated. This weighted aggregation process is expressed as follows: （9） in, This represents the omnidirectional enhanced feature sequence after weighted aggregation; This represents the adaptive gating weights for the four scanning directions; This indicates a sequence splitting operation in four scanning directions; Finally, the weighted aggregation result Y is expanded point-by-point according to the spatial arrangement order of the input patch feature sequences, and the output is an omnidirectional enhanced feature sequence with the same length as the input sequence. Each of them All of them contain context-aware information about the grayscale images of Android malware in global spatiotemporal and multi-perspective dimensions; Step 2.2.4: The obtained omnidirectional enhanced feature sequence Global pooling is performed, and adaptive fusion weight parameters are introduced to automatically adapt to the feature distribution of different types of Android malware, thereby achieving spatial dimensionality reduction and semantic aggregation of the associated features between feature sequences of various enhancement patches. Among them, omnidirectional enhancement feature sequences The global pooling process, which involves performing global pooling operations, is represented as follows: （10） in, This represents the omnidirectional enhanced feature sequence after global pooling; This represents the omnidirectional enhanced feature sequence after average pooling; This represents the omnidirectional enhanced feature sequence after max pooling; This represents the adaptive fusion weight parameters. ; Then, an adaptive fully connected linear transformation is used to map the globally pooled omnidirectional augmented feature sequence to the target dimension of the output. The adaptive fully connected linear transformation process is expressed as: （11） in, This represents the output global aggregated feature embedding vector. ; Represents the adaptive weight matrix; Represents the bias vector of adaptive behavior; This outputs a fixed-length global aggregated feature embedding vector. This enables the vectorized representation of each Android malware grayscale image; finally, a global aggregated feature embedding vector set is generated for all Android malware grayscale images.

5. The Android malware family classification method based on meta-learning according to claim 4, characterized in that, Step 3 specifically involves: Step 3.1: Construct a heterogeneous directed topological graph using the global aggregated feature embedding vector set output in Step 2 to obtain the heterogeneous adjacency matrix; Step 3.2: Calculate the heterogeneous adjacency matrix obtained in Step 3.

1. Perform sparsification optimization and matrix stability correction on the adaptive heterogeneous topology graph structure to obtain the heterogeneous normalized adjacency matrix. Step 3.3: Convert the heterogeneous normalized adjacency matrix obtained in Step 3.2 into a single matrix. Enter the constructed heterogeneous graph neural network and perform direct-guided feature iterative inference based on the heterogeneous directed topological graph structure.

6. The Android malware family classification method based on meta-learning according to claim 5, characterized in that, Step 3.1 specifically involves: Step 3.1.1: Construct a heterogeneous directed topology graph based on meta-tasks; Step 3.1.1 specifically refers to: The global aggregated feature embedding vector set output from step 2 is used as the total meta-task pool. Independent meta-tasks are randomly sampled from the total meta-task pool according to the pre-set N-way K-shot rule of meta-learning. Each meta-task contains a specified number of support sets and query sets. For each sampled meta-task, a heterogeneous directed graph is constructed for that meta-task in a completely direct manner. ;in, This represents the set of sample data nodes, where each sample data node... For a single sample data point from the current meta-task support set or query set, each sample data node... The initial state is set to the global aggregated feature embedding vector obtained in step 2. ; This represents a collection of hyperprototype nodes for a malware family, with each hyperprototype node... This corresponds to a global central anchor point for a known Android malware family within the current meta-task. Step 3.1.2: Perform adaptive similarity measurement calculation through the constructed heterogeneous directed topology graph to obtain the heterogeneous adjacency matrix between the sample data and the malware family superprototype; Step 3.1.2 specifically involves: First, the generalized edge weights between any two nodes in a heterogeneous topology graph are calculated using the heterogeneous node adaptive similarity calculation operator. Define variables and These represent the sets of nodes in a heterogeneous topology graph. Any two nodes in the node and nodes Generalized edge weights between Represented as: （12） in, Represents a node and nodes The weights of heterogeneous topological edges between nodes, especially when nodes and nodes When all nodes are sample data nodes, Transform into homogeneous topological edge weights between sample data nodes When node For sample data nodes and nodes When it is a hyperprototype node of a malware family. Transformed into heterogeneous topological edge weights between sample data and malware family hyperprototypes ; Represents the natural exponential function; This represents an adaptive distance adjustment factor, used to dynamically adjust the scaling scale for measuring feature distances in the latent space; Represents the generalized distance metric function in the projected latent space; and These represent the feature linear mapping layers adaptively selected based on the type of the node; and Representing nodes respectively and nodes The corresponding feature vector, especially when the node is a sample data node. The corresponding global aggregated feature embedding vector When the node is a malware family hyperprototype node The time corresponds to the first one initially obtained from the support set. The central vector of an Android malware family; Indicates a function to indicate the type of heterogeneous nodes; It represents the topological impedance coefficient, used to adjust the diffusion intensity of information flow between heterogeneous and homogeneous edges; For the current meta-task, the generalized edge weights are then filled into the dimension. The matrix, where, This indicates the total number of sample data nodes within the current meta-task; This indicates the total number of malware family hyperprototype nodes within the current meta-task; Finally, the first row / column of the matrix The bits correspond sequentially to all sample data nodes, and then... Each bit corresponds sequentially to a superprototype node of all malware families, achieving an ordered mapping of heterogeneous nodes and obtaining a heterogeneous adjacency matrix. .

7. The Android malware family classification method based on meta-learning according to claim 6, characterized in that, Step 3.2 specifically involves: By analyzing the heterogeneous adjacency matrix output in step 3.1 Adaptive tensor truncation is performed, and an adaptive topological similarity-gated filtering mechanism is introduced. For the adaptive topological similarity gated filtering mechanism, an activation threshold needs to be dynamically calculated based on the mean and standard deviation of the edge weights between all nodes in the current meta-task. When the elements in the heterogeneous adjacency matrix When the topological edge is low-confidence, it indicates that the topological edge belongs to a low-confidence association, and the topological edge is directly cleared to zero; when In this case, the directed edge is retained to achieve adaptive sparsity of the heterogeneous graph topology; The heterogeneous adjacency matrix after implementing the adaptive topological similarity gated filtering mechanism is symmetrically smoothed using a dynamic Laplacian regularization operator, resulting in a symmetrically smoothed heterogeneous normalized adjacency matrix. Symmetric smoothing correction is expressed as: （13） in, This represents the heterogeneous normalized adjacency matrix after symmetric smoothing correction; This represents the degree matrix of the heterogeneous adjacency matrix after filtering. This represents the identity matrix with the same dimension as the heterogeneous adjacency matrix.

8. The Android malware family classification method based on meta-learning according to claim 7, characterized in that, Step 3.3 specifically involves: Step 3.3.1: Constructing a heterogeneous graph neural network and its final objective function ; Step 3.3.1 specifically refers to: The constructed heterogeneous graph neural network structure includes a first input layer, a first graph convolutional layer, a first activation function layer, a first heterogeneous topology gating correction layer, a second graph convolutional layer, a first classification mapping layer, and a first output layer. The parameters for each layer are as follows: The feature dimension of the input to the first convolutional layer is... The output feature dimension is The feature dimension of the input to the first activation function layer is consistent with the feature dimension of the output of the first graph convolutional layer, and the output feature dimension is perfectly aligned with the input dimension. LeakyReLU is selected as the sole activation function. The input to the first heterogeneous topology gated correction layer... Features of individual sample data nodes and Features of several malware family hyperprototype nodes, totaling [number missing]. There are nodes; the input feature dimension is . Output a The heterogeneous topological gated modified adjacency matrix of dimension 1; the input of the second graph convolutional layer contains two parts, one being the feature dimension 1. The first is the node feature tensor, and the second is the output of the first heterogeneous topology gated correction layer. An adjacency matrix of dimension 1, the output dimension is 1. ,in This represents the total number of malware family categories corresponding to the current meta-task; all graph convolutional layers use LeakyReLU as their activation function; the input to the first classification mapping layer is the output from the second graph convolutional layer. Extracted from the feature tensor of the dimensional node Each sample data node corresponds to 3D eigenvalue submatrix, output A similarity probability matrix of dimension; the first output layer input is the output of the second graph convolutional layer. The query set samples extracted from the feature tensor of the dimensional nodes 3D feature vectors, outputting the corresponding query set samples dimensional probability prediction vector; The input to the first input layer of the heterogeneous graph neural network consists of two parts. First, the global aggregated feature embedding vector set obtained in step 2 is concatenated with the malware family hyperprototype anchor feature vector according to the node sorting rules to generate the initial heterogeneous topology graph feature matrix. Secondly, the heterogeneous normalized adjacency matrix obtained in step 3.

2. The first output layer outputs the sample data of each query set to be tested under the current meta-task, obtained through direct feature inference in the unlabeled blind testing state. The probability prediction vector for Android malware family classification is obtained by taking the maximum value index of the probability vector and finally obtaining the predicted discrete Android malware family category label. The final objective function of the heterogeneous graph neural network adopts a collaborative objective function based on uncertain dynamic weight learning, expressed as: （14） in, This represents the final objective function of the heterogeneous graph neural network; This represents the cross-entropy classification loss calculated on the query set; This represents the boundary adaptive center constraint loss used to mitigate the problem of ambiguous classification surfaces caused by the high variation of malware families. and These represent the adaptive variance parameters that the quality graph neural network learns adaptively during the multi-task joint loss constraint training process, which are used to dynamically calibrate the gradient weights of the two losses, and are used to automatically find the optimal decision surface constraint in a blind test environment without relying on manual parameter tuning. Step 3.3.2: The heterogeneous graph neural network constructed in Step 3.3.1 is used for global feature propagation and interaction across sample data nodes and malware family hyperprototype nodes through layer-by-layer forward propagation to obtain the final node feature matrix. ; Step 3.3.2 specifically refers to: In each graph convolutional layer of the heterogeneous graph neural network constructed in step 3.3.1, the direct-guided feature iterative inference is achieved by introducing an adaptive gated residual update mechanism to nonlinearly aggregate the feature information of the current local neighborhood sample data nodes and the high-order malware family superprototype nodes, so as to update the feature representation of the current node in real time. The matrix update of the current node's feature representation is expressed as follows: （15） in, Indicates the first The node feature matrix of the layer; Represents the initial node feature matrix; For non-linear activation functions, LeakyReLU activation function is used; This represents the heterogeneous normalized adjacency matrix after symmetric smoothing correction; Indicates the first The node feature matrix of the layer; and They represent the first Layer-parallel adaptive, mutually independent feature transformation weight parameter matrices; This indicates that the elements of the matrix are multiplied at corresponding positions. Represents a matrix of all 1s with the same dimension as the node feature matrix; Indicates the first The adaptive topological feature flow gating matrix of the layer; After forward propagation computation of the heterogeneous graph neural network, the feature matrix of the initial heterogeneous topological graph is obtained. go through After layer graph convolution and adaptive gated residual update iteration processing, the final output is Vidi The final node feature matrix integrates macroscopic spatial topological correlation information across sample data and achieves semantic aggregation. .

9. The Android malware family classification method based on meta-learning according to claim 8, characterized in that, Step 4 specifically involves: Step 4.1: Analyze the final node feature matrix obtained in Step 3. Perform multi-task joint loss constraint optimization training with boundary adaptive center constraints; Step 4.1 specifically involves: The final node feature matrix output from step 3 Extract the final feature representation vector for each query set sample data node. The final feature representation vector is extracted using the collaborative objective function formula (14) adopted in step 3.3.

1. Perform joint constraint optimization training; During the joint constraint optimization training process, the cross-entropy classification loss in formula (14) The optimization is represented as: （16） in, This represents the cross-entropy classification loss calculated on the query set; This represents the set of query set sample data in the current meta-task; Indicates the first Sample data of a query set to be tested; Indicates the first The real Android malware family tags corresponding to each query set sample data; This represents the final feature representation vector corresponding to the query set sample data after iterative inference in the heterogeneous graph network. This indicates the feature vector of the superprototype anchor point of the Android malware family corresponding to the real label of the query set sample data; Indicates the first [item] within the current meta-task Feature vectors of superprototype anchor points of Android malware families; Dynamic constraints are achieved through joint constraint optimization training to dynamically update the parameters of a heterogeneous graph neural network. These dynamic constraints utilize a boundary adaptive center constraint loss. The optimization is represented as: （17） in, This represents the boundary adaptive center constraint loss; Indicates the first [item] within the current meta-task A family of Android malware supports a set of sample data; Indicates the first The cardinality of the sample data set supported by each Android malware family; Indicates the first The first malware family support set One sample data; Indicates the first Feature vectors of superprototype anchor points of Android malware families; Indicates that for the first A dynamic intra-class variance tolerance boundary that adaptively adjusts the mutation frequency of each Android malware family applies a centripetal constraint to Android malware families with different mutation characteristics. Based on the dynamic constraints of dynamically updating the parameters of the obtained heterogeneous graph neural network, variant sample data that were originally skewed by the high degree of variation in malware families are forcibly compressed around the hyperprototype anchor points of their respective malware families. This maximizes the separation of geometric boundaries between different malware families in the feature manifold space, realizing the transformation of the classification decision surface from fuzzy to clear. Finally, the optimized feature representation vector of each query set sample data node is obtained. ; Step 4.2: For each query set of sample data to be classified, provide classification decision results to infer the Android malware family affiliation of the unknown sample data; Step 4.2 specifically involves: Based on the final optimized feature representation vector obtained in step 4.1 For each query set sample data to be classified, the final optimized feature representation vector after inference from the heterogeneous graph neural network is fed into the Softmax classifier. The multi-class Android malware family label is determined by selecting the index corresponding to the highest similarity score in the output predicted probability vector, as shown below: （18） in, Indicates the first The final multi-class malware family labels corresponding to each query set sample data; Indicates the argument operator; This represents a prediction vector that indicates the probability of a sample belonging to each category. This represents the category index within the current meta-task context; Ultimately, the classification decision output is a defined multi-class family label result for each unknown Android malware query set sample data. This label serves as the final output data for automatically classifying malware families and identifying malicious behaviors from Android malware sample data.

Images