Android malware family fine-grained classification method based on markov graph attention network

Abstract

The application provides a malware family fine-grained classification method based on a Markov graph attention network, relates to the technical field of mobile network security, and comprises the following steps: multi-source bytecode file extraction and bytecode vector generation, multi-source byte stream adaptive blocking and RGB image generation, cross-file Markov correlation feature extraction and RGBA coding, double-path cross-modal fusion and family classification prediction. The application extracts the original byte stream of three core files in an Android application installation package, constructs a multi-source feature fusion image, captures cross-file correlation features by using a Markov transition probability matrix, aggregates family relationship information between samples by using a graph attention network, and finally realizes accurate classification of malware families.

Description

Technical Field

[0001] This invention relates to the field of mobile network security technology, and in particular to a fine-grained classification method for Android malware families based on Markov graph attention networks. Background Technology

[0002] With the widespread adoption of mobile internet, the Android operating system, thanks to its open-source nature, has captured a major share of the global mobile terminal market. Simultaneously, the Android platform has become a primary target for malware attacks. Malware creators widely employ various obfuscation techniques, such as code obfuscation, resource encryption, control flow flattening, and string encryption, making traditional signature-based detection methods and static feature-matching-based classification methods ineffective. Malware family classification, as one of the core tasks of malware analysis, aims to categorize unknown malicious samples into known malware families, thereby helping security analysts understand the attack intent, propagation methods, and evolutionary patterns of malware.

[0003] Existing methods for classifying Android malware families face several key technical challenges. First, insufficient single-file feature information. Most existing methods extract features solely from the classes.dex file, failing to fully utilize complementary information such as permission declarations, component configurations, and resource references contained in the AndroidManifest.xml and resources.arsc files. Second, lack of cross-file association features. While some studies have attempted to simply overlay information from multiple files, they fail to capture deep relationships between files, such as the correspondence between permission declarations and actual system application programming interfaces (APIs) called in the code, and the dependency between resource references and resource access operations in the code. Third, significant class imbalance. The distribution of malware family samples is extremely uneven, with minority families having far fewer samples than majority families, leading to a severe decline in the classification model's performance in identifying minority families. Fourth, underutilization of inter-sample family relationships. Existing graph neural network-based methods focus only on the call relationship graph between code elements within a single Android application installation package file, failing to leverage the association information between samples of the same family during the training phase to enhance the model's family discrimination ability. Summary of the Invention

[0004] This invention addresses the technical problems of insufficient single-file feature information, missing cross-file association features, class imbalance, and underutilization of family relationships between samples in existing Android malware family classification methods. It provides a fine-grained classification method for Android malware families based on Markov graph attention networks.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: A fine-grained classification method for Android malware families based on Markov graph attention networks includes the following steps: The Android application installation package files to be classified are decompressed, and the classes.dex file, AndroidManifest.xml file, and resources.arsc file are extracted from the decompressed files; binary reading operations are performed on the three files respectively, and the entire contents of each file are converted into the corresponding one-dimensional unsigned integer vector; Perform a two-dimensional matrix dimension adaptive block transformation operation on a one-dimensional unsigned integer vector to generate three two-dimensional byte matrices corresponding to the three files respectively. Map the three two-dimensional byte matrices to the three color channels respectively to construct a color image tensor. Extract the multivariate behavioral feature sequences from the three files and perform Markov state transition probability matrix construction to generate three Markov transition probability matrices. Perform multimodal feature-level fusion on the three Markov transition probability matrices to generate a joint Markov transition probability fusion matrix. Process the joint Markov transition probability fusion matrix to generate a binarized feature map. Encode the binarized feature map into the transparency channel of the color image tensor to generate an RGBA four-channel image tensor. The RGBA four-channel image tensor is input into the Markov Graph Attention Dual-Path Aggregation Network for family classification prediction. The Markov Graph Attention Dual-Path Aggregation Network includes a graph attention network encoding submodule, a separable multi-head self-attention visual encoding submodule, and a cross-modal feature interaction fusion submodule. The cross-modal feature interaction fusion submodule is used to perform cross-modal interaction fusion of the graph-level feature vector output by the graph attention network encoding submodule and the visual feature vector output by the separable multi-head self-attention visual encoding submodule, and output the family classification prediction vector.

[0006] In summary, the present invention has at least the following beneficial effects: Effectively integrates heterogeneous features from multiple sources. By mapping the raw byte streams of classes.dex, AndroidManifest.xml, and resources.arsc files to the red, green, and blue color channels respectively, and performing differentiated image enhancement operations based on the characteristics of different source files, the independent feature information of each core file is preserved, overcoming the deficiency of insufficient feature information from a single file in existing technologies.

[0007] Deeply mine cross-file association features. By extracting three different types of behavioral feature sequences from three source files and constructing Markov state transition probability matrices for each, a joint Markov transition probability fusion matrix is ​​generated through element-wise addition and fusion. This matrix is ​​then encoded into the transparency channel of an RGBA image, achieving deep fusion of cross-file association features with the original three-channel color information, overcoming the deficiency of missing cross-file association features in existing technologies.

[0008] Make full use of family relationships. By constructing a malware sample relationship graph based on sample family labels during the training phase, and using a graph attention network to aggregate and encode the node features of samples within the same family, the family discrimination ability of the model is enhanced by utilizing the association information between samples within the same family during the training phase, thus overcoming the deficiency of the existing technology that does not fully utilize the family relationships between samples.

[0009] Deeply integrate cross-modal features. By designing a cross-modal feature interaction fusion submodule based on a gating mechanism, bidirectional interaction and adaptive fusion of graph-level features and visual features are achieved. Furthermore, the second-order statistical correlation between the two modal features is captured through bilinear pooling interaction terms, further improving classification accuracy.

[0010] It effectively alleviates the class imbalance problem. By designing a class balancing focus loss function, it simultaneously addresses the model bias and imbalance between easy and difficult samples caused by class imbalance, effectively improving the model's recognition performance on minority class families. Attached Figure Description

[0011] Figure 1 This is a flowchart illustrating a fine-grained classification method for Android malware families based on Markov graph attention networks.

[0012] Figure 2 A flowchart illustrating the process of differential image enhancement for multi-source bytecode files.

[0013] Figure 3 This is a flowchart illustrating the process of cross-file Markov association feature extraction and transparency encoding.

[0014] Figure 4 A schematic diagram illustrating the process of optimizing the training of a class-balanced focus loss function model. Detailed Implementation

[0015] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0016] like Figure 1 As shown, this embodiment provides a fine-grained classification method for Android malware families based on Markov graph attention networks, including the following steps: S1: Extraction of multi-source heterogeneous bytecode files and raw byte stream collection from Android application installation packages. The input to S1 is the Android application installation package file to be classified, which exists as a compressed file with the .apk extension. The Android application installation package files to be classified are derived from publicly available malware datasets or unknown Android application installation package file samples collected in real-world network environments. Each Android application installation package file is processed independently in S1.

[0017] The process involves decompressing the Android application installation package files to be categorized. A standard zip decompression algorithm is used to read the compressed directory structure of the Android application installation package file, extracting three core files: classes.dex, AndroidManifest.xml, and resources.arsc. The classes.dex file stores the Dalvik bytecode generated after the Android application is compiled, containing all the executable code logic of the application. The AndroidManifest.xml file is the application's global configuration file, declaring the application's package name, component structure, required system permissions, and various runtime essential attributes such as intent filters. The resources.arsc file is the application's compiled resource index table, storing in binary format all compiled string text, image asset references, and resource identifiers and corresponding resource data offsets for user interface components.

[0018] Perform binary read operations on the three core files mentioned above, treating the contents of each file as a continuous stream of raw bytes. For the classes.dex file, open it in binary read-only mode and read the value of each byte sequentially, forming a one-dimensional unsigned integer vector, denoted as . ,in This refers to the first [item] in the classes.dex file. An integer value of 1 byte. Indicates the total byte length of the classes.dex file, index. This is used to identify that the vector originates from the classes.dex file. The byte order index in the file and satisfying For the AndroidManifest.xml file, all its bytes are read in the same way to form a one-dimensional unsigned integer vector. ,in This refers to the first line in the AndroidManifest.xml file. An integer value of 1 byte. Indicates the total byte length of the AndroidManifest.xml file, index This is used to identify that the vector originates from the AndroidManifest.xml file. The byte order index in the file and satisfying For the resources.arsc file, all its bytes are read in the same way to form a one-dimensional unsigned integer vector. ,in This refers to the first line in the resources.arsc file. An integer value of 1 byte. Indicates the total byte length of the resources.arsc file, index. This is used to identify that the vector originates from the resources.arsc file. The byte order index in the file and satisfying .

[0019] S1 outputs three one-dimensional unsigned integer vectors. , and These correspond to the raw byte stream numerical representations of the classes.dex file, AndroidManifest.xml file, and resources.arsc file, respectively.

[0020] S2: Three-channel color space mapping based on byte stream length adaptive block segmentation and differential image enhancement. The input is the three one-dimensional unsigned integer vectors output from S1. , and The process of differential image enhancement for multi-source bytecode files is as follows: Figure 2 As shown.

[0021] First, perform a two-dimensional matrix dimension adaptive block transformation operation on the three one-dimensional unsigned integer vectors output by S1. For the one-dimensional unsigned integer vectors corresponding to the classes.dex file... Based on its total byte length Determine the column width parameter of a two-dimensional matrix Column width parameter The determination rule is based on the statistical distribution analysis of the file sizes of all Android application installation packages in the CICmalDroid 2020 and CICmalDroid 2017 datasets. The nearest integer power of 2 corresponding to each file size quantile interval is selected as the column width value to minimize information loss while maintaining a reasonable image aspect ratio. The specific rules are as follows: When... hour, ;when hour, ;when hour, ;when hour, ;when hour, ;when hour, ;when hour, ;when hour, The segmentation thresholds of 10, 30, 60, 100, 200, 500, and 1000 kilobytes were derived from the major quantiles of the classes.dex file size in the CICmalDroid 2020 and CICmalDroid 2017 datasets. In these datasets, samples smaller than 10KB accounted for approximately 8%, 10KB to 30KB for approximately 15%, 30KB to 60KB for approximately 22%, 60KB to 100KB for approximately 18%, 100KB to 200KB for approximately 12%, 200KB to 500KB for approximately 10%, 500KB to 1000KB for approximately 7%, and larger than 1000KB for approximately 8%. These segmentation intervals collectively covered more than 95% of the sample files.

[0022] Calculate the row number parameter of a two-dimensional matrix ,in This indicates a round-up operation. Based on the column width parameter. and row number parameter Transform a one-dimensional unsigned integer vector Fill the dimension according to row priority. Two-dimensional matrix In the middle. For any position ,in It is a row index and satisfies , It is a column index and satisfies Two-dimensional matrix In position element value at Determined in the following ways: ; in Represents a one-dimensional unsigned integer vector The index is The element values ​​are then used. For positions exceeding the original vector length, zeros are padded to ensure matrix integrity. This yields a two-dimensional byte matrix of the classes.dex file. .

[0023] For the one-dimensional unsigned integer vector corresponding to the AndroidManifest.xml file Following the same rules as above, based on its total byte length Determine column width parameters Calculate the number of rows parameter And using the same row-major padding and trailing zero-padding strategy, a two-dimensional matrix is ​​constructed. Two-dimensional matrix In position element value at Determined in the following ways: ; in It is a row index and satisfies , It is a column index and satisfies , Represents a one-dimensional unsigned integer vector The index is The element value.

[0024] For the one-dimensional unsigned integer vector corresponding to the resources.arsc file Following the same rules as above, based on its total byte length Determine column width parameters Calculate the number of rows parameter And using the same row-major padding and trailing zero-padding strategy, a two-dimensional matrix is ​​constructed. Two-dimensional matrix In position element value at Determined in the following ways: ; in It is a row index and satisfies , It is a column index and satisfies , Represents a one-dimensional unsigned integer vector The index is The element value.

[0025] Then, a size unification operation is performed on the three two-dimensional matrices mentioned above, scaling all three two-dimensional matrices to the target size. ,in The scaling operation is implemented using a bilinear interpolation algorithm. For any original two-dimensional matrix... Its scaled matrix At the target location element value at Calculated using the following bilinear interpolation formula: ;in These are the row coordinates of the source matrix in floating-point format. These are the column coordinate floating-point values ​​in the source matrix. The decimal part of the row coordinate. The decimal part of the column coordinates. This indicates the floor function. Represents the original matrix In position The element value at that position, Indicates row index is Column index is The element value at that position, Indicates row index is Column index is The element value at that position, Indicates row index is Column index is The element value at that position, Indicates row index is Column index is The element value at that location. For or In this case, a clipping and filling strategy is adopted. For row coordinates... Define the row clipping function as follows: ; For column coordinates Define column clipping function as follows: ; thus, Through the bilinear interpolation scaling operation described above, three two-dimensional matrices of uniform size are obtained respectively. , and .

[0026] S2 then performs differential image enhancement operations on the three two-dimensional matrices after unifying their dimensions. For the two-dimensional matrix corresponding to the classes.dex file... The Canny edge detection algorithm was used to extract its structural contour features. Gaussian filtering is applied for smoothing, and the standard deviation parameter of the Gaussian kernel is set to a value of 1. The size of the Gaussian kernel is taken as: Then, the gradient magnitude and direction at each pixel location are calculated, and non-maximum suppression is used to refine the edges. Finally, a double-threshold hysteresis thresholding method is used to determine the final edge pixels, where the lower threshold is set to a value of [value missing]. The high threshold value is The enhanced two-dimensional matrix is ​​obtained. .

[0027] For the two-dimensional matrix corresponding to the AndroidManifest.xml file The two-dimensional matrix corresponding to the resources.arsc file Histogram equalization techniques were used to enhance the contrast of the two-dimensional matrix. Calculate the cumulative distribution function of its gray-level histogram. ,in grayscale value exist The normalized frequency appearing in That is, divided by the total number of pixels in the matrix, 50176. It is a grayscale value variable and satisfies , Let be the independent variable of the cumulative distribution function and satisfy... Then, the original pixel values ​​are mapped to the full dynamic range according to the cumulative distribution function. The mapping function is ,in For scaled two-dimensional matrix In position The element value at that position, To enhance the two-dimensional matrix In position The element values ​​at each position yield the enhanced two-dimensional matrix. For a two-dimensional matrix Perform the same histogram equalization operation to obtain the enhanced two-dimensional matrix. .

[0028] Finally, the three enhanced two-dimensional matrices are mapped to the red, green, and blue color channels respectively, and a color image tensor is constructed by stacking the matrices. Red channel matrix Assigned value Green Channel Matrix Assigned value Blue channel matrix Assigned value The symbols This represents the entire index range for that dimension. , , These represent the channel indices for the red, green, and blue channels, respectively. This generates the color image tensor. .

[0029] S3: Visualization of cross-file association features based on multi-source Markov transition probability matrix construction and transparency channel encoding. The input to S3 is the three one-dimensional unsigned integer vectors output from S1. , and and the color image tensor output by S2 The process of cross-file Markov association feature extraction and transparency encoding is as follows: Figure 3 As shown.

[0030] First, perform multivariate behavioral feature sequence extraction on the three one-dimensional unsigned integer vectors output by S1. For the one-dimensional unsigned integer vectors corresponding to the classes.dex file... This method employs a decompilation toolkit provided by the Android open-source project to extract the opcode stream of the Dalvik instruction set. The `baksmali` tool is used to decompile the `classes.dex` file into a smali-formatted intermediate representation file. Then, the instruction sequence of each method is parsed from the smali file, and the opcode portion of each instruction is extracted. All opcodes are arranged in the order of their appearance in the original file to construct the DEX opcode sequence. ,in Indicates the first The category identifier of each opcode and satisfying , This represents the total length of the opcode sequence.

[0031] For the one-dimensional unsigned integer vector corresponding to the AndroidManifest.xml file The AXMLPrinter2 tool is used to parse the binary AndroidManifest.xml file into a readable XML text format. Then, permission declarations and component declarations are extracted from the parsed XML text. The permission declaration information includes all... <uses-permission>The value of the `android:name` attribute of the tag, the component declaration information includes all `` <activity> `、` <service> `、` <receiver>`and` <provider>The `android:name` attribute value of the `` tag and the corresponding intent filter configuration. All extracted permission names and component type names are arranged in the order they appear in the XML file to construct an XML structure sequence. ,in Indicates the first The category identifier of each XML structural element and satisfying , This represents the total length of the XML structure sequence.

[0032] For the one-dimensional unsigned integer vector corresponding to the resources.arsc file This method employs the resource parsing module within the AndroGuard framework to extract resource reference chains built based on intent filters from the resources.arsc file. It parses the resource type specification block and resource entry block of the resources.arsc file, extracting the reference relationships of all string resources (type 0x03) and the string resource identifiers referenced by all layout resources (type 0x04). A directed graph structure of resource references is constructed, and a depth-first traversal is performed on this graph. The resource type identifiers accessed during the traversal are arranged in the order of access, constructing an ARSC resource sequence. ,in Indicates the first The category identifier of each resource reference item and satisfying , This represents the total length of the ARSC resource sequence.

[0033] Then, the Markov state transition probability matrix construction operation is performed on the three behavioral feature sequences mentioned above. The core idea of ​​this operation is to treat each behavioral feature sequence as a discrete-time Markov chain and estimate the transition probability by statistically analyzing the transition frequency between states.

[0034] For DEX opcode sequences Extract the most frequently occurring sequence from the sequence. Each opcode category serves as the state space, and in one specific implementation, K=100. In another optional implementation, K can also be adaptively determined based on the cumulative frequency contribution rate, as detailed in Embodiment 3 of this specification. The following explanation uses K=100 as an example. Let the state space be denoted as... ,in Indicates the frequency ranking in the DEX opcode sequence. opcode category identifier, subscript Let be the index of the state in the state space and satisfy... Statistical state transition frequency matrix , where matrix elements Indicates from state Transition to state Number of times, The index of the target state for transition and satisfying Traverse the DEX opcode sequence All adjacent state pairs ,like and ,but Add 1. For the state transition frequency matrix Each row is row-normalized to obtain the DEX Markov transition probability matrix. Its matrix elements Calculated using the following formula: ;in For temporary index variables in the summation process and satisfying , Indicates from state The sum of all transitions from the starting point. For rows whose sum is 0, uniformly assign values ​​to all elements of that row. This ensures that the sum of the elements in each row of the DEX Markov transition probability matrix is ​​1. After row normalization, the sum of the elements in each row of the matrix satisfies... .

[0035] For XML structure sequences Following the same procedure as above, extract the pre-extraction... A high-frequency XML structural element serves as the state space. ,in Indicates the frequency ranking in an XML structure sequence. The structural element category identifier, Let be the index of the state in the state space and satisfy... Statistical state transition frequency matrix , where matrix elements Indicates from state Transition to state Number of times, The index of the target state for transition and satisfying Then, row normalization is performed. For rows where the sum of all elements is 0, all elements in that row are uniformly assigned a value. The XML Markov transition probability matrix is ​​obtained. Its matrix elements Calculated using the following formula: ;in For temporary index variables in the summation process and satisfying .

[0036] For ARSC resource sequences Following the same procedure as above, extract the pre-extraction... Each high-frequency resource reference item serves as the state space. ,in Indicates the frequency ranking in the ARSC resource sequence Resource item category identifier, Let be the index of the state in the state space and satisfy... Statistical state transition frequency matrix , where matrix elements Indicates from state Transition to state Number of times, subscript The index of the target state for transition and satisfying Then, row normalization is performed. For rows where the sum of all elements is 0, all elements in that row are uniformly assigned a value. The ARSC Markov transition probability matrix is ​​obtained. Its matrix elements Calculated using the following formula: ;in For temporary index variables in the summation process and satisfying .

[0037] Then, a multimodal feature-level fusion operation is performed on the above three Markov transition probability matrices to generate a joint Markov transition probability fusion matrix. The fusion operation employs an element-wise addition strategy, where the matrix elements... Calculated using the following formula: ;in The DEX Markov transition probability matrix The value of the element at position (r,s) XML Markov transition probability matrix In position The element value at that position, ARSC Markov transition probability matrix In position The element value at that position, and , The state space of three Markov transition probability matrices. , and Semantically, they correspond to different types of feature sequences, but all three state spaces are sorted from high to low frequency, with position indices... In all three state spaces, the frequency ranking is represented. State, position index In all three state spaces, the frequency ranking is represented. The technical rationale for using frequency ranking as the alignment basis lies in the fact that although the symbol sequences in different source files of malware have different semantic domains, their frequency distribution patterns (i.e., symbol usage preferences) themselves reflect the behavioral tendencies of the application. Aligning states with the same frequency ranking across domains is essentially associating equally important behavioral symbols. To perform matrix addition operations, matrix position indexes are used uniformly. To represent the elements at corresponding positions in each matrix, where It is a row index and satisfies , It is a column index and satisfies Element-level summation encodes the transition probability information from three different source files by superimposing it at the same matrix position index, thus encoding the position... The summation at each point is considered as the superposition of joint transition propensity measures among the same rank-state pairs in the three types of source files. Through the above element-level summation and fusion, the joint Markov transition probability fusion matrix is ​​obtained. Each element in The superposition of transition probability information from three different types of source files is encoded.

[0038] Then the joint Markov transition probability fusion matrix is... Perform normalization to scale its element values ​​to... The integer range is used to obtain the normalized matrix. The specific formula for normalization is: ;in Normalized matrix In position The element value at that position, For the joint Markov transition probability fusion matrix In position The element value at that position, Represents the joint Markov transition probability fusion matrix The minimum value of all elements in the set. Represents the joint Markov transition probability fusion matrix The maximum value of all elements in the set. This indicates the floor function.

[0039] Then the normalized matrix Perform local dynamic binarization to generate a binarized feature map. For normalized matrices Each position in An adaptive thresholding method is used to calculate the weighted threshold of the pixel neighborhood at that location. Then, the binarized feature map is determined according to the following rules. In position element value at : ; in For position The Gaussian weighted average of all pixel values ​​within the center's neighborhood is calculated using the following formula: ; in The neighborhood radius parameter has a value of 3. The offset in the row direction and satisfying , The column direction offset and satisfying , The normalized Gaussian weights are calculated using the following formula: ;in These are the unnormalized Gaussian weights. Let be the standard deviation parameter of the Gaussian kernel and take the value of . , For the natural constant An exponential function with base 0. and This is a temporary offset variable used during the summation process. It is applied when the matrix exceeds its boundaries. neighborhood location Using a zero-fill strategy, that is, exceeding the boundary... It is considered to be a value of 0.

[0040] Then binarize the feature map Scaled to the color image tensor using bilinear interpolation. Same space size The scaled binarized feature map is obtained. For binarized feature maps After performing bilinear interpolation scaling, the scaling result is rounded to the nearest integer, setting values ​​greater than or equal to 0.5 to 1 and values ​​less than 0.5 to 0, to maintain binarization characteristics. The specific formula for the scaling operation is the same as the bilinear interpolation formula in S2.

[0041] S3 finally calculates the scaled binary feature map. Encoding to color image tensor The transparency channel is used to generate an RGBA four-channel image tensor. RGBA image tensor The first three channels are directly copied from the color image tensor. The three channels: ;in , , These represent the channel indices for the red, green, and blue channels, respectively. The fourth channel is the transparency channel, and its channel index is [insert index here]. The value is assigned to the scaled binary feature map. : Through the above transparency channel encoding operation, the feature map is binarized. Pixels with a value of 1 are completely opaque in the RGBA image, while pixels with a value of 0 are completely transparent, thus achieving deep fusion of cross-file Markov correlation features and the original three-channel color information.

[0042] S4: Construction of a malware sample relationship graph based on training sample family labels and initialization of node features in the graph attention network encoding submodule. The input to S4 is the set of RGBA four-channel image tensors of all Android malware samples during the training phase. ,in The total number of training samples, superscript Indicates the first The index of training samples and satisfying Each RGBA four-channel image tensor All by S3 to the first S4 is generated after processing a sample of Android application installation package files. The input to S4 also includes a set of family labels for each training sample. ,in Indicates the first The malware family category number to which each training sample belongs. To represent the total number of malware family categories in the training dataset, the aforementioned family labels are derived from annotation information in publicly available datasets.

[0043] First, the RGBA four-channel image tensor of each Android application installation package file sample during the training phase is processed. Perform node feature extraction operations in the graph attention network encoding submodule. Convert the RGBA four-channel image tensor... The input is fed into a feature extraction sub-network consisting of three convolutional blocks. The first convolutional block of this sub-network has 4 input channels, consistent with the number of channels in an RGBA four-channel image tensor. Each convolutional block sequentially contains a convolutional layer, a batch normalization layer, and a modified linear unit activation function. After the third convolutional block outputs its feature map, global average pooling is performed directly without further activation. The kernel size of the first convolutional block is... The output channel count is 64, and the stride in both the height and width directions is 2. The kernel size of the second convolutional block is... The output channel count is 128, and the stride in both the height and width directions is 2. The kernel size of the third convolutional block is... The output has 256 channels, with a stride of 2 in both the height and width directions. After processing through three convolutional blocks, the resulting spatial dimensions are... A feature map with 256 channels is used. Global average pooling is performed on this feature map to obtain a 256-dimensional feature vector. As the first The initial feature vectors of the nodes in the graph attention network encoding submodule for each sample. The specific formula for the global average pooling operation is: ;in Indicates the first Initial feature vectors of nodes for each sample The One element, Indexed by feature dimension and satisfying , Indicates the first The channel index of the feature map obtained after processing each sample through three convolutional blocks is: Spatial location is eigenvalues ​​at that location The feature map is indexed in the height orientation space and satisfies , The feature map is spatially indexed along its width direction and satisfies .

[0044] Then, a malware sample relationship graph is constructed based on the family tags of the training samples. ,in It is a set of nodes, where each node corresponds to a training sample. Let edge be the set of edges, representing the relationships between samples. (Malware sample relationship graph edge set) The construction rules are as follows: for any two nodes and and ,like Then at node and nodes Establish an undirected edge between them ;like Then it is not in the node. and nodes Edges are established between them. Based on the above construction rules, a malware sample relationship graph is created. The edges in the array only connect sample nodes that belong to the same family category.

[0045] Then, a relationship diagram of malware samples. Each node in Assign the initial feature vectors of the nodes extracted in S4 To form a node feature matrix , where the matrix's first A row is a node initial feature vector Superscript The propagation of the graph attention network encoding submodule represents the first... The layer is the initial input layer.

[0046] S4 also constructs a malware sample relationship graph. adjacency matrix , where matrix elements Determined in the following ways: ; in and All are node indexes and satisfy Adjacency matrix diagonal elements This indicates that each node has a self-loop connection with itself, so as to preserve the node's own feature information during the subsequent propagation of the graph attention network coding submodule.

[0047] S4 Output Malware Sample Relationship Diagram adjacency matrix and node feature matrix The two matrices mentioned above will serve as input data for the graph attention network encoding submodule in S5. S4 is executed only during the model training phase. During the model inference phase, i.e., when classifying a single unknown sample, the malware sample relationship graph cannot be constructed due to the lack of family label information. The graph attention network encoding submodule is bypassed at this stage. In this case, the separable multi-head self-attention visual encoding submodule and the cross-modal feature interaction fusion submodule in S5 are used, where the graph-level feature vector is replaced by the default graph feature vector.

[0048] S5: A cross-modal feature interaction fusion network based on a graph attention network coding submodule and a separable multi-head self-attention visual coding submodule. The input to S5 is the RGBA four-channel image tensor output from S3. and the adjacency matrix output by S4 and node feature matrix The latter is only available during the training phase.

[0049] A Markov graph attention dual-path aggregation network is constructed, consisting of three core sub-modules: a graph attention network encoding sub-module, a separable multi-head self-attention visual encoding sub-module, and a cross-modal feature interaction fusion sub-module based on a gating mechanism. These three sub-modules achieve collaborative optimization through feature propagation and gradient backpropagation.

[0050] Submodule S5-1: Graph Attention Network Encoding Submodule; the Graph Attention Network Encoding Submodule outputs the adjacency matrix from S4. and node feature matrix Using multi-layer graph attention propagation as input, the family relationship information between samples is encoded.

[0051] The graph attention network encoding submodule consists of The attention layers are stacked together, and the layered graph is composed of layers. For the first Layered graph attention layer Its input is the node feature matrix of the previous layer. ,in For the first The feature dimension of the layer, when hour The output is the node feature matrix of the current layer. ,in For the first The feature dimension of the layer and .

[0052] In the In the layered graph attention layer, for each node Input feature vector That is, the node feature matrix The Perform a linear transformation to obtain the query vector. Key vector Sum value vector : ; in For the first The query weight matrix of the layer is a learnable parameter. For the first The layer's key weight matrix is ​​a learnable parameter. For the first The layer's value weight matrix consists of learnable parameters.

[0053] Malware sample relationship diagram Each edge in ,in Index the neighboring nodes and satisfy compute nodes For nodes Original attention coefficient : ; in For the first The attention weight vector of the layer is a learnable parameter. This represents the vector transpose operation. This represents a vector concatenation operation. To query vector and The vector obtained by concatenating along the feature dimension, LeakyReLU is a linear unit activation function with leakage correction and its negative slope parameter takes values ​​of 10 ... .

[0054] For nodes All neighboring nodes, including node The original attention coefficients are subjected to Softmax normalization to obtain normalized attention coefficients. : ; in For nodes The set of neighboring nodes and containing nodes itself, For the temporary neighbor node index in the summation process and satisfying , For the natural constant An exponential function with base 0.

[0055] node In the The output feature vector of the layer Calculated using the following formula: ; in For nodes The value vector, where ELU is the exponential linear unit activation function.

[0056] go through After layered graph attention propagation, the final graph-encoded node feature matrix is ​​obtained. ,in Global average pooling is performed on the feature vectors of all nodes to obtain graph-level feature vectors. : ;in Represents graph-level eigenvectors The One element, Represents the feature matrix of graph-encoded nodes. The Middle Line number The element values ​​of the column, Indexed by feature dimension and satisfying .

[0057] Submodule S5-2: Separable multi-head self-attention visual coding submodule; the separable multi-head self-attention visual coding submodule uses the RGBA four-channel image tensor output by S3. Using a separable multi-head self-attention mechanism and a partial convolutional module as input, multi-scale feature encoding of malware images is achieved.

[0058] RGBA four-channel image tensor Divided into non-overlapping image blocks of fixed size, each image block has a spatial dimension of [missing information]. Since the spatial size of the input image is The total number of image patches is The original size of each image patch is... Flatten it into a length of The vector is then mapped to a linear projection onto... The embedding space is 768×1024. The weight matrix of the linear projection layer has a size of 768×1024, and the bias vector has a size of 768. This yields the image patch embedding sequence. ,in For the first The embedding vectors of image patches satisfy the following conditions: Insert a learnable classification token at the beginning of the sequence. Classification tokens At the start of training, images are randomly initialized according to a normal distribution with a mean of 0 and a standard deviation of 0.02, and updated via gradient backpropagation during training. The final state is used as the global image representation for classification. Learnable positional encodings are added to each image patch embedding and classification token. Location coding A learnable positional encoding matrix is ​​employed, randomly initialized at the start of training according to a normal distribution with a mean of 0 and a standard deviation of 0.02, and updated during training via gradient backpropagation to preserve the spatial positional information between image patches. This yields the input sequence for the visual encoding module. : ;in This is the matrix obtained by concatenating the classification tokens and all image patch embeddings along the sequence dimension.

[0059] The separable multi-head self-attention visual coding submodule consists of It is composed of stacked coding layers, among which Each coding layer contains a separable multi-head self-attention submodule and a feedforward network submodule, both of which employ residual connections and layer normalization.

[0060] In the In each coding layer, The computation process of the separable multi-head self-attention submodule is as follows. The input sequence... The query matrix is ​​obtained through three linear transformations. Key matrix Sum matrix .

[0061] In a separable multi-head self-attention mechanism, the query matrix... Divided along the feature dimension Size, among them The feature dimension of each head is For the first Size, Its query submatrix is The key matrix is The value submatrix is .

[0062] Calculate the context score matrix in branch I. Its elements Calculated using the following formula: ; in For querying submatrix No. Line number Column elements, Key matrix No. Line number Column elements, It is a sequence position index and satisfies , It is a sequence position index and satisfies , Indexed by feature dimension and satisfying Then for each query position For all key positions The context score is normalized using the Softmax function to obtain the normalized context score. : ;in For temporary position indexes in the summation process and satisfying Subsequently, the normalized context score was used to pair the submatrix. Perform weighted aggregation to generate a context vector matrix. , its first Behavior: ;in Represents the context vector matrix The i-th row vector, i.e., the vector corresponding to the query position. The context representation obtained by weighted aggregation of all key positions ; Value submatrix The Okay. Finally, the output of each head is processed by an output weight matrix. Perform a linear transformation. (This will transform all...) The outputs of each element are concatenated along the feature dimension and projected through the total output matrix. A linear transformation is performed to obtain the final output of the separable multi-head self-attention submodule. The entire residual connection and normalization process can be represented as: ;in Indicates the first Separable multi-head self-attention submodule functions in each coding layer.

[0063] Subsequently, It is fed into the feedforward network submodule. The feedforward network consists of two linear layers; the first linear layer shifts the feature dimension from... Rise to The second linear layer reduces the feature dimension from descend The Gaussian error linear unit activation function is used during this process. The mathematical expression for the Gaussian error linear unit activation function is: ,in This is the cumulative distribution function of the standard normal distribution. Similarly, residual connectivity and layer normalization are applied: ;in For layer normalization operation, For the first Each coding layer has a feedforward network submodule.

[0064] go through After one coding layer, extract the output matrix. The first row, which is the output vector corresponding to the classification token, serves as the global image representation. .

[0065] Parallel to the Transformer path described above, a partially convolutional module is dedicated to processing the alpha channel (transparency channel) of the RGBA four-channel image tensor. The input to this module is... The input is compared with the scaled binarized feature map. Completely identical. The number of input channels for some convolutional modules is denoted as... The number of output channels is denoted as The partial convolutional module consists of three convolutional layers: the first layer is a partial convolutional layer with a kernel size of [missing value]. Step size is The first layer uses the same padding method to maintain the same number of output channels as the number of input channels (i.e., the number of output channels is 1), followed by a batch normalization layer and a modified linear unit activation function. The second layer is a pointwise convolutional layer with a kernel size of [missing information]. The number of channels will be reduced from Expand to This is followed by a batch normalization layer and a modified linear unit activation function. The third layer is a pointwise convolutional layer with a kernel size of [missing value]. The number of channels will be reduced from Mapped to This is followed by batch normalization layers and modified linear unit activation functions. The output of some convolutional modules is a feature tensor. Then, local feature vectors are obtained through global average pooling. : ;in Represents local eigenvectors The One element, It is a channel index and satisfies , For characteristic tensors In spatial location and channels The element value at that location.

[0066] Representing the global image With local feature vectors By concatenating along the feature dimensions, the final output of the visual encoding submodule is obtained. .

[0067] Submodule S5-3: A cross-modal feature interaction fusion submodule based on a gating mechanism; the cross-modal feature interaction fusion submodule encodes the graph-level feature vector output by the graph attention network submodule. Visual feature vectors output by the separable multi-head self-attention visual encoding submodule Using the input as input, a gating mechanism is used to achieve deep interaction and adaptive fusion of features from two modalities.

[0068] graph-level feature vectors and visual feature vectors Each is mapped to a unified path through a linear projection layer. Dimensional fusion space, in which : ; ;in The projection weight matrix represents the graph-level features and consists of learnable parameters. The bias vectors are graph-level features and are learnable parameters. Let be the projection weight matrix of the visual features and be learnable parameters. It is a bias vector of visual features and is a learnable parameter.

[0069] Calculate the cross-attention weights between graph-level features and visual features. : ;in It is a sigmoid activation function. This indicates element-wise multiplication.

[0070] Gated fusion features are calculated based on cross-attention weights. : ;in It is a vector in which all elements are the value 1.

[0071] Compute the bilinear pooling interaction term between graph-level features and visual features. : ;in Represents bilinear pooling interaction terms The One element, Indexed by feature dimension and satisfying , Bilinear weight tensor In the index The element value at that position is a learnable parameter. The projected graph-level feature vector The One element, The dimension index of the graph-level feature vector and satisfying , Visual feature vectors after projection The One element, The dimension index of the visual feature vector and satisfying .

[0072] Gating fusion features Interaction terms with bilinear pooling The data is concatenated along the feature dimension and mapped to the family category space through a multilayer perceptron classification head to obtain the final family classification prediction vector. : ; in It is a three-layer multilayer perceptron, with each layer having an output dimension of [missing information]. , and The modified linear unit activation function is used between each layer. The Softmax activation function is used. This indicates a concatenation operation along the feature dimension. This represents the total number of malware family categories.

[0073] S5 outputs family classification prediction vector Each element This indicates that the input sample belongs to the first... Predicted probabilities of each malware family category Family category index and satisfying .

[0074] S6: Model optimization training based on the class-balanced focus loss function. The input to S6 is the family classification prediction vector output by S5. For the first training set One sample, and the true family label of that sample. ,in The training sample index satisfies , The total number of training samples, as defined in S4 Consistent. The optimization and training process for the category-balanced focus loss function model is as follows: Figure 4 As shown.

[0075] S6 constructs a category-balanced focus loss function to drive end-to-end optimization training of the Markov graph attention dual-path aggregation network in S5.

[0076] For the Each training sample, based on its true family label Extract the predicted probability of the corresponding class from the prediction vector. ,in Represents the prediction vector The index is The element value.

[0077] Count the number of samples in each family category in the training dataset. Let the number of samples in each family category be denoted as . The number of samples for each family category is ,in Family category index and satisfying Based on sample size Calculate the first Category balance weights for each family category : ;in To balance the hyperparameters and take values ​​of , For the first The number of samples in each family category. When the number of samples in a certain category... When it is large, Approaching The weight is relatively low; when When smaller, Values ​​close to 1 have higher weights.

[0078] Moderating factors in combined focus loss Construct a category-balanced focus loss function : ; in For the first True category of each sample The corresponding category balance weights, The focus parameter has a value of , It is a function of the natural logarithm. When predicting probability When the value is close to 1, the adjustment factor As the predicted probability approaches zero, the loss value is significantly reduced; When the value is small, the adjustment factor is close to 1, and the loss value remains high.

[0079] S6 employs the AdamW optimizer to perform end-to-end optimization of all learnable parameters of the Markov graph attention dual-path aggregation network, with the optimization objective being to minimize the class-balanced focus loss function. Default graph feature vector As a learnable parameter used in training, this vector is randomly initialized at the start of training according to a normal distribution with a mean of 0 and a standard deviation of 0.02, and updated through gradient backpropagation using the class-balanced focus loss function. The optimization objective is to minimize the class balance focus loss function. In each round of training, As a learnable parameter independent of all specific samples, its gradient originates from the sensitivity of the classification loss to the input of the cross-modal feature interaction fusion submodule. Because... During training, it is always compared with the graph-level feature vectors of all samples. Since they reside in the same feature space and their update direction is jointly determined by the gradient contributions of all training samples, therefore... The convergence stable point is located at all mean Nearby. In other words, after training is completed. It has been optimized to be the empirical distribution center of graph-level features for all training samples. Its optimization objective is consistent with other network parameters, namely, minimizing the family classification error on the training set. Bilinear weight tensor At the start of training, random initialization is performed according to a truncated normal distribution, with a truncation range of [value missing]. Meanwhile, during training, the bilinear weight tensor... Apply weight decay L2 regularization is applied to prevent overfitting. A cosine annealing learning rate scheduling strategy is used during training, with the learning rate... and The periodic changes occur between each period, and the formula for each period is: ; in For the first Learning rate during training rounds This refers to the current training round, starting from 0, i.e., the first training round. , To minimize the learning rate, To achieve the maximum learning rate, For the total number of training rounds, It is a cosine function. Pi is a constant. The total number of training rounds is set to... The number of samples per batch is set to .

[0080] S6 outputs the parameters of the trained Markov graph attention dual-path aggregation network, including all learnable parameters of the graph attention network's encoding submodule. , , , All learnable parameters of the separable multi-head self-attention visual coding submodule are... , The weight matrices and bias vectors of each linear layer, all learnable parameters of some convolutional modules (i.e., the kernel weights and bias vectors of each convolutional layer), and all learnable parameters of the cross-modal feature interaction fusion submodule. , , , , The complete weight matrix and bias vector of the multilayer perceptron classification head, as well as the default graph feature vector. .

[0081] S7: Malware family inference classification based on a trained Markov graph attention dual-path aggregation network. The input to S7 is the unknown Android application installation package file to be classified, and the output of S6 is the parameters of the trained Markov graph attention dual-path aggregation network.

[0082] For the unknown Android application installation package file to be classified, perform the same processing steps as S1 to S3, generating the RGBA four-channel image tensor for that sample. .

[0083] Will The input is fed into the Markov Graph Attention Dual-Path Aggregation Network trained on S6 for forward propagation computation. During the inference phase, only a single sample is processed, making it impossible to construct the malware sample relationship graph. Therefore, the graph attention network encoding submodule is bypassed during this phase; that is, the graph attention network encoding submodule does not perform any forward propagation computation during inference, and its output is a graph-level feature vector. It was directly replaced with the default graph feature vector. Instead of calculating graph-level features from the input data, it only uses the separable multi-head self-attention visual encoding submodule and the cross-modal feature interaction fusion submodule. In this case, the graph-level feature vector... Replaced with the default graph feature vector This vector, after training, has been optimized to become the empirical distribution center of the graph-level features of all training samples. It is used as a fixed parameter during the inference phase and is no longer updated.

[0084] The projection calculation during the inference phase is as follows and use replace It participates in subsequent cross-attention weight calculation and bilinear pooling interaction term calculation.

[0085] Separable multi-head self-attention visual coding submodule As input, following the calculation process of submodule S5-2 in S5, the output is a visual feature vector. The cross-modal feature interaction fusion submodule uses the default graph feature vector. and visual feature vectors As input, follow the calculation process of submodule S5-3 in S5 (where... Replace with Output family classification prediction vector .

[0086] Predicting vectors based on family classification Determine the malware family category of this unknown sample: ;in Number the predicted family category. For the prediction vector The Middle The value of each element, Indicates taking Largest category index .

[0087] The malware family category number to which the S7 output of the unknown Android application installation package file belongs. This completes the fine-grained classification of the malware family for this sample.

[0088] Example 1: In one specific implementation, the CICmalDroid 2020 and CICmalDroid 2017 datasets were used as training data sources. These two datasets together contain 13,205 Android application installation package file samples from four families of malware: adware, banking malware, SMS malware, and risky malware. The datasets were divided into training, validation, and test sets in a 7:1:2 ratio. The validation set was used to evaluate the model's generalization performance after each training epoch. The evaluation metric was the loss value on the validation set. The decision to stop training early was based on the change in the loss value on the validation set, with a patience threshold of 10 epochs set for early stopping.

[0089] In S2, when performing Canny edge detection on the two-dimensional matrix corresponding to the classes.dex file, the standard deviation parameter of the Gaussian kernel is set to... The low threshold value is The high threshold value is When performing histogram equalization on the two-dimensional matrices corresponding to the AndroidManifest.xml file and the resources.arsc file, the cumulative distribution function is calculated based on a 256-level grayscale histogram.

[0090] In S3, the size of the Markov state space takes the value of The neighborhood radius parameter for local dynamic binarization is set to... The standard deviation parameter of the Gaussian kernel takes the value of A zero-padding strategy is used for neighborhood positions that extend beyond the matrix boundary.

[0091] In S5, the number of layers in the graph attention network encoding submodule is [value missing]. The feature dimensions of each layer are all The number of coding layers for the separable multi-head self-attention visual coding submodule is set to a value of The embedding dimension takes the value of The number of attention heads is taken as 1. The feature dimension of each head is The output dimension of the first linear layer of the feedforward network submodule is... The output dimension of the second linear layer is The number of input channels in some convolutional modules is... The number of channels in the three layers are as follows: , , The number of output channels is set to Bilinear pooling weight tensor Tucker decomposition is used for low-rank approximation, and the core tensor size is set to... The dimensions of the three factor matrices are respectively , , The specific form of Tucker decomposition is as follows: ,in For the core tensor, , , It is a three-factor matrix.

[0092] In S6, the equilibrium hyperparameter takes the value of The focus parameter takes the value of The initial learning rate of the AdamW optimizer is set to 1. The weight decay coefficient is taken as: The momentum parameter takes the value of and In the cosine annealing learning rate scheduling strategy, Starting from 0, the minimum learning rate is [value]. The maximum learning rate is 100%. The total number of training rounds is set to 1. The number of samples processed in each batch is taken as: Default graph feature vector At the start of training, the weights are randomly initialized according to a normal distribution with a mean of 0 and a standard deviation of 0.02. Bilinear weight tensors are used. At the start of training, random initialization is performed according to a truncated normal distribution, with a truncation range of [value missing]. And apply weight decay to L2 regularization.

[0093] After the above training process, the performance of the trained Markov graph attention dual-path aggregation network was evaluated on the test set. Accuracy, precision, recall and F1 score were used as evaluation indicators, and the classification accuracy reached 94.96%.

[0094] Example 2: Based on Example 1, Example 2 further optimizes the differential image enhancement operation in S2. For the two-dimensional matrix corresponding to the classes.dex file, an adaptive Canny edge detection algorithm is used instead of the fixed-threshold Canny algorithm. The low and high thresholds of the adaptive Canny algorithm are dynamically determined based on the pixel value distribution characteristics of the two-dimensional matrix: First, the two-dimensional matrix is ​​calculated... average pixel value and standard deviation Then determine the low threshold according to the following formula. and high threshold : ;in To find the maximum value function, This is a function that minimizes the value. The introduction of an adaptive threshold allows the Canny edge detection algorithm to automatically adjust the sensitivity of edge detection based on the file content features of each Android application installation package file sample, further improving the adaptability of image enhancement effects to different types of malware samples.

[0095] Example 3: Based on Example 1, Example 3 further optimizes the Markov state space construction method in S3. An adaptive state space size determination method based on the frequency cumulative contribution rate is used instead of a fixed method. The proposed solution sets the cumulative frequency contribution rate threshold to [value missing]. For each behavioral feature sequence, the frequencies of each state are accumulated sequentially from high to low. When the accumulated frequency first reaches or exceeds the total frequency... When the condition is met, stop accumulating and record the number of states that have been accumulated as the size of the state space for the sequence. The state space sizes of the three behavioral feature sequences are obtained respectively. , and Then, the maximum value of the three is taken as the unified state space size. For state spaces smaller than The sequence of states is used to pad the state space to unify the matrix dimension. The introduction of adaptive state space size allows the Markov transition probability matrix to automatically adjust the state space dimension according to the characteristics of each dataset, improving the model's generalization ability on different datasets.

[0096] Comparative Example 1: To verify the technical effect of the present invention, a comparative example was set up. Comparative Example 1 uses the same training and test data partitioning method as Example 1, but omits the construction of the cross-file Markov transition probability matrix and the transparency channel encoding operation in S3, that is, directly using the color image tensor generated in S2. The input is fed into a separable multi-head self-attention visual coding submodule for classification, excluding the generation of RGBA four-channel image tensors and graph attention network coding submodules.

[0097] The model architecture in Comparative Example 1 only includes a separable multi-head self-attention visual encoding submodule and a classification multilayer perceptron, excluding the graph attention network encoding submodule and the cross-modal feature interaction fusion submodule. During training, the standard cross-entropy loss function is used instead of the class-balanced focus loss function.

[0098] Evaluations on the same test set showed that Example 1 achieved a classification accuracy of 91.06%, lower than Example 1's 94.96%, a decrease of 3.90 percentage points. This result indicates that the construction of the cross-file Markov transition probability matrix and the transparency channel encoding operation in S3, the construction of the malware sample relationship graph and the graph attention network encoding submodule in S4, and the introduction of the class-balanced focus loss function in S6 all played a crucial role in improving classification performance.< / provider> < / receiver> < / service> < / activity>

Claims

1. A fine-grained classification method for Android malware families based on Markov graph attention networks, characterized in that, Includes the following steps: The Android application installation package files to be classified are decompressed, and the classes.dex file, AndroidManifest.xml file, and resources.arsc file are extracted from the decompressed files; binary reading operations are performed on the three files respectively, and the entire contents of each file are converted into the corresponding one-dimensional unsigned integer vector; Perform a two-dimensional matrix dimension adaptive block transformation operation on a one-dimensional unsigned integer vector to generate three two-dimensional byte matrices corresponding to the three files respectively. Map the three two-dimensional byte matrices to the three color channels respectively to construct a color image tensor. Extract the multivariate behavioral feature sequences from the three files, and perform Markov state transition probability matrix construction to generate three Markov transition probability matrices. Then, perform multimodal feature-level fusion on the three Markov transition probability matrices to generate a joint Markov transition probability fusion matrix. The joint Markov transition probability fusion matrix is ​​processed to generate a binarized feature map. The binarized feature map is then encoded into the transparency channel of the color image tensor to generate an RGBA four-channel image tensor. The RGBA four-channel image tensor is input into the Markov Graph Attention Dual-Path Aggregation Network for family classification prediction. The Markov Graph Attention Dual-Path Aggregation Network includes a graph attention network encoding submodule, a separable multi-head self-attention visual encoding submodule, and a cross-modal feature interaction fusion submodule. The cross-modal feature interaction fusion submodule is used to perform cross-modal interaction fusion of the graph-level feature vector output by the graph attention network encoding submodule and the visual feature vector output by the separable multi-head self-attention visual encoding submodule, and output the family classification prediction vector.

2. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, Before mapping the three two-dimensional byte matrices to the three color channels, the process includes performing size unification and differential image enhancement operations on the three two-dimensional byte matrices: scaling all two-dimensional byte matrices to the target size; extracting structural contour features from the two-dimensional byte matrix corresponding to the classes.dex file using the Canny edge detection algorithm; enhancing contrast by applying histogram equalization to the two-dimensional byte matrices corresponding to the AndroidManifest.xml file and the resources.arsc file; and mapping the three two-dimensional byte matrices after differential image enhancement to the three color channels.

3. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, The three color channels are red, green, and blue. When the three two-dimensional byte matrices are mapped to the red, green, and blue color channels respectively, the two-dimensional byte matrix corresponding to the classes.dex file is mapped to the red channel, the two-dimensional byte matrix corresponding to the AndroidManifest.xml file is mapped to the green channel, and the two-dimensional byte matrix corresponding to the resources.arsc file is mapped to the blue channel.

4. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, Extracting the multivariate behavioral feature sequences from the three files includes: extracting the Dalvik instruction set operation code stream from the classes.dex file to construct the DEX opcode sequence; extracting permission declarations and component declaration information from the AndroidManifest.xml file to construct the XML structure sequence; and extracting the resource reference chain based on the intent filter from the resources.arsc file to construct the ARSC resource sequence.

5. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, The operation of constructing the Markov state transition probability matrix includes: setting a frequency cumulative contribution rate threshold; for each behavioral feature sequence in the multivariate behavioral feature sequence, accumulating the frequency of each state in descending order of frequency; when the cumulative frequency first reaches or exceeds the frequency cumulative contribution rate threshold, using the number of currently accumulated states as the size of the state space of the behavioral feature sequence; counting the transition frequencies between adjacent states in the behavioral feature sequence to construct a state transition frequency matrix; and performing row normalization on each row of the state transition frequency matrix to obtain the Markov transition probability matrix corresponding to the behavioral feature sequence.

6. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, The three Markov transition probability matrices are fused at the multimodal feature level using an element-level summation strategy: the element values ​​at the same index in the three Markov transition probability matrices are added together to obtain the element values ​​at the corresponding index in the joint Markov transition probability fusion matrix.

7. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, The processing of the joint Markov transition probability fusion matrix includes: normalizing the joint Markov transition probability fusion matrix to generate a normalized matrix, and then performing local dynamic binarization. For each position in the normalized matrix, the Gaussian weighted average of all pixel values ​​in the neighborhood centered at that position is calculated as an adaptive threshold. When the pixel value at that position is greater than the adaptive threshold, the position is assigned the first value; otherwise, it is assigned the second value, thus generating a binarized feature map.

8. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, During the training phase, the graph attention network encoding submodule takes the adjacency matrix and node feature matrix of the training samples as input. The node feature matrix is ​​generated by extracting features from the RGBA four-channel image tensor of the training samples through convolution. The adjacency matrix is ​​constructed based on the family labels of the training samples, and connection edges are established between training samples belonging to the same family category. Each training sample establishes a self-loop connection with itself. The graph attention network encoding submodule updates node features through multi-layer graph attention propagation. Each graph attention layer maps the input feature vector of each node to a query vector, key vector, and value vector through a linear transformation. It calculates the original attention coefficients between the node and each neighboring node, normalizes the original attention coefficients of all neighboring nodes to obtain normalized attention coefficients, and weights and sums the value vectors of each neighboring node according to the normalized attention coefficients. After processing by the activation function, it is used as the output feature vector of the node in the current layer.

9. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, The separable multi-head self-attention visual encoding submodule comprises multiple encoding layers, each containing a separable multi-head self-attention submodule and a feedforward network submodule. The separable multi-head self-attention submodule divides the input sequence into multiple heads along the feature dimension. For each head, the query submatrix and key submatrix are element-wise multiplied, scaled, and then normalized to obtain a normalized context score. This normalized context score is used to weight and aggregate the value submatrix to generate a context vector. The outputs of all heads are concatenated and transformed by a projection matrix to obtain the output of the separable multi-head self-attention submodule. The separable multi-head self-attention visual encoding submodule also includes a partial convolutional module. This partial convolutional module takes the transparency channel of the RGBA four-channel image tensor as input. The output of this partial convolutional module is global average pooled and concatenated with the classification token output vector of the separable multi-head self-attention visual encoding submodule to generate a visual feature vector.

10. The fine-grained classification method for Android malware families based on Markov graph attention networks according to claim 1, characterized in that, During the training phase, the Class Balanced Focus Loss Function is used to optimize the Markov Graph Attention Dual Path Aggregation Network. The Class Balanced Focus Loss Function includes Class Balance Weights and Focus Adjustment Factors. The Class Balance Weights are calculated based on the number of samples in each family category. The smaller the number of samples in a family category, the larger the Class Balance Weights. The Focus Adjustment Factors are calculated based on the model's prediction probability of the true category of the training samples. The lower the prediction probability, the larger the Focus Adjustment Factors. During the inference phase, the graph attention network encoding submodule is bypassed, and the graph-level feature vector is replaced with a default graph feature vector. The default graph feature vector is a learnable parameter that is learned together with the parameters of the Markov graph attention dual-path aggregation network during the training phase.

Images