26 results about "Android malware" patented technology

The application provides a malware identification method based on an Android malware detection model, and relates to the technical field of malware identification. The APK file contains permission information and function call relationship, so the permission vector and function call graph corresponding to the APK file can be constructed. A first model and a second model are trained respectively, the first model is used for malware detection based on the permission information in the APK file, and the second model is used for malware detection based on the function call graph. Finally, the first model and the second model are integrated to obtain an Android malware detection model. The obtained Android malware detection model can greatly improve the accuracy and robustness of detection, and is suitable for large-scale Android malware detection.

The application relates to an Android malware detection method based on a meta-path embedding graph neural network, which comprises the following steps: extracting static features to obtain API and Permission; constructing a heterogeneous graph; defining a meta-path and embedding each APP node; calculating the weight of each meta-path; and obtaining the classification result of the APP; the method is characterized in that the RotatE encoder is used to embed each meta-path, the features of the intermediate nodes on the meta-path are aggregated, the features of the destination nodes themselves are also considered, and more information beneficial to malware detection is obtained, so that the method can exceed the accuracy rate of other methods trained by using a large number of samples by using a small number of samples; meanwhile, the application defines a lambda parameter to limit the number of meta-paths and reduce system resource consumption.

The application discloses a kind of API sequence semantics and graph structure feature fusion Android malware dynamic detection method, including the following steps: running Android application in simulator environment, monitoring and collecting runtime log, extracting API method name sequence from log, retaining call order semantic information;Based on point mutual information PMI theory, global API dependency graph is constructed;Combined with semantic embedding and graph structure embedding, joint feature representation is generated, including semantic embedding, graph structure embedding and joint embedding;The fusion embedding is input into pre-training BERT encoder, and the feature is extracted through self-attention mechanism, and the detection result is output by the classifier with [CLS] flag bit vector;The application significantly improves the detection performance, and has strong practical application value.

This invention provides a permission-based Android malware detection method and system, relating to the field of Android malware detection. The method includes: extracting multimodal features of each function from the APK installation package file of the target Android software and constructing a call graph between functions. The multimodal features include permissions, and the call graph uses nodes to represent functions and edges to represent the call relationships between functions. The multimodal features and call graph of all functions are input into a trained detection model for malicious and benign classification, yielding Android malware detection results. This invention exhibits higher detection accuracy and robustness in static analysis-based malware detection tasks, effectively improving security protection capabilities in practical applications.

The invention relates to the technical field of computer security, in particular to a dynamically updated Android malicious software continuous learning detection method, which comprises the following steps of: acquiring and sequencing historical Android application samples according to time to construct a training set, and training a hierarchical comparison classifier; new applications are collected regularly to form a to-be-tested batch, and the current classifier is used for prediction; for each sample in the to-be-detected batch, executing pseudo loss uncertainty calculation to obtain an uncertainty score of the sample; according to the score, selecting a predetermined number of most uncertain samples for labeling, and obtaining a real label; adding the new labeled sample into the training set, and performing incremental training by adopting a hot start mode based on the weight of the current classifier to obtain an updated classifier; and circularly executing, and detecting the new application in the next period by using the updated classifier. According to the method, the labeling cost can be remarkably reduced, the concept drift can be effectively coped, and efficient, stable and continuous malicious software detection is realized.

The present application provides a kind of malware detection method and system, the detection method includes: client is according to preset first rule to the feature extraction of software to be detected, generates the feature vector of software to be detected;In preset carrier picture, embeds preset perturbation parameter and the feature vector of software to be detected, generates embedding picture, wherein, a carrier picture corresponds to a perturbation parameter;The embedding picture is sent to preset picture classification model, and accepts the classification result of embedding picture by picture classification model;According to the classification result obtained and preset mapping relationship judges whether software to be detected is malicious software.The present application can make attacker difficult to detect behavior or obtain the data in detection behavior, so as to be unable to carry out targeted attack, effectively improve the reliability and security of Android malware detection service.

The application discloses an Android malware detection method based on large-scale heterogeneous graph representation learning, extracts static features and dynamic features in meta information from original Android software application packages to construct a heterogeneous graph, obtains semantic and structural information by sampling neighbor nodes of each Android software in the heterogeneous graph, generates matrix representation of each Android software by inductive information aggregation and scaling of the neighbor nodes, generates a detection module containing multiple sub-detectors through multi-model training and model fusion, and realizes real-time subdivision detection of Android malware by using the trained detection module and real-time representation of new Android software in an actual online detection stage. The application improves the generation method of graph representation learning by extracting mixed static and dynamic features, avoids information loss based on a single aggregator, supports real-time detection of unknown Android software, realizes accurate detection of specific categories of Android malware based on a multi-model fusion strategy, and achieves accuracy, real-time performance and subdivision effect.

This invention discloses a malware detection method based on adaptive node-edge joint masking. First, a function call graph of an Android application is constructed, and the structural and semantic features of nodes and edges are extracted. Then, a masking strategy is adaptively determined based on the relative importance of nodes and edges in the graph structure, and joint masking is applied to nodes and edges. On this basis, a graph neural network model is trained, enabling the model to learn stable and discriminative representations even when some graph structures or features are damaged. Finally, the trained model is used to detect malware in Android applications. This invention demonstrates effectiveness in improving the robustness and engineering practicality of Android malware detection models.

The application provides an Android malware detection method based on multi-view learning, and belongs to the technical field of Android malware detection. The method comprises the following steps: 1, decompiling the Android application to be detected, extracting the function call relationship, opcode sequence and permission information, constructing the function call graph and extracting the sensitive behavior subgraph; 2, using the pre-trained code representation model CodeBERT to perform semantic coding on the method-level opcode sequence, and fusing the permission features to generate the node semantic vector; 3, constructing a multi-view graph neural network, generating multi-view input through a feature mask enhancement strategy, introducing a multi-hop adaptive attention mechanism to realize dynamic aggregation of multi-hop neighborhood information, and simultaneously adopting a multi-channel coding structure for learning complementary graph representation; 4, fusing the multi-channel node representation, constructing a relationship matrix through key-value mapping, and generating a graph-level representation through convolution and pooling, and finally inputting a classification model to realize Android malware detection.

This invention discloses a method for detecting and classifying Android malware based on multi-feature fusion deep learning. The method is accomplished by obtaining a sample of an APK to be tested, feeding the sample into a trained model, and obtaining detection results. The invention uses deep learning to capture the data flow patterns of different types of malware from static taint paths. The taint paths are used as a set of features for detecting and classifying Android malware. Feature fusion is performed using a Wide & Deep model, where the Wide portion processes two types of features: sensitive API calls and dangerous permissions, and the Deep portion processes static taint paths. The fused features add semantic information from the static taint paths, enabling the learning of behavioral patterns of different malware, improving the accuracy and robustness of the model.

The application discloses an Android malicious program detection method based on a small sample learning model, and comprises the following steps: step 1, collecting initial sample data and performing preliminary preprocessing to obtain an original Dalvik operation code sequence of the initial sample data; step 2, performing Smali embedding representation on the original Dalvik operation code sequence of the initial sample data obtained in step 1; step 3, obtaining newly generated sample data; step 4, outputting a three-order fusion feature tensor with Android application malicious code semantic information; and step 5, providing a classification result of detecting whether an Android application is a malicious program. According to the method, the sample data enhancement is performed on the initial small sample data, the sample category imbalance problem is alleviated, and the problems of missing long sequence context association, high artificial feature engineering cost and high false detection rate are solved.

The present application belongs to the field of Android malware detection in information security, and particularly relates to a training method, device and equipment of an Android malware detection model; the method comprises the following steps: obtaining an original Android software sample dataset; using random undersampling to process the majority of Android benign samples; using boundary density weighting-based oversampling to process the minority of Android malicious samples; using evolutionary screening undersampling to process the resampled Android software sample dataset; these methods can optimize the Android software sample dataset; based on the optimized Android software sample dataset, the hyperparameters of the classifier of the Android software detection model are optimized by using a binary particle swarm optimization algorithm, so that iterative training of the Android software detection model is realized. The present application can improve the training efficiency and detection accuracy of the Android malware classification model.

This invention discloses a multi-view few-sample Android malware classification method based on optimal guidance matching, belonging to the field of information security technology. The invention includes constructing multi-view grayscale images, training a backbone network, optimal guidance matching classification, and dynamic fusion of multiple views. First, the method extracts permissions, APIs, components, and intent features of the Android application to construct multi-view grayscale images. Then, it trains a backbone network that integrates attention mechanisms and self-supervised rotation prediction to extract discriminative features with geometric structure awareness. Valid guidance samples are identified through optimal guidance matching, and category similarity scores are calculated. Finally, adaptive weights are generated based on view confidence, and the multi-view scores are dynamically fused to complete the classification. This invention improves the accuracy and robustness of malware family classification in few-sample scenarios, reduces noise interference, and is suitable for rapid and accurate identification of malware.

The invention relates to an Android malicious software detection method based on a multi-evidence fusion mixed heterogeneous graph. The method comprises the following steps: collecting an Android application data set and preprocessing the Android application data set; extracting a function call graph and a runtime event graph of the application program through static analysis and dynamic analysis respectively; utilizing a multi-evidence similarity fusion mechanism, combining code semantics, permission consistency and time frequency characteristics, associating static function nodes with dynamic event nodes, and constructing a hybrid heterogeneous graph; performing feature coding on nodes and edges in the graph; a deep learning framework is built, an improved reliability calibration heterogeneous graph model is adopted, and the model comprises confidence calibration attention and a reliability gating mechanism; and a final classifier is obtained through model iteration training. According to the method, the static structure and the dynamic behavior characteristics can be effectively fused, the noise is suppressed through the reliability of the automatic calibration edge, and the accuracy and robustness of Android malicious software detection are remarkably improved.

This invention discloses an Android malware adversarial sample detection method based on the concept of mobile target defense. The method includes: a heterogeneous model pool, diversified adversarial training, optimal ensemble learning, and a dynamic update trigger. The heterogeneous model pool is designed for Android software, aiming to provide a heterogeneous orthogonal foundational model for subsequent adversarial training and ensemble learning. The diversified adversarial training is designed for Android malware, generating corresponding detection models for different types of adversarial sample attacks. The optimal ensemble learning is designed for all adversarial detection models, aiming to form a detection capability against all types of adversarial samples. The dynamic update trigger is based on the detection results, updating the construction process of the heterogeneous model pool, diversified adversarial training, and optimal ensemble learning through a mixture of periodic and event-driven triggers. Through the technical solution of this disclosed example, mainstream Android malware adversarial samples can be detected, improving the security of the Android platform.

The invention provides an Android malicious software detection method based on family feature vectors. Firstly, a reverse tool is used for extracting software static features from an Android APK file and converting the software static features into fixed-length vectors; inputting into a pre-trained multi-classifier, and taking a last layer of non-activated output as a high-dimensional space coordinate of the Android software; calculating the similarity with other family feature vectors according to the coordinates, taking the similarity as a weight, performing weighted summation on the first three vectors with the highest similarity and the coordinates of the software, amplifying the characteristics of malicious features of the software, and skipping the step if the similarities are all too low; and finally inputting into the deep learning model for malicious software detection.

The application provides an Android malware universal adversarial sample generation method, and the method specifically comprises the following steps: receiving a user-uploaded malicious APK file, and constructing a target function call graph corresponding to the APK file; traversing all nodes in the target function call graph, and identifying custom functions, non-custom functions and APIs in all nodes; determining a target API disturbance set to be injected, and the number of new nodes to be added for each non-custom function; and integrating the file generated after injecting the target API disturbance set and the new non-custom function, so as to generate an adversarial sample. The application focuses on universal disturbance from three angles of nodes, edges and application programming interfaces, so that the generated adversarial sample can effectively evade multiple typical detection methods based on different feature sets. In addition, the application has the advantages of practicability and function losslessness.

A method of detecting Android malware based on a heterogeneous graph and an apparatus thereof are provided, including: constructing a target heterogeneous graph according to entities and entity relationship information extracted from an application to be tested; determining a KL distance between any two meta-paths, and taking the meta-paths in which the KL distance is greater than a preset threshold as a plurality of finally selected meta-paths; carrying out, by RBM, feature fusion on the plurality of meta-paths, and adjusting, by an automatic encoder, fusion parameters of initial fusion vectors to meet a predetermined condition to obtain a plurality of fusion feature vectors; inputting the plurality of fusion feature vectors into a trained Deep Neural Network (DNN) for classification to obtain a final classification result, and determining whether the application to be tested is Android malware according to the final classification result.

The application discloses an Android malware detection method based on an operation code graph, and comprises the following contents: collecting benign and malicious application sets from an Android platform; performing reverse compilation on the Android application to obtain an operation code sequence set; analyzing a plurality of operation codes defined in a virtual machine, and performing vectorization representation on the features of the operation codes to construct feature vectors of nodes in an operation code graph; processing the operation code sequence by using a 2-gram model to form co-occurrence operation code pairs to construct edges of the operation code graph, calculating the frequency of the co-occurrence operation code pairs, and normalizing matrix rows to form a co-occurrence matrix to construct edge weights of the operation code graph; and performing supervised learning on the operation code graph by using an improved deep graph convolution network to realize detection of the Android malware. The application represents the Android application program from the code level by using the operation code graph, has good persuasiveness, and achieves a good accuracy in the detection of the Android malware.

This invention belongs to the field of malicious code detection and provides an Android malware detection system and method based on a hypergraph. It primarily addresses the problems of existing heterogeneous graph-based Android malware detection methods, such as coarse granularity, high computational overhead, and neglect of high-order relationships between applications during application relationship modeling. The main scheme includes: statically analyzing Android APK files to obtain their API call information; constructing a hypergraph describing the relationships between APKs based on their API call relationships; obtaining a simple graph corresponding to the hypergraph through clique expansion; extracting high-order and low-order relationship features between APKs through hypergraph convolution and graph convolution based on the obtained hypergraph, simple graph, and initial node features, and fusing them through an attention mechanism; training and learning the detection model on the fused features using node classification tasks; and using the trained detection model to detect and identify Android malware.

The present application relates to a kind of Android malware detection method based on entropy spectrum density and adaptive shrink convolution, comprising the following steps: collecting malware dataset;Dex head feature extraction;Shannon entropy distribution feature extraction;Markov image combined gray image feature extraction, Android manifest file analysis module;Using adaptive soft voting method to carry out integrated learning, and predict final result.The present application introduces a kind of light multi-source fast Android malware detection method, uses multiple files in an Android application package, extracts relevant features contained in file from multiple dimensions, such as information in file header and power spectrum density of executable file structure entropy, so that the extraction of feature is more comprehensive.

The present application belongs to the technical field of computer security, and particularly relates to an Android malware detection method based on a stacking integration technology, which comprises: obtaining a labeled Android software APK data sample of a mobile terminal, performing data equalization on the obtained data sample, extracting features of the equalized data, screening and reducing dimensions according to information entropy gain values of each feature, establishing an AM-Stacking malware detection model, and performing malware detection according to the screened features. The present application fuses multiple models with good classification performance in a stacking integration manner, divides a data set using K-fold cross validation, simultaneously introduces an attention mechanism, and combines equalized data samples and a hybrid feature processing method, so that the presence of malware can be more accurately detected, and existing malware in various software platforms and terminals can be effectively detected, thereby improving the detection precision of malware.

The invention belongs to the technical field of Android malicious software identification, and particularly relates to an Android malicious software identification method for dex reinforcement. The method comprises the following steps of: reconstructing an original byte code of a reinforced program through an independently researched and developed Dex shelling framework, and establishing a flexible and extensible API (Application Program Interface) monitoring configuration system; generating an instruction-level tracking control script based on preset malicious behavior characteristics, and capturing fine-grained instruction stream data in real time in a system source code modification mode; and in combination with context-sensitive data flow analysis and a cross-function pollution propagation tracking algorithm, an automatic analysis model of a malicious behavior propagation chain is constructed. Through series connection of technologies of dynamic shelling, accurate tracking and instruction stream analysis, automatic detection and determination of malicious behaviors such as privacy stealing are realized. Compared with a static detection method, the scheme can effectively break through code reinforcement protection, and improves the recognition capability of the resistant sample while ensuring the detection precision.

The present invention discloses an adversarial Android malware detection method based on contrastive learning, which comprises: firstly, determining a perturbed feature set and an unperturbed feature set in a feature space by defining an Android application and all feasible perturbation sets, and then determining the architecture of a feature projection model by using the obtained perturbed feature set and unperturbed feature set. Then, a feature projection model is obtained based on the loss function of contrastive learning and adversarial malware training to project feature vectors, so that the distance between the feature vectors obtained after projection can be expressed as a feature matching degree. The present invention utilizes deep learning technology to achieve efficient and low-loss adversarial Android malware detection, which greatly improves the robustness of the Android malware detection method based on machine learning.

The present application belongs to the field of Android malware detection in information security, and particularly relates to an Android malware detection method based on cost-sensitive learning. The method comprises the following steps: obtaining an original Android software sample data set; decompiling all samples in the data set to obtain source code files; extracting permissions and four components from the decompiled source code files as original features; calculating sample weights by using a sample-sensitive weight calculation method, and obtaining a sample-sensitive weight sequence; applying the sample-sensitive weight sequence to the feature selection stage, and selecting a sensitive feature subset by using a cost-sensitive feature selection method; applying the sample-sensitive weight sequence to the model training stage, and detecting Android malware from the sensitive feature subset by using a cost-sensitive learning-based classification method. The present application can improve the detection efficiency and accuracy of the Android malware classification model.

The application provides an Android malicious program detection method and system based on multi-modal feature linear weighted fusion, and belongs to the technical field of malicious program analysis. Dalvik byte stream data of an Android application is visualized as a "vector" color image; a dynamic permission information table is constructed to perform one-hot encoding processing on permission information of the Android application; feature information represented by the two modalities is processed and analyzed respectively, a lightweight convolutional neural network model is constructed to extract and learn features of image data, and a lightweight feedforward neural network model is constructed to extract and learn features of text data; linear weighting is used to fuse features of the two different modalities of data extracted and learned, the fused feature vector is input into a classifier for classification, and a classification result is obtained, so that the accuracy and efficiency of Android malicious application detection are improved.