16 results about "Android malware" patented technology

The application relates to an Android malware detection method based on a meta-path embedding graph neural network, which comprises the following steps: extracting static features to obtain API and Permission; constructing a heterogeneous graph; defining a meta-path and embedding each APP node; calculating the weight of each meta-path; and obtaining the classification result of the APP; the method is characterized in that the RotatE encoder is used to embed each meta-path, the features of the intermediate nodes on the meta-path are aggregated, the features of the destination nodes themselves are also considered, and more information beneficial to malware detection is obtained, so that the method can exceed the accuracy rate of other methods trained by using a large number of samples by using a small number of samples; meanwhile, the application defines a lambda parameter to limit the number of meta-paths and reduce system resource consumption.

The application discloses a kind of API sequence semantics and graph structure feature fusion Android malware dynamic detection method, including the following steps: running Android application in simulator environment, monitoring and collecting runtime log, extracting API method name sequence from log, retaining call order semantic information;Based on point mutual information PMI theory, global API dependency graph is constructed;Combined with semantic embedding and graph structure embedding, joint feature representation is generated, including semantic embedding, graph structure embedding and joint embedding;The fusion embedding is input into pre-training BERT encoder, and the feature is extracted through self-attention mechanism, and the detection result is output by the classifier with [CLS] flag bit vector;The application significantly improves the detection performance, and has strong practical application value.

This invention provides a permission-based Android malware detection method and system, relating to the field of Android malware detection. The method includes: extracting multimodal features of each function from the APK installation package file of the target Android software and constructing a call graph between functions. The multimodal features include permissions, and the call graph uses nodes to represent functions and edges to represent the call relationships between functions. The multimodal features and call graph of all functions are input into a trained detection model for malicious and benign classification, yielding Android malware detection results. This invention exhibits higher detection accuracy and robustness in static analysis-based malware detection tasks, effectively improving security protection capabilities in practical applications.

The invention relates to the technical field of computer security, in particular to a dynamically updated Android malicious software continuous learning detection method, which comprises the following steps of: acquiring and sequencing historical Android application samples according to time to construct a training set, and training a hierarchical comparison classifier; new applications are collected regularly to form a to-be-tested batch, and the current classifier is used for prediction; for each sample in the to-be-detected batch, executing pseudo loss uncertainty calculation to obtain an uncertainty score of the sample; according to the score, selecting a predetermined number of most uncertain samples for labeling, and obtaining a real label; adding the new labeled sample into the training set, and performing incremental training by adopting a hot start mode based on the weight of the current classifier to obtain an updated classifier; and circularly executing, and detecting the new application in the next period by using the updated classifier. According to the method, the labeling cost can be remarkably reduced, the concept drift can be effectively coped, and efficient, stable and continuous malicious software detection is realized.

The application discloses an Android malware detection method based on large-scale heterogeneous graph representation learning, extracts static features and dynamic features in meta information from original Android software application packages to construct a heterogeneous graph, obtains semantic and structural information by sampling neighbor nodes of each Android software in the heterogeneous graph, generates matrix representation of each Android software by inductive information aggregation and scaling of the neighbor nodes, generates a detection module containing multiple sub-detectors through multi-model training and model fusion, and realizes real-time subdivision detection of Android malware by using the trained detection module and real-time representation of new Android software in an actual online detection stage. The application improves the generation method of graph representation learning by extracting mixed static and dynamic features, avoids information loss based on a single aggregator, supports real-time detection of unknown Android software, realizes accurate detection of specific categories of Android malware based on a multi-model fusion strategy, and achieves accuracy, real-time performance and subdivision effect.

This invention discloses a malware detection method based on adaptive node-edge joint masking. First, a function call graph of an Android application is constructed, and the structural and semantic features of nodes and edges are extracted. Then, a masking strategy is adaptively determined based on the relative importance of nodes and edges in the graph structure, and joint masking is applied to nodes and edges. On this basis, a graph neural network model is trained, enabling the model to learn stable and discriminative representations even when some graph structures or features are damaged. Finally, the trained model is used to detect malware in Android applications. This invention demonstrates effectiveness in improving the robustness and engineering practicality of Android malware detection models.

The application discloses an Android malicious program detection method based on a small sample learning model, and comprises the following steps: step 1, collecting initial sample data and performing preliminary preprocessing to obtain an original Dalvik operation code sequence of the initial sample data; step 2, performing Smali embedding representation on the original Dalvik operation code sequence of the initial sample data obtained in step 1; step 3, obtaining newly generated sample data; step 4, outputting a three-order fusion feature tensor with Android application malicious code semantic information; and step 5, providing a classification result of detecting whether an Android application is a malicious program. According to the method, the sample data enhancement is performed on the initial small sample data, the sample category imbalance problem is alleviated, and the problems of missing long sequence context association, high artificial feature engineering cost and high false detection rate are solved.

This invention discloses a multi-view few-sample Android malware classification method based on optimal guidance matching, belonging to the field of information security technology. The invention includes constructing multi-view grayscale images, training a backbone network, optimal guidance matching classification, and dynamic fusion of multiple views. First, the method extracts permissions, APIs, components, and intent features of the Android application to construct multi-view grayscale images. Then, it trains a backbone network that integrates attention mechanisms and self-supervised rotation prediction to extract discriminative features with geometric structure awareness. Valid guidance samples are identified through optimal guidance matching, and category similarity scores are calculated. Finally, adaptive weights are generated based on view confidence, and the multi-view scores are dynamically fused to complete the classification. This invention improves the accuracy and robustness of malware family classification in few-sample scenarios, reduces noise interference, and is suitable for rapid and accurate identification of malware.

The invention relates to an Android malicious software detection method based on a multi-evidence fusion mixed heterogeneous graph. The method comprises the following steps: collecting an Android application data set and preprocessing the Android application data set; extracting a function call graph and a runtime event graph of the application program through static analysis and dynamic analysis respectively; utilizing a multi-evidence similarity fusion mechanism, combining code semantics, permission consistency and time frequency characteristics, associating static function nodes with dynamic event nodes, and constructing a hybrid heterogeneous graph; performing feature coding on nodes and edges in the graph; a deep learning framework is built, an improved reliability calibration heterogeneous graph model is adopted, and the model comprises confidence calibration attention and a reliability gating mechanism; and a final classifier is obtained through model iteration training. According to the method, the static structure and the dynamic behavior characteristics can be effectively fused, the noise is suppressed through the reliability of the automatic calibration edge, and the accuracy and robustness of Android malicious software detection are remarkably improved.

The application provides an Android malware universal adversarial sample generation method, and the method specifically comprises the following steps: receiving a user-uploaded malicious APK file, and constructing a target function call graph corresponding to the APK file; traversing all nodes in the target function call graph, and identifying custom functions, non-custom functions and APIs in all nodes; determining a target API disturbance set to be injected, and the number of new nodes to be added for each non-custom function; and integrating the file generated after injecting the target API disturbance set and the new non-custom function, so as to generate an adversarial sample. The application focuses on universal disturbance from three angles of nodes, edges and application programming interfaces, so that the generated adversarial sample can effectively evade multiple typical detection methods based on different feature sets. In addition, the application has the advantages of practicability and function losslessness.

The application discloses an Android malware detection method based on an operation code graph, and comprises the following contents: collecting benign and malicious application sets from an Android platform; performing reverse compilation on the Android application to obtain an operation code sequence set; analyzing a plurality of operation codes defined in a virtual machine, and performing vectorization representation on the features of the operation codes to construct feature vectors of nodes in an operation code graph; processing the operation code sequence by using a 2-gram model to form co-occurrence operation code pairs to construct edges of the operation code graph, calculating the frequency of the co-occurrence operation code pairs, and normalizing matrix rows to form a co-occurrence matrix to construct edge weights of the operation code graph; and performing supervised learning on the operation code graph by using an improved deep graph convolution network to realize detection of the Android malware. The application represents the Android application program from the code level by using the operation code graph, has good persuasiveness, and achieves a good accuracy in the detection of the Android malware.

This invention belongs to the field of malicious code detection and provides an Android malware detection system and method based on a hypergraph. It primarily addresses the problems of existing heterogeneous graph-based Android malware detection methods, such as coarse granularity, high computational overhead, and neglect of high-order relationships between applications during application relationship modeling. The main scheme includes: statically analyzing Android APK files to obtain their API call information; constructing a hypergraph describing the relationships between APKs based on their API call relationships; obtaining a simple graph corresponding to the hypergraph through clique expansion; extracting high-order and low-order relationship features between APKs through hypergraph convolution and graph convolution based on the obtained hypergraph, simple graph, and initial node features, and fusing them through an attention mechanism; training and learning the detection model on the fused features using node classification tasks; and using the trained detection model to detect and identify Android malware.

The present application relates to a kind of Android malware detection method based on entropy spectrum density and adaptive shrink convolution, comprising the following steps: collecting malware dataset;Dex head feature extraction;Shannon entropy distribution feature extraction;Markov image combined gray image feature extraction, Android manifest file analysis module;Using adaptive soft voting method to carry out integrated learning, and predict final result.The present application introduces a kind of light multi-source fast Android malware detection method, uses multiple files in an Android application package, extracts relevant features contained in file from multiple dimensions, such as information in file header and power spectrum density of executable file structure entropy, so that the extraction of feature is more comprehensive.

The present application belongs to the technical field of computer security, and particularly relates to an Android malware detection method based on a stacking integration technology, which comprises: obtaining a labeled Android software APK data sample of a mobile terminal, performing data equalization on the obtained data sample, extracting features of the equalized data, screening and reducing dimensions according to information entropy gain values of each feature, establishing an AM-Stacking malware detection model, and performing malware detection according to the screened features. The present application fuses multiple models with good classification performance in a stacking integration manner, divides a data set using K-fold cross validation, simultaneously introduces an attention mechanism, and combines equalized data samples and a hybrid feature processing method, so that the presence of malware can be more accurately detected, and existing malware in various software platforms and terminals can be effectively detected, thereby improving the detection precision of malware.

The present application belongs to the field of Android malware detection in information security, and particularly relates to an Android malware detection method based on cost-sensitive learning. The method comprises the following steps: obtaining an original Android software sample data set; decompiling all samples in the data set to obtain source code files; extracting permissions and four components from the decompiled source code files as original features; calculating sample weights by using a sample-sensitive weight calculation method, and obtaining a sample-sensitive weight sequence; applying the sample-sensitive weight sequence to the feature selection stage, and selecting a sensitive feature subset by using a cost-sensitive feature selection method; applying the sample-sensitive weight sequence to the model training stage, and detecting Android malware from the sensitive feature subset by using a cost-sensitive learning-based classification method. The present application can improve the detection efficiency and accuracy of the Android malware classification model.

The application provides an Android malicious program detection method and system based on multi-modal feature linear weighted fusion, and belongs to the technical field of malicious program analysis. Dalvik byte stream data of an Android application is visualized as a "vector" color image; a dynamic permission information table is constructed to perform one-hot encoding processing on permission information of the Android application; feature information represented by the two modalities is processed and analyzed respectively, a lightweight convolutional neural network model is constructed to extract and learn features of image data, and a lightweight feedforward neural network model is constructed to extract and learn features of text data; linear weighting is used to fuse features of the two different modalities of data extracted and learned, the fused feature vector is input into a classifier for classification, and a classification result is obtained, so that the accuracy and efficiency of Android malicious application detection are improved.