7 results about "Android malware" patented technology

This invention provides a permission-based Android malware detection method and system, relating to the field of Android malware detection. The method includes: extracting multimodal features of each function from the APK installation package file of the target Android software and constructing a call graph between functions. The multimodal features include permissions, and the call graph uses nodes to represent functions and edges to represent the call relationships between functions. The multimodal features and call graph of all functions are input into a trained detection model for malicious and benign classification, yielding Android malware detection results. This invention exhibits higher detection accuracy and robustness in static analysis-based malware detection tasks, effectively improving security protection capabilities in practical applications.

The application discloses an Android malware detection method based on large-scale heterogeneous graph representation learning, extracts static features and dynamic features in meta information from original Android software application packages to construct a heterogeneous graph, obtains semantic and structural information by sampling neighbor nodes of each Android software in the heterogeneous graph, generates matrix representation of each Android software by inductive information aggregation and scaling of the neighbor nodes, generates a detection module containing multiple sub-detectors through multi-model training and model fusion, and realizes real-time subdivision detection of Android malware by using the trained detection module and real-time representation of new Android software in an actual online detection stage. The application improves the generation method of graph representation learning by extracting mixed static and dynamic features, avoids information loss based on a single aggregator, supports real-time detection of unknown Android software, realizes accurate detection of specific categories of Android malware based on a multi-model fusion strategy, and achieves accuracy, real-time performance and subdivision effect.

This invention discloses a malware detection method based on adaptive node-edge joint masking. First, a function call graph of an Android application is constructed, and the structural and semantic features of nodes and edges are extracted. Then, a masking strategy is adaptively determined based on the relative importance of nodes and edges in the graph structure, and joint masking is applied to nodes and edges. On this basis, a graph neural network model is trained, enabling the model to learn stable and discriminative representations even when some graph structures or features are damaged. Finally, the trained model is used to detect malware in Android applications. This invention demonstrates effectiveness in improving the robustness and engineering practicality of Android malware detection models.

The application discloses an Android malicious program detection method based on a small sample learning model, and comprises the following steps: step 1, collecting initial sample data and performing preliminary preprocessing to obtain an original Dalvik operation code sequence of the initial sample data; step 2, performing Smali embedding representation on the original Dalvik operation code sequence of the initial sample data obtained in step 1; step 3, obtaining newly generated sample data; step 4, outputting a three-order fusion feature tensor with Android application malicious code semantic information; and step 5, providing a classification result of detecting whether an Android application is a malicious program. According to the method, the sample data enhancement is performed on the initial small sample data, the sample category imbalance problem is alleviated, and the problems of missing long sequence context association, high artificial feature engineering cost and high false detection rate are solved.

This invention discloses a multi-view few-sample Android malware classification method based on optimal guidance matching, belonging to the field of information security technology. The invention includes constructing multi-view grayscale images, training a backbone network, optimal guidance matching classification, and dynamic fusion of multiple views. First, the method extracts permissions, APIs, components, and intent features of the Android application to construct multi-view grayscale images. Then, it trains a backbone network that integrates attention mechanisms and self-supervised rotation prediction to extract discriminative features with geometric structure awareness. Valid guidance samples are identified through optimal guidance matching, and category similarity scores are calculated. Finally, adaptive weights are generated based on view confidence, and the multi-view scores are dynamically fused to complete the classification. This invention improves the accuracy and robustness of malware family classification in few-sample scenarios, reduces noise interference, and is suitable for rapid and accurate identification of malware.

The application discloses an Android malware detection method based on an operation code graph, and comprises the following contents: collecting benign and malicious application sets from an Android platform; performing reverse compilation on the Android application to obtain an operation code sequence set; analyzing a plurality of operation codes defined in a virtual machine, and performing vectorization representation on the features of the operation codes to construct feature vectors of nodes in an operation code graph; processing the operation code sequence by using a 2-gram model to form co-occurrence operation code pairs to construct edges of the operation code graph, calculating the frequency of the co-occurrence operation code pairs, and normalizing matrix rows to form a co-occurrence matrix to construct edge weights of the operation code graph; and performing supervised learning on the operation code graph by using an improved deep graph convolution network to realize detection of the Android malware. The application represents the Android application program from the code level by using the operation code graph, has good persuasiveness, and achieves a good accuracy in the detection of the Android malware.

This invention belongs to the field of malicious code detection and provides an Android malware detection system and method based on a hypergraph. It primarily addresses the problems of existing heterogeneous graph-based Android malware detection methods, such as coarse granularity, high computational overhead, and neglect of high-order relationships between applications during application relationship modeling. The main scheme includes: statically analyzing Android APK files to obtain their API call information; constructing a hypergraph describing the relationships between APKs based on their API call relationships; obtaining a simple graph corresponding to the hypergraph through clique expansion; extracting high-order and low-order relationship features between APKs through hypergraph convolution and graph convolution based on the obtained hypergraph, simple graph, and initial node features, and fusing them through an attention mechanism; training and learning the detection model on the fused features using node classification tasks; and using the trained detection model to detect and identify Android malware.