API Call Graph Deep Learning for Malicious App Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious behavior in Android mobile applications are limited, often incorrectly classifying benign applications as malicious or vice versa, due to the shared use of APIs, and fail to accurately analyze actual execution patterns.
Innovation Solution
A mobile application malicious behavior pattern detection method based on API call graph extraction using deep learning techniques, which involves extracting API Call Graphs, generating a training dataset, training a prediction model, extracting malicious behavior patterns, and classifying applications through similarity comparison.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If detection is performed using only API usage checking, then malicious applications can be identified by detecting actual execution, but benign applications may be incorrectly classified as malicious when they use the same APIs
Solution Approach 1:
The patent segments the detection process into multiple components: API call graph extraction, deep learning model training, and pattern matching. By dividing the detection task into these stages, the system can analyze not just individual API usage but the structural relationships and call patterns, thereby improving accuracy while reducing false positives through multi-layered verification
Solution Approach 2:
The patent transitions from one-dimensional API usage checking to multi-dimensional analysis by constructing API call graphs that capture temporal, structural, and contextual relationships. This dimensional expansion allows the system to distinguish between benign and malicious usage of the same APIs by examining the broader pattern context rather than isolated API calls
2Measurement precision
If deep learning techniques are used to analyze API call graphs, then accurate malicious behavior detection is achieved, but the complexity of the detection system increases
Solution Approach 1:
The patent applies preliminary action by pre-training the deep learning model with labeled API call graph data before actual detection. This offline training phase prepares the model to recognize malicious patterns, so that during runtime, the system only needs to perform pattern matching rather than complex real-time analysis, thereby reducing operational complexity while maintaining high detection accuracy
Solution Approach 2:
The patent creates simplified representations (API call graphs) that copy the essential structural and behavioral characteristics of application execution. These graphical models serve as compressed, manageable versions of the actual application behavior, allowing complex analysis to be performed on the simplified representation rather than the full application code
Data Source
AI summary
A mobile application malicious behavior pattern detection method based on Application Programming Interface (API) call graph extraction includes extracting an API Call Graph (ACG) representing an API call flow from benign applications and applications which perform malicious behavior, generating and vectorizing a training dataset for deep learning using the extracted ACG, generating a deep learning algorithm prediction model by training with the vectorized training dataset, extracting ACG features used in the malicious behavior from the generated prediction model and extracting a malicious behavior pattern from an intersection of the malicious applications, and classifying an application which performs malicious behavior through similarity comparison between the extracted malicious behavior pattern and a pattern extracted from the target application. Accordingly, it is possible to detect the malicious behavior itself using the ACG representing an API call flow.