CN115391778A - Android malware detection method and device based on heterogeneous graph attention network - Google Patents

Abstract

The present invention provides a method for detecting an Android malicious program based on a heterogeneous graph attention network, comprising the following steps: S1: downloading an APP and labeling it; S2: decompiling the APK, and extracting various key feature entities; S3: Build a heterogeneous graph attention network, convert the heterogeneous graph attention network into multiple meta-structures, and calculate the adjacency matrix of each meta-structure; S4: Obtain low-dimensional vector embedding; S5: Train the logistic regression model, and obtain the detection The node embedding of the Android application program; S6: Get the detection result. The present invention also provides an Android malware detection device based on a heterogeneous graph attention network, which is used to implement the above-mentioned Android malware detection method based on a heterogeneous graph attention network. The present invention provides a method and device for detecting Android malicious programs based on a heterogeneous graph attention network, which solves the problem that the existing malicious program detection technology cannot effectively classify and detect Android malicious applications.

Description

Android malware detection method and device based on heterogeneous graph attention network

technical field

The present invention relates to the technical field of information security, and more specifically, to a method and device for detecting Android malicious programs based on a heterogeneous graph attention network.

Background technique

Driven by the rapid development of Internet services, mobile applications have entered all aspects of public life, such as communication, finance, travel, entertainment, etc. At present, Android is the largest operating system platform in the global smartphone market, and the scalability of the Android platform Due to its openness and openness, users are faced with threats and attacks from various malicious programs, including privacy violations, data leaks, spam advertisements, and some transaction payment operations involving the safety of users’ personal property. Therefore, the research on identification and detection methods of Android malicious programs is of great importance. application value.

Traditional Android malware detection methods include static analysis of APK files, characterizing the list of items, code files, and resource files, and then comparing similarities to determine whether they are malicious. However, this method may be because of simple Malicious applications using code obfuscation technology and Android vulnerabilities cannot be effectively identified through fuzzy processing. The dynamic analysis method is to collect system information by running program codes, including system calls, API calls, network information, etc. to build a feature library, and then use similar The disadvantage is that it depends heavily on the version of the operating system and the running time of the program. In order to solve this problem, the current detection technology based on machine learning algorithms extracts key features and applies classification algorithms to distinguish between malicious and benign. However, this method Without taking into account the rich semantic information between nodes, it is impossible to detect malicious applications whose features are disguised and hidden.

Therefore, the existing malicious program detection technology cannot effectively classify and detect Android malicious applications.

Contents of the invention

In order to overcome the technical defect that the existing malicious program detection technology cannot effectively classify and detect Android malicious applications, the present invention provides a method and device for detecting Android malicious programs based on a heterogeneous graph attention network.

In order to solve the problems of the technologies described above, the technical solution of the present invention is as follows:

A kind of Android malware detection method based on heterogeneous graph attention network, comprises the following steps:

S1: Download the Android application APP and label it to obtain a set of Android applications; wherein, the Android application includes a benign Android application and a malicious Android application;

S2: Decompile the installation package APK of the Android application program, and extract various key feature entities from the decompiled file;

S3: Construct a heterogeneous graph attention network based on the relationship between Android applications and key feature entities, transform the heterogeneous graph attention network into multiple meta-structures, and calculate the adjacency matrix of each meta-structure;

S4: Obtain the low-dimensional vector embedding of existing nodes according to the adjacency matrix of the meta structure;

S5: Use the low-dimensional vector embedding and label of the existing nodes to train the logistic regression model, obtain the trained logistic regression model, and obtain the node embedding of the Android application to be detected;

S6: Embed the nodes of the Android application to be detected into the trained logistic regression model for detection, and obtain a detection result indicating whether the Android application to be detected is malicious or benign.

In the above scheme, firstly, a variety of key feature entities are extracted by decompiling the APK, and a heterogeneous graph attention network is constructed according to the relationship between the Android application and the key feature entities, and the heterogeneous graph attention network is transformed into multiple Metastructure, then obtain the low-dimensional vector embedding of existing nodes from the adjacency matrix of the metastructure, use the low-dimensional vector embedding and label training logistic regression model, finally obtain the node embedding of the Android application to be tested and input the trained logistic regression The model detects and obtains the detection result that the Android application to be detected is malicious or benign.

Preferably, the key feature entities include API, authority, authority type, class, interface and so file.

Preferably, the relationship matrix _Rlin in the graph is formed according to the relationship between the Android application program and the key feature entity, l∈[1,6]; wherein, R1 _in represents the relationship between the App and the API, and R2 _in represents the relationship between the App and the authority R3 _in indicates the permission type of the App, R4 _in indicates the relationship between the App and the class, R5 _in indicates the relationship between the App and the interface, and R6 _in indicates the relationship between the App and the so file.

Preferably, the heterogeneous graph attention network is a graph G=(V, E, A, R), the types of its nodes include APP, API, authority, authority type, class, interface and so file, and the types of edges include R1 _in , R2 _in , R3 _in , R4 _in , R5 _in and R6 _in ; among them, V represents the set of nodes, E represents the set of edges, A represents the type set of nodes, R represents the type set of edges, |A|+ |R|>2.

Preferably, the meta-structure is a meta-path or a meta-graph, the meta-path is a path defined on a heterogeneous graph attention network, the source object and the target object are located at both ends of the path, if the source object and the target object Multiple meta-paths constitute a meta-graph.

Preferably, the adjacency matrix set {Ψ ^M1 ,...,Ψ ^Mk ,...,Ψ ^MK } is composed of K adjacency matrices of the meta-structure, and the adjacency matrix of the meta-structure is the adjacency matrix of the meta-path or the adjacency of the meta-graph matrix,

Among them, the calculation formula of the adjacency matrix of the meta-path is:

Ψ ^MP ＝R _A1A2 ·...·R _AiA(i+1) ·...·R _A(n-1)An

The formula for calculating the adjacency matrix of the meta graph is:

Ψ ^RG = Ψ ^MP1 ⊙...⊙Ψ ^MPj ⊙...⊙Ψ ^MPm ;

Among them, Ψ ^Mk represents the adjacency matrix of the k-th element structure, R _AiA(i+1) represents the relationship matrix between the i-th node and the i+1-th node, i=1,2,...,n , n represents the number of meta-path nodes, Ψ ^MPj represents the jth Ψ ^MP , ⊙ represents the Hadamard product, and m represents the number of Ψ ^MP .

Preferably, step S4 includes the following steps:

S41: Encode each node in the form of a one-hot vector to obtain a matrix H, combine H with the adjacency matrix of a given metastructure Mk, and obtain the adjacency matrix of the internal nodes of the metastructure through a normalization operation:

Ψ ^Mk' ＝Normalize(H·H ^T ⊙Ψ ^Mk )

And introduce the GAT model of edge weight perception to update the meta-structure Mk internal node embedding Φ ^Mk = GAT(H; Ψ ^Mk' );

S42: Using a multi-layer perceptron to learn the weight β ^Mk of each meta-structure Mk in the fusion,

(β ^M1 ,...,β ^Mk ,...,β ^MK )＝softmax(NN(Φ ^M1 ),...,NN(Φ ^Mk ),...,NN(Φ ^MK ))

Among them, NN is a native neural network that maps a given matrix to a numerical value,

To obtain the low-dimensional vector embedding of existing nodes:

Preferably, in step S5, the node embedding of the Android application program to be detected is obtained through the following steps:

S51: Form an out-of-graph relationship matrix Rl _out according to the relationship between the Android application to be detected and the key feature entity, l∈[1,6];

形式为j行列矩阵，j表示图内节点的个数，矩阵的第j行数值

代表新节点与图内节点v_j之间元结构的数量；S52: Form an incremental segment of the node adjacency matrix

The form is a matrix of j rows and columns, j represents the number of nodes in the graph, and the value of the jth row of the matrix

Represents the number of metastructures between the new node and the node v _j in the graph;

进行排序，选出数值较大的前t个图内节点作为图内邻居节点v_s，s＝1,2,...,t，聚合新节点与图内邻居节点的向量，得到待检测的安卓应用程序的节点嵌入：S53: Use the top-k algorithm pair

Sort, select the first t nodes in the graph with larger values as the neighbor nodes v _s in the graph, s=1,2,...,t, aggregate the vectors of the new node and the neighbor nodes in the graph, and obtain the to-be-detected Node Embedding for Android Apps:

表示v_s在元路径Mk上的权重，

表示新节点与图内邻居节点v_s之间元结构的数量。in,

Indicates the weight of v _s on the meta-path Mk,

Indicates the number of metastructures between the new node and its neighbor nodes vs _s in the graph.

Preferably, the predicted value of the logistic regression model output is:

表示待检测的安卓应用程序的节点嵌入；Among them, b represents the offset parameter, w represents the weight,

a node embedding representing the Android application to be detected;

When the predicted value a output by the logistic regression model is greater than 0.5, the detection result is malicious; otherwise, the detection result is benign.

An Android malware detection device based on a heterogeneous graph attention network, used to implement the described Android malware detection method based on a heterogeneous graph attention network, comprising:

The feature engineering module is used to label the APP, decompile the APK, and extract key feature entities;

Graph building blocks for constructing heterogeneous graph attention networks in the form of points and edges based on relationships between Android apps and key feature entities; also for transforming heterogeneous graph attention networks into multiple metastructures, and Calculate the adjacency matrix of each meta-structure;

The node aggregation module is used to obtain the node embedding of the Android application, and obtain the low-dimensional vector embedding of the node according to the adjacency matrix of the meta structure;

The detection module is used to learn and classify through the low-dimensional vector embedding and label of the node, and detect according to the node embedding of the Android application to be detected, and output the detection result that the Android application to be detected is malicious or benign.

Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

The present invention provides a method and device for detecting an Android malicious program based on a heterogeneous graph attention network. First, multiple key feature entities are obtained by decompiling and extracting the APK, and a heterogeneous program is constructed according to the relationship between the Android application program and the key feature entity. Construct the attention network and convert the heterogeneous graph attention network into multiple meta-structures, then obtain the low-dimensional vector embedding of the existing nodes from the adjacency matrix of the meta-structure, and use the low-dimensional vector embedding and label to train the logistic regression model, Finally, the node embedding of the Android application to be detected is obtained and input into the trained logistic regression model for detection, and the detection result that the Android application to be detected is malicious or benign is obtained.

Description of drawings

Fig. 1 is a flowchart of implementation steps of the technical solution of the present invention;

Fig. 2 is a schematic structural diagram of a heterogeneous graph attention network in the present invention;

Fig. 3 is a structural schematic diagram of the meta path in the present invention;

Fig. 4 is a schematic structural diagram of a metagraph in the present invention.

Detailed ways

The accompanying drawings are for illustrative purposes only and cannot be construed as limiting the patent;

In order to better illustrate this embodiment, some parts in the drawings will be omitted, enlarged or reduced, and do not represent the size of the actual product;

For those skilled in the art, it is understandable that some well-known structures and descriptions thereof may be omitted in the drawings.

The technical solutions of the present invention will be further described below in conjunction with the accompanying drawings and embodiments.

Example 1

As shown in Figure 1, a method for detecting Android malware based on a heterogeneous graph attention network includes the following steps:

S1: Download the Android application APP and label it to obtain a set of Android applications; wherein, the Android application includes a benign Android application and a malicious Android application;

S2: Decompile the installation package APK of the Android application program, and extract various key feature entities from the decompiled file;

S3: Construct a heterogeneous graph attention network based on the relationship between Android applications and key feature entities, transform the heterogeneous graph attention network into multiple meta-structures, and calculate the adjacency matrix of each meta-structure;

S4: Obtain the low-dimensional vector embedding of existing nodes according to the adjacency matrix of the meta structure;

S5: Use the low-dimensional vector embedding and label of the existing nodes to train the logistic regression model, obtain the trained logistic regression model, and obtain the node embedding of the Android application to be detected;

S6: Embed the nodes of the Android application to be detected into the trained logistic regression model for detection, and obtain a detection result indicating whether the Android application to be detected is malicious or benign.

In the specific implementation process, firstly, a variety of key feature entities are extracted by decompiling the APK, and a heterogeneous graph attention network is constructed according to the relationship between the Android application program and the key feature entities, and the heterogeneous graph attention network is transformed into Multiple meta-structures, and then obtain the low-dimensional vector embedding of existing nodes from the adjacency matrix of the meta-structure, use the low-dimensional vector embedding and label to train the logistic regression model, and finally obtain the node embedding of the Android application to be tested and input the trained The logistic regression model is used for detection, and the detection result of whether the Android application program to be detected is malicious or benign is obtained.

Example 2

A kind of Android malware detection method based on heterogeneous graph attention network, comprises the following steps:

S1: Download the Android application APP and label it to obtain a set of Android applications; where the Android application includes a benign Android application and a malicious Android application, the label of a benign Android application is 0, and the label of a malicious Android application is 1 ; Benign apps are downloaded from Google Play Store, malicious apps are downloaded from virusshare.com;

S2: Use the decompilation tool apktool to decompile the installation package APK of the Android application, and extract various key feature entities from the decompiled file;

S3: Construct a heterogeneous graph attention network based on the relationship between Android applications and key feature entities, transform the heterogeneous graph attention network into multiple meta-structures, and calculate the adjacency matrix of each meta-structure;

S4: Obtain the low-dimensional vector embedding of existing nodes according to the adjacency matrix of the meta structure;

S5: Use the low-dimensional vector embedding and label of the existing nodes to train the logistic regression model, obtain the trained logistic regression model, and obtain the node embedding of the Android application to be detected;

S6: Embed the nodes of the Android application to be detected into the trained logistic regression model for detection, and obtain a detection result indicating whether the Android application to be detected is malicious or benign.

More specifically, the key feature entities include API, authority, authority type, class, interface and so file.

As shown in Figure 2-4, A in the figure represents API, application programming interface; P represents permissions, specifying the operations performed by applications; T represents permission types; C represents classes, which abstract common attributes and behaviors into relatively complex data Type; I means interface, which is an abstract data structure used to define a specification; S means so file, and the .so file is the dynamic link library of Android; where A, C, and I come from decompiled smali files, and P , T comes from the decompiled AndroidManifest.xml file, and S comes from the decompiled lib file.

More specifically, the relationship matrix _Rlin in the graph is formed according to the relationship between Android applications and key feature entities, l∈[1,6]; where R1 _in represents the relationship between App and API, and R2 _in represents the relationship between App and The relationship between permissions, R3 _in indicates the type of permission to which the App belongs, R4 _in indicates the relationship between the App and the class, R5 _in indicates the relationship between the App and the interface, and R6 _in indicates the relationship between the App and the so file.

In the specific implementation process, for R1 _in , use a _ij ∈ (0,1) to indicate whether App _i contains API _j , if yes, then a _ij = 1, otherwise, a _ij = 0; for R2 _in , use P _ij ∈(0,1) indicates whether App _i contains authority j, if yes, then P _ij =1, otherwise, P _ij =0; for R3 _in , use T _ij ∈(0,1) to indicate whether authority i belongs to type j , if yes, then T _ij =1, otherwise, T _ij =0; for R4 _in , use C _ij ∈ (0,1) to indicate whether App _i contains class j, if yes, then C _ij =1, otherwise, C _ij = 0; for R5 _in , use I _ij ∈ (0,1) to indicate whether App _i contains interface j, if yes, then I _ij = 1, otherwise, I _ij = 0; for R6 _in , use S _ij ∈ ( 0,1) indicates whether App _i contains .so file j, if yes, then S _ij =1, otherwise, S _ij =0.

More specifically, the heterogeneous graph attention network is a graph G=(V, E, A, R), the types of its nodes include APP, API, authority, authority type, class, interface and so file, and the type of edge Including R1 _in , R2 _in , R3 _in , R4 _in , R5 _in and R6 _in ; among them, V represents the set of nodes, E represents the set of edges, A represents the type set of nodes, R represents the type set of edges, |A| +|R|>2.

More specifically, the meta-structure is a meta-path or a meta-graph. The meta-path is a path defined on a heterogeneous graph attention network. The source object and the target object are located at both ends of the path. If the source object and the target object There are multiple meta-paths between them to form a meta-graph.

More specifically, the adjacency matrix set {Ψ ^M1 ,...,Ψ ^Mk ,...,Ψ ^MK } is composed of K adjacency matrices of meta-structure, and the adjacency matrix of meta-structure is the adjacency matrix of meta-path or meta-graph adjacency matrix,

Among them, the calculation formula of the adjacency matrix of the meta-path is:

Ψ ^MP ＝R _A1A2 ·...·R _AiA(i+1) ·...·R _A(n-1)An

The formula for calculating the adjacency matrix of the meta graph is:

Ψ ^MG = Ψ ^MP1 ⊙...⊙Ψ ^MPj ⊙...⊙Ψ ^MPm ;

Among them, Ψ ^Mk represents the adjacency matrix of the k-th element structure, R _AiA(i+1) represents the relationship matrix between the i-th node and the i+1-th node, i=1,2,...,n , n represents the number of meta-path nodes, Ψ ^MPj represents the jth Ψ ^MP , ⊙ represents the Hadamard product, and m represents the number of Ψ ^MP .

More specifically, step S4 includes the following steps:

S41: Encode each node in the form of a one-hot vector to obtain a matrix H, combine H with the adjacency matrix of a given metastructure Mk, and obtain the adjacency matrix of the internal nodes of the metastructure through a normalization operation:

Ψ ^Mk' ＝Normalize(H·H ^T ⊙Ψ ^Mk )

And introduce the GAT model of edge weight perception to update the meta-structure Mk internal node embedding Φ ^Mk = GAT(H; Ψ ^Mk' );

S42: Using a multi-layer perceptron to learn the weight β ^Mk of each meta-structure Mk in the fusion,

(β ^M1 ,...,β ^Mk ,...,β ^MK )＝softmax(NN(Φ ^M1 ),...,NN(Φ ^Mk ),...,NN(Φ ^MK ))

Among them, NN is a native neural network that maps a given matrix to a numerical value,

To obtain the low-dimensional vector embedding of existing nodes:

More specifically, in step S5, the node embedding of the Android application to be detected is obtained through the following steps:

S51: Form an out-of-graph relationship matrix Rl _out according to the relationship between the Android application to be detected and the key feature entity, l∈[1,6];

形式为j行列矩阵，j表示图内节点的个数，矩阵的第j行数值

代表新节点与图内节点v_j之间元结构的数量；S52: Form an incremental segment of the node adjacency matrix

The form is a matrix of j rows and columns, j represents the number of nodes in the graph, and the value of the jth row of the matrix

Represents the number of metastructures between the new node and the node v _j in the graph;

进行排序，选出数值较大的前t个图内节点作为图内邻居节点v_s，s＝1,2,...,t，聚合新节点与图内邻居节点的向量，得到待检测的安卓应用程序的节点嵌入：S53: Use the top-k algorithm pair

Sort, select the first t nodes in the graph with larger values as the neighbor nodes v _s in the graph, s=1,2,...,t, aggregate the vectors of the new node and the neighbor nodes in the graph, and obtain the to-be-detected Node Embedding for Android Apps:

表示v_s在元路径Mk上的权重，

表示新节点与图内邻居节点v_s之间元结构的数量。in,

Indicates the weight of v _s on the meta-path Mk,

Indicates the number of metastructures between the new node and its neighbor nodes vs _s in the graph.

More specifically, the predicted value output by the logistic regression model is:

表示待检测的安卓应用程序的节点嵌入；Among them, b represents the offset parameter, w represents the weight,

a node embedding representing the Android application to be detected;

When the predicted value a output by the logistic regression model is greater than 0.5, the detection result is malicious; otherwise, the detection result is benign.

Example 3

An Android malware detection device based on a heterogeneous graph attention network, used to implement the described Android malware detection method based on a heterogeneous graph attention network, comprising:

The feature engineering module is used to label the APP, decompile the APK, and extract key feature entities;

Graph building blocks for constructing heterogeneous graph attention networks in the form of points and edges based on relationships between Android apps and key feature entities; also for transforming heterogeneous graph attention networks into multiple metastructures, and Calculate the adjacency matrix of each meta-structure;

The node aggregation module is used to obtain the node embedding of the Android application, and obtain the low-dimensional vector embedding of the node according to the adjacency matrix of the meta structure;

The detection module is used to learn and classify through the low-dimensional vector embedding and label of the node, and detect according to the node embedding of the Android application to be detected, and output the detection result that the Android application to be detected is malicious or benign.

Apparently, the above-mentioned embodiments of the present invention are only examples for clearly illustrating the present invention, rather than limiting the implementation of the present invention. For those of ordinary skill in the art, other changes or changes in different forms can be made on the basis of the above description. It is not necessary and impossible to exhaustively list all the implementation manners here. All modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (10)

1. the Android malicious program detection method based on heterogeneous graph attention network, it is characterized in that, comprises the following steps: S1: Download the Android application APP and label it to obtain a set of Android applications; wherein, the Android application includes a benign Android application and a malicious Android application; S2: Decompile the installation package APK of the Android application program, and extract various key feature entities from the decompiled file; S3: Construct a heterogeneous graph attention network based on the relationship between Android applications and key feature entities, transform the heterogeneous graph attention network into multiple meta-structures, and calculate the adjacency matrix of each meta-structure; S4: Obtain the low-dimensional vector embedding of existing nodes according to the adjacency matrix of the meta structure; S5: Use the low-dimensional vector embedding and label of the existing nodes to train the logistic regression model, obtain the trained logistic regression model, and obtain the node embedding of the Android application to be detected; S6: Embed the nodes of the Android application to be detected into the trained logistic regression model for detection, and obtain a detection result indicating whether the Android application to be detected is malicious or benign. 2. the Android malicious program detection method based on heterogeneous graph attention network according to claim 1, is characterized in that, described key feature entity comprises API, authority, authority type, class, interface and so file. 3. the Android malicious program detection method based on heterogeneous graph attention network according to claim 2, it is characterized in that, according to the relationship between Android application program and key characteristic entity, form relation matrix Rlin _{in the} graph, l∈[ 1,6]; among them, R1 _in represents the relationship between App and API, R2 _in represents the relationship between App and authority, R3 _in represents the type of authority to which App belongs, R4 _in represents the relationship between App and class, R5 in _in indicates the relationship between App and interface, and R6 _in indicates the relationship between App and so file. 4. the Android malicious program detection method based on heterogeneous graph attention network according to claim 3, is characterized in that, described heterogeneous graph attention network is graph G=(V, E, A, R), its The type of node includes APP, API, permission, permission type, class, interface and so file, and the type of edge includes R1 _in , R2 _in , R3 _in , R4 _in , R5 _in and R6 _in ; where, V represents a collection of nodes, E represents the set of edges, A represents the type set of nodes, R represents the type set of edges, |A|+|R|>2. 5. the Android malicious program detection method based on heterogeneous graph attention network according to claim 1, is characterized in that, described metastructure is metapath or metagraph, and described metapath is in heterogeneous graph attention network The path defined above, the source object and the target object are located at the two ends of the path, if there are multiple meta-paths between the source object and the target object, a meta-graph is formed. 6. the Android malicious program detection method based on heterogeneous graph attention network according to claim 5, is characterized in that, The adjacency matrix set {Ψ ^M1 , ..., Ψ ^Mk , ..., Ψ ^MK } is composed of K element-structured adjacency matrices, The adjacency matrix of the meta-structure is the adjacency matrix of the meta-path or the adjacency matrix of the meta-graph, Among them, the calculation formula of the adjacency matrix of the meta-path is: Ψ ^MP ＝R _A1A2 ·...·R _AiA(i+1) ·...·R _A(n-1)An The formula for calculating the adjacency matrix of the meta graph is: Ψ ^MG = Ψ ^MP1 ⊙...⊙Ψ ^MPj ⊙...⊙Ψ ^MPm ; Among them, Ψ ^Mk represents the adjacency matrix of the k-th element structure, R _AiA(i+1) represents the relationship matrix between the i-th node and the i+1-th node, i=1, 2,..., n , n represents the number of meta-path nodes, Ψ ^MPj represents the jth Ψ ^MP , ⊙ represents the Hadamard product, and m represents the number of Ψ ^MP . 7. the Android malicious program detection method based on heterogeneous graph attention network according to claim 6, is characterized in that, step S4 comprises the following steps: S41: Encode each node in the form of a one-hot vector to obtain a matrix H, combine H with the adjacency matrix of a given metastructure Mk, and obtain the adjacency matrix of the internal nodes of the metastructure through a normalization operation: Ψ ^Mk' ＝Normalize(H·H ^T ⊙Ψ ^Mk ) And introduce the GAT model of edge weight perception to update the meta-structure Mk internal node embedding Φ ^Mk = GAT(H; Ψ ^Mk' ); S42: Using a multi-layer perceptron to learn the weight β ^Mk of each meta-structure Mk in the fusion, (β ^M1 ,...,β ^Mk ,...,β ^MK )=softmax(NN(Φ ^M1 ),...,NN(Φ ^Mk ),...,NN(Φ ^MK )) Among them, NN is a native neural network that maps a given matrix to a numerical value, To obtain the low-dimensional vector embedding of existing nodes:

8. the Android malicious program detection method based on heterogeneous graph attention network according to claim 7, is characterized in that, in step S5, obtains the node embedding of the Android application program to be detected by the following steps: S51: Form an out-of-graph relationship matrix Rl _out according to the relationship between the Android application to be detected and the key feature entity, l∈[1,6]; S52: Form an incremental segment of the node adjacency matrix

S53: Use the top-k algorithm pair

put in order,

Indicates the number of metastructures between the new node and the node v _j in the graph, select the first t nodes in the graph with a larger value as the neighbor node v _s in the graph, s=1,2,...,t, aggregate new The vector of the node and the neighbor nodes in the graph, and the node embedding of the Android application to be detected is obtained:

in,

Indicates the weight of v _s on the meta-path Mk,

Indicates the number of metastructures between the new node and the neighbor node b _s in the graph. 9. the Android malicious program detection method based on heterogeneous graph attention network according to claim 1, is characterized in that, the predictive value of logistic regression model output is:

Among them, b represents the offset parameter, w represents the weight,

a node embedding representing the Android application to be detected; When the predicted value a output by the logistic regression model is greater than 0.5, the detection result is malicious; otherwise, the detection result is benign. 10. the Android malicious program detection device based on heterogeneous graph attention network according to claim 1, is characterized in that, comprises: The feature engineering module is used to label the APP, decompile the APK, and extract key feature entities; Graph building blocks for constructing heterogeneous graph attention networks in the form of points and edges based on relationships between Android apps and key feature entities; also for transforming heterogeneous graph attention networks into multiple metastructures, and Calculate the adjacency matrix of each meta-structure; The node aggregation module is used to obtain the node embedding of the Android application, and obtain the low-dimensional vector embedding of the node according to the adjacency matrix of the meta structure; The detection module is used to learn and classify through the low-dimensional vector embedding and label of the node, and detect according to the node embedding of the Android application to be detected, and output the detection result that the Android application to be detected is malicious or benign.

Images