CN117034218A - Apk confusion mechanism detection method based on graph attention network and NLP word embedding model - Google Patents

Abstract

The application provides an apk confusion mechanism detection method based on a graph attention network and an NLP word embedding model, which obtains an initial ICFG by acquiring apk to be detected and performing static analysis; regularizing each jimple instruction of the apk to be detected, and obtaining a vector corresponding to each instruction; accumulating and averaging the vectors according to the corresponding dimension to obtain the vector of each basic block, and combining the ICFG structural information to obtain a final code attribute map; and obtaining the confusion type of the apk to be detected by training the confusion detection model completed by the basic block feature matrix and the adjacent matrix of the final code attribute diagram. According to the application, the word2vec model is used for converting the jimple code block into the vector, so that semantic information of the jimple code can be integrated to the greatest extent, and structural information of the jimple code block can be learned by combining the GAT model, thereby having higher accuracy.

Description

APK confusion mechanism detection method based on graph attention network and NLP word embedding model

Technical field

The invention belongs to the field of network security technology, and specifically relates to an APK confusion mechanism detection method based on graph attention network and NLP word embedding model.

Background technique

Due to the development of code obfuscation technology, more and more malware writers will use obfuscation technology to modify the malicious code of the software, making the code difficult to be discovered by automated malicious code detection tools, and the code still has malicious functions. Obfuscation technology is in The use of malicious code also makes it more difficult for technicians to reverse the malicious code software. Therefore, the detection of code obfuscation methods helps to quickly determine the obfuscation methods of malicious code, which facilitates the detection of software maliciousness and the reverse analysis of security reverse engineers.

An existing technical solution discloses a function-level confusion detection method based on a graph convolutional neural network (application number is 202011521368.4). This solution detects function-level confusion mechanisms. This solution is not highly adaptable to complex confusion mechanisms. . Moreover, when extracting features, this scheme selects statistical features in the decompilation instructions and lacks the extraction of code semantic information. Therefore, the recognition accuracy of this scheme is low.

Contents of the invention

In order to solve the above-mentioned problems existing in the prior art, the present invention provides an APK confusion mechanism detection method based on the graph attention network and the NLP word embedding model. The technical problems to be solved by the present invention are achieved through the following technical solutions:

The present invention provides an APK confusion mechanism detection method based on graph attention network and NLP word embedding model, including:

S100, obtain the apk to be detected, and perform process analysis on the apk to be detected to obtain the initial inter-process control flow graph ICFG of the apk to be detected; the initial ICFG includes: the call graph CG of the function and the Jimple code block within each function, each Jimple code A block consists of multiple instructions;

S200, perform corresponding regularization processing on each instruction of the apk to be detected, and convert the processed instructions into vectors;

S300: Accumulate and average the vectors corresponding to each instruction according to the corresponding dimensions to obtain the detection vector of each Simple code block, and introduce the detection vector into the initial ICFG to obtain the final code attribute map of the apk to be detected;

S400: Pass the basic block feature matrix and adjacency matrix of the final code attribute graph through the trained confusion detection model to perform information transfer, overall information extraction and loss processing to obtain the confusion category of the apk to be detected.

The present invention provides an apk confusion mechanism detection method based on graph attention network and NLP word embedding model. By obtaining the apk to be detected and statically analyzing the apk to be detected, the initial inter-process control flow graph ICFG of the apk to be detected is obtained. Each instruction of the apk to be detected is converted into a vector, and each vector is regularized to obtain the vector corresponding to each instruction; the vector corresponding to each instruction is accumulated and averaged according to the corresponding dimension to obtain each Jimple code block The detection vector is introduced into the initial ICFG to obtain the final code attribute graph of the apk to be detected; the basic block feature matrix and adjacency matrix of the final code attribute graph are passed through the trained confusion detection model for information transfer, overall information extraction and Loss processing obtains the obfuscation category of the apk to be detected. By obtaining the jimple code block of the apk and using the word2vec model to convert the jimple code block into a vector, the present invention can integrate the semantic information of the jimple code to the greatest extent and combine it with GAT to learn the structural information of the jimple code block. Compared with other neural networks The method has higher accuracy.

The present invention will be further described in detail below with reference to the accompanying drawings and examples.

Description of the drawings

Figure 1 is a schematic flow chart of the apk confusion mechanism detection method based on the graph attention network and NLP word embedding model provided by the present invention;

Figure 2 is a schematic diagram of an example of the apk confusion mechanism detection method based on the graph attention network and NLP word embedding model provided by the present invention;

Figure 3 is a schematic diagram of training a confusion detection model provided by the present invention.

Detailed ways

The present invention will be described in further detail below with reference to specific examples, but the implementation of the present invention is not limited thereto.

Combining Figures 1 and 2, the present invention provides an APK confusion mechanism detection method based on graph attention network and NLP word embedding model, including:

S100, obtain the apk to be detected, and perform static analysis on the apk to be detected to obtain the initial inter-process control flow graph ICFG of the apk to be detected; the initial ICFG includes: the call graph CG of the function and the Simple code block within each function, each Simple code A block consists of multiple instructions;

S200, perform corresponding regularization processing on each instruction of the apk to be detected, and convert the processed instructions into vectors;

S200 of the present invention includes:

S210, use the preset word2vec model to convert each instruction into a vector;

Since there are many NLP word embedding models, Word2vec of the present invention can be replaced by Glove, FastText, Doc2Vec and other models.

S220, perform regularization processing on each vector to remove custom variable names in the simple code block, and obtain the code text of the simple code block;

It is worth explaining that the jimple code block is the code obtained after using flowdroid to process the apk. word2vec is a natural language data processing model. This model is trained by inputting text. After the training is completed, a jimple code instruction is input and a corresponding vector is output.

After being processed by flowdroid, the present invention can obtain a call graph (Call Graph) of an apk and display the mutual calling relationship between functions. In this way, the present invention obtains a graph structure. After obtaining the graph structure, it is necessary to determine the vector of each node in the graph, that is, convert the code block corresponding to each method into a vector, and the dimensions of these vectors must be the same, otherwise There is no way to train.

This invention performs corresponding regularization processing on each vector to reduce code differences introduced by user-defined variables. The regularization method is to convert all the custom variable names into the same variable name. The purpose is to reduce the code differences introduced by user-defined variables. The custom variable names in the jimple code are removed, leaving only the corresponding ones. jimple code. Then the processed code text is put into the word2vec file for training, so that the present invention can obtain the vector corresponding to each jimple instruction.

S230, put the code text into the word2vec file for training, and obtain the vector corresponding to each instruction. The dimensions of all vectors are the same.

S300: Accumulate and average the vectors corresponding to each instruction according to the corresponding dimensions to obtain the detection vector of each Simple code block, and introduce the detection vector into the initial ICFG to obtain the final code attribute map of the apk to be detected;

S300 of the present invention includes:

S310: Accumulate and average the vectors corresponding to each instruction according to the corresponding dimensions to obtain an average vector;

S320: Determine the average vector as the vector of the jimple code block.

The method of converting into vectors in this invention is to use word2vec. The number of instructions in each code block is definitely different, so in order to unify, this invention uses word2vec to convert each instruction in each code block into a vector, and process it like this After completing the code block, the present invention obtains multiple vectors, and then uses the averaging method to convert these vectors into one vector. For example, suppose a method has two instructions. After processing, it is [[1, 2, 3], [5, 6, 7]], and then after averaging, it is ([1, 2, 3] + [5, 6, 7])/2 = [3, 4, 5], and then each code block is processed accordingly. After that, the vector dimensions of all functions of the present invention are unified, and then by combining these vectors with the call graph, a complete graph structure can be obtained. The call graph obtained before does not have the vector value of each node. The vector value needs to be calculated and combined with the call graph to obtain a complete graph structure, which can be used for neural network training or identification.

After the present invention obtains the vector of the corresponding jimple instruction, the vectors in each code block will be accumulated and averaged to obtain the vector of each code block.

S400: Pass the basic block feature matrix and adjacency matrix of the final code attribute graph through the trained confusion detection model to perform information transfer, overall information extraction and loss processing to obtain the confusion category of the apk to be detected.

S400 of the present invention includes:

S410, determine the basic block feature matrix and adjacency matrix of the final code attribute graph;

S420, transfer the basic block feature matrix and adjacency matrix through each layer of the trained confusion detection model, and perform dimensionality reduction, splicing, overall information extraction, and loss processing during the transfer process to obtain the confusion category of the apk to be detected.

S420 of the present invention includes:

S421, according to the attention-related score of each layer of the trained confusion detection model, transfer the basic block feature matrix and adjacency matrix through each layer of the trained confusion detection model, and perform dimensionality reduction during the transfer process. , splicing, overall information extraction, and loss processing to obtain the probability distribution of the confusion category of the apk to be detected;

S422: Determine the confusion category that is greater than the preset probability threshold as the confusion category of the apk to be detected.

The basic block feature matrix of the final code attribute graph is expressed as X∈R ^N×M , and the adjacency matrix is expressed as A∈R ^N×N . Among them, N represents the total number of nodes, and M represents the dimension of each node vector. The present invention uses a 5-layer GAT graph convolutional neural network, and its layer-by-layer propagation rules are as follows:

in, It represents the vector value of the i-th node when it is in the next layer. a _ij is the attention cross-correlation score, which represents the contribution of node j to node i. j is the other nodes adjacent to node i, and N represents the number of nodes adjacent to node i. where a _ij is calculated by:

Among them, W∈R ^M′×M is a trainable matrix. Its main function is to transform the vector of h _j and perform dimensionality reduction on the vector. ⊕ represents the splicing of vectors from two nodes, and LeakyReLU represents a nonlinear activation function.

Summing the embeddings of all nodes in a CFG is the embedding of the entire graph.

Use LSTM to process the embedding of the graph, further extract the overall information, and add Dropout. Dropout is a commonly used regularization method that effectively avoids probabilistic disconnection of some neurons during the forward transfer and weight update process. The overfitting problem occurs. The output of the LSTM layer is s∈R ^k , where k is the number of categories of confusion techniques to be tested:

s=Dropout(LSTM(g)) (7);

The output of LSTM is processed using the softmax layer, and the output of the softmax layer is y∈R ^k .

y=softmax(s) (8);

In the formula, y is the probability distribution of all classifications, and based on y, the classification result of the confusion technology used by the function is obtained.

Referring to Figure 2, the training process of the completed confusion detection model includes:

S010, obtain the obfuscated apk collection from the database;

Among them, the apk collection includes: ordinary confusion collection, rename confusion collection, encryption confusion collection, reflection confusion collection, code confusion collection and various mixed confusion collections.

Common obfuscation: As the name suggests, this category includes simple methods that do not have a real obfuscation effect on the apk, but these methods can fool some signature-based malware. Methods include: signing the apk file with a new signature, classes The bytecode contained in the .dex file is disassembled and reassembled to obtain different versions of the file, etc.

Renaming confusion: In software development, identifier names (variable names, function names, etc.) should be meaningful to provide good readability and maintainability of the code. However, such explicit names may reveal relevant functional information about the code. In addition, since the package name uniquely identifies an Android application, its modification is equivalent to installing a new application into the system. Therefore, the renaming technique replaces every identifier with an obscure and meaningless one. Although renaming methods and fields will not have any impact on the normal operation of the program, renaming class and package names is more complicated because AndroidManifest.xml must be updated accordingly for the software to run properly.

Encryption obfuscation: Some resources required by the APK file can be requested at runtime. These resources include local link libraries or some string type text resources. These files can be encrypted and decrypted at runtime. In this case, malware analysts need to first obtain the encrypted key to complete access to the resource file, but this obfuscation method will reduce the operating efficiency of the software.

Reflection confusion: Reflection is a feature of the Java language that allows a Java class to be modified and tested at runtime. This feature is usually used to call methods of a given object. The basic principle of this technology is to query the APK executable code for calls to APK file classes instead of calls to Android system file classes, and then check whether these calls can be made using reflective API calls, which can cover up mutual interactions in the APK. The calling relationship does not affect the normal operation of the code.

Code obfuscation: This type of obfuscation technology mainly affects the content in the classes.dex file. Specific methods include deleting useful information during debugging, adding meaningless arithmetic branches, and adding new methods to implement indirect calls.

Multi-method obfuscation: A mixture of two or more of the above obfuscation methods.

S020, perform static analysis on each apk in the apk collection, and obtain the inter-process control flow graph ICFG of each apk;

Among them, ICFG includes the call graph CG of the function and the Simple code block within each function. Each Simple code block includes multiple instructions.

This invention uses the flowdroid open source software that has been widely used. FlowDroid is a static taint analysis tool suitable for Android applications. It uses IFDS-based flow functions to improve sensitivity and simultaneously conducts analysis on the Android life cycle and callbacks. Complete modeling and generation of a special main method to ensure that no available information is lost. This tool has high analysis accuracy and reliability. The call graph and the jimple code of each function are obtained through the FlowDroid tool to realize the construction of the control flow graph.

S030, construct the graph data structure corresponding to the apk according to the ICFG of each apk;

This invention is based on the Simple code of each function, uses the word2vec model to convert it into a vector, and then combines the CG of the function to build the corresponding graph data structure.

S040, establish a GAT neural network model based on the graph data structure corresponding to each apk and the preset GAT neural network structure;

S050, use the GAT neural network model as a confusion detection model;

S060, train the confusion detection model to obtain the trained confusion detection model.

By obtaining the jimple code block of the apk and using the word2vec model, the present invention can integrate the semantic information of the jimple code to the greatest extent, and combines GAT to learn the structural information of the jimple code, which has higher accuracy than other neural network methods. The present invention directly uses flowdroid to obtain the jimple code of the AndroOBFS Dataset to obtain the data set of the neural network for training of the graph neural network. Compared with some confusion recognition technologies, the present invention omits the steps of confusing and labeling the open source code. Obtaining data collections is more convenient and faster.

In addition, the terms “first” and “second” are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the quantity of indicated technical features. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of these features. In the description of the present invention, "plurality" means two or more than two, unless otherwise explicitly and specifically limited.

Although the present application has been described herein in connection with various embodiments, in practicing the claimed application, those skilled in the art will understand and understand by reviewing the drawings, the disclosure, and the appended claims. Other variations of the disclosed embodiments are implemented. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude a plurality.

The above content is a further detailed description of the present invention in combination with specific preferred embodiments, and it cannot be concluded that the specific implementation of the present invention is limited to these descriptions. For those of ordinary skill in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, and all of them should be regarded as belonging to the protection scope of the present invention.

Claims (8)

1. An APK confusion mechanism detection method based on graph attention network and NLP word embedding model, which is characterized by: S100, obtain the apk to be detected, and perform static analysis on the apk to be detected to obtain the initial inter-process control flow graph ICFG of the apk to be detected; the initial ICFG includes: the call graph CG of the function and the Simple code block in each function , each Simple code block includes multiple instructions; S200, perform corresponding regularization processing on each instruction of the apk to be detected, and convert the processed instructions into vectors; S300: Accumulate and average the vectors corresponding to each instruction according to the corresponding dimensions to obtain the detection vector of each Simple code block, and introduce the detection vector into the initial ICFG to obtain the final code of the apk to be detected. property map; S400: Pass the basic block feature matrix and adjacency matrix of the final code attribute graph through the trained confusion detection model to perform information transfer, overall information extraction and loss processing to obtain the confusion category of the apk to be detected. 2. APK confusion mechanism detection method based on graph attention network and NLP word embedding model according to claim 1, characterized in that the training process of the confusion detection model completed by training includes: S010, obtain the obfuscated apk collection from the database; S020, perform static analysis on each apk in the apk set, and obtain the inter-process control flow graph ICFG of each apk; S030, construct the graph data structure corresponding to the apk according to the ICFG of each apk; S040, establish a GAT neural network model based on the graph data structure corresponding to each apk and the preset GAT neural network structure; S050, use the GAT neural network model as a confusion detection model; S060: Train the confusion detection model to obtain the trained confusion detection model. 3. The apk confusion mechanism detection method based on graph attention network and NLP word embedding model according to claim 2, characterized in that the apk set in S010 includes: ordinary confusion set, rename confusion set, encrypted confusion set, Reflection obfuscation set, code obfuscation set and obfuscation set mixed in various ways. 4. The apk confusion mechanism detection method based on graph attention network and NLP word embedding model according to claim 2, characterized in that the ICFG in S020 includes the call graph CG of the function and the Jimple code block within each function, Each Jimple code block consists of multiple instructions. 5. The apk confusion mechanism detection method based on graph attention network and NLP word embedding model according to claim 1, characterized in that S200 includes: S210, use the preset word2vec model to convert each instruction into a vector; S220, perform regularization processing on each vector to remove custom variable names in the simple code block, and obtain the code text of the simple code block; S230: Put the code text into the word2vec file for training, and obtain the vector corresponding to each instruction. The dimensions of all vectors are the same. 6. APK confusion mechanism detection method based on graph attention network and NLP word embedding model according to claim 1, characterized in that S300 includes: S310: Accumulate and average the vectors corresponding to each instruction according to the corresponding dimensions to obtain an average vector; S320: Determine the average vector as the vector of the jimple code block. 7. The apk confusion mechanism detection method based on graph attention network and NLP word embedding model according to claim 1, characterized in that S400 includes: S410, determine the basic block feature matrix and adjacency matrix of the final code attribute graph; S420, transfer the basic block feature matrix and adjacency matrix through each layer of the trained confusion detection model, and perform dimensionality reduction, splicing, overall information extraction, and loss processing during the transfer process to obtain the apk to be detected. category of confusion. 8. The apk confusion mechanism detection method based on graph attention network and NLP word embedding model according to claim 7, characterized in that, S420 includes: S421. According to the attention-related score of each layer, the basic block feature matrix and the adjacency matrix are transferred through each layer of the trained confusion detection model, and dimensionality reduction, splicing, and overall information extraction are performed during the transfer process. , loss processing is performed to obtain the probability distribution of the confusion category of the apk to be detected; S422: Determine the confusion category that is greater than the preset probability threshold as the confusion category of the apk to be detected.