基于异构信息网络的Android恶意程序检测方法

殷丹丽; 凌捷

doi:10.12052/gdutxb.230021

欢迎来到能源电力期刊网！

English Version 期刊登录

您当前的位置：

首页 >

文章列表页 >

基于异构信息网络的Android恶意程序检测方法

计算机科学与技术 | 更新时间：2026-05-27

- 基于异构信息网络的Android恶意程序检测方法
- Android Malware Application Detection Method Based on Heterogeneous Information Network
- 广东工业大学学报 2024年41卷第2期页码：56-64
- 作者机构：
  
  广东工业大学计算机学院,广东,广州,510006
- 作者简介：
  
  殷丹丽(1997–)，女，硕士研究生，主要研究方向为网络信息安全，E-mail：1521506972@qq.com
  凌捷(1964–) ，男，教授，博士，主要研究方向为网络信息安全，E-mail：jling@gdut.edu.cn
- 基金信息：
  
  广东省重点领域研发计划项目(2019B010139002);广州市科技研发计划项目(202007010004)
- DOI：10.12052/gdutxb.230021
  中图分类号： TP309
- 纸质出版：2024
- 稿件说明：
移动端阅览
殷丹丽, 凌捷. 基于异构信息网络的Android恶意程序检测方法[J]. 广东工业大学学报, 2024, 41(2): 56-64.

Yin Dan-li, Ling Jie. Android Malware Application Detection Method Based on Heterogeneous Information Network[J]. 2024, 41(2): 56-64.
殷丹丽, 凌捷. 基于异构信息网络的Android恶意程序检测方法[J]. 广东工业大学学报, 2024, 41(2): 56-64. DOI： 10.12052/gdutxb.230021.

Yin Dan-li, Ling Jie. Android Malware Application Detection Method Based on Heterogeneous Information Network[J]. 2024, 41(2): 56-64. DOI： 10.12052/gdutxb.230021.

摘要

针对传统Android恶意程序检测方法无法解决的伪装及实时检测问题，提出了一种基于异构信息网络的Android恶意程序检测方法。将Android实体及关系建模为异构信息网络中的节点和边，设计了元结构注意力网络表示学习模型和增量学习模型。首先使用元结构注意力网络表示学习模型进行训练集节点嵌入，将节点嵌入及标签输入到深度神经网络中进行训练，再采用增量表示学习模型学习测试集节点嵌入，使用top-k算法寻找邻居节点进行聚合，将待检测节点输入到训练好的深度神经网络中进行检测。实验结果表明，该方法

$ {F}_{1} $

img text_id='M1' class='formula-img' style='display:none;' src='gdgydxxb-41-2-56_M1.jpg'>

值为97.5%，准确率为96.7%，平均检测时间3.7 ms。与现有方法相比，

$ {F}_{1} $

img text_id='M1' class='formula-img' style='display:none;' src='gdgydxxb-41-2-56_M1.jpg'>

值和准确率更高，平均检测时间更短，表明该方法能够有效应对Android恶意程序伪装，可以用于实时Android恶意程序检测。

Abstract

To address the problems of camouflage and real-time detection of the traditional Android malware detection methods

a new Android malware detection method based on heterogeneous information networks is proposed. By modeling the Android entities and

relationships nodes and edges

respectively

in a heterogeneous information network

two network representation learning models are designed

including the meta-structure attention network representation learning and the incremental learning models. First

the meta-structure attention network representation learning model is used for intra-sample node embedding

and the embedded nodes and labels are input to a deep neural network for training. Then

the incremental learning model is used for learning the extra-sample node embeddings. The top-k algorithm is used to aggregate neighboring nodes within the heterogeneous information network

and the embedded node to be detected is input to the trained deep neural network for detection. Experimental results show that the

value of the proposed method is 97.5%

the accuracy rate is 96.7%

and the average detection time is 3.7 ms

which are better than the existing methods

demonstrating the effectiveness of the proposed method for dealing with Android malware camouflage and for real-time Android malware detection.

关键词

Keywords

references

ZHANG G, LI Y, BAO X, et al . TSDroid: a novel android malware detection framework based on temporal spatial metrics in IoMT [J ] . ACM Transactions on Sensor Networks, 2023, 19(3): 1-23.

AMI A S, KAFLE K, MORAN K, et al . Systematic mutation-based evaluation of the soundness of security-focused android static analysis techniques [J ] . ACM Transactions on Privacy and Security, 2021, 24(3): 1-37.

HU C C, JENG T H, Chen Y M. Dynamic android malware analysis with de-identification of personal identifiable information[C]//2020 the 3rd International Conference on Computing and Big Data(ICCBD) . New York: Association for Computing Machinery, 2020: 30-36.

ZHENG J, OU Y Y. Malware classification method based on convolutional neural network and multi-feature fusion [J]. Application Research of Computers, 2022, 39(1): 240-244.

REN X X, ZHAO L R, WANG K, et al . Android malware detection based on heterogeneous information network with cross-layer features[C ] // 2022 19th International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP) . Piscataway: IEEE, 2022: 1-4.

LI B T, PI D. Network representation learning: a systematic literature review [J]. Neural Computing and Applications, 2020, 32(21): 16647-16679.

HUANG J H, WANG Z Y. A research on deep learning object detection algorithm based on feature fusion [J]. Journal of Guangdong University of Technology, 2021, 38(4): 52-58.

凌捷, 殷丹丽, 罗玉. 一种基于异构图注意力网络的安卓恶意程序检测方法和装置: CN202210983464.3[P]. 2022-8-14.

GROVER A, LESKOVEC J. node2vec: scalable feature learning for networks[C]//Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining(KDD) . New York: Association for Computing Machinery, 2016: 855-864.

ZHANG D, YIN J, ZHU X, et al . Metagraph2vec: complex semantic path augmented heterogeneous network embedding[C ] //Advances in Knowledge Discovery and Data Mining: 22nd Pacific-Asia Conference(PAKDD) . Berlin: Springer, 2018: 196-208.

ROMERO H J, LI C, WANG P, et al . ACE-GCN: a fast data-driven FPGA accelerator for GCN embedding [J ] . ACM Transactions on Reconfigurable Technology and Systems, 2021, 14(4): 1-23.

WANG X, JI H Y, SHI C, et al . Heterogeneous graph attention network[C ] //The 2019 World Wide Web Conference(WWW) . New York: Association for Computing Machinery, 2019: 2022-2032.

DAOUDI N, ALLIX K, BISSYANDÉ T F, et al . A deep dive inside drebin: an explorative analysis beyond android malware detection scores [J ] . ACM Transactions on Privacy and Security, 2022, 25(2): 1-28.

WANG S, PHILIP S Y. Heterogeneous graph matching networks: Application to unknown malware detection[C]//2019 IEEE International Conference on Big Data. California: IEEE Computer Society Press, 2019: 5401-5408.

XU K, LI Y, DENG R, et al . Droidevolver: self-evolving android malware detection system[C ] //2019 IEEE European Symposium on Security and Privacy. California: IEEE Computer Society Press, 2019: 47-62.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

SCA-YOLO: 基于可变形卷积与上下文感知注意力的实时目标检测

面向灾后救援的多无人机通感算一体化资源分配优化方法

基于AAGV-YOLOX模型的输电线路异物检测研究

储能变流器电能质量治理策略研究

基于高效时序建模的RGB-T跟踪