| With the widespread use of applications such as mobile payments,it has become increasingly important to detect and protect against malware in Android devices.Research into Android malware detection is not only crucial to protecting user privacy and security,but is also of great importance to maintaining the security of the entire social network.However,traditional static detection methods are inadequate in terms of adapting to different samples,as well as the time and computational resources often required to analyse and compare large numbers of samples.In response to the above problems,this paper proposes a multi-modal fusion detection method by analyzing the advantages of different static feature modalities,and the main research is as follows:(1)For the problem that the traditional static method of permission-based detection is poor and there are more similar features,this paper proposes a pre-detection method based on permission features based on the advantage of fast permission detection.The Gini coefficient was first used to measure the importance of the authority features and combined with the random forest algorithm for feature selection,reasonably retaining the most important feature information,and then improving the decision tree classification model based on the information gain value of the feature attributes,while defining the malicious marker value,and further improving the accuracy of the detection method through the comparison verification of this value.(2)To address the problem that current static detection methods are still inadequate in adapting to different samples,this paper proposes a multimodal decision-level fusion detection method based on multimodal decision-level fusion technology,which combines the advantages of API calls and opcodes,two eigenmodes that are more effective in malware detection.The API call-based detection method generates a call graph by extracting API call information.The improved graph embedding method is able to retain the maximum amount of original feature information and output the results in combination with deep learning methods.The opcode-based detection method extracts the opcode sequence,enhances and extracts key feature information using a convolutional neural network,connects to a long short-term memory network to classify the sequence features and outputs the results.The linear fusion method based on optimal weights is then used to optimise the linear fusion formulation used for the experiments,enabling the advantages of different modalities to complement each other to suit different sample situations.(3)To address the problem that static detection methods consume too much time resources in the case of a large number of samples,this paper proposes a method flow of pre-detection followed by multimodal decision fusion detection,through which the pre-detection method can quickly and effectively eliminate part of the malware,thus reducing the overall time overhead.In this paper,the feasibility of the multimodal fusion detection method is verified step by step through three experiments.The results of the single-modal detection experiments show that the detection effect is superior among the detection methods with similar features.The results of the multimodal fusion experiments,in which the weights of the linear fusion function are determined,show that the multimodal decision fusion method has a more obvious improvement in detection results than the single-modal method.Finally,the results of the comparison experiments demonstrate that the addition of pre-detection methods can improve the overall detection efficiency of the method to a certain extent. |
