Affiliations: [a] School of Information Science and Engineering, Xinjiang University, Urumqi, Xinjiang, China
| [b] Network Center, Xinjiang University, Urumqi, Xinjiang, China
| [c] School of Software, Xinjiang University, Urumqi, Xinjiang, China
Correspondence:
[*]
Corresponding author. Long Yu. Network Center, Xinjiang University, Urumqi, 830001, Xinjiang, China. E-mail: [email protected].
Abstract: Combining natural language processing technology, image analysis technology and malware detection technology, a novel Android malware detection method, named BIHAD (an improved IndRNN and attention-treated DenseNet-based pipeline model), is proposed in this paper. First, in order to describe the behavior of Android malware, multiple features are used to construct a more stable discriminant method. Second, the embedding technology is introduced to map all behavior information into a vector space, which implements the extraction of the joint embedded information of semantics and images. Third, an improved Independently Recurrent Neural Network (IndRNN) is used to extract valuable texture information from the original values of the gray image, and effectively utilized the long distance information contained in the gray image. Finally, Hierarchical Attention Dense Convolutional Network (HADenseNet) is used to ensure the maximization of information flow between layers in the network, improving the utilization of semantic distribution and spatial context information. Especially, Hierarchical Attention can enhance the representational ability for key features. The comparison of the BIHAD model with several existing malware detection methods indicated a significant improvement in F-score achieved by the BIHAD.