基于异质信息网络的安卓虚拟化程序检测方法

考虑到安卓应用虚拟化技术的功能特性，精确检测安卓虚拟化程序是识别其隐藏安全风险的基础和必要前提。为此，提出了基于异质信息网络的安卓虚拟化程序检测方法，并实现了原型系统Aiplugin。根据安卓虚拟化程序的特点，提取四类静态程序特征，并将程序特征映射到异质信息网络上，以元路径的形式将不同程序关联起来。采用异质图注意力网络表征算法和OC-SVM算法，融合不同视图的程序语义信息，实现对安卓虚拟化程序的表征和分类。实验结果表明，相较于当前的代表性工具VAhunt, Aiplugin可有效检测包括平行空间等更多类型的安卓虚拟化程序。

Detection method of Android virtualization program based on heterogeneous information network

Considering the functional characteristics of Android application virtualization technology, accurate detection of Android virtualization programs is the basis and necessary prerequisite for identifying hidden security risks. Therefore, this paper proposed a method to detect Android virtualization programs based on heterogeneous information networks, and implemented the prototype system Aiplugin. According to the characteristics of Android virtualization programs, the system extracted four types of static program features and mapped program features to heterogeneous information networks. Aiplugin associated different programs in the form of meta paths. It used heterogeneous graph attention network representation algorithm and OC-SVM algorithm and integrated program semantic information from different views to realize the representation and classification of Android virtualization programs. The experimental results show that Aiplugin can detect more types of Android virtualization programs, including parallel space, compared with the current representative tool VAhunt.