# A Lightweight Multi-Source Fast Android Malware Detection Model
## 3 A Lightweight Multi-Source Fast Android Malware Detection Model
### Adaptive Shrinkage Convolution Unit  
For many Android malware applications, malicious code fragments are mixed into a large number of normal code fragments. As a result, many noises unrelated to malicious code fragments appear in the extracted features. The features need to be noise-reduced to improve the feature learning ability to address this problem. The classical wavelet threshold noise reduction method consists of three main steps: wavelet decomposition, soft thresholding, and wavelet reconstruction; in this noise reduction method, it is a challenging problem to construct a suitable filter operator to set a reasonable soft threshold. An adaptive shrinkage convolution unit is proposed in this paper to solve this problem, its specific structure is shown in Figure 8.  
Figure 6: Statistics of permissions and intent used by benign software samples versus malware samples. Figure 7: Convolutional network structure and feature dimension. The convolutional layer is used to compute the output feature mapping by convolving the feature mapping of the previous layer with a set of filters. These filters are the only parameters of the convolutional layer and are usually learned in training by a backpropagation algorithm. This model makes two main improvements on the traditional convolutional layer, which uses convolutional kernels (filters) learned in training and kept constant in testing. In contrast, our model uses convolutional kernels that change during testing as the input varies. This is achieved by learning the kernel functions that map the inputs to the convolutional kernels through an attention mechanism. Meanwhile, the key of feature learning method is not only to extract the target information related to the labels, but it is also important to eliminate irrelevant information, so it is important to introduce soft thresholding inside the deep neural network to adaptively eliminate redundant information during the feature learning process and improve the learning of useful features. More importantly, each sample should have a different threshold value. This is because a sample set often contains many samples, and the amount of noise contained in these samples is often different. In deep learning algorithms, the size of the threshold cannot be interpreted because these features have no clear physical meaning, but the reasoning is similar, each sample should have a different threshold, so this model also uses the attention mechanism to learn to map the input to the threshold of the soft-threshold activation function. The model representation for each convolutional layer is enhanced by superimposing convolutional kernels nonlinearly according to attention by the dynamic convolution [36; 37] method. Let the traditional static convolution be represented as \(y=g(W^{T}(x)x+b)\), where \(W\) and \(b\) are the weight matrix and bias vector, and \(g\) is an activation function, and define the dynamic convolution by aggregating multiple (\(K\)) linear functions \(\tilde{W}_{k}^{T}x+\tilde{b}_{k}\) as in Equations (3)-(5):  
\[y=g(\tilde{W}^{T}(x)x+\tilde{b}(x)) \tag{3}\]  
\[\tilde{W}(x)=\sum_{k=1}^{K}\pi_{k}(x)\tilde{W}_{k} \tag{4}\]  
\[\tilde{b}(x)=\sum_{k=1}^{K}\pi_{k}(x)\tilde{b}_{k} \tag{5}\]  
where \(\pi_{k}\) is the attention weight of the \(k\)th linear equation \(\tilde{W}_{k}^{T}x+\tilde{b}_{k}\), \(\pi_{k}(x)\in[0,1]\) and \(\sum_{k=1}^{K}\pi_{k}(x)=1\), the weight \(\tilde{W}(x)\) and the bias \(\tilde{b}(x)\) are functions of the inputs and share the same attention. The attention weights \(\pi_{k}(x)\) are not fixed but vary for each input \(x\), and they represent the best aggregation of a linear model \(\tilde{W}_{k}^{T}+\tilde{b}_{k}\) for a given input. Figure 8: Adaptive shrinkage convolution unit structure. The aggregated model \(\tilde{W}^{T}(x)x+\tilde{b}(x)\) is nonlinear. Therefore, it is possible to change the convolution kernel weights adaptively according to the input \(x\) to make it more expressive compared to static convolution.