The application provides a method and device for identifying a shell of an
Android application and a storage medium. The method comprises the following steps: obtaining a training
Android application, and obtaining a dex file after decompression; counting the number of occurrences of each string in the dex file, and calculating the frequency of character occurrence based on the number of occurrences of the string; obtaining the string with the highest difference in frequency of character occurrence as
feature data according to the frequency of character occurrence of the shell
Android application and the frequency of character occurrence of the unshell Android application; training a shell identification model through the
feature data; obtaining a to-be-identified Android application, obtaining a to-be-identified dex file after decompression, and identifying the to-be-identified dex file through the trained shell identification model, so as to obtain an identification result. The application provides a method for quickly determining whether an Android application is shelled, and uses a
machine learning model to identify the shell, thereby further improving the efficiency and accuracy of identification.