Application anomaly detection method and apparatus, and electronic device

Abstract

The present application relates to an application anomaly detection method and apparatus, and an electronic device. The method comprises: constructing a data flow diagram and a first program flow diagram on the basis of a selected source data set, and preprocessing the first program flow diagram to obtain a second program flow diagram; performing static call analysis and dynamic call analysis on the data flow diagram and the second program flow diagram, respectively, and determining a program point set to be monitored, an application program corresponding to said program point set, and a plurality of sample call sequences when the application program is correctly run; generating a hidden Markov model (HMM) on the basis of the plurality of sample call sequences, the first program flow diagram and the second program flow diagram, and monitoring the application program by means of the HMM; and when it is detected that the application program is run, acquiring a call sequence during this instance of running the application program, inputting the call sequence into the HMM to obtain a transition probability of the call sequence, and when the transition probability is greater than the current threshold value of the HMM, outputting a result indicating that the application program is abnormal. The method can accurately detect application anomaly data.

Description

Application anomaly detection method, device and electronic equipment

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the Intellectual Property Office of the People's Republic of China on October 19, 2023, with application number 202311361833.6 and invention name "A method, device and electronic device for application anomaly detection", the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of data security technology, and in particular to an application anomaly detection method, device, and electronic device. Background Art

[0004] Conventional application anomaly detection methods all have shortcomings. Static analysis methods cannot predict control paths that leak sensitive data, and dynamic path tracing methods incur expensive overhead during system execution. While preventative measures such as code vulnerability monitoring and code storage encryption taken during the development process reduce the risk of attack, they make it difficult to track data leaks in real time. Among optimization solutions using machine learning, behavioral baseline analysis relies on techniques such as tracking to collect user data. This method has low accuracy and interpretability. Models built solely using data-based learning methods have a very high probability of false positives when the application is complex and the model training trajectory is not long enough. These limitations prevent enterprises from accurately identifying abnormal data flows and potential leakage risks at the application level.

[0005] Summary of the Invention

[0006] The present application provides an application anomaly detection method, device, and electronic device for accurately identifying abnormal data flows and potential leakage risks at the application level.

[0007] In a first aspect, the present application provides an application anomaly detection method, the method comprising:

[0008] Constructing a data flow graph and a first program flow graph according to the selected source data set, and obtaining a second program flow graph by preprocessing the first program flow graph;

[0009] Performing static call analysis and dynamic call analysis on the data flow graph and the second program flow graph respectively to determine a program point set to be monitored, an application corresponding to the program point set to be monitored, and multiple sample call sequences of the application when it is running correctly;

[0010] Based on the multiple sample call sequences, the first program flow graph and the second program flow graph generate a hidden Markov model HMM, and monitor the application through the HMM;

[0011] When the application is monitored, the call sequence of the application during this operation is obtained, and the call sequence is input into the HMM to obtain the transition probability of the call sequence. When the transition probability is greater than the current threshold of the HMM, the result of the application abnormality is output.

[0012] In one possible design, constructing a data flow graph and a first program flow graph based on a selected source data set, and preprocessing the first program flow graph to obtain a second program flow graph includes: constructing a data flow graph and a first program flow graph based on a selected source data set, wherein the data flow graph and the first program flow graph contain source nodes and focus nodes, the source nodes are source data, and the focus nodes are data written to the memory by the source nodes; filtering out directed loop edges and edges without cascade relationships between the source nodes and the focus nodes from the first program flow graph, and pruning loop edges with a preset number of hops in the directed loop edges and the edges without cascade relationships to obtain a pruned program flow graph; and injecting a monitoring program at a preset position in the pruned program flow graph to obtain the second program flow graph.

[0013] In one possible design, the data flow graph and the second program flow graph are respectively subjected to static call analysis and dynamic call analysis to determine the program point set to be monitored, the application corresponding to the program point set to be monitored, and multiple sample call sequences when the application is running correctly, including: performing static call analysis on the data flow graph and the second program flow graph to determine the program point set to be monitored and the application corresponding to the program point set to be monitored; performing dynamic call analysis on the second program flow graph through the monitoring program in the second program flow graph to collect multiple sample call sequences when the application is running correctly.

[0014] In one possible design, the generation of the hidden Markov model HMM based on the multiple sample call sequences, the first program flow chart and the second program flow chart includes: constructing a call transfer initial matrix corresponding to each sample call sequence based on the multiple sample call sequences and the second program flow chart; performing preset processing on each call transfer initial matrix to obtain multiple call transfer vectors, performing dimensionality reduction processing on the multiple call transfer vectors to obtain initialization parameters of the HMM; constructing a first call transfer matrix based on the multiple call transfer vectors, and clustering the first call transfer matrix to obtain clustering results; generating the hidden Markov model HMM according to the initialization parameters, the clustering results and the program trajectory of the first program flow chart.

[0015] In one possible design, the preset processing of each call transfer initial matrix to obtain multiple call transfer vectors includes: adjusting the elements in each call transfer initial matrix to obtain each adjusted second call transfer matrix, wherein the second call transfer matrix satisfies a preset condition, and the preset condition is: the sum of all elements in each column of the second call transfer matrix is ​​equal to a set value, and the sum of the incoming probability of each transfer in the second call transfer matrix is ​​the sum of the outgoing probability of each transfer; converting each second call transfer matrix into a corresponding call transfer vector to obtain multiple call transfer vectors, wherein the call transfer vector is composed of the column probability and row probability of the corresponding second call transfer matrix.

[0016] In one possible design, the monitoring program includes a node monitoring function for monitoring each node call process in the second program flow chart, and the node monitoring function includes an attention coefficient, which is the sensitivity level of data associated with each node call process.

[0017] In a second aspect, the present application provides an application anomaly detection device, the device comprising:

[0018] a processing module, constructing a data flow graph and a first program flow graph according to the selected source data set, and obtaining a second program flow graph by preprocessing the first program flow graph;

[0019] an analysis module for performing static call analysis and dynamic call analysis on the data flow graph and the second program flow graph, respectively, to determine a program point set to be monitored, an application corresponding to the program point set to be monitored, and a plurality of sample call sequences of the application when the application is running correctly;

[0020] A generating module, which generates a hidden Markov model HMM based on the multiple sample call sequences, the first program flow graph and the second program flow graph, and monitors the application through the HMM;

[0021] The monitoring module, when monitoring the application running, obtains the call sequence of the application during this running, inputs the call sequence into the HMM to obtain the transition probability of the call sequence, and outputs the result of the application abnormality when the transition probability is greater than the current threshold of the HMM.

[0022] In one possible design, the processing module is specifically used to: construct a data flow graph and a first program flow graph based on a selected source data set, wherein the data flow graph and the first program flow graph contain source nodes and focus nodes, the source nodes are source data, and the focus nodes are data written into the memory by the source nodes; filter out directed loop edges and edges without cascade relationships between the source nodes and the focus nodes from the first program flow graph, prune the loop edges with a preset number of hops and the edges without cascade relationships in the directed loop edges, and obtain a pruned program flow graph; inject the monitoring program at a preset position in the pruned program flow graph to obtain the second program flow graph.

[0023] In one possible design, the analysis module is specifically used to: perform static call analysis on the data flow graph and the second program flow graph to determine the set of program points to be monitored and the application corresponding to the set of program points to be monitored; perform dynamic call analysis on the second program flow graph through the monitoring program in the second program flow graph to collect multiple sample call sequences when the application is running correctly.

[0024] In one possible design, the generation module is specifically used to: construct a call transfer initial matrix corresponding to each sample call sequence based on the multiple sample call sequences and the second program flow graph; perform preset processing on each call transfer initial matrix to obtain multiple call transfer vectors, perform dimensionality reduction processing on the multiple call transfer vectors to obtain initialization parameters of the HMM; construct a first call transfer matrix based on the multiple call transfer vectors, and perform clustering processing on the first call transfer matrix to obtain clustering results; generate the hidden Markov model HMM according to the initialization parameters, the clustering results and the program trajectory of the first program flow graph.

[0025] In one possible design, the generation module is further used to: adjust the elements in each call transfer initial matrix to obtain each adjusted second call transfer matrix, wherein the second call transfer matrix satisfies a preset condition, and the preset condition is: the sum of all elements in each column of the second call transfer matrix is ​​equal to a set value, and the sum of the incoming probability of each transfer in the second call transfer matrix is ​​the sum of the outgoing probability of each transfer; convert each second call transfer matrix into a corresponding call transfer vector to obtain multiple call transfer vectors, wherein the call transfer vector is composed of the column probability and row probability of the corresponding second call transfer matrix.

[0026] In one possible design, the monitoring program includes a node monitoring function for monitoring each node call process in the second program flow chart, and the node monitoring function includes an attention coefficient, which is the sensitivity level of data associated with each node call process.

[0027] In a third aspect, the present application provides an electronic device, comprising:

[0028] Memory for storing computer programs;

[0029] The processor is configured to implement the above-mentioned steps of the application anomaly detection method when executing the computer program stored in the memory.

[0030] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned application anomaly detection method are implemented.

[0031] For each of the above-mentioned aspects from the second to the fourth aspects and the technical effects that may be achieved by each of the aspects, please refer to the above-mentioned description of the technical effects that can be achieved by the first aspect or various possible solutions in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] FIG1 is a flow chart of an application anomaly detection method provided by the present application;

[0033] FIG2 is a schematic diagram of a possible program flow provided by this application;

[0034] FIG3 is a schematic diagram of an application anomaly detection device provided by the present application;

[0035] FIG4 is a schematic diagram of the structure of an electronic device provided by the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of this application more clear, the application will be further described in detail below with reference to the accompanying drawings. The specific operation methods in the method embodiments can also be applied to the device embodiments or system embodiments.

[0037] In the description of this application, "multiple" is understood to mean "at least two." "And / or" describes the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. A and B are connected, which can mean: A and B are directly connected, and A and B are connected through C. In addition, in the description of this application, words such as "first" and "second" are used only for the purpose of distinguishing descriptions and should not be understood as indicating or implying relative importance or order.

[0038] To help those skilled in the art better understand the technical solutions provided by the embodiments of the present application, the following is a brief description of the professional terms involved:

[0039] A Hidden Markov Model (HMM) is a statistical model used to describe a Markov process with hidden unknown parameters. A Markov chain is a random process that transitions from one state to another in state space. It can determine the transition probability between any two states in the system.

[0040] Hooks are programs that execute step-by-step according to the event flow. Hooks can intercept and monitor the transmission of events before they reach their destination. They can "integrate" their own code into the process of the hooked program, becoming part of the target process and handling its own specific events.

[0041] Principal Component Analysis (PCA) is a commonly used data analysis method. PCA transforms raw data into a set of linearly independent representations through linear transformation. It can be used to extract the main characteristic components of the data and is often used for dimensionality reduction of high-dimensional data.

[0042] The k-means clustering algorithm (k-clustering) is an iterative clustering analysis algorithm that divides the data into K groups. K objects are randomly selected as initial cluster centers. The distance between each object and each seed cluster center is calculated, and each object is assigned to the cluster center closest to it. The cluster centers and the objects assigned to them represent a cluster.

[0043] The present application is described in further detail below with reference to the accompanying drawings.

[0044] 1 is a flow chart of a method provided in an embodiment of the present application. The specific implementation process of the method is as follows:

[0045] Step 101: constructing a data flow graph and a first program flow graph according to a selected source data set, and obtaining a second program flow graph by preprocessing the first program flow graph;

[0046] Specifically, extract the data connection function and define a source data set. The data in the source data set can be selected according to the needs. It can be sensitive data, source data, etc. that need to be monitored. The source data set can be a source list. Take each source data in the source data set as the source node, pass it down along the source node to build the original data flow graph, and mark all direct commands to access data from the database. Take the various data written to the memory by the source node as the focus node. The data of the focus node can be local variables, member variables, global variables, and operand stacks. Generate a list of focus points based on all focus nodes. Decompose the data type of the focus node. The data type with other types nested is defined as the parent type, and the data type without other types nested is defined as the subtype. Modify the original data flow graph, remove all subtype focus nodes, and construct the data flow graph.

[0047] Obtain application functions associated with all nodes and edges in a data flow graph, and construct a first program flow graph based on the application functions. Analyze the call relationships within the application functions, construct a directed graph based on the call relationships, and store the directed graph using an adjacency matrix. In the program flow graph, all external library methods are used as pointers to skip the application's method calls to the external library and directly point to the program's method function instructions, thereby directly skipping the external library function instructions within the program.

[0048] For each edge in the first program flow graph, the in-and-out degrees are calculated. Directed loop edges are found in the adjacency matrix. Loop edges with a preset number of hops are pruned, for example, the last hop of a directed loop is pruned. The fully permuted sets of the source list and the focus list are used as the head and tail, respectively. Edges without cascade relationships between source nodes and focus nodes are filtered out and pruned. Loops and recursive logic are ignored to obtain the pruned program flow graph.

[0049] Inject a monitoring program at a preset position in the pruned program flow graph to obtain a second program flow graph. Specifically, the monitoring program can be a hook program hook, and the preset position can be a position before the first instruction of the program. In the pruned program flow graph, the initialization code of init() of the monitoring instance is injected before the first instruction of the program, and the input application is modified to obtain a second program flow graph. The second program flow graph contains a monitoring program, and the monitoring program includes a node monitoring function MonitorNode(v, γ). MonitorNode(v, γ) will track and record the program call stack and entry and exit parameters. v is the input injection point id, and γ is the attention coefficient. The attention coefficient defines the sensitivity level of the data associated with each node call process.

[0050] Step 102: Perform static call analysis and dynamic call analysis on the data flow graph and the second program flow graph respectively to determine a program point set to be monitored, an application corresponding to the program point set to be monitored, and multiple sample call sequences of the application when it is running correctly;

[0051] In the implementation of this application, static call analysis is performed on the constructed data flow graph and the second program flow graph to determine the set of program points to be monitored and the application corresponding to the set of program points to be monitored. Using the monitoring program in the second program flow graph, dynamic call analysis is performed on the second program flow graph to collect multiple sample call sequences when the application is running correctly. It is worth noting that the determined set of program points to be monitored is the minimum set of program points that need to be monitored.

[0052] By performing static call analysis on the processed data flow graph and the second program flow graph, the efficiency of static call analysis can be improved, and the minimum set of program points requiring monitoring can be determined. Dynamic call analysis is then performed by injecting monitoring program hooks into the minimum set of program points identified by static call analysis. This allows only data paths that could potentially leak sensitive data to be monitored at runtime, addressing the issues of static analysis methods being unable to predict control paths for sensitive data and dynamic path tracking methods consuming significant resources on the execution device.

[0053] Step 103: Generate a Hidden Markov Model (HMM) based on the multiple sample call sequences, the first program flow graph, and the second program flow graph, and monitor the application program through the HMM.

[0054] In the embodiment of the present application, Hidden Markov Model (HMM) training is performed based on the static call analysis results and the dynamic call analysis results.

[0055] Specifically, based on multiple sample call sequences and the second program flow graph, the call transition initial matrix corresponding to each sample call sequence is constructed. Considering a source node with an in-degree of 0 and a terminal node with an out-degree of 0 each time, the transition probability of each call pair in the second program flow graph is calculated. For example, as shown in Figure 2, (N i , N j ) call pair has a set L = {A, B, C} three directed edges (common in conditional statements). i , N j ) of L, the call pairs (N i , N j )'s three transition probabilities P A (N i │N j ), P B (N i │N j ), P C (N i │N j ). And adjust γ in MonitorNode(v,γ) according to the transfer path. For example, if the transfer path is A, adjust γ=P A (N i │N j )*γ, if the transfer path is B, then adjust γ=P B (N i │N j )*γ, if the transfer path is C, then adjust γ=P C (N i │N j )*γ. p , N k ) calls to aggregate nodes with one directed edge, transforming the node-edge-node structure into a single-edge structure.

[0056] Based on a sample calling sequence and the second program flow graph, a calling transfer initial matrix can be constructed, and based on multiple sample calling sequences, multiple calling transfer initial matrices can be constructed.

[0057] Each call transfer initial matrix is ​​preset to obtain multiple call transfer vectors. Specifically, the elements in each call transfer initial matrix are adjusted to obtain each adjusted second call transfer matrix. Each call transfer matrix satisfies the following conditions:

[0058] (1) The sum of all elements in each column is equal to the set value, for example, the sum of all elements is equal to 1;

[0059] (2) For each transition in the call transition matrix, the sum of the incoming probabilities is equal to the sum of the outgoing probabilities.

[0060] Flatten the second call transition matrix to create a call transition vector, which is a vector consisting of column probabilities and row probabilities. For a call transition matrix of dimension n, each call transition vector has a size of 2n. Convert each second call transition matrix into its corresponding call transition vector, resulting in multiple call transition vectors.

[0061] A first call transition matrix is ​​constructed based on the multiple call transition vectors, i.e., a new call transition matrix is ​​constructed, in which each row of the matrix represents a call transition and contains the corresponding call transition vector. PCA is used to reduce the dimensionality of the call transition vectors in the first call transition matrix to obtain initialization parameters for training the HMM. Using the initialization parameters after dimensionality reduction can reduce HMM training time and improve training efficiency.

[0062] The first call transfer matrix is ​​clustered. The clustering process can use the k-clustering algorithm to obtain the clustering result. According to the initialization parameters, the clustering result trains the initial HMM model. The initial threshold of the initial HMM model is preset to C. The initial threshold C will be dynamically adjusted with the training. The adjustment formula is: Among them, C t is the current threshold, C t-1 The previous threshold, γ i For node N i The initial HMM model is then further trained using the program trace of the unpruned first program flow graph to obtain the final hidden Markov model (HMM). The resulting hidden Markov model (HMM) can handle dynamic program behaviors such as loops and recursions that cannot be learned statically.

[0063] Step 104: When the application is monitored, the call sequence of the application during this operation is obtained, and the call sequence is input into the HMM to obtain the transition probability of the call sequence. When the transition probability is greater than the current threshold of the HMM, the result of the application abnormality is output.

[0064] In the implementation of this application, a trained hidden Markov model HMM is used to dynamically monitor the application. The monitoring behavior can be implemented through an anomaly detection engine. When the application is monitored, dynamic call analysis is performed through a dynamic call analyzer to obtain the call sequence of the application during this runtime. The call sequence is input into the hidden Markov model HMM to obtain the transition probability of the call sequence, and the transition probability is compared with the current threshold of the HMM. If the transition probability is greater than the current threshold, it indicates that there is an anomaly in the application, and the result of the application anomaly is output.

[0065] It is worth noting that the embodiments of the present application have the following beneficial effects:

[0066] By using a static analysis method based on data sources to obtain program focus points, and implanting hook programs in the program focus function instructions for dynamic tracking, only the data paths that may leak sensitive data are monitored at runtime, solving the problems that static analysis methods cannot predict control paths that leak sensitive data and dynamic path tracking methods consume a lot of resources during system execution.

[0067] By using program flow pruning and aggregation on the first program flow graph, the minimum set of program points to be monitored is determined, and the task focus on loops and recursive logic in the static call analysis phase is deferred to the HMM secondary training. This greatly improves the efficiency of the static analysis engine while ensuring that all sensitive program paths can be monitored. It also solves the problem of low prediction accuracy due to insufficient model training sequences when the program is complex.

[0068] The attention coefficient is introduced. In the process call of MonitorNode(v, γ), the attention coefficient γ defines the sensitivity level of the sensitive data associated with the call and can be continuously optimized. γ can segment the data according to the sensitivity level to achieve control over data flow analysis.

[0069] By obtaining sample call data when the program is running correctly, a call transfer matrix is ​​constructed and used as the initial value for HMM model training. This initial value can reduce the computational and communication overhead caused by the large scale of model parameters in the HMM model, while improving the model training efficiency and ensuring the model training direction, and preventing model training failure caused by random seeds.

[0070] This approach uses a dynamic update method tied to data sensitivity to update the model's detection threshold, maintaining effective detection of application anomalies. This solves the problem of previous methods requiring cross-validation to determine hyperparameters, improving the model's practicality and application value, and further enhancing its accuracy and robustness.

[0071] Based on the same inventive concept, the present application also provides an application anomaly detection device for accurately identifying abnormal data flows and potential leakage risks at the application level, thereby resolving the problems of existing static analysis methods being unable to predict control paths that leak sensitive data and dynamic path tracking methods consuming a large amount of resources during system execution. Referring to FIG3 , the device comprises:

[0072] Processing module 301 constructs a data flow graph and a first program flow graph according to the selected source data set, and pre-processes the first program flow graph to obtain a second program flow graph;

[0073] An analysis module 302 performs static call analysis and dynamic call analysis on the data flow graph and the second program flow graph, respectively, to determine a program point set to be monitored, an application corresponding to the program point set to be monitored, and multiple sample call sequences of the application when it is running correctly;

[0074] A generating module 303 generates a hidden Markov model HMM based on the multiple sample call sequences, the first program flow graph and the second program flow graph, and monitors the application through the HMM;

[0075] The monitoring module 304, when monitoring the application running, obtains the call sequence of the application during this running, inputs the call sequence into the HMM to obtain the transition probability of the call sequence, and outputs the result of the application abnormality when the transition probability is greater than the current threshold of the HMM.

[0076] In one possible design, the processing module 301 is specifically used to: construct a data flow graph and a first program flow graph based on a selected source data set, wherein the data flow graph and the first program flow graph contain source nodes and focus nodes, the source nodes are source data, and the focus nodes are data written into the memory by the source nodes; filter out directed loop edges and edges without cascade relationships between the source nodes and the focus nodes from the first program flow graph, prune the loop edges with a preset number of hops and the edges without cascade relationships in the directed loop edges, and obtain a pruned program flow graph; inject the monitoring program at a preset position in the pruned program flow graph to obtain the second program flow graph.

[0077] In one possible design, the analysis module 302 is specifically used to: perform static call analysis on the data flow graph and the second program flow graph to determine the set of program points to be monitored and the application corresponding to the set of program points to be monitored; perform dynamic call analysis on the second program flow graph through the monitoring program in the second program flow graph to collect multiple sample call sequences when the application is running correctly.

[0078] In one possible design, the generation module 303 is specifically used to: construct a call transfer initial matrix corresponding to each sample call sequence based on the multiple sample call sequences and the second program flow graph; perform preset processing on each call transfer initial matrix to obtain multiple call transfer vectors, perform dimensionality reduction processing on the multiple call transfer vectors to obtain initialization parameters of the HMM; construct a first call transfer matrix based on the multiple call transfer vectors, and perform clustering processing on the first call transfer matrix to obtain clustering results; generate the hidden Markov model HMM according to the initialization parameters, the clustering results and the program trajectory of the first program flow graph.

[0079] In one possible design, the generation module 303 is further used to: adjust the elements in each call transfer initial matrix to obtain each adjusted second call transfer matrix, wherein the second call transfer matrix satisfies a preset condition, and the preset condition is: the sum of all elements in each column of the second call transfer matrix is ​​equal to a set value, and the sum of the incoming probability of each transfer in the second call transfer matrix is ​​the sum of the outgoing probability of each transfer; convert each second call transfer matrix into a corresponding call transfer vector to obtain multiple call transfer vectors, wherein the call transfer vector is composed of the column probability and row probability of the corresponding second call transfer matrix.

[0080] In one possible design, the monitoring program includes a node monitoring function for monitoring each node call process in the second program flow chart, and the node monitoring function includes an attention coefficient, which is the sensitivity level of data associated with each node call process.

[0081] Based on the same inventive concept, an embodiment of the present application further provides an electronic device that can implement the functions of the aforementioned device for detecting anomalies in an application. Referring to FIG. 4 , the electronic device includes:

[0082] At least one processor 401 and a memory 402 connected to the at least one processor 401. The specific connection medium between the processor 401 and the memory 402 is not limited in the embodiments of the present application. FIG4 shows an example of a connection between the processor 401 and the memory 402 via a bus 400. The bus 400 is represented by a bold line in FIG4 , and the connection between other components is merely for illustrative purposes and is not intended to be limiting. The bus 400 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, FIG4 shows only a single bold line, but this does not indicate that there is only one bus or only one type of bus. Alternatively, the processor 401 may also be referred to as a controller, without limitation to the name.

[0083] In the embodiment of the present application, memory 402 stores instructions executable by at least one processor 401. At least one processor 401 can execute the application anomaly detection method discussed above by executing the instructions stored in memory 402. Processor 401 can implement the functions of each module in the device shown in Figure 3.

[0084] Among them, the processor 401 is the control center of the device / system, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory 402 and calling data stored in the memory 402, the various functions of the device and processing data.

[0085] In one possible design, processor 401 may include one or more processing units. Processor 401 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 401. In some embodiments, processor 401 and memory 402 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0086] The processor 401 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the application anomaly detection method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0087] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 402 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 402 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0088] By designing and programming processor 401, the code corresponding to the application anomaly detection method described in the aforementioned embodiment can be embedded in the chip, so that the chip can execute the steps of the application anomaly detection method of the embodiment shown in FIG1 during operation. How to design and program processor 401 is well known to those skilled in the art and will not be described in detail here.

[0089] Based on the same inventive concept, an embodiment of the present application further provides a storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer executes the application anomaly detection method discussed above.

[0090] In some possible implementations, various aspects of the application anomaly detection method provided in the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on the device, the program code is used to enable the control device to execute the steps of the application anomaly detection method according to various exemplary embodiments of the present application described above in this specification.

[0091] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0092] The present application is described with reference to the flow chart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each flow process and / or box in the flow chart and / or block diagram and the combination of the flow process and / or box in the flow chart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processing machine or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one flow chart flow or multiple flows and / or one box or multiple boxes of the block diagram.

[0093] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0094] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0095] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for detecting anomalies in an application, characterized in that: The method comprises: Constructing a data flow graph and a first program flow graph according to the selected source data set, and obtaining a second program flow graph after preprocessing the first program flow graph; Performing static call analysis and dynamic call analysis on the data flow graph and the second program flow graph respectively to determine a program point set to be monitored, an application corresponding to the program point set to be monitored, and a plurality of sample call sequences when the application is running correctly; Based on the multiple sample call sequences, the first program flow graph and the second program flow graph generate a hidden Markov model HMM, and monitor the application through the HMM; When the application is monitored to be running, the call sequence of the application during this running is obtained, and the call sequence is input into the HMM to obtain the transition probability of the call sequence. When the transition probability is greater than the current threshold of the HMM, the result of the application abnormality is output.

2. The method according to claim 1, characterized in that The step of constructing a data flow graph and a first program flow graph according to the selected source data set, and preprocessing the first program flow graph to obtain a second program flow graph comprises: Constructing a data flow graph and a first program flow graph according to the selected source data set, wherein the data flow graph and the first program flow graph contain source nodes and focus nodes, the source nodes are source data, and the focus nodes are data written into the memory by the source nodes; Screening out directed loop edges and edges without cascade relationship between the source node and the focus node from the first program flow graph, and pruning loop edges with a preset number of hops and the edges without cascade relationship in the directed loop edges to obtain a pruned program flow graph; A monitoring program is injected into a preset position in the pruned program flow graph to obtain the second program flow graph.

3. The method according to claim 1, characterized in that The performing of static call analysis and dynamic call analysis on the data flow graph and the second program flow graph respectively to determine a program point set to be monitored, an application corresponding to the program point set to be monitored, and a plurality of sample call sequences when the application is running correctly comprises: Performing static call analysis on the data flow graph and the second program flow graph to determine the program point set to be monitored and the application corresponding to the program point set to be monitored; The monitoring program in the second program flow graph is used to perform dynamic call analysis on the second program flow graph, and multiple sample call sequences when the application program is running correctly are collected.

4. The method according to claim 1, characterized in that The generating of the hidden Markov model HMM by the first program flow graph and the second program flow graph based on the multiple sample call sequences comprises: Based on the multiple sample call sequences and the second program flow graph, construct a call transfer initial matrix corresponding to each sample call sequence; Performing preset processing on each call transfer initial matrix to obtain a plurality of call transfer vectors, and performing dimension reduction processing on the plurality of call transfer vectors to obtain initialization parameters of the HMM; forming a first call transfer matrix based on the multiple call transfer vectors, and performing clustering processing on the first call transfer matrix to obtain a clustering result; The hidden Markov model HMM is generated according to the initialization parameters, the clustering results and the program trajectory of the first program flow graph.

5. The method according to claim 4, characterized in that The presetting of each call transfer initial matrix to obtain a plurality of call transfer vectors comprises: Adjusting the elements in each initial matrix of each call transfer to obtain each adjusted second call transfer matrix, wherein the second call transfer matrix satisfies a preset condition, wherein the preset condition is: the sum of all elements in each column of the second call transfer matrix is ​​equal to a set value, and the sum of the incoming probability of each transfer in the second call transfer matrix is ​​the sum of the outgoing probability of each transfer; Each of the second call transfer matrices is converted into a corresponding call transfer vector to obtain a plurality of call transfer vectors, wherein the call transfer vector is composed of a column probability and a row probability of the corresponding second call transfer matrix.

6. The method according to claim 1, characterized in that The monitoring program includes a node monitoring function for monitoring each node calling process in the second program flow chart, and the node monitoring function includes a concern coefficient, which is a sensitivity level of data associated with each node calling process.

7. An application anomaly detection device, characterized in that: The device comprises: A processing module, constructing a data flow graph and a first program flow graph according to a selected source data set, and obtaining a second program flow graph after preprocessing the first program flow graph; An analysis module performs static call analysis and dynamic call analysis on the data flow graph and the second program flow graph respectively to determine a program point set to be monitored, an application corresponding to the program point set to be monitored, and a plurality of sample call sequences when the application is running correctly; A generating module, generating a hidden Markov model HMM based on the plurality of sample call sequences, the first program flow graph and the second program flow graph, and monitoring the application through the HMM; The monitoring module, when monitoring the application running, obtains the call sequence of the application during this running, inputs the call sequence into the HMM to obtain the transition probability of the call sequence, and outputs the result of the application abnormality when the transition probability is greater than the current threshold of the HMM.

8. The device according to claim 7, characterized in that The processing module is specifically used for: Constructing a data flow graph and a first program flow graph according to the selected source data set, wherein the data flow graph and the first program flow graph contain source nodes and focus nodes, the source nodes are source data, and the focus nodes are data written into the memory by the source nodes; Screening out directed loop edges and edges without cascade relationship between the source node and the focus node from the first program flow graph, and pruning loop edges with a preset number of hops and the edges without cascade relationship in the directed loop edges to obtain a pruned program flow graph; The monitoring program is injected into a preset position in the pruned program flow graph to obtain the second program flow graph.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 6 when executing the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 6 are implemented.

Images