Malicious application detection method, device, equipment, storage medium and program

Abstract

The embodiment of the present invention provides a malicious application detection method, device, equipment, storage medium and program. The malicious application detection method includes: encoding multiple features of an application to obtain a first code for each feature; inputting the first code for each feature into a trained coding model to obtain a second code for the application; obtaining a detection result based on the second code of the application and the trained detection model, and the detection result is used to indicate whether the application is a malicious application; wherein the coding model is obtained by training a feature coding sample and a decoding model, and the decoding model is used to obtain a reconstructed feature coding sample based on an input intermediate code; the intermediate code is obtained by the coding model based on the feature coding sample. The above scheme can handle obfuscated malicious applications, reduce the false alarm rate and missed alarm rate in the detection process, and has high accuracy.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a malicious application detection method, device, equipment, storage medium and program. Background Art

[0002] With the rapid development of the Android platform, many third-party platforms can publish Android applications. Due to the irregular review procedures of third-party platforms for Android applications, a large number of malicious applications have emerged. According to statistics, an average of about 12,000 new malicious applications are added every day. Various types of malicious applications such as fee consumption, privacy theft, malicious deductions, rogue behavior, remote control, etc. pose a threat to users.

[0003] In the prior art, generally, an Android malicious application detection scheme based on a static analysis method or a dynamic analysis method is used. Among them, although the Android malicious application detection scheme based on the static analysis method is analyzed, most of them are based on the application programming interface (Application Programming Interface, API) call sequence, and the API call sequence is used to perform multiple transformations to extract the required features. The features are not comprehensive, and there are high false alarm rates and missed alarm rates; the Android malicious application detection scheme based on the dynamic analysis method is generally a malicious application homology analysis, and there are high false alarm rates and missed alarm rates for the detection of whether it is a malicious application. Therefore, how to improve the accuracy of malicious application detection is a technical problem that technicians in this field need to solve urgently. Summary of the invention

[0004] In view of the problems in the prior art, embodiments of the present invention provide a malicious application detection method, apparatus, device, storage medium and program.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a malicious application detection method, comprising:

[0007] Encoding multiple features of the application to obtain a first code for each of the features;

[0008] Inputting the first encoding of each of the features into a trained encoding model to obtain a second encoding of the application;

[0009] Acquire a detection result according to the second encoding of the application and the trained detection model, wherein the detection result is used to indicate whether the application is a malicious application;

[0010] The encoding model is obtained by training the feature encoding samples and the decoding model, and the decoding model is used to obtain the reconstructed feature encoding samples based on the input intermediate encoding; the intermediate encoding is obtained by the encoding model based on the feature encoding samples.

[0011] Furthermore, the method further comprises:

[0012] Establish an initial coding model;

[0013] Training the initial coding model based on the feature coding samples to obtain intermediate coding;

[0014] Based on the intermediate coding and the decoding model, the model parameters of the initial coding model are optimized until a convergence condition is met, thereby obtaining the trained coding model.

[0015] Furthermore, the optimizing the model parameters of the initial coding model based on the intermediate coding and the decoding model until a convergence condition is met to obtain the trained coding model includes:

[0016] Inputting the intermediate code into the decoding model to obtain the reconstructed feature code sample;

[0017] Based on the similarity between the reconstructed feature coding sample and the feature coding sample, the model parameters of the initial coding model are optimized until a convergence condition is met, thereby obtaining the trained coding model.

[0018] Furthermore, the method further comprises:

[0019] Build an initial machine learning model;

[0020] The machine learning model is trained using training data to obtain the detection model; the training data includes: coding samples of the application and labels indicating whether the application is malicious.

[0021] Furthermore, the multiple features include: features of a first type and features of a second type, and the multiple features of the application are encoded to obtain a first encoding of each of the features, including:

[0022] Encoding the first type of features based on a first encoding method to obtain a first code of the first type of features;

[0023] Based on the second encoding method, the second type of features are encoded to obtain a first encoding of the second type of features.

[0024] Further, the first type of features includes at least one of the following: an application programming interface API call feature, a reflection API call feature, and a text message sending feature;

[0025] The encoding of the first type of features based on the first encoding method includes:

[0026] Encoding the API call feature and / or the reflection API call feature according to the number of API calls;

[0027] The SMS sending feature is encoded according to the number of times the SMS is sent.

[0028] Further, the second type of features includes at least one of the following: dangerous permission features, display component features, component communication features, and service component features;

[0029] The second encoding method is one-hot encoding, and encoding the second type of features based on the second encoding method includes:

[0030] The features of the second type are encoded based on the one-hot encoding.

[0031] Furthermore, before encoding the multiple features of the application, the method further includes:

[0032] Get the installation package APK file of the application;

[0033] According to the APK file of the application, multiple features of the application are obtained.

[0034] Furthermore, the feature is a feature that does not change before and after code obfuscation in the application; the application is an application that has been code obfuscated.

[0035] In a second aspect, an embodiment of the present invention further provides a malicious application detection device, including:

[0036] A preprocessing module, used for encoding multiple features of the application program to obtain a first code of each of the features;

[0037] A processing module, used for inputting the first encoding of each of the features into a trained encoding model to obtain a second encoding of the application;

[0038] The processing module is further used to obtain a detection result according to the second encoding of the application and the trained detection model, wherein the detection result is used to indicate whether the application is a malicious application;

[0039] The encoding model is obtained by training the feature encoding samples and the decoding model, and the decoding model is used to obtain the reconstructed feature encoding samples based on the input intermediate encoding; the intermediate encoding is obtained by the encoding model based on the feature encoding samples.

[0040] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the malicious application detection method described in the first aspect are implemented.

[0041] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the malicious application detection method described in the first aspect.

[0042] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the malicious application detection method described in the first aspect.

[0043] The malicious application detection method, apparatus, device, storage medium and program provided in the embodiments of the present invention encode multiple features of an application to obtain a first code for each feature; the first code for each feature is input into a trained coding model to obtain a second code for the application; the coding model is used to enable the output second code to reflect the correlation between the features, and then the detection result is obtained based on the second code of the application and the trained detection model. The detection result is used to indicate whether the application is a malicious application. The detection result output by the trained detection model is more accurate, which improves the accuracy of malicious application detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 An application scenario diagram of an embodiment of the malicious application detection method provided by the present invention;

[0046] Figure 2 A schematic diagram of a flow chart of an embodiment of a malicious application detection method provided by the present invention;

[0047] Figure 3A schematic diagram of a flow chart of another embodiment of the malicious application detection method provided by the present invention;

[0048] Figure 4 A schematic diagram of a flow chart of another embodiment of the malicious application detection method provided by the present invention;

[0049] Figure 5 It is a structural schematic diagram of an embodiment of a malicious application detection device provided by the present invention;

[0050] Figure 6 It is a structural schematic diagram of an embodiment of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] The method of the embodiment of the present invention can be applied to malicious application detection scenarios. Figure 1 The application scenario diagram provided by an embodiment of the present invention, optionally, as Figure 1 As shown, the application scenario includes an electronic device 11 and a server 12;

[0053] The electronic device 11 and the server 12 may be connected via a network, such as a 4G, 5G or Wireless Fidelity (WIFI) communication network.

[0054] The method provided by the present invention can be implemented by an electronic device 11 such as a processor executing a corresponding software code, or it can be implemented by the electronic device 11 executing the corresponding software code while interacting with the server 12, such as the server executing some operations to control the electronic device to execute the malicious application detection method.

[0055] The malicious application detection method of the embodiment of the present invention encodes multiple features of an application to obtain a first code for each feature; inputs the first code for each feature into a trained coding model to obtain a second code for the application; the coding model enables the output second code to reflect the correlation between the various features, and then obtains a detection result based on the second code of the application and the trained detection model. The detection result is used to indicate whether the application is a malicious application. The detection result output by the trained detection model is more accurate, which improves the accuracy of malicious application detection.

[0056] The following embodiments are all described with electronic devices as the execution subject. Figure 2-Figure 4 The technical solution of the present invention is described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0057] Figure 2 FIG. 1 is a flow chart of an embodiment of a malicious application detection method provided by the present invention. Figure 2 As shown, the method provided by the embodiment of the present invention includes:

[0058] Step 101: Encode multiple features of an application program to obtain a first code for each feature.

[0059] Optionally, the feature is a feature that does not change before and after code obfuscation in the application; the application is an application that has been code obfuscated.

[0060] Optionally, multiple features can be divided into two categories:

[0061] (1) Whether the feature exists, if so, it is coded as 1, otherwise it is coded as 0.

[0062] (2) The number of features present, which is encoded as the number S.

[0063] Optionally, multiple characteristics of the application are first obtained before encoding.

[0064] For each feature, selection is made based on the difference in feature usage between malicious applications and normal applications. At the same time, in order to deal with the situation where obfuscated code exists, features that do not change before and after obfuscation should be selected so that the model can detect obfuscated applications.

[0065] Optionally, the feature may include at least one of the following: an application programming interface API call feature, a reflection API call feature, a dangerous permission feature, a display (Activity) component feature, a component communication (Intent) feature, a service (Service) component feature, and a text message sending feature.

[0066] Among them, dangerous permission characteristics refer to permissions that can read or change data or resources of user privacy information, posing a threat to user information security;

[0067] API call features, which represent interfaces that help programs implement certain system functions;

[0068] Service component characteristics indicate the behavioral characteristics of stealing user data and controlling host communications by taking advantage of the service's ability to work for a long time and operate remotely.

[0069] Intent feature represents a messaging object that can potentially be used by malicious behavior to launch Android components.

[0070] The SMS sending feature is a dynamic feature, indicating that malicious applications send paid SMS messages to maliciously charge fees or steal user privacy.

[0071] Step 102: input the first code of each feature into the trained coding model to obtain the second code of the application;

[0072] Among them, the encoding model is trained by feature encoding samples and decoding models. The decoding model is used to obtain reconstructed feature encoding samples based on the input intermediate code; the intermediate code is obtained by the encoding model based on the feature encoding samples.

[0073] Specifically, in step 101, separate encoding is performed according to different features, and there may be a lack of correlation between the features. The encoding effect is easily affected by the deviation of individual or a few features, resulting in abnormal encoding results and even affecting the final malicious application detection. Therefore, in this step, the first encodings of multiple features are respectively input into the trained encoding model to obtain the second encoding corresponding to the application.

[0074] The coding model is obtained by training the feature coding samples and the decoding model. The feature coding samples (i.e., the first coding samples) are input into the coding model to obtain the intermediate coding. The intermediate coding is input into the decoding model to obtain the reconstructed feature coding samples. The feature coding samples and the reconstructed feature coding samples are compared. The model parameters of the coding model and the decoding model are optimized based on the comparison results. The iteration is repeated until the convergence conditions are met to obtain the trained coding model.

[0075] The first encoding of each feature is input into the trained encoding model to obtain the second encoding of the application.

[0076] Step 103: Obtain a detection result according to the second encoding of the application and the trained detection model, where the detection result is used to indicate whether the application is a malicious application.

[0077] Specifically, the input parameter of the detection model is the second code of the application, and the output parameter is the detection result, that is, whether the application is a malicious application.

[0078] The detection model can be obtained by training an initial machine learning model based on training data, and the training data includes: coding samples of the application and labels of whether it is a malicious application.

[0079] Optionally, the machine learning model includes a random forest model, a decision tree model, a support vector machine (SVM) model, or a convolutional neural network model.

[0080] The method of this embodiment encodes multiple features of an application to obtain a first code for each feature; inputs the first code for each feature into a trained coding model to obtain a second code for the application; the coding model enables the output second code to reflect the correlation between the features, and then obtains a detection result based on the second code of the application and the trained detection model. The detection result is used to indicate whether the application is a malicious application. The detection result output by the trained detection model is more accurate, which improves the accuracy of malicious application detection.

[0081] In one embodiment, the plurality of features include: a first type of feature and a second type of feature, and step 101 may be specifically implemented in the following manner:

[0082] Based on the first encoding method, encode the first type of features to obtain a first code of the first type of features;

[0083] Based on the second encoding method, the second type of feature is encoded to obtain a first encoding of the second type of feature.

[0084] Specifically, the first type of feature may be a feature with a large difference in the number of features, such as a text message sending feature, which may be characterized by the number of times the text messages are sent.

[0085] The first type of feature is encoded using a first encoding method, for example, the number of features is used as the first code of the feature.

[0086] The second type of features, such as dangerous permission features, are permissions that can read or change data or resources of user privacy information, posing a threat to user information security.

[0087] The second type of feature is encoded using a second encoding method, for example, encoding is performed based on whether the feature exists. Optionally, if the feature exists, 1 is used as the first encoding of the feature, and if the feature does not exist, 0 is used as the first encoding of the feature.

[0088] In the above implementation, different encoding methods are used for different types of features, so that the encoding result can more accurately represent the features, thereby improving the accuracy of malicious application detection.

[0089] In one embodiment, the first type of feature includes at least one of the following: an application programming interface API call feature, a reflection API call feature, and a text message sending feature;

[0090] In view of the above-mentioned first type of features, the first encoding method is specifically implemented in the following manner:

[0091] Encoding the API call features and / or the reflected API call features according to the number of API calls;

[0092] The SMS sending frequency characteristics are encoded according to the number of times the SMS is sent.

[0093] Specifically, the API call feature represents an interface that helps applications implement certain system functions, such as multiple APIs for obtaining location information, sending text messages, making calls, taking photos, and connecting to the network; reflection refers to the ability of an application to access, detect, and modify its own state or behavior, and to adjust or modify the state and related semantics of the behavior described by the application based on the state and results of its own behavior.

[0094] The above two characteristics can be characterized by the number of API calls. The greater the number of API calls in an application, the more likely it is a malicious application.

[0095] The SMS sending frequency feature can be characterized by the number of SMS sending times. The greater the number of SMS sending times in an application, the more likely it is to be a malicious application.

[0096] In one embodiment, the second type of features includes at least one of the following: a dangerous permission feature, a display component feature, a component communication feature, and a service component feature;

[0097] The second type of features can be encoded using one-hot encoding.

[0098] Specifically, the dangerous permission characteristics may include at least one of the following: READ_CONTACTS, WRITE_CONTACTS, CALL_PHONE, RECEIVE_SMS and other dangerous permissions.

[0099] The display component features are Activity component features;

[0100] The component communication feature is the Intent feature, which can represent a message passing object that can potentially be used by malicious behavior to start an Android component.

[0101] The service component characteristics are the service component characteristics, which can represent the behavioral characteristics of stealing user data information and controlling host communication by taking advantage of the service's ability to work for a long time and operate remote processes.

[0102] For the second type of features, one-hot encoding can be used to encode the second type of features, that is, encoding is performed based on whether the feature exists, if it exists, it is encoded as 1, and if it does not exist, it is encoded as 0.

[0103] In the above implementation, the above multiple features are selected so that the features can more comprehensively characterize the application, and the above features will not change before and after code obfuscation, which can handle the situation of code obfuscation and improve the accuracy of malicious application detection.

[0104] Optionally, extracting application features can be achieved by:

[0105] Get the installation package APK file of the application;

[0106] Get multiple features of the application based on the APK file of the application.

[0107] In one embodiment, if Figure 3 As shown, the training process of the encoding model is described in detail:

[0108] Step 104: Establish an initial coding model;

[0109] Step 105: training the initial coding model based on the characteristic coding samples to obtain the intermediate coding;

[0110] Step 106: Optimize the model parameters of the initial coding model based on the intermediate coding and decoding models until the convergence conditions are met to obtain a trained coding model.

[0111] Alternatively, if Figure 4 As shown, step 106 "optimizing the model parameters of the initial coding model" includes:

[0112] Step 1061: Input the intermediate code into the decoding model to obtain a reconstructed feature code sample;

[0113] Step 1062: Based on the similarity between the reconstructed feature coding sample and the feature coding sample, the model parameters of the initial coding model are optimized until the convergence condition is met, thereby obtaining a trained coding model.

[0114] Specifically, first, appropriate training data is selected to build an installation package APK file library of the application program containing obfuscated code.

[0115] File samples are collected from Android malicious code databases, such as the Drebin and Androzoo databases. Malicious APK files are collected from the Derbin database, with a total of A1 samples collected, including A2 malicious application APK files; and B benign APK files are collected from the Androzoo database.

[0116] Optionally, multiple benign APK files can also be obtained from other platforms.

[0117] For example, APK files are downloaded from multiple application markets, and are detected one by one through a virus scanning engine, and multiple benign APK files detected are selected as benign samples.

[0118] Secondly, feature extraction is performed on APK file samples.

[0119] The final features extracted include static features such as dangerous permission features, API call features, reflected API call features, Service component features, Intent features, Activity component features, and dynamic features such as SMS sending features.

[0120] The features selected from the analysis results of each application in the data set are counted, including N features in total. The N features include dangerous permission features, Activity component features, API call features, reflection API call features, Intent features, Service component features, and SMS sending frequency features. Each feature is n i species, where i = 1, 2, ..., 7, where

[0121] According to the characteristics of dangerous permissions, we counted the dangerous permissions applied by all applications in the dataset and selected the n1 dangerous permissions with the highest number of calls. As the final dangerous permissions used, for example, dangerous permissions 1 and dangerous permissions 2 are selected. When encoding, if the dangerous permission 1 exists in the application, it is encoded as 1, otherwise it is encoded as 0; for the Activity component features, the first n2 types of Activity component features with the most usage times are selected, and the peak value is For API call features, the top n3 types with the highest number of calls are selected as the selected features, with the highest being For reflection API calls, the top n4 calls with the highest number of calls are selected as the selected features, with a peak value of For the Intent component, select the top n5 most frequently called features as the selected features, with the maximum number of calls being For the Service component, the top n6 types with the most calls are selected as the selected features, and the peak value is

[0122] Among the N features obtained, API call, reflected API call and SMS sending frequency features are encoded using S, where S is the number of API calls or SMS sending times; dangerous permissions, Activity components, Intent, and Service component features are encoded using e, where e=1 if the feature exists, otherwise e=0.

[0123] After encoding the features, N features can be obtained. The input features are first encoded and mapped to the feature space using an autoencoder to obtain the code of each sample, and then this set of codes is decoded to reconstruct the N sample features of the initial input.

[0124] Among them, the autoencoder includes an encoding model and a decoding model.

[0125] Specifically, since the selected N features have different characteristics, it may cause individual or a few features to deviate from other features, resulting in abnormal encoding.

[0126] During the training process, a set of samples x n Send it to the initial encoding model and map this set of data to the feature space to obtain the encoding z of each sample n , and then through the decoding model, in the hope of z n Mapping back to the initial sample, the result here is The goal of the training process, that is, the loss function is Where λ is the regularization coefficient and W is the model parameter. In the whole process, the model parameters in the autoencoder are effectively trained by minimizing the loss function.

[0127] Among them, the feature encoding sample is x n , the encoding z of each feature encoding sample n That is the intermediate code, Encode samples for the reconstructed features.

[0128] The similarity between feature-encoded samples and feature-encoded samples can be compared to optimize model parameters.

[0129] After data training, when actually encoding and detecting the features of the application, only the encoding model is used, and the output of the encoding model is the input of the subsequent machine learning model.

[0130] In the above implementation, the encoding model and the decoding model are trained unsupervisedly, and the trained encoding model is used to process the first encoding of each feature separately to obtain a second encoding with greater correlation that can accurately represent the application.

[0131] In one embodiment, the training process of the detection model is described in detail:

[0132] Build an initial machine learning model;

[0133] The machine learning model is trained using training data to obtain the detection model; the training data includes: coding samples of the application and labels indicating whether the application is malicious.

[0134] Specifically, the encoding result output by the aforementioned encoding model is sent to a machine learning model for training to achieve detection of malicious applications.

[0135] Specifically, several machine learning methods such as random forest model, decision tree model, convolutional neural network model and SVM model are selected to train the data set, and the feature encoding obtained previously is trained. The accuracy, the area under the receiver operating characteristic curve (ROC) (Area UnderCurve, AUC) value, recall rate and F1 value are used to judge the training effect of each model on the training data. The processed training data is divided into ten parts, one of which is selected as test data, and the remaining nine are used as training data. The applications are judged in turn whether they are malicious applications.

[0136] Optionally, the detection model may adopt a trained random forest model.

[0137] In the above implementation, the machine learning model is trained, and the detection model obtained by the training is used to detect the second code, which can more accurately identify whether it is a malicious application, and has high efficiency.

[0138] The malicious application detection device provided by the present invention is described below. The malicious application detection device described below and the malicious application detection method described above can be referenced to each other.

[0139] Figure 5 Schematic diagram of the structure of an embodiment of a malicious application detection device provided by the present invention. Figure 5 As shown, the malicious application detection device provided in this embodiment includes:

[0140] A preprocessing module 210 is used to encode multiple features of the application program to obtain a first code for each of the features;

[0141] A processing module 220, configured to input the first encoding of each of the features into a trained encoding model to obtain a second encoding of the application;

[0142] The processing module 220 is further used to obtain a detection result according to the second encoding of the application and the trained detection model, wherein the detection result is used to indicate whether the application is a malicious application;

[0143] The encoding model is obtained by training the feature encoding samples and the decoding model, and the decoding model is used to obtain the reconstructed feature encoding samples based on the input intermediate encoding; the intermediate encoding is obtained by the encoding model based on the feature encoding samples.

[0144] Optionally, the processing module 220 is further configured to:

[0145] Establish an initial coding model;

[0146] Training the initial coding model based on the feature coding samples to obtain intermediate coding;

[0147] Based on the intermediate coding and the decoding model, the model parameters of the initial coding model are optimized until a convergence condition is met, thereby obtaining the trained coding model.

[0148] Furthermore, the processing module 220 is specifically configured to:

[0149] Inputting the intermediate code into the decoding model to obtain the reconstructed feature code sample;

[0150] Based on the similarity between the reconstructed feature coding sample and the feature coding sample, the model parameters of the initial coding model are optimized until a convergence condition is met, thereby obtaining the trained coding model.

[0151] Furthermore, the processing module 220 is further configured to:

[0152] Build an initial machine learning model;

[0153] The machine learning model is trained using training data to obtain the detection model; the training data includes: coding samples of the application and labels indicating whether the application is malicious.

[0154] Furthermore, the plurality of features include: features of a first type and features of a second type, and the preprocessing module 210 is specifically configured to:

[0155] Encoding the first type of features based on a first encoding method to obtain a first code of the first type of features;

[0156] Based on the second encoding method, the second type of features are encoded to obtain a first encoding of the second type of features.

[0157] Further, the first type of features includes at least one of the following: an application programming interface API call feature, a reflection API call feature, and a text message sending feature;

[0158] The preprocessing module 210 is specifically used for:

[0159] Encoding the API call feature and / or the reflection API call feature according to the number of API calls;

[0160] The SMS sending feature is encoded according to the number of times the SMS is sent.

[0161] Further, the second type of features includes at least one of the following: dangerous permission features, display component features, component communication features, and service component features;

[0162] The second encoding method is one-hot encoding, and the preprocessing module 210 is specifically used for:

[0163] The features of the second type are encoded based on the one-hot encoding.

[0164] Furthermore, the preprocessing module 210 is also used for:

[0165] Get the installation package APK file of the application;

[0166] According to the APK file of the application, multiple features of the application are obtained.

[0167] Furthermore, the feature is a feature that does not change before and after code obfuscation in the application; the application is an application that has been code obfuscated.

[0168] The device of the embodiment of the present invention is used to execute the method in any of the aforementioned method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0169] Here is an example:

[0170] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the following method: encode multiple features of the application to obtain a first code of each of the features; input the first code of each of the features into the trained encoding model to obtain a second code of the application; obtain a detection result according to the second code of the application and the trained detection model, and the detection result is used to indicate whether the application is a malicious application; wherein the encoding model is obtained by training a feature encoding sample and a decoding model, and the decoding model is used to obtain a reconstructed feature encoding sample based on an input intermediate code; the intermediate code is obtained by the encoding model based on the feature encoding sample.

[0171] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0172] On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the malicious application detection method provided in the above embodiments is implemented to execute the following steps: encoding multiple features of an application to obtain a first code for each of the features; inputting the first code for each of the features into a trained coding model to obtain a second code for the application; obtaining a detection result based on the second code for the application and the trained detection model, wherein the detection result is used to indicate whether the application is a malicious application; wherein the coding model is obtained by training a feature coding sample and a decoding model, and the decoding model is used to obtain a reconstructed feature coding sample based on an input intermediate code; and the intermediate code is obtained by the coding model based on the feature coding sample.

[0173] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0174] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0175] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A malicious application detection method, characterized in that: include: Encoding multiple features of the application to obtain a first code for each of the features; Inputting the first encoding of each of the features into a trained encoding model to obtain a second encoding of the application; The second code output by the coding model can reflect the correlation between various features; Obtaining a detection result according to the second encoding of the application and the trained detection model, wherein the detection result is used to indicate whether the application is a malicious application; the detection model is a machine learning model; The encoding model is obtained by training the feature encoding sample and the decoding model, and the decoding model is used to obtain the reconstructed feature encoding sample based on the input intermediate code; the intermediate code is obtained by the encoding model based on the feature encoding sample; The multiple features include: features of a first type and features of a second type, and the encoding of the multiple features of the application to obtain a first encoding of each of the features includes: Encoding the first type of features based on a first encoding method to obtain a first code of the first type of features; Based on the second encoding method, the second type of features are encoded to obtain a first encoding of the second type of features.

2. The malicious application detection method according to claim 1, characterized in that: The method further comprises: Establish an initial coding model; Training the initial coding model based on the feature coding samples to obtain intermediate coding; Based on the intermediate coding and the decoding model, the model parameters of the initial coding model are optimized until a convergence condition is met, thereby obtaining the trained coding model.

3. The malicious application detection method according to claim 2, characterized in that: The optimizing the model parameters of the initial coding model based on the intermediate coding and the decoding model until a convergence condition is satisfied to obtain the trained coding model includes: Inputting the intermediate code into the decoding model to obtain the reconstructed feature code sample; Based on the similarity between the reconstructed feature coding sample and the feature coding sample, the model parameters of the initial coding model are optimized until a convergence condition is met, thereby obtaining the trained coding model.

4. The malicious application detection method according to any one of claims 1 to 3, characterized in that: The method further comprises: Build an initial machine learning model; The machine learning model is trained using training data to obtain the detection model; the training data includes: coding samples of the application and labels indicating whether the application is malicious.

5. The malicious application detection method according to claim 1, characterized in that: The first type of features includes at least one of the following: an application programming interface API call feature, a reflection API call feature, and a text message sending feature; The encoding of the first type of features based on the first encoding method includes: Encoding the API call feature and / or the reflection API call feature according to the number of API calls; The SMS sending feature is encoded according to the number of times the SMS is sent.

6. The malicious application detection method according to claim 1, characterized in that: The second type of features includes at least one of the following: dangerous permission features, display component features, component communication features, and service component features; The second encoding method is one-hot encoding, and encoding the second type of features based on the second encoding method includes: The features of the second type are encoded based on the one-hot encoding.

7. The malicious application detection method according to any one of claims 1 to 3, characterized in that: Before encoding the multiple features of the application, the method further includes: Get the installation package APK file of the application; According to the APK file of the application, multiple features of the application are obtained.

8. The malicious application detection method according to any one of claims 1 to 3, characterized in that: The feature is a feature that does not change before and after code obfuscation in the application; the application is an application that has been code obfuscated.

9. A malicious application detection device, characterized in that: include: A preprocessing module, used for encoding multiple features of the application program to obtain a first code of each of the features; A processing module, used for inputting the first encoding of each of the features into a trained encoding model to obtain a second encoding of the application; The second code output by the coding model can reflect the correlation between various features; The processing module is further used to obtain a detection result according to the second encoding of the application and the trained detection model, wherein the detection result is used to indicate whether the application is a malicious application; the detection model is a machine learning model; The encoding model is obtained by training the feature encoding sample and the decoding model, and the decoding model is used to obtain the reconstructed feature encoding sample based on the input intermediate code; the intermediate code is obtained by the encoding model based on the feature encoding sample; The plurality of features include: features of a first type and features of a second type, and the preprocessing module is specifically configured to: Encoding the first type of features based on a first encoding method to obtain a first code of the first type of features; Based on the second encoding method, the second type of features are encoded to obtain a first encoding of the second type of features.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the malicious application detection method according to any one of claims 1 to 8 are implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the malicious application detection method as claimed in any one of claims 1 to 8 are implemented.

12. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the steps of the malicious application detection method as described in any one of claims 1 to 8.

Images