Distributed application detection method, device, equipment, storage medium and program

Abstract

The embodiment of the present invention provides a distributed application detection method, device, equipment, storage medium and program. The method is used in a distributed application detection system, and the distributed application detection system includes: a server and at least one virtual machine, and the method includes: step 101, the server obtains multiple applications to be detected; step 102, the server determines the target virtual machine according to the weight of at least one virtual machine in an idle state; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection, and the weight is updated based on the detection of the target application by the virtual machine; step 103, the server sends the target application among the multiple applications to the target virtual machine, and obtains the detection result of the target virtual machine on the target application and the updated weight; the server repeats step 102-step 103 until the detection of multiple applications is completed. The above scheme improves the detection efficiency.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a distributed application detection method, device, equipment, storage medium and program. Background Art

[0002] With the rapid development of the Android platform, many third-party platforms can publish Android applications. Due to the irregular review procedures of third-party platforms for Android applications, a large number of malicious applications have emerged. According to statistics, an average of about 12,000 new malicious applications are added every day. Various types of malicious applications such as fee consumption, privacy theft, malicious deductions, remote control, etc. pose a threat not only to individual users, but also to the security of enterprises and society.

[0003] With the upgrading of attack and defense methods, attackers confuse Android applications to evade inspection, and security personnel need to analyze Android applications one by one. The above process will consume a lot of time and energy and is inefficient. Summary of the invention

[0004] In view of the problems in the prior art, embodiments of the present invention provide a distributed application detection method, apparatus, device, storage medium and program.

[0005] Specifically, the embodiment of the present invention provides the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a distributed application detection method, the method is used in a distributed application detection system, the distributed application detection system includes: a server and at least one virtual machine, the method includes:

[0007] Step 101: The server obtains multiple applications to be detected;

[0008] Step 102: The server determines a target virtual machine according to a weight of at least one virtual machine in an idle state; the weight is at least related to a detection speed of the virtual machine and a probability of successful detection, and the weight is updated based on the detection of the target application by the virtual machine;

[0009] Step 103: the server sends a target application among the multiple applications to the target virtual machine, and obtains a detection result of the target virtual machine on the target application and an updated weight;

[0010] The server repeatedly executes step 102 to step 103 until the detection of multiple application programs is completed.

[0011] Optionally, the server determines the target virtual machine according to the weight of at least one virtual machine in an idle state, including:

[0012] The server determines a virtual machine with the largest weight among the at least one virtual machine as the target virtual machine.

[0013] Optionally, the updated weight is determined by the target virtual machine based on detection data of the target application; the detection data includes at least one of the following: the number of times the detection tool is run, the maximum number of times it is run, a step coefficient and a first step length; the step coefficient is the coefficient used when the weight is reduced, and the first step length is the step length used when the weight is increased.

[0014] Optionally, the smaller the number of times the detection tool is run, and / or the higher the probability of successful detection, the greater the weight.

[0015] Optionally, if the target virtual machine obtains the detection result for the mth time when running the detection tool, the updated weight is obtained by increasing the weight before the update by the first step length, and the first step length is less than the step length coefficient; m is an integer greater than 0; the weight before the update is an initial value, or a value obtained in the previous update, and the initial value is a preset value;

[0016] If the target virtual machine obtains the detection result after running the detection tool for the i-th time, the updated weight is obtained by subtracting the second step length from the weight before the update; the second step length is obtained based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

[0017] Optionally, the server obtains the application to be detected, including:

[0018] The server obtains the target application from a plurality of pre-acquired applications based on a target order; the target order is an order based on target attributes of the application, and the target attributes include at least one of the following: priority, update time, name or type.

[0019] Optionally, before the server determines the target virtual machine according to the weight of at least one virtual machine in an idle state, the server further includes:

[0020] The server receives status indication information of the virtual machine, where the status indication information includes an identifier and an idle state of the virtual machine; the identifier includes an IP address.

[0021] Optionally, after obtaining the detection result of the target virtual machine on the target application, the method further includes:

[0022] The server restores the state of the target virtual machine to a snapshot state; the snapshot state is a state in which the target virtual machine waits to receive the target application and starts detection after receiving the target application.

[0023] In a second aspect, an embodiment of the present invention provides a distributed application detection method, the method is used in a distributed application detection system, the distributed application detection system includes: a server and at least one virtual machine, the method includes:

[0024] The virtual machine receives the target application sent by the server;

[0025] The virtual machine detects the target application to obtain a detection result, and updates the weight of the virtual machine to obtain an updated weight; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection;

[0026] The virtual machine sends the detection result and the updated weight to the server.

[0027] Optionally, updating the weight of the virtual machine to obtain an updated weight includes:

[0028] If the virtual machine obtains the detection result after running the detection tool for the mth time, the weight before update is increased by the first step length to obtain the updated weight, wherein the first step length is less than the first coefficient; m is an integer greater than 0; the weight before update is the initial value, or the weight obtained in the previous update, and the initial value is a preset value;

[0029] If the virtual machine obtains the detection result after running the detection tool for the i-th time, the second step length is subtracted from the weight before update to obtain the updated weight, where the second step length is based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

[0030] Optionally, before the virtual machine receives the target application sent by the server, the method further includes:

[0031] If the virtual machine is in an idle state, the virtual machine sends the state indication information and the weight of the virtual machine to the server; the state indication information includes the identifier and the idle state of the virtual machine; and the identifier includes the IP address.

[0032] In a third aspect, an embodiment of the present invention further provides a distributed application detection device, the device is used in a distributed application detection system, the distributed application detection system includes: a server and at least one virtual machine, the device includes:

[0033] An acquisition module, used for acquiring multiple applications to be detected;

[0034] A determination module, configured to determine a target virtual machine according to a weight of at least one virtual machine in an idle state; the weight is at least related to a detection speed of the virtual machine and a probability of successful detection, and the weight is updated based on the detection of the target application by the virtual machine;

[0035] The sending module is used to send the target application among the multiple applications to the target virtual machine; the obtaining module is also used to obtain the detection result of the target virtual machine on the target application and the updated weight;

[0036] The device repeatedly executes the operations of the determination module, the sending module and the acquisition module until the detection of multiple application programs is completed.

[0037] In a fourth aspect, an embodiment of the present invention further provides a distributed application detection device, the device is used in a distributed application detection system, the distributed application detection system includes: a server and at least one virtual machine, the device includes:

[0038] A receiving module, used for receiving a target application sent by a server;

[0039] A processing module, configured to detect the target application to obtain a detection result, and update the weight of the virtual machine to obtain an updated weight; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection;

[0040] A sending module is used to send the detection result and the updated weight to the server.

[0041] In a fifth aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the distributed application detection method as described in the first aspect or the second aspect are implemented.

[0042] In a sixth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the distributed application detection method as described in the first aspect or the second aspect.

[0043] In a seventh aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the distributed application detection method described in the first aspect or the second aspect.

[0044] The distributed application detection method, apparatus, device, storage medium and program provided in the embodiments of the present invention determine a target virtual machine based on the weight of at least one virtual machine in an idle state; the target application is detected using the target virtual machine, and the weight is updated based on the detection data, and this cycle is repeated until multiple application detections are completed. The weight is at least related to the detection speed of the virtual machine and the probability of successful detection. The faster the detection speed, the greater the weight, and the greater the probability of successful detection, the greater the weight. Therefore, selecting a virtual machine for detection based on the weight can improve detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 An application scenario diagram of an embodiment of the distributed application detection method provided by the present invention;

[0047] Figure 2 A schematic diagram of a flow chart of an embodiment of a distributed application detection method provided by the present invention;

[0048] Figure 3 A schematic diagram of a flow chart of another embodiment of the distributed application detection method provided by the present invention;

[0049] Figure 4 A schematic diagram of a flow chart of another embodiment of the distributed application detection method provided by the present invention;

[0050] Figure 5 It is a structural diagram of an embodiment of a distributed application detection device provided by the present invention;

[0051] Figure 6 is a structural schematic diagram of another embodiment of the distributed application detection device provided by the present invention;

[0052] Figure 7 is a structural schematic diagram of an embodiment of an electronic device provided by the present invention;

[0053] Figure 8 It is a structural diagram of an embodiment of a server provided by the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] The method of the embodiment of the present invention can be applied to malicious application detection scenarios and can improve detection efficiency.

[0056] Figure 1 The application scenario diagram provided by an embodiment of the present invention, optionally, as Figure 1 As shown, the application scenario includes at least one electronic device 11 ( Figure 1 In the example, two electronic devices 11 are used) and a server 12;

[0057] The electronic device 11 and the server 12 may be connected via a network, such as a 4G, 5G or Wireless Fidelity (WIFI) communication network.

[0058] The method provided by the present invention can be implemented by an electronic device 11 such as a processor executing a corresponding software code, or it can be implemented by the electronic device 11 executing the corresponding software code while interacting with the server 12, such as the server executing some operations to control the electronic device to execute a distributed application detection method.

[0059] Among them, the electronic device can be a virtual machine.

[0060] The distributed application detection method of the embodiment of the present invention determines the target virtual machine based on the weight of at least one virtual machine in an idle state; uses the target virtual machine to detect the target application, and updates the weight based on the detection data, and repeats this cycle until multiple application detections are completed. The weight is at least related to the detection speed of the virtual machine and the probability of successful detection. The faster the detection speed, the greater the weight, and the higher the probability of successful detection, the greater the weight, thereby improving the detection efficiency.

[0061] Combine the following Figure 2-Figure 4 The technical solution of the present invention is described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0062] Figure 2 FIG. 1 is a flow chart of an embodiment of a distributed application detection method provided by an embodiment of the present invention. Figure 2As shown, the method provided by the embodiment of the present invention is used in a distributed application detection system, the distributed application detection system includes: a server and at least one virtual machine, the method includes:

[0063] Step 101: The server obtains multiple applications to be detected;

[0064] Specifically, the server obtains an application to be detected, which may include multiple applications, and the multiple applications may be obfuscated applications. Optionally, application obfuscation may refer to changing the resource paths of multiple applications. For example, during the obfuscation process, the original lengthy resource path of the application is changed, such as changing res / drawable / wechat to r / d / w to achieve obfuscation.

[0065] The server can select an application from multiple applications and send it to the virtual machine for detection.

[0066] Step 102: The server determines a target virtual machine according to a weight of at least one virtual machine in an idle state.

[0067] The weight is at least related to the detection speed of the virtual machine and the probability of successful detection.

[0068] The weights can be updated based on the VM's detection of the target application.

[0069] The faster the detection speed, the greater the weight; and / or, the greater the probability of successful detection, the greater the weight.

[0070] Specifically, multiple virtual machines are pre-set, and the server can record the status of multiple virtual machines, compare the weights of virtual machines in an idle state, and determine the target virtual machine. The server can set initial values ​​of weights for multiple virtual machines. The weights can be updated based on the initial values ​​based on the detection of the target application by the virtual machine.

[0071] Optionally, the server determines a virtual machine with the largest weight among the at least one virtual machine as the target virtual machine.

[0072] Step 103: The server sends the target application among the multiple applications to the target virtual machine, and obtains the detection result of the target virtual machine on the target application and the updated weight;

[0073] The server repeatedly executes step 102 to step 103 until multiple application program detections are completed.

[0074] Specifically, the server sends a target application from multiple applications to a target virtual machine, where the target application can be any one of the multiple applications, or an application selected according to certain rules, and obtains the detection result of the target virtual machine on the target application and the updated weight. The server selects a new target virtual machine again based on the updated weight of the target virtual machine and the weights of other idle virtual machines, and selects the target application from the remaining applications to send to the new target virtual machine, and repeats this cycle until the detection of multiple applications is completed.

[0075] Assuming that the current target virtual machine can obtain the detection result quickly, the weight will be increased to obtain the updated weight, that is, the updated weight is greater than the previous weight. If the current target virtual machine takes a long time to obtain the detection result, the weight will be reduced to obtain the updated weight, that is, the updated weight is less than the previous weight.

[0076] Later, when selecting a target virtual machine, it is easier to select a virtual machine with a large weight, that is, a virtual machine with a faster efficiency, which can improve the efficiency of the entire detection process.

[0077] The server may record the status of multiple virtual machines, and optionally correspond the identifier of the virtual machine to the status, where the identifier of the virtual machine may be an IP address.

[0078] Optionally, in step 103, the server may also send the current weight of the target virtual machine to the target virtual machine.

[0079] Optionally, before the detection, the server may send the initial weight configured for each virtual machine to each virtual machine.

[0080] The detection result includes information such as whether the application is a malicious application or a benign application.

[0081] The method of this embodiment determines the target virtual machine based on the weight of at least one virtual machine in an idle state; uses the target virtual machine to detect the target application, and updates the weight based on the detection data, and repeats this cycle until multiple application detections are completed. The weight is at least related to the detection speed of the virtual machine and the probability of successful detection. The faster the detection speed, the greater the weight, and the greater the probability of successful detection, the greater the weight. Therefore, selecting a virtual machine with a larger weight for detection can improve detection efficiency.

[0082] In one embodiment, the updated weight is determined by the target virtual machine based on the detection data of the target application; the detection data includes at least one of the following: the number of times the detection tool is run, the maximum number of times it is run, the step coefficient and the first step length; the step coefficient is the coefficient used when the weight is reduced, and the first step length is the step length used when the weight is increased.

[0083] Optionally, the detection speed can be represented by the number of times the detection tool is run. The greater the number of times the detection tool is run, the smaller the weight is, and the smaller the number of times the detection tool is run, the greater the weight is.

[0084] Optionally, the greater the probability of successful detection, the greater the weight; the smaller the probability of successful detection, the smaller the weight.

[0085] Specifically, if the number of times the detection tool is run is large, it means that the detection efficiency of the target virtual machine for the target application is low, and the weight needs to be reduced.

[0086] The maximum number of runs is the upper limit of the number of runs of the detection tool, which prevents the virtual machine from not getting the detection results for a long time, affecting the detection efficiency.

[0087] Optionally, a smaller step size may be used when the weight increases, or the step size may increase with the number of increases, for example, the first step size a is used when the weight of a virtual machine increases for the first time, and the first step size b is used when the weight increases for the second time, where b is greater than a.

[0088] Optionally, the first step length can be fixed.

[0089] Optionally, if the target virtual machine obtains the detection result for the mth time when running the detection tool, the updated weight is obtained by increasing the weight before the update by the first step length, where the first step length << the step length coefficient; m is an integer greater than 0; the weight before the update is the initial value, or the weight obtained in the previous update, and the initial value is a preset value;

[0090] If the target virtual machine obtains the detection result after running the detection tool for the i-th time, the updated weight is obtained by subtracting the second step length from the weight before the update; the second step length is obtained based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

[0091] Specifically, assume that there are N virtual machines, and each virtual machine guest_j (j is less than or equal to N) is installed with the detection tool tool. The virtual machine guest_j has two states, one is the idle state state_free, and the other is the busy state state_busy. The virtual machine guest_j has a weight value w_j. The server side stores the identifier of the virtual machine in the idle state state_free, such as the IP address. Before the analysis begins, the IP addresses of all virtual machines are stored on the server side. First, the weight of each virtual machine is initialized to the same value ini. During the detection process of the virtual machine guest_j on the application apk_i, the detection tool is run at most r times for each detection. If the previous run fails, it will be run again until the run is successful or reaches r times. If the mth run is successful (for example, m is equal to 1), that is, the test result is obtained, then the weight w_j of guest_j increases by the first step length, such as uplittle. If the sth (s is greater than m, and less than or equal to r) run is successful, then the weight w_j of guest_j decreases Where down is the step length coefficient, and uplittle<<down, that is, the first step length is much smaller than the step length coefficient.

[0092] In one embodiment, m is 1.

[0093] Optionally, the above parameters such as step size coefficient and first step size can be obtained through training.

[0094] In the above implementation, by updating the weights, virtual machines with larger weights are used as much as possible during the detection process, that is, virtual machines with faster detection speeds are used for detection, which can improve the efficiency of the entire detection process.

[0095] In one embodiment, step 103 may be implemented as follows:

[0096] The server obtains the target application from the pre-acquired multiple applications based on the target order; the target order is the order arranged based on the target attributes of the application, and the target attribute includes at least one of the following: priority, update time, name or type.

[0097] Specifically, the server may obtain the target application based on certain rules, such as according to a target order, which is an order based on target attributes of the application, such as according to the priority, update time, name or type of the application.

[0098] For example, applications with higher priorities may be detected first; or applications with the latest update time may be detected first; or the detection may be performed in alphabetical order of the names; or the detection may be performed after the applications are arranged according to their types.

[0099] The above target attributes may also be used in combination, for example, first arranging the applications according to their types, and then arranging the applications within each type according to their priorities.

[0100] In the above-mentioned embodiment, based on the target order, the target application is acquired from the plurality of pre-acquired applications, and the application arranged first can be detected preferentially.

[0101] In one embodiment, before the server determines the target virtual machine, the process further includes:

[0102] The server receives status indication information of the virtual machine respectively, where the status indication information includes an identifier and an idle state of the virtual machine; the identifier includes an IP address.

[0103] Specifically, when the virtual machine is in an idle state, the state indication information is sent to the server, where the state indication information includes the identifier and idle state of the virtual machine; the identifier includes the IP address.

[0104] In the above implementation, the server can accurately know whether the virtual machine is in an idle state based on the state indication information, so the selected target virtual machine is more accurate, avoiding selecting a virtual machine in a busy state, which affects the detection efficiency.

[0105] Figure 3 FIG. 2 is a flow chart of another embodiment of the distributed application detection method provided by an embodiment of the present invention. Figure 3 As shown, the method provided by the embodiment of the present invention is used in a distributed application detection system, the distributed application detection system includes: a server and at least one virtual machine, the method includes:

[0106] Step 201, the virtual machine receives the target application sent by the server;

[0107] Optionally, before step 201, the following steps may also be included:

[0108] If the virtual machine is in an idle state, the virtual machine sends the state indication information and the weight of the virtual machine to the server; the state indication information includes the identifier and the idle state of the virtual machine; the identifier includes the IP address.

[0109] Before the virtual machine receives the target application, the server sets its state to a snapshot state, where the snapshot state is a state in which the virtual machine waits to receive the target application and can start detection immediately after receiving the target application.

[0110] Specifically, in order to improve the detection efficiency of the virtual machine, the virtual machine may be restored to a snapshot state before detection, that is, a state in which detection can be started immediately after receiving the target application.

[0111] Step 202: The virtual machine detects the target application to obtain a detection result, and updates the weight of the virtual machine to obtain an updated weight; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection;

[0112] Optionally, after the server obtains the detection result sent by the virtual machine, the following further includes:

[0113] The server reverts the state of the virtual machine to the snapshot state.

[0114] Optionally, in step 202, the weight of the virtual machine is updated to obtain the updated weight, which can be specifically implemented in the following manner:

[0115] If the virtual machine obtains a detection result after running the detection tool for the mth time, the weight before update is increased by the first step length to obtain the updated weight, and the first step length is less than the first coefficient; m is an integer greater than 0; the weight before update is an initial value, or the weight obtained in the previous update, and the initial value is a preset value;

[0116] If the virtual machine obtains the detection result after running the detection tool for the i-th time, the second step length is subtracted from the weight before update to obtain the updated weight, where the second step length is based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

[0117] Step 203: The virtual machine sends the detection result and the updated weight to the server.

[0118] The method of the embodiment of the present invention is similar to the method in any of the aforementioned server-side method embodiments in terms of its implementation principle and technical effect, and will not be described in detail here.

[0119] In one embodiment, all Android application samples that need to be analyzed are stored in the server. When performing the detection, a virtual machine in the idle state state_free is first restored to the snapshot state, and the host transfers an Android application sample to the virtual machine using the sshpass command, and the virtual machine then starts to analyze the Android application sample. After the analysis starts, the server selects an Android application apk_i in the order of the name and sends it to the virtual machine in the idle state corresponding to the IP address through the sshpass command, that is, the virtual machine guest_j in the idle state state_free and with the highest weight w (w_j=max{w_b|state_guest_b=state_free}), and then the virtual machine guest_j is in the busy state state_busy; when the virtual machine guest_j receives the analysis task, the detection tool tool1 is used to analyze the file, and the analysis result result_i and the IP address ip_j are sent to the server through the sshpass command, and then the virtual machine guest_j is in the idle state state_free. Repeat the above process until all applications in the application sample are traversed.

[0120] In the implementation of distributed analysis, the server is responsible for allocating and sending the Android application file apk_i to the virtual machine guest_j in the idle state state_free, and receiving the analysis result result_i (for example, represented by a json file) from the virtual machine guest_j; after receiving the Android application file apk_i sent by the server, the virtual machine guest_j uses the detection tool to specifically implement the detection of the Android application apk_i, that is, to detect whether the application is a malicious application, and sends the analysis result result_i to the server.

[0121] Among them, sshpass is a simple, lightweight command line tool that provides non-interactive password authentication.

[0122] In one embodiment, if Figure 4 As shown, the method includes:

[0123] Step 301: Establish a mapping between a virtual machine name and its IP address;

[0124] Step 302, traverse the application sample set;

[0125] Step 303: Determine whether the traversal is completed;

[0126] If yes, then the process ends; if no, then the process proceeds to step 304, determining whether there is an idle virtual machine;

[0127] If not, execute step 305 and wait for traversing other virtual machines in idle state;

[0128] If yes, execute step 306 to restore the virtual machine to the snapshot state;

[0129] Step 307: Send the APK file and the current weight of the virtual machine to the virtual machine; at this time, the initial value of the weight can be configured;

[0130] Step 308: Perform detection using a detection tool;

[0131] Step 309: Obtain the test result and send it to the server;

[0132] Step 310: Send the updated weights to the server.

[0133] In one embodiment, the parameters used in the weight update process can be obtained through training, which is specifically achieved in the following way:

[0134] Step 401: The server obtains a set of malicious applications and a set of benign applications;

[0135] Step 402: The server selects a plurality of malicious applications and a plurality of benign applications from the malicious application set and the benign application set for obfuscation to obtain a training data set.

[0136] Step 403: Use multiple virtual machines to detect the applications in the training data set, optimize the step coefficient and the first step length based on the detection results, the labels of the applications, and the detection time until the convergence conditions are met, and obtain the trained step coefficient and the first step length.

[0137] Specifically, in step 401, it is necessary to select a set of malicious applications widely used by researchers from an existing public Android malicious application database, and select a set of applications whose number of malicious applications detected by the detection tool is not more than a certain number from an existing data set or in the application market of the terminal as a set of benign applications. In addition, in the process of selecting applications, select an application with a large compilation time span, that is, a compilation time spanning multiple years and an Android Software Development Kit (SDK) version not exceeding the Android SDK version required by the detection tool.

[0138] In step 402, the same number of Android malicious applications and benign applications can be randomly selected; then the selected malicious application and benign application files are obfuscated using the currently available Android obfuscation software to obtain an obfuscated data set. During the obfuscation process, the original lengthy resource path of the application is changed, for example, res / drawable / wechat is changed to r / d / w to achieve obfuscation.

[0139] In step 403, it is assumed that there are N virtual machines, and each virtual machine guest_j (j is less than or equal to N) is installed with the detection tool tool. The virtual machine guest_j has two states, one is the idle state state_free, and the other is the busy state state_busy. The virtual machine guest_j has a weight value w_j. The server side stores the identifier of the virtual machine in the idle state state_free, such as the IP address. Before the analysis starts, the IP addresses of all virtual machines are stored on the server side. First, the weight of each virtual machine is initialized to the same value ini. During the detection process of the virtual machine guest_j on the application apk_i, the detection tool is run at most r times for each detection. If the previous run fails, it will be run again until the run is successful or reaches r times. If the mth run is successful, that is, the test result is obtained, then the weight w_j of guest_j increases by the first step length, such as uplittle. If the sth (s is greater than m and less than or equal to r) run is successful, then the weight w_j of guest_j decreases Where down is the step length coefficient, and uplittle<<down, that is, the first step length is much smaller than the step length coefficient.

[0140] Among them, the initial values ​​of the step coefficient and the first step are preset values.

[0141] A plurality of virtual machines are used to detect the applications in the training data set, and the step coefficient and the first step length are optimized based on the detection results and the labels of the applications. The detection results are compared. If the detection result is correct and the number of runs is greater than m, the weight is reduced. If the detection result is correct and the number of runs is less than i, the weight is increased. If the detection result is wrong, the weight is reduced until all the applications in the training data set are detected. The detection time is recorded, and the step coefficient and the first step length are adjusted according to the detection time and the preset time until the detection time meets the convergence condition, so as to obtain the trained step coefficient and the first step length.

[0142] In this embodiment, the execution subject may be a server, a virtual machine, or other electronic devices.

[0143] The distributed application detection device provided by the present invention is described below. The distributed application detection device described below and the distributed application detection method described above can be referenced to each other.

[0144] Figure 5 5 is a structural diagram of an embodiment of a distributed application detection device provided by the present invention. As shown in FIG5 , the distributed application detection device provided by this embodiment is used in a distributed application detection system, and the distributed application detection system includes: a server and at least one virtual machine, and the device includes:

[0145] An acquisition module 210 is used to acquire multiple applications to be detected;

[0146] A determination module 220, configured to determine a target virtual machine according to a weight of at least one virtual machine in an idle state; the weight is at least related to a detection speed of the virtual machine and a probability of successful detection, and the weight is updated based on the detection of the target application by the virtual machine;

[0147] The sending module 230 is used to send the target application among the multiple applications to the target virtual machine; the obtaining module 210 is also used to obtain the detection result of the target virtual machine on the target application and the updated weight;

[0148] The device repeatedly executes the operations of the determination module 220, the sending module 230 and the acquisition module 210 until the detection of multiple application programs is completed.

[0149] Optionally, the determining module 220 is specifically configured to:

[0150] A virtual machine with the largest weight among the at least one virtual machine is determined as the target virtual machine.

[0151] Optionally, the updated weight is determined by the target virtual machine based on detection data of the target application; the detection data includes at least one of the following: the number of times the detection tool is run, the maximum number of times it is run, a step coefficient and a first step length; the step coefficient is the coefficient used when the weight is reduced, and the first step length is the step length used when the weight is increased.

[0152] Optionally, the smaller the number of times the detection tool is run, and / or the higher the probability of successful detection, the greater the weight.

[0153] Optionally, if the target virtual machine obtains the detection result for the mth time when running the detection tool, the updated weight is obtained by increasing the weight before the update by the first step length, and the first step length is less than the step length coefficient; m is an integer greater than 0; the weight before the update is an initial value, or a value obtained in the previous update, and the initial value is a preset value;

[0154] If the target virtual machine obtains the detection result after running the detection tool for the i-th time, the updated weight is obtained by subtracting the second step length from the weight before the update; the second step length is obtained based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

[0155] Optionally, the acquisition module 210 is specifically configured to:

[0156] Based on a target order, the target application is obtained from a plurality of pre-acquired applications; the target order is an order based on target attributes of the application, and the target attribute includes at least one of the following: priority, update time, name or type.

[0157] Optionally, the acquisition module 210 is further configured to:

[0158] Receive status indication information of the virtual machine, where the status indication information includes an identifier and an idle state of the virtual machine; the identifier includes an IP address.

[0159] Optionally, the determination module 220 is further configured to:

[0160] The state of the target virtual machine is restored to a snapshot state; the snapshot state is a state in which the target virtual machine waits to receive the target application and starts detection after receiving the target application.

[0161] Optionally, the device of this embodiment may be arranged in a server.

[0162] The device of the embodiment of the present invention is used to execute the method in any of the aforementioned server-side method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0163] Figure 6 FIG. 1 is a schematic diagram of the structure of another embodiment of the distributed application detection device provided by the present invention. Figure 6 As shown, the distributed application detection device provided in this embodiment includes:

[0164] Receiving module 220, used for receiving the target application sent by the server;

[0165] The processing module 221 is used to detect the target application to obtain a detection result, and update the weight of the virtual machine to obtain an updated weight; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection;

[0166] The sending module 222 is used to send the detection result and the updated weight to the server.

[0167] Optionally, the processing module 221 is specifically configured to:

[0168] If the virtual machine obtains a detection result after running the detection tool for the mth time, the weight before update is increased by the first step length to obtain the updated weight, wherein the first step length is less than the first coefficient; m is an integer greater than 0; the weight before update is the initial value, or the weight obtained in the previous update, and the initial value is a preset value;

[0169] If the virtual machine obtains the detection result after running the detection tool for the i-th time, the second step length is subtracted from the weight before update to obtain the updated weight, where the second step length is based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

[0170] Optionally, the sending module 222 is further configured to:

[0171] If the virtual machine is in an idle state, the state indication information and the weight of the virtual machine are sent to the server; the state indication information includes the identifier and the idle state of the virtual machine; and the identifier includes an IP address.

[0172] Optionally, the device of this embodiment may be arranged in a virtual machine.

[0173] The device of the embodiment of the present invention is used to execute the method in any of the aforementioned method embodiments on the virtual machine side. Its implementation principle and technical effects are similar and will not be repeated here.

[0174] Here is an example:

[0175] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7As shown, the electronic device may include: a processor (processor) 710, a communication interface (Communications Interface) 720, a memory (memory) 730 and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 complete mutual communication through the communication bus 740. The processor 710 can call the logic instructions in the memory 730 to execute the following method: Step 101, the server obtains multiple applications to be detected; Step 102, the server determines the target virtual machine according to the weight of at least one virtual machine in an idle state; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection, and the weight is obtained by updating the detection of the target application by the virtual machine; Step 103, the server sends the target application of the multiple applications to the target virtual machine, and obtains the detection result of the target virtual machine on the target application and the updated weight; the server repeats steps 102-103 until the detection of multiple applications is completed.

[0176] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0177] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the following method: receiving a target application sent by a server; detecting the target application to obtain a detection result, and updating the weight of the virtual machine to obtain an updated weight; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection; and sending the detection result and the updated weight to the server.

[0178] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0179] On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the distributed application detection method provided in the above embodiments includes:

[0180] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0181] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A distributed application detection method, characterized in that: The method is used in a distributed application detection system, the distributed application detection system comprising: a server and at least one virtual machine, the method comprising: Step 101: The server obtains multiple applications to be detected; Step 102: The server determines a target virtual machine according to a weight of at least one virtual machine in an idle state; the weight is at least related to a detection speed of the virtual machine and a probability of successful detection, and the weight is updated based on the detection of the target application by the virtual machine; Step 103: the server sends a target application among the multiple applications to the target virtual machine, and obtains a detection result of the target virtual machine on the target application and an updated weight; The server repeatedly executes step 102 to step 103 until the detection of multiple applications is completed; If the target virtual machine obtains the detection result for the mth time when running the detection tool, the updated weight is obtained by increasing the weight before the update by the first step length, and the first step length is Step coefficient; m is an integer greater than 0; the weight before the update is the initial value, or the weight obtained in the previous update, and the initial value is a preset value; the step coefficient is the coefficient used when the weight decreases, and the first step is the step used when the weight increases; If the target virtual machine obtains the detection result after running the detection tool for the i-th time, the updated weight is obtained by subtracting the second step length from the weight before the update; the second step length is obtained based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

2. The distributed application detection method according to claim 1, characterized in that: The server determines a target virtual machine according to a weight of at least one virtual machine in an idle state, including: The server determines a virtual machine with the largest weight among the at least one virtual machine as the target virtual machine.

3. The distributed application detection method according to claim 1 or 2, characterized in that: The updated weight is determined by the target virtual machine based on detection data of the target application; the detection data includes at least one of the following: the number of runs of the detection tool, the maximum number of runs, the step coefficient, and the first step length.

4. The distributed application detection method according to claim 3, characterized in that: The smaller the number of times the detection tool is run, and / or the higher the probability of successful detection, the greater the weight.

5. The distributed application detection method according to any one of claims 1 to 4, characterized in that: The server obtains the application to be detected, including: The server obtains the target application from a plurality of pre-acquired applications based on a target order; the target order is an order based on target attributes of the application, and the target attributes include at least one of the following: priority, update time, name or type.

6. The distributed application detection method according to any one of claims 1 to 4, characterized in that: Before the server determines the target virtual machine according to the weight of at least one virtual machine in an idle state, the server further includes: The server receives status indication information of the virtual machine, where the status indication information includes an identifier and an idle state of the virtual machine; the identifier includes an IP address.

7. The distributed application detection method according to any one of claims 1 to 4, characterized in that: After obtaining the detection result of the target virtual machine on the target application, the method further includes: The server restores the state of the target virtual machine to a snapshot state; the snapshot state is a state in which the target virtual machine waits to receive the target application and starts detection after receiving the target application.

8. A distributed application detection method, characterized in that: The method is used in a distributed application detection system, the distributed application detection system comprising: a server and at least one virtual machine, the method comprising: The virtual machine receives the target application sent by the server; The virtual machine detects the target application to obtain a detection result, and updates the weight of the virtual machine to obtain an updated weight; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection; The virtual machine sends the detection result and the updated weight to the server; The step of updating the weight of the virtual machine to obtain an updated weight includes: If the virtual machine obtains the detection result after running the detection tool for the mth time, the weight before update is increased by the first step length to obtain the updated weight, and the first step length is The first coefficient; m is an integer greater than 0; the weight before the update is the initial value, or the weight obtained in the previous update, and the initial value is a preset value; the step coefficient is the coefficient used when the weight decreases, and the first step is the step used when the weight increases; If the virtual machine obtains the detection result after running the detection tool for the i-th time, the second step length is subtracted from the weight before update to obtain the updated weight, where the second step length is based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

9. The distributed application detection method according to claim 8, characterized in that: Before the virtual machine receives the target application sent by the server, the method further includes: If the virtual machine is in an idle state, the virtual machine sends the state indication information and the weight of the virtual machine to the server; the state indication information includes the identifier and the idle state of the virtual machine; and the identifier includes the IP address.

10. A distributed application detection device, characterized in that: The device is used in a distributed application detection system, the distributed application detection system includes: a server and at least one virtual machine, the device includes: An acquisition module, used for acquiring multiple applications to be detected; A determination module, configured to determine a target virtual machine according to a weight of at least one virtual machine in an idle state; the weight is at least related to a detection speed of the virtual machine and a probability of successful detection, and the weight is updated based on the detection of the target application by the virtual machine; The sending module is used to send the target application among the multiple applications to the target virtual machine; the obtaining module is also used to obtain the detection result of the target virtual machine on the target application and the updated weight; The device repeatedly executes the operations of the determination module, the sending module and the acquisition module until the detection of multiple applications is completed; If the target virtual machine obtains the detection result for the mth time when running the detection tool, the updated weight is obtained by increasing the weight before the update by the first step length, and the first step length is Step coefficient; m is an integer greater than 0; the weight before the update is the initial value, or the weight obtained in the previous update, and the initial value is a preset value; the step coefficient is the coefficient used when the weight decreases, and the first step is the step used when the weight increases; If the target virtual machine obtains the detection result after running the detection tool for the i-th time, the updated weight is obtained by subtracting the second step length from the weight before the update; the second step length is obtained based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

11. A distributed application detection device, characterized in that: The device is used in a distributed application detection system, the distributed application detection system includes: a server and at least one virtual machine, the device includes: A receiving module, used for receiving a target application sent by a server; A processing module, configured to detect the target application to obtain a detection result, and update the weight of the virtual machine to obtain an updated weight; the weight is at least related to the detection speed of the virtual machine and the probability of successful detection; A sending module, used to send the detection result and the updated weight to the server; The processing module is specifically used for: If the virtual machine obtains the detection result after running the detection tool for the mth time, the weight before update is increased by the first step length to obtain the updated weight, and the first step length is The first coefficient; m is an integer greater than 0; the weight before the update is the initial value, or the weight obtained in the previous update, and the initial value is a preset value; the step coefficient is the coefficient used when the weight decreases, and the first step is the step used when the weight increases; If the virtual machine obtains the detection result after running the detection tool for the i-th time, the second step length is subtracted from the weight before update to obtain the updated weight, where the second step length is based on i, the maximum number of runs and the step length coefficient; i is greater than m, and i is less than or equal to the maximum number of runs.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the distributed application detection method according to any one of claims 1 to 7 are implemented, or the steps of the distributed application detection method according to claim 8 or 9 are implemented.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the distributed application detection method according to any one of claims 1 to 7 are implemented, or the steps of the distributed application detection method according to claim 8 or 9 are implemented.

14. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the steps of the distributed application detection method according to any one of claims 1 to 7, or the steps of the distributed application detection method according to claim 8 or 9.

Images