Malicious application behavior analysis method, device and related products
By establishing a set of monitoring objects, tracking behavioral data and extracting features, generating sample feature sequences and inputting them into the behavioral analysis model, the problem of malicious application camouflage performance is solved, and effective monitoring and identification of malicious applications is achieved.
Patent Information
- Application Number
- CN202210096487.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-01-26
- Publication Date
- 2025-10-03
- Estimated Expiration
- 2042-01-26
AI Technical Summary
Malicious applications have extremely strong camouflage capabilities, which increases the difficulty of monitoring. Existing technologies cannot effectively identify and analyze their behavior.
By determining the application to be analyzed, establishing a set of monitoring objects, tracking data based on the behavior tracking model, extracting sample feature sequences, and inputting them into the behavior analysis model for analysis.
Effective monitoring and identification of malicious applications are achieved, improving security.
Smart Images
Figure CN114491534B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of security technology, and in particular to a behavior analysis method, device, and related products for malicious application programs. Background Art
[0002] With the rapid development of the Internet, it has become very easy for users to obtain information from the Internet. However, the Internet is extremely open, which makes users vulnerable to attacks from malicious applications while using the Internet. In addition, these malicious applications have extremely strong camouflage capabilities to avoid being monitored, thereby increasing the difficulty of monitoring malicious applications. Summary of the Invention
[0003] Based on the above problems, embodiments of the present application provide a behavior analysis method, device, and related products for malicious application programs.
[0004] The embodiments of this application disclose the following technical solutions:
[0005] A method for analyzing behavior of an application program, comprising:
[0006] Determine the application to be analyzed, and establish a monitoring object set based on the determined application to be analyzed;
[0007] Based on a set behavior tracking model, tracking behavior data of each application in the monitoring object set to form a sample behavior data set;
[0008] For each application in the monitoring object set, feature extraction is performed on the corresponding sample behavior data to generate a sample feature sequence;
[0009] The sample feature sequence corresponding to each application is input into a set behavior analysis model to perform behavior analysis on the application.
[0010] Optionally, determining the application to be analyzed and establishing a monitoring object set based on the determined application to be analyzed includes: obtaining historical behavior data of each specified application in the specified application set, determining the application to be analyzed based on the historical behavior data of each specified application, and establishing a monitoring object set based on the determined application to be analyzed.
[0011] Optionally, obtaining the historical behavior data of each specified application in the specified application set includes: creating corresponding multiple monitoring lists based on the number of specified applications in the specified application set, and writing the ID of the corresponding specified application in each monitoring list, and obtaining the historical behavior data of the corresponding specified application based on the ID of the specified application recorded in the multiple monitoring lists.
[0012] Optionally, obtaining historical behavior data of corresponding specified applications based on the IDs of specified applications recorded in multiple monitoring lists includes: creating multiple tasks that can be executed in parallel based on the IDs of specified applications recorded in multiple monitoring lists, so as to obtain historical behavior data of multiple specified applications in the specified application set by running multiple tasks in parallel.
[0013] Optionally, determining the application to be analyzed based on the historical behavior data of each designated application includes: evaluating the credibility of each designated application based on the historical behavior data of each designated application to obtain a credibility evaluation value; and screening out the application to be analyzed based on the credibility evaluation value.
[0014] Optionally, the screening out of the applications to be analyzed based on the trustworthy evaluation values includes: counting the average trustworthy evaluation values of each designated application within a set statistical period, and selecting the designated applications whose average trustworthy evaluation values are not greater than the set average trustworthy evaluation threshold as the applications to be analyzed.
[0015] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set first behavior tracking model, the behavior data of the calling interface function of each application in the monitoring object set is tracked to form a first sample behavior data set.
[0016] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set second behavior tracking model, the behavior data of file operations of each application in the monitoring object set is tracked to form a second sample behavior data set.
[0017] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set third behavior tracking model, the memory access behavior data of each application in the monitoring object set is tracked to form a third sample behavior data set.
[0018] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set fourth behavior tracking model, the behavior data of data sending and receiving of each application in the monitoring object set is tracked to form a fourth sample behavior data set.
[0019] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set fifth behavior tracking model, the behavior data of the environmental change data caused by the operation of each application in the monitoring object set is tracked to form a fifth sample behavior data set.
[0020] A device for analyzing the behavior of an application program, comprising:
[0021] A monitoring object establishing unit, configured to determine an application to be analyzed and establish a monitoring object set based on the determined application to be analyzed;
[0022] a behavior data set establishing unit, which tracks behavior data of each application in the monitoring object set based on a set behavior tracking model to form a sample behavior data set;
[0023] A sample feature sequence generating unit is used to extract features from the corresponding sample behavior data for each application in the monitoring object set to generate a sample feature sequence;
[0024] The behavior analysis unit is used to input the sample feature sequence corresponding to each application into a set behavior analysis model to perform behavior analysis on the application.
[0025] Optionally, the monitoring object establishment unit is further used to: obtain historical behavior data of each specified application in the specified application set, determine the application to be analyzed based on the historical behavior data of each specified application, and establish a monitoring object set based on the determined application to be analyzed.
[0026] Optionally, the monitoring object establishment unit is further specifically used to: create corresponding multiple monitoring lists based on the number of specified applications in the specified application set, and write the ID of the corresponding specified application in each monitoring list, and obtain the historical behavior data of the corresponding specified application based on the ID of the specified application recorded in the multiple monitoring lists.
[0027] Optionally, the monitoring object establishment unit is further specifically used to: create multiple tasks that can be executed in parallel based on the IDs of the specified applications recorded in multiple monitoring lists, so as to obtain historical behavior data of multiple specified applications in the specified application set by running multiple tasks in parallel.
[0028] Optionally, the monitoring object establishment unit is further specifically configured to evaluate the credibility of each designated application based on historical behavior data of each designated application to obtain a credibility evaluation value; and screen out the application to be analyzed based on the credibility evaluation value.
[0029] Optionally, the monitoring object establishment unit is further specifically configured to count the average trustworthy evaluation value of each designated application within a set statistical period, and select designated applications whose average trustworthy evaluation value is not greater than a set average trustworthy evaluation threshold as applications to be analyzed.
[0030] Optionally, the behavior data set establishing unit is specifically configured to track the behavior data of the calling interface function of each application in the monitoring object set based on a set first behavior tracking model to form a first sample behavior data set.
[0031] Optionally, the behavior data set establishing unit is specifically configured to: track the behavior data of file operations performed by each application in the monitoring object set based on a set second behavior tracking model to form a second sample behavior data set.
[0032] Optionally, the behavior data set establishing unit is specifically configured to track the memory access behavior data of each application in the monitoring object set based on a set third behavior tracking model to form a third sample behavior data set.
[0033] Optionally, the behavior data set establishing unit is specifically configured to track the behavior data of data sending and receiving of each application in the monitoring object set based on a set fourth behavior tracking model to form a fourth sample behavior data set.
[0034] Optionally, the behavior data set establishing unit is specifically configured to track the behavior data of the environment change data caused by the running of each application in the monitoring object set based on a set fifth behavior tracking model to form a fifth sample behavior data set.
[0035] An electronic device comprises: a memory and a processor, wherein the memory stores a computer executable program, and the processor is configured to execute the computer executable program to implement the method described in any one of the embodiments of the present application.
[0036] A computer storage medium having a computer executable program stored thereon, wherein the computer executable program, when executed, implements the method described in any one of the embodiments of the present application.
[0037] In the embodiment of the present application, an application to be analyzed is determined, and a monitoring object set is established based on the determined application to be analyzed;
[0038] Based on the set behavior tracking model, behavior data of each application in the monitoring object set is tracked to form a sample behavior data set; for each application in the monitoring object set, features are extracted from the corresponding sample behavior data to generate a sample feature sequence; the sample feature sequence corresponding to each application is input into the set behavior analysis model to perform behavior analysis on the application, thereby realizing monitoring of the application and ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0040] Figure 1 Schematic diagram of the flow of the behavior analysis method of malicious applications in Example 1 of the present application;
[0041] Figure 2 This is a schematic diagram of the structure of the behavior analysis device for malicious applications in Example 2 of the present application;
[0042] Figure 3 This is a schematic diagram of the structure of the electronic device in Example 3 of this application;
[0043] Figure 4 This is a schematic diagram of the hardware structure of the electronic device in Example 4 of the present application. DETAILED DESCRIPTION
[0044] The implementation of any technical solution in the embodiments of the present application does not necessarily require achieving all of the above advantages at the same time.
[0045] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.
[0046] In an embodiment of the present application, an application to be analyzed is determined, and a monitoring object set is established based on the determined application to be analyzed; based on a set behavior tracking model, behavior data of each application in the monitoring object set is tracked to form a sample behavior data set; for each application in the monitoring object set, features are extracted from the corresponding sample behavior data to generate a sample feature sequence; the sample feature sequence corresponding to each application is input into the set behavior analysis model to perform behavior analysis on the application.
[0047] Figure 1 This is a flow chart of a behavior analysis method for an application program according to an embodiment of the present application; Figure 1 As shown, it includes:
[0048] S101, determining an application to be analyzed, and establishing a monitoring object set based on the determined application to be analyzed;
[0049] Optionally, determining the application to be analyzed and establishing a monitoring object set based on the determined application to be analyzed includes: obtaining historical behavior data of each specified application in the specified application set, determining the application to be analyzed based on the historical behavior data of each specified application, and establishing a monitoring object set based on the determined application to be analyzed.
[0050] In this embodiment, the designated application set may be implemented based on user configuration or data provided by a third-party application.
[0051] In this embodiment, the historical behavior data includes any data that can reflect the credibility of the application, such as exchange behavior with other applications, behavior data of calling other applications, behavior data of changing its operating environment, etc.
[0052] Optionally, obtaining the historical behavior data of each specified application in the specified application set includes: creating corresponding multiple monitoring lists based on the number of specified applications in the specified application set, and writing the ID of the corresponding specified application in each monitoring list, and obtaining the historical behavior data of the corresponding specified application based on the ID of the specified application recorded in the multiple monitoring lists.
[0053] In this embodiment, the multiple monitoring lists can form an application registry, and one monitoring list is used to manage a specified application. The ID of the monitoring list is the ID of the specified application, thereby realizing orderly management of multiple specified applications, improving data processing efficiency, and avoiding the occurrence of disorder problems.
[0054] Of course, it should be noted here that historical behavior data can be coded to form code vectors. For a specified application, there are multiple historical behavior data, forming multiple code vectors. These multiple code vectors form a code matrix, thereby realizing vectorized representation of behavior and saving storage resources.
[0055] Optionally, obtaining historical behavior data of corresponding specified applications based on the IDs of specified applications recorded in multiple monitoring lists includes: creating multiple tasks that can be executed in parallel based on the IDs of specified applications recorded in multiple monitoring lists, so as to obtain historical behavior data of multiple specified applications in the specified application set by running multiple tasks in parallel.
[0056] In this embodiment, by executing multiple tasks in parallel, the efficiency of obtaining historical behavior data can be improved, the speed of algorithm implementation can be accelerated, and the real-time degree of solution implementation can be increased.
[0057] Specifically, when assigning tasks, tasks can be divided based on hash partitioning, thereby improving the rationality of the division and avoiding task duplication or conflict.
[0058] Optionally, determining the application to be analyzed based on the historical behavior data of each designated application includes: evaluating the credibility of each designated application based on the historical behavior data of each designated application to obtain a credibility evaluation value; and screening out the application to be analyzed based on the credibility evaluation value.
[0059] In this embodiment, a hash operation can be performed on each historical behavior data to obtain a corresponding hash value, and then compared with the hash value corresponding to the expected behavior data to determine the distance between the two hash values, such as the Euclidean distance or cosine distance, to obtain a credibility evaluation value. The closer the distance, the higher the credibility evaluation value. Of course, here, in order to reduce the difficulty of algorithm implementation, the possible hash values calculated can be binned to obtain several intervals, and the different intervals can be matched with the hash values corresponding to the expected behavior data, so as to obtain a credibility evaluation value based on the degree of matching.
[0060] Optionally, the screening out of the applications to be analyzed based on the trustworthy evaluation values includes: counting the average trustworthy evaluation values of each designated application within a set statistical period, and selecting the designated applications whose average trustworthy evaluation values are not greater than the set average trustworthy evaluation threshold as the applications to be analyzed.
[0061] In this embodiment, in order to improve objectivity, the average trust evaluation value is calculated based on a set statistical period, and then the application with the average trust evaluation value not greater than the set average trust evaluation threshold is preliminarily judged to be potentially malicious or attacking, and thus selected as the application to be analyzed.
[0062] S102 : Based on a set behavior tracking model, track behavior data of each application in the monitoring object set to form a sample behavior data set.
[0063] In this embodiment, different behavior tracking models can be set according to different behavior data to be tracked. Of course, the tracking model here can be a neural network model or a regular expression.
[0064] Specifically, when executing step S102, at least one of the following four situations may exist.
[0065] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set first behavior tracking model, the behavior data of the calling interface function of each application in the monitoring object set is tracked to form a first sample behavior data set.
[0066] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set second behavior tracking model, the behavior data of file operations of each application in the monitoring object set is tracked to form a second sample behavior data set.
[0067] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set third behavior tracking model, the memory access behavior data of each application in the monitoring object set is tracked to form a third sample behavior data set.
[0068] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set fourth behavior tracking model, the behavior data of data sending and receiving of each application in the monitoring object set is tracked to form a fourth sample behavior data set.
[0069] Optionally, based on the set behavior tracking model, the behavior data of each application in the monitoring object set is tracked to form a sample behavior data set, including: based on the set fifth behavior tracking model, the behavior data of the environmental change data caused by the operation of each application in the monitoring object set is tracked to form a fifth sample behavior data set.
[0070] Here, it should be noted that the above-mentioned first to fifth sample behavior data sets can be specifically obtained from a relational database, or, can also be stored in a vectorized database after similar vectorization, thereby improving the real-time nature of data acquisition and improving the efficiency of data processing.
[0071] S103 : For each application in the monitoring object set, extract features from the corresponding sample behavior data to generate a sample feature sequence.
[0072] In this embodiment, when executing step S103 , the sample behavior data may be input into a feature extraction model for feature extraction to generate a sample feature sequence.
[0073] In this embodiment, the sample feature sequence, such as the first to fifth sample feature sequences of the above-mentioned first to fifth sample behavior data sets, can similarly also store the first to fifth sample feature sequences in a vector database, so that the feature extraction model can actually be configured directly based on the vector database, thereby quickly generating a sample feature sequence.
[0074] S104: Input the sample feature sequence corresponding to each application into a set behavior analysis model to perform behavior analysis on the application.
[0075] In this embodiment, the behavior analysis model may be a binary classification model, for example, classification is performed from the perspective of determining whether the application is malicious or non-malicious.
[0076] Specifically, for example, the deviation between each feature in the sample feature sequence and the expected feature is counted, and then these deviations are weighted averaged to obtain a weighted average value. If the weighted average value is greater than the set weighted average threshold, the corresponding application is considered malicious, otherwise it is considered non-malicious.
[0077] Figure 2 This is a schematic diagram of the structure of a behavior analysis device for an application program according to an embodiment of the present application; Figure 2 As shown, it includes:
[0078] The monitoring object establishing unit 201 is used to determine the application to be analyzed and establish a monitoring object set based on the determined application to be analyzed;
[0079] The behavior data set establishing unit 202 performs behavior data tracking on each application in the monitoring object set based on a set behavior tracking model to form a sample behavior data set;
[0080] The sample feature sequence generating unit 203 is configured to extract features from the corresponding sample behavior data for each application in the monitoring object set to generate a sample feature sequence;
[0081] The behavior analysis unit 204 is configured to input the sample feature sequence corresponding to each application into a set behavior analysis model to perform behavior analysis on the application.
[0082] Optionally, the monitoring object establishing unit 201 is further used to: obtain historical behavior data of each specified application in the specified application set, determine the application to be analyzed based on the historical behavior data of each specified application, and establish a monitoring object set based on the determined application to be analyzed.
[0083] Optionally, the monitoring object establishment unit 201 is also specifically used to: create corresponding multiple monitoring lists based on the number of specified applications in the specified application set, and write the ID of the corresponding specified application in each monitoring list, and obtain the historical behavior data of the corresponding specified application based on the ID of the specified application recorded in the multiple monitoring lists.
[0084] Optionally, the monitoring object establishment unit 201 is further specifically used to create multiple tasks that can be executed in parallel based on the IDs of the specified applications recorded in multiple monitoring lists, so as to obtain historical behavior data of multiple specified applications in the specified application set by running multiple tasks in parallel.
[0085] Optionally, the monitoring object establishing unit 201 is further specifically configured to evaluate the credibility of each designated application based on the historical behavior data of each designated application to obtain a credibility evaluation value; and to filter out the application to be analyzed based on the credibility evaluation value.
[0086] Optionally, the monitoring object establishing unit 201 is further specifically configured to count the average trustworthiness evaluation value of each designated application within a set statistical period, and select designated applications whose average trustworthiness evaluation value is not greater than a set average trustworthiness evaluation threshold as applications to be analyzed.
[0087] Optionally, the behavior data set establishing unit 202 is specifically configured to track the behavior data of the calling interface function of each application in the monitoring object set based on a set first behavior tracking model to form a first sample behavior data set.
[0088] Optionally, the behavior data set establishing unit 202 is specifically configured to: track the behavior data of file operations performed by each application in the monitoring object set based on a set second behavior tracking model to form a second sample behavior data set.
[0089] Optionally, the behavior data set establishing unit 202 is specifically configured to track the memory access behavior data of each application in the monitoring object set based on a set third behavior tracking model to form a third sample behavior data set.
[0090] Optionally, the behavior data set establishing unit 202 is specifically configured to track the behavior data of data sending and receiving of each application in the monitoring object set based on a set fourth behavior tracking model to form a fourth sample behavior data set.
[0091] Optionally, the behavior data set establishing unit 202 is specifically configured to track the behavior data of the environment change data caused by the running of each application in the monitoring object set based on a set fifth behavior tracking model to form a fifth sample behavior data set.
[0092] Figure 3 Schematic diagram of the structure of the electronic device in the third embodiment of the present application; Figure 3 As shown, it includes: a memory 301 and a processor 302, the memory stores a computer executable program, and the processor is used to execute the computer executable program to implement the method described in any embodiment of the present application.
[0093] Figure 4 Schematic diagram of the hardware structure of the electronic device in the fourth embodiment of the present application; Figure 4 As shown, the hardware structure of the electronic device may include: a processor 401, a communication interface 402, a computer-readable medium 403 and a communication bus 404;
[0094] The processor 401, the communication interface 402, and the computer-readable medium 403 communicate with each other via a communication bus 404;
[0095] Optionally, the communication interface 402 may be an interface of a communication module, such as an interface of a GSM module;
[0096] The processor 401 may be specifically configured to run an executable program stored in the memory, thereby executing all or part of the processing steps of any of the above method embodiments.
[0097] The processor 401 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.
[0098] The electronic devices of the embodiments of the present application exist in various forms, including but not limited to:
[0099] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and are primarily designed to provide voice and data communications. These terminals include smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones.
[0100] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.
[0101] (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.
[0102] (4) Server: A device that provides computing services. The server consists of a processor 710, a hard disk, memory, a system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.
[0103] (5) Other electronic devices with data interaction functions.
[0104] Embodiment 7 of the present application provides a computer storage medium, on which a computer executable program is stored. When the computer executable program is executed, the method described in any embodiment of the present application is implemented.
[0105] An embodiment of the present application further provides a data system, which includes the electronic device described in any embodiment of the present application.
[0106] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and system embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components indicated as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without paying any creative work.
[0107] The above is only a specific implementation of the present application, but the scope of protection of the present application is not limited thereto. Any changes or replacements that can be easily conceived by any technician familiar with this technical field within the technical scope disclosed in this application should be covered by the scope of protection of the present application.
Claims
1. A method for analyzing the behavior of an application, characterized in that: include: Determine the application to be analyzed, and establish a monitoring object set based on the determined application to be analyzed; Based on a set behavior tracking model, tracking behavior data of each application in the monitoring object set to form a sample behavior data set; The behavior tracking model includes at least one of a first behavior tracking model, a second behavior tracking model, a third behavior tracking model, a fourth behavior tracking model, and a fifth behavior tracking model; The first behavior tracking model is used to track behavior data of the calling interface function of each application in the monitoring object set to form a first sample behavior data set; The second behavior tracking model is used to track the behavior data of file operations performed by each application in the monitoring object set to form a second sample behavior data set; The third behavior tracking model is used to track the memory access behavior data of each application in the monitoring object set to form a third sample behavior data set; The fourth behavior tracking model is used to track the behavior data of data sending and receiving of each application in the monitoring object set to form a fourth sample behavior data set; The fifth behavior tracking model is used to track the behavior data of the environment change data caused by the operation of each application in the monitoring object set to form a fifth sample behavior data set; For each application in the monitoring object set, feature extraction is performed on the corresponding sample behavior data to generate a sample feature sequence; Inputting the sample feature sequence corresponding to each application into a set behavior analysis model to perform behavior analysis on the application; The determining of the application to be analyzed and establishing a monitoring object set based on the determined application to be analyzed includes creating a plurality of corresponding monitoring lists according to the number of specified applications in the specified application set, writing the ID of the corresponding specified application in each monitoring list, obtaining historical behavior data of the corresponding specified application based on the ID of the specified application recorded in the plurality of monitoring lists, and simultaneously obtaining the historical behavior data of the plurality of applications through parallel tasks; Based on the historical behavior data of each of the designated applications, a credibility evaluation is performed on each designated application to obtain a credibility evaluation value; The average credibility evaluation value of each designated application within a set statistical period is counted, and the designated application whose average credibility evaluation value is not greater than the set average credibility evaluation threshold is used as the application to be analyzed.
2. The behavior analysis method according to claim 1, characterized in that: The determining of the application to be analyzed and establishing a monitoring object set based on the determined application to be analyzed includes: obtaining historical behavior data of each specified application in the specified application set, determining the application to be analyzed based on the historical behavior data of each specified application, and establishing a monitoring object set based on the determined application to be analyzed.
3. The behavior analysis method according to claim 1, characterized in that: The method of obtaining historical behavior data of corresponding specified applications based on the IDs of specified applications recorded in multiple monitoring lists includes: creating multiple tasks that can be executed in parallel according to the IDs of specified applications recorded in multiple monitoring lists, so as to obtain historical behavior data of multiple specified applications in the specified application set by running multiple tasks in parallel.
4. A device for analyzing the behavior of an application, characterized in that: include: A monitoring object establishing unit, configured to determine an application to be analyzed and establish a monitoring object set based on the determined application to be analyzed; a behavior data set establishing unit, which tracks behavior data of each application in the monitoring object set based on a set behavior tracking model to form a sample behavior data set; The behavior tracking model includes at least one of a first behavior tracking model, a second behavior tracking model, a third behavior tracking model, a fourth behavior tracking model, and a fifth behavior tracking model; The first behavior tracking model is used to track behavior data of the calling interface function of each application in the monitoring object set to form a first sample behavior data set; The second behavior tracking model is used to track the behavior data of file operations performed by each application in the monitoring object set to form a second sample behavior data set; The third behavior tracking model is used to track the memory access behavior data of each application in the monitoring object set to form a third sample behavior data set; The fourth behavior tracking model is used to track the behavior data of data sending and receiving of each application in the monitoring object set to form a fourth sample behavior data set; The fifth behavior tracking model is used to track the behavior data of the environment change data caused by the operation of each application in the monitoring object set to form a fifth sample behavior data set; A sample feature sequence generating unit, configured to extract features from the corresponding sample behavior data for each application in the monitoring object set to generate a sample feature sequence; A behavior analysis unit, configured to input a sample feature sequence corresponding to each application into a set behavior analysis model to perform behavior analysis on the application; The determining of the application to be analyzed and establishing a monitoring object set based on the determined application to be analyzed includes creating a plurality of corresponding monitoring lists according to the number of specified applications in the specified application set, writing the ID of the corresponding specified application in each monitoring list, obtaining historical behavior data of the corresponding specified application based on the ID of the specified application recorded in the plurality of monitoring lists, and simultaneously obtaining the historical behavior data of the plurality of applications through parallel tasks; Based on the historical behavior data of each of the designated applications, a credibility evaluation is performed on each designated application to obtain a credibility evaluation value; The average credibility evaluation value of each designated application within a set statistical period is counted, and the designated application whose average credibility evaluation value is not greater than the set average credibility evaluation threshold is used as the application to be analyzed.
5. The behavior analysis device according to claim 4, characterized in that: The monitoring object establishing unit is further configured to obtain historical behavior data of each designated application in the designated application set, determine an application to be analyzed based on the historical behavior data of each designated application, and establish a monitoring object set based on the determined application to be analyzed.
6. An electronic device, characterized in that: include: A memory and a processor, wherein the memory stores a computer executable program, and the processor is configured to execute the computer executable program to implement the method according to any one of claims 1 to 3.
7. A computer storage medium, characterized in that The computer storage medium stores a computer executable program, and the computer executable program implements the method according to any one of claims 1 to 3 when executed.