Abnormality detection method, system, electronic device and storage medium for mobile device

Abstract

The present invention discloses a method, system, electronic device, and storage medium for detecting anomalies in a mobile device. The method comprises the following steps: obtaining a dynamic link library (DLL) when a mobile device requests an application, and splitting the DLL into a plurality of plug-in libraries; obtaining first label data and multiple feature information of each plug-in library, inputting the feature information and first label data into a support vector machine model to obtain a risk score for the plug-in library; obtaining a weight of the plug-in library based on the risk score using Newton's law of cooling; obtaining a dynamic link library score based on the weight of the plug-in library and the corresponding risk score; and determining whether the corresponding mobile device is an abnormal device based on the dynamic link library score. The present invention does not need to rely on a blacklist when detecting mobile devices. Based on the identification and detection of plug-in libraries, it can improve the coverage rate of abnormal device detection and improve the efficiency of anomaly detection.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method, system, electronic device and storage medium for detecting anomalies in a mobile device. Background Art

[0002] Nowadays, anomaly detection on mobile terminals plays an important role in maintaining business security. In related technologies, when detecting anomalies, the system will include some risk tags for detecting device anomalies. These tags can check whether the device is jailbroken, whether the device jailbreak detection is bypassed, whether the device information is tampered with, and other risks. However, the use of risk tags is not only limited by version, but some tags also require blacklist maintenance. Therefore, when risk tags identify abnormal risks, they are inefficient and easy to miss risks, and cannot effectively improve the coverage of abnormal device detection. Summary of the Invention

[0003] The following is a summary of the subject matter described in detail herein. This summary is not intended to limit the scope of the claims.

[0004] Embodiments of the present invention provide a method, system, electronic device, and storage medium for detecting anomalies in a mobile device, which can improve the coverage of abnormal device detection and increase the efficiency of anomaly detection.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting anomalies in a mobile device, comprising: obtaining a dynamic link library when a mobile device requests an application, and splitting the dynamic link library into several plug-in libraries; obtaining first label data and multiple feature information of each of the plug-in libraries, inputting the feature information and the first label data into a support vector machine model to obtain a risk score for the plug-in library; obtaining a weight of the plug-in library according to the risk score using Newton's law of cooling; obtaining a dynamic link library score by weighting the weight of the plug-in library and the corresponding risk score; and judging whether the corresponding mobile device is an abnormal device according to the dynamic link library score.

[0006] In some embodiments, the feature information includes a word scoring feature, which is obtained according to the following steps: obtaining the plug-in library name of the plug-in library and splitting the plug-in library name into several words; selecting target words from the words and calculating the homogeneity feature and the difference feature of each target word; and obtaining the word scoring feature corresponding to the plug-in library based on the homogeneity feature and the difference feature.

[0007] In some embodiments, the calculating to obtain the homogeneity feature and the difference feature of each target word includes: obtaining second label data, and determining an abnormal plug-in library and a normal plug-in library among the plurality of plug-in libraries based on the second label data; obtaining a first request number of the abnormal plug-in library containing the target word, a second request number of all the abnormal plug-in libraries, and a third request number of the normal plug-in library containing the target word; obtaining the homogeneity feature based on a proportional relationship between the first request number and the second request number, and obtaining the difference feature based on a proportional relationship between the first request number and the third request number.

[0008] In some embodiments, obtaining the word scoring feature corresponding to the plug-in library based on the homogeneity feature and the difference feature includes: selecting the maximum value of the homogeneity feature and the maximum value of the difference feature among the homogeneity feature and the difference feature of all words in the plug-in library; and obtaining the word scoring feature according to the product of the maximum value of the homogeneity feature and the maximum value of the difference feature.

[0009] In some embodiments, the feature information further includes at least one of hyphen information in the plug-in library name, character information in the plug-in library name, the number of the plug-in libraries in the dynamic link library containing the abnormal plug-in library, the number of the plug-in libraries under the dynamic link library, and the number of the words obtained by splitting.

[0010] In some embodiments, inputting the feature information and the first label data into a support vector machine model to obtain a risk score for the plug-in library includes: calculating a correlation coefficient between a plurality of the feature information; obtaining a first preset threshold for feature screening; when the correlation coefficient between the feature information is greater than the first preset threshold, retaining at least one of the feature information; and inputting the retained feature information and the first label data into the support vector machine model to obtain the risk score.

[0011] In some embodiments, determining whether the corresponding mobile device is an abnormal device based on the dynamic link library score includes: obtaining a second preset threshold value obtained based on an abnormal dynamic link library sample; when the dynamic link library score is greater than the second preset threshold value, determining that the corresponding mobile device is an abnormal device.

[0012] In a second aspect, an embodiment of the present invention further provides an anomaly detection system for a mobile device, comprising: a data acquisition module, configured to acquire a dynamic link library when a mobile device requests an application, and split the dynamic link library into several plug-in libraries; a data processing module, configured to acquire first label data and multiple feature information of each of the plug-in libraries, and input the feature information and the first label data into a support vector machine model to obtain a risk score of the plug-in library; an anomaly scoring module, configured to obtain a weight of the plug-in library according to the risk score using Newton's law of cooling, and obtain a dynamic link library score by weighting the weight of the plug-in library and the corresponding risk score; and an anomaly detection module, configured to determine whether the corresponding mobile device is an abnormal device according to the dynamic link library score.

[0013] In a third aspect, an embodiment of the present invention further provides an electronic device, characterized in that it includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the abnormality detection method for the mobile device described in the first aspect.

[0014] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the abnormality detection method for a mobile device as described in the first aspect.

[0015] The embodiments of the present invention have at least the following beneficial effects:

[0016] The present invention discloses an anomaly detection method, system, electronic device and storage medium for a mobile device, wherein, when executing the anomaly detection method, the anomaly detection system of the mobile device first obtains the dynamic link library of the mobile device when requesting an application, and splits it into several plug-in libraries, and performs anomaly detection based on the plug-in library. The system obtains the first label data and multiple feature information of the plug-in library, and inputs them into a support vector machine model to obtain the risk score of the plug-in library, and then calculates the weight of the plug-in library. The weight of the plug-in library and the risk score are weighted to obtain the dynamic link library score. By judging the dynamic link library score, it can be determined whether the mobile device corresponding to the dynamic link library score is an abnormal device. The embodiment of the present invention does not need to rely on a blacklist when detecting mobile devices. Based on the identification and detection of the plug-in library, it can improve the coverage of abnormal device detection and improve the efficiency of anomaly detection.

[0017] Other features and advantages of the present invention will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present invention. The purposes and other advantages of the present invention can be realized and obtained through the structures particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are used to provide a further understanding of the technical solution of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the technical solution of the present invention and do not constitute a limitation to the technical solution of the present invention.

[0019] Figure 1 This is a flow chart of a method for detecting anomalies in a mobile device according to an embodiment of the present invention;

[0020] Figure 2 is a flow chart of a method for detecting anomalies in a mobile device provided by another embodiment of the present invention;

[0021] Figure 3 is a flow chart of a method for detecting anomalies in a mobile device provided by another embodiment of the present invention;

[0022] Figure 4 is a flow chart of a method for detecting anomalies in a mobile device provided by another embodiment of the present invention;

[0023] Figure 5 is a flow chart of a method for detecting anomalies in a mobile device provided by another embodiment of the present invention;

[0024] Figure 6 is a flow chart of a method for detecting anomalies in a mobile device provided by another embodiment of the present invention;

[0025] Figure 7 1 is a schematic diagram of an anomaly detection system for a mobile device provided by an embodiment of the present invention;

[0026] Figure 8 It is a schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0028] It should be understood that in the description of the embodiments of the present invention, "several" means more than one, "multiple" means more than two, "greater than," "less than," and "exceed" are understood to exclude the number itself, while "above," "below," and "within" are understood to include the number itself. The use of "first," "second," and the like in the description is solely for the purpose of distinguishing technical features and is not to be construed as indicating or implying relative importance, implicitly specifying the number of the indicated technical features, or implicitly specifying the order of the indicated technical features.

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present invention pertains. The terms used herein are for the purpose of describing embodiments of the present invention only and are not intended to limit the present invention.

[0030] Embodiments of the present invention provide a method and system for detecting anomalies in a mobile device, an electronic device, and a storage medium, which can improve the coverage of abnormal device detection and improve the efficiency of anomaly detection.

[0031] The abnormality detection method for a mobile device disclosed in the embodiments of the present invention is specifically described through the following embodiments.

[0032] Reference Figure 1 As shown, Figure 1 This is an optional flowchart of the abnormality detection method for a mobile device provided by an embodiment of the present invention. Figure 1 The method may include but is not limited to step S110, step S120, step S130, step S140, step S150 and step S160.

[0033] Step S110 , obtaining a dynamic link library when the mobile device requests an application, and splitting the dynamic link library into several plug-in libraries.

[0034] In some embodiments of the present invention, a method for detecting anomalies in a mobile device is applied in an anomaly detection system of the mobile device. The anomaly detection system can obtain dynamic-link library (DLL) data when the mobile device requests an application, and organize and store the collected dynamic-link libraries. The dynamic-link library is a module containing functions and data, which can be used by other modules (applications or other DLLs). Since each dynamic-link library is composed of several plug-in libraries, each dynamic-link library is split into several plug-in libraries, that is, each dynamic-link library data is split into several plug-in library data.

[0035] It should be noted that the mobile device in the embodiment of the present invention may be any form of mobile terminal. For example, the mobile device may be a mobile phone, a tablet computer, or other forms of mobile terminals, and the embodiment of the present invention does not impose any specific restrictions on this.

[0036] Step S120 , obtaining first label data and multiple feature information of each plug-in library, inputting the feature information and first label data into a support vector machine model, and obtaining a risk score of the plug-in library.

[0037] In some embodiments of the present invention, after the anomaly detection system splits into several plug-in libraries, it can obtain the first label data of the plug-in library and the feature information corresponding to the multiple plug-in libraries. When the dynamic link library is split into multiple plug-in libraries, the anomaly detection system can respectively obtain the first label data of each plug-in library and the multiple feature information of each plug-in library. When the dynamic link library is split into one plug-in library, the first label data and the multiple feature information of the plug-in library are obtained. In the subsequent embodiments of the present invention, the splitting into multiple plug-in libraries is used as an example. The first label data is the label data of the plug-in library. Then, the anomaly detection system can input the obtained multiple feature information and the first label data into the support vector machine (SVM) model. After processing by the support vector machine model, the risk score corresponding to the plug-in library can be obtained. The risk score is used to characterize the possibility of the plug-in library being abnormal.

[0038] Step S130 : Obtain the weight of the plug-in library according to the risk score using Newton's law of cooling.

[0039] In some embodiments of the present invention, after obtaining the risk score of the plug-in library, the anomaly detection system calculates the weight of each plug-in library by using Newton's law of cooling. For example, the anomaly detection system sorts the plug-in libraries from high to low according to their risk scores. When the weight of the plug-in library ranked e is 1 / e of the weight of the first-ranked one, such as the weight of the plug-in library ranked 30 is 1 / 30 of the weight of the first-ranked one, the weight of all plug-in library scores is calculated using Newton's law of cooling. On the premise of meeting the requirements of the embodiments of the present invention, the anomaly detection system can also calculate the weight of the plug-in library by other means.

[0040] Step S140 , obtaining a dynamic link library score based on the weight of the plug-in library and the corresponding risk score.

[0041] In some embodiments of the present invention, after obtaining the weight of each plug-in library, the anomaly detection system calculates the risk score obtained in step S120 and the corresponding plug-in library weight to obtain the corresponding dynamic link library score. It can be understood that each dynamic link library is composed of several plug-in libraries, each plug-in library has a score and a weight, and the weighted sum is used to obtain the dynamic link library score to obtain the dynamic link library score.

[0042] Step S150: determining whether the corresponding mobile device is an abnormal device based on the dynamic link library score.

[0043] In some embodiments of the present invention, after obtaining the dynamic link library score, the anomaly detection system determines whether the corresponding mobile device is an abnormal device based on the size of the dynamic link library score. The embodiments of the present invention do not need to rely on blacklists when detecting mobile devices. Based on the identification and detection of the plug-in library, the coverage of abnormal device detection can be improved, thereby improving the efficiency of anomaly detection.

[0044] It should be noted that the anomaly detection method for mobile devices in the embodiment of the present invention can be applied in the field of artificial intelligence to improve the efficiency of artificial intelligence in detecting anomalies in mobile devices. The anomaly detection method for mobile devices in the embodiment of the present invention can also be applied in a business risk decision system (ARES). After executing the anomaly detection method in the embodiment of the present invention, the business risk decision system can identify abnormal mobile devices without relying on the plug-in library blacklist, which can improve the coverage of abnormal device detection and improve the anomaly detection efficiency. No specific restrictions are made on its application scenarios here.

[0045] In some embodiments of the present invention, the multiple feature information of the plug-in library includes word scoring features. Figure 2 As shown, the word scoring features in the embodiment of the present invention can be obtained according to the following steps, including but not limited to the following steps S210, S220 and S230.

[0046] Step S210: Obtain the plug-in library name of the plug-in library, and split the plug-in library name into several words.

[0047] Step S220 , selecting target words from the words, and calculating the homogeneity feature and difference feature of each target word.

[0048] Step S230 , obtaining word scoring features of the corresponding plug-in library according to the homogeneity features and the difference features.

[0049] In some embodiments of the present invention, the plug-in library obtains a risk score by inputting multiple feature information and first label data into a support vector machine model. The multiple feature information includes the word scoring feature of the plug-in library. The word scoring feature of the plug-in library is obtained based on the plug-in library name. The anomaly detection system can obtain the plug-in library name of the plug-in library and split it into several words. When performing calculations, the calculation is performed for each word. When targeting a certain word, it is selected as the target word. The word scoring feature is obtained based on the word features of the word, including homogeneity features and difference features. Therefore, the homogeneity features and difference features of each target word are calculated, and the word scoring feature of the corresponding plug-in library is obtained based on the homogeneity features and difference features. The word scoring feature can represent the positive heterogeneity of the plug-in library corresponding to the word. Therefore, selecting the word scoring feature as one of the feature information can improve the accuracy of the obtained risk score. It is understandable that the homogeneity features and difference features in the embodiments of the present invention can be obtained based on the number of requests for the word in different types of plug-in libraries.

[0050] It should be noted that the anomaly detection system can split the plug-in library name according to a variety of algorithms. The anomaly detection system in the embodiment of the present invention uses a matching method to split the plug-in library name into words. Each plug-in library name can be split into several words. The matching and splitting can be set according to actual needs. In one embodiment, the anomaly detection system is based on the fact that the plug-in library names are basically in camel case. Therefore, when splitting the plug-in library name, the plug-in library name is split according to the camel case naming rules to obtain several words. In another embodiment, the anomaly detection system can also split the plug-in library name according to the Chinese word segmentation algorithm. There are two main Chinese word segmentation algorithms, namely the forward maximum matching method and the reverse maximum matching method. The anomaly detection system can split the plug-in library name into several words according to the forward maximum matching method and the reverse maximum matching method.

[0051] Reference Figure 3 As shown, step S220 of the abnormality detection method in the embodiment of the present invention may also include but is not limited to the following steps S310, S320 and S330.

[0052] Step S310: Acquire second label data, and determine an abnormal plug-in library and a normal plug-in library among a plurality of plug-in libraries according to the second label data.

[0053] Step S320 , obtaining a first request count of abnormal plug-in libraries containing the target word, a second request count of all abnormal plug-in libraries, and a third request count of normal plug-in libraries containing the target word.

[0054] Step S330 , obtaining a homogeneity feature based on a proportional relationship between the first number of requests and the second number of requests, and obtaining a difference feature based on a proportional relationship between the first number of requests and the third number of requests.

[0055] In some embodiments of the present invention, when the dynamic link library is split to obtain the plug-in library, the anomaly detection system aggregates the count by the plug-in library and calculates the number of requests for each plug-in library. The word scoring feature of the plug-in library is obtained according to the homogeneity feature and difference feature of the words in the plug-in library. In the process of calculating the homogeneity feature and the difference feature, the anomaly detection system needs to judge the abnormal price difference library and the normal plug-in library in the plug-in library. The anomaly detection system first obtains the second label data and determines the abnormal plug-in library and the normal plug-in library in the multiple plug-in libraries according to the second label data. The second label data is the label data obtained by the anomaly detection system for judging the abnormality of the plug-in library, which can be based on the existing abnormal plug-in library and the normal plug-in library. The label data of the normal plug-in library is obtained and compared with the first label data previously stored by the abnormality detection system to determine whether the stored plug-in library is one of the abnormal plug-in library and the normal plug-in library. Since there are multiple plug-in libraries, multiple abnormal plug-in libraries and multiple normal plug-in libraries will be obtained. Subsequently, when calculating the homogeneity feature and the difference feature of the target word, the first request number of the abnormal plug-in library containing the target word, the second request number of all abnormal plug-in libraries, and the third request number of the normal plug-in library containing the target word are obtained, and the homogeneity feature is obtained according to the proportional relationship between the first request number and the second request number, and the difference feature is obtained according to the proportional relationship between the first request number and the third request number.

[0056] Specifically, in one embodiment, the anomaly detection system can obtain the homogeneity feature of the target word by dividing the first request number by the second request number, and can obtain the request number of all plug-in libraries containing the target word by the sum of the first request number and the third request number, and can obtain the difference feature by dividing the first request number by the request number of all plug-in libraries containing the target word.

[0057] Reference Figure 4 As shown, step S230 of the abnormality detection method in the embodiment of the present invention may also include but not be limited to the following steps S410 and S420.

[0058] Step S410 : selecting the maximum value of the homogeneity feature and the maximum value of the difference feature from the homogeneity features and difference features of all the words in the plug-in library.

[0059] Step S420 , obtaining a word score feature according to the product of the maximum value of the homogeneity feature and the maximum value of the difference feature.

[0060] In some embodiments of the present invention, the word scoring feature of the plug-in library is obtained based on the homogeneity feature and the difference feature of the words in the plug-in library. The anomaly detection system selects the maximum value of the homogeneity feature and the maximum value of the difference feature from the homogeneity feature and the difference feature of all the words in a certain plug-in library, and multiplies the maximum value of the homogeneity feature and the maximum value of the difference feature to obtain the word scoring feature of the plug-in library. It can be understood that the basis for taking the maximum value of the homogeneity feature and the maximum value of the difference feature for calculation is that the name of a plug-in library can be split into multiple words, and each word can be calculated separately. The word scoring feature, and then the score of each word for the plug-in library is calculated, and the maximum value of these scores can be taken as the plug-in library word scoring feature. Therefore, in the embodiment of the present invention, the maximum value of the homogeneity feature and the maximum value of the difference feature are directly selected for calculation.

[0061] In some embodiments of the present invention, the feature information of the plug-in library also includes at least one of hyphen information in the plug-in library noun, character information in the plug-in library noun, the number of plug-in libraries in the dynamic link library containing the abnormal plug-in library, the number of plug-in libraries under the dynamic link library, and the number of words obtained by splitting. The risk score of the plug-in library is calculated by using the above multiple feature information, which can improve the accuracy of the risk score. On the premise of meeting the requirements of the embodiments of the present invention, in addition to the word score feature, the anomaly detection system can obtain other information of the plug-in library as needed and use it as one of the feature information to calculate the risk score of the plug-in library.

[0062] It can be understood that the hyphen information in the plug-in library noun may include the number of hyphens and numbers in the plug-in library name, etc.; the character information in the plug-in library noun may include the character length of the plug-in library, etc.; when sorting the dynamic link libraries, the anomaly detection system will aggregate the counts by dynamic link library, calculate the number of requests for each dynamic link library, and mark the dynamic link library containing the abnormal plug-in library as abnormal. The number of plug-in libraries in the dynamic link library containing the abnormal plug-in library is the number of plug-in libraries that appear in the abnormal dynamic link library; the anomaly detection system can split the dynamic link library into multiple plug-in libraries, so the number of plug-in libraries under the dynamic link library is the number of plug-in libraries that appear in all plug-in libraries.

[0063] Reference Figure 5 As shown, step S120 of the abnormality detection method in the embodiment of the present invention may further include but is not limited to the following steps S510, S520, S530 and S540.

[0064] Step S510: Calculate the correlation coefficients between multiple feature information.

[0065] Step S520: Obtain a first preset threshold for feature screening.

[0066] Step S530: When the correlation coefficient between the feature information is greater than a first preset threshold, retain at least one feature information.

[0067] Step S540: Input the retained feature information and the first label data into a support vector machine model to obtain a risk score.

[0068] In some embodiments of the present invention, when calculating a risk score, the anomaly detection system screens multiple feature information in the plug-in library to reduce the difficulty of calculation and optimize and simplify the calculation. In particular, in the embodiments of the present invention, the correlation coefficient between the multiple feature information is calculated by determining the correlation of the feature information. The correlation coefficient is a statistical indicator used to reflect the closeness of the correlation between variables. It is a non-deterministic relationship and is a coefficient that studies the degree of linear correlation between variables. The correlation coefficient is calculated using the product difference method, which is based on the deviation of two variables from their respective means and reflects the degree of correlation between the two variables by multiplying the two deviations. Correlation is a statistical indicator that describes the linear relationship between random variables. The larger the absolute value of the correlation coefficient, the stronger the linear relationship between the variables. The anomaly detection system then compares the obtained correlation coefficient with a first preset threshold. The first preset threshold is a pre-set comparison threshold used for feature screening and is set based on the actual calculation results. When the correlation coefficient between the feature information is greater than the first preset threshold, at least one feature information is retained, and the retained feature information and the first label data are input into the support vector machine model to obtain the risk score.

[0069] It should be noted that, in the embodiment of the present invention, by calculating the correlation coefficient between each pair of feature information, when the correlation coefficient between the feature information is greater than a first preset threshold, one of the feature information is retained. It can be understood that, on the premise of meeting the requirements of the embodiment of the present invention, the correlation coefficient can also be obtained for more than two feature information, and several feature information for correlation judgment can also be set. The specified feature information is used for correlation judgment, and two or more can be specified. The embodiment of the present invention does not impose specific restrictions on it, and it can be set according to the actual application scenario.

[0070] It should be noted that the feature information in the embodiment of the present invention may include word scoring features, hyphen information in the plug-in library noun, character information in the plug-in library noun, the number of plug-in libraries in the dynamic link library containing the abnormal plug-in library, the number of plug-in libraries under the dynamic link library and the number of words obtained by splitting, etc., and the correlation between the above feature information is judged pairwise to obtain the correlation coefficient between the pairwise feature information. When the correlation coefficient is greater than the first preset threshold, one of the feature information is retained, and then the retained feature information is input into the support vector machine model to obtain a risk score. It can be understood that the word scoring feature in the embodiment of the present invention will always be retained in the process of correlation coefficient judgment, and finally one of the feature information will be input into the support vector machine model. This is due to the calculation principle of the word scoring feature. It is difficult for the word scoring feature to have a strong correlation with other feature information, so it is always retained.

[0071] Reference Figure 6 As shown, step S150 of the abnormality detection method in the embodiment of the present invention may also include but not be limited to the following steps S610 and S620.

[0072] Step S610: Acquire a second preset threshold value obtained according to the abnormal dynamic link library sample.

[0073] Step S610: When the dynamic link library score is greater than a second preset threshold, the corresponding mobile device is determined to be an abnormal device.

[0074] In some embodiments of the present invention, after obtaining the dynamic link library score, the anomaly detection system determines whether the corresponding mobile device is an abnormal device based on the size of the dynamic link library, and determines the size of the dynamic link library score based on a set second preset threshold. The anomaly detection system obtains the second preset threshold obtained based on the abnormal dynamic link library sample. The abnormal dynamic link library sample is a known data sample. The threshold is defined by the known abnormal dynamic link library sample to obtain the second preset threshold. When the dynamic link library score is greater than the second preset threshold, the corresponding mobile device is determined to be an abnormal device, indicating that when the dynamic link library score is greater than the second preset threshold, it is similar to the existing known abnormal dynamic link library samples and can be classified as an abnormal device. When the dynamic link library score is less than or equal to the second preset threshold, the corresponding mobile device is determined to be a normal device, indicating that it is different from the existing known abnormal dynamic link library samples at this time, and therefore the device is a normal device. The embodiments of the present invention do not need to rely on a blacklist when detecting mobile devices. Based on the identification and detection of the plug-in library, the coverage of abnormal device detection can be improved, thereby improving the efficiency of anomaly detection.

[0075] Specifically, in a specific embodiment, the anomaly detection method in the embodiment of the present invention may have the following specific steps:

[0076] Step 1): Collect label data of abnormal plug-in libraries and normal plug-in libraries and data of device dynamic link libraries when the user's mobile device requests an application.

[0077] Step 2): Arrange the data of dynamic link libraries. First, aggregate the counts by dynamic link library and calculate the number of requests for each dynamic link library. Second, mark the dynamic link library containing the abnormal plug-in library as abnormal.

[0078] Step 3): Organize the plug-in library data. Each dynamic link library data is composed of several plug-in libraries. Split each dynamic link library data into plug-in library data, aggregate count by plug-in library, and calculate the number of requests for each plug-in library.

[0079] Step 4): Split the plug-in library name into words using a matching method. Each plug-in library name can be split into several words.

[0080] Step 5): Calculate word features, calculate the homogeneity features and difference features of each word, where:

[0081] Homogeneity feature = number of requests to abnormal plug-in libraries containing a target word / number of requests to all abnormal plug-in libraries;

[0082] Differentiation feature = number of requests for abnormal plug-in libraries containing a certain target word / (number of requests for all plug-in libraries containing a certain target word - number of requests for abnormal plug-in libraries containing a certain target word).

[0083] Step 6): Calculate the plugin library word scoring features. Select the maximum value of the homogeneity feature and the maximum value of the difference feature among the words in the plugin library. The formula for calculating the word scoring features for each plugin library is as follows:

[0084] The word scoring feature of the plug-in library = the maximum value of the homogeneity feature * the maximum value of the difference feature.

[0085] Step 7): Calculate the plug-in library feature information, which includes: the number of hyphens and numbers in the plug-in library name, the length of the plug-in library characters, the number of plug-in libraries appearing in abnormal dynamic link libraries, the number of plug-in libraries appearing in all plug-in libraries, the number of split words, word score features, etc.

[0086] Step 8): Plug-in library feature screening. Calculate the correlation of each feature information in step 7), and if the correlation coefficient exceeds a first preset threshold, retain one of the feature information.

[0087] Step 9): Calculate the risk score of the plug-in library. Input the feature information retained in step 8) and the label data of the plug-in library into the support vector machine model to obtain the risk score of the plug-in library.

[0088] Step 10): Calculate the weight of the plug-in library. Calculate the weight of each plug-in library based on the risk score and Newton's law of cooling.

[0089] Step 11): Calculate the dynamic link library score by using the risk score of the plug-in library in step 9) and the plug-in library weight in step 10) to calculate the dynamic link library score.

[0090] Step 12): Mark abnormal devices. When the dynamic link library score is greater than a second preset threshold, mark the mobile device corresponding to the dynamic link library as an abnormal device.

[0091] It should be noted that when the anomaly detection method in the embodiment of the present invention is applied to a business risk decision-making system, it can improve the coverage of abnormal device identification for the business risk decision-making system. At the same time, without relying on a blacklist, abnormal devices can still be identified, thereby improving risk identification efficiency and ensuring business security.

[0092] Reference Figure 7 As shown, an embodiment of the present invention further provides an anomaly detection system 100 for a mobile device. The anomaly detection system 100 can execute the anomaly detection method in the above embodiment. The anomaly detection system 100 includes: a data acquisition module 101, a data processing module 102, an anomaly scoring module 103 and an anomaly detection module 104. The data acquisition module 101 is mainly used to acquire data, including dynamic link library data, etc. The data processing module 102 can process the data from the data acquisition module 101 to obtain a risk score. The anomaly scoring module 103 is mainly used to obtain a dynamic link library score based on the data from the data processing module 102 for performing anomaly score judgment. The anomaly detection module 104 is mainly used to judge whether the corresponding mobile device is an abnormal device based on the dynamic link library score.

[0093] Specifically, the data acquisition module 101 is used to obtain the dynamic link library when the mobile device requests an application, and split the dynamic link library into several plug-in libraries; the data processing module 102 is used to obtain the first label data and multiple feature information of each plug-in library, and input the feature information and the first label data into the support vector machine model to obtain the risk score of the plug-in library; the anomaly scoring module 103 is used to obtain the weight of the plug-in library according to the risk score through Newton's cooling law, and obtain the dynamic link library score according to the weight of the plug-in library and the corresponding risk score; the anomaly detection module 104 is used to determine whether the corresponding mobile device is an abnormal device based on the dynamic link library score.

[0094] The anomaly detection system 100 in the embodiment of the present invention can be a business risk decision system. By executing the anomaly detection method in the above embodiment, the anomaly detection system 100 does not need to rely on a blacklist when detecting mobile devices. Based on the identification and detection of the plug-in library, it can improve the coverage of abnormal device detection and improve the efficiency of anomaly detection.

[0095] Figure 8 The electronic device 200 provided by an embodiment of the present invention is shown. The electronic device 200 includes: a memory 201, a processor 202, and a computer program stored in the memory 201 and executable on the processor 202. When the computer program is executed, it is used to execute the above-mentioned abnormality detection method for mobile devices.

[0096] The processor 202 and the memory 201 may be connected via a bus or other means.

[0097] Memory 201, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs, such as the mobile device anomaly detection method described in the embodiments of the present invention. Processor 202 implements the mobile device anomaly detection method by executing the non-transitory software programs and instructions stored in memory 201.

[0098] The memory 201 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store an abnormality detection method for executing the above-mentioned mobile device. In addition, the memory 201 may include a high-speed random access memory 201, and may also include a non-volatile memory 201, such as at least one storage device memory device, a flash memory device or other non-volatile solid-state memory device. In some embodiments, the memory 201 may optionally include a memory 201 remotely located relative to the processor 202, and these remote memories 201 may be connected to the electronic device 200 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0099] The non-transient software program and instructions required to implement the above-mentioned abnormality detection method for mobile devices are stored in the memory 201. When executed by one or more processors 202, the above-mentioned abnormality detection method for mobile devices is executed, for example, Figure 1 Steps S110 to S150 of the method, Figure 2 Steps S210 to S230 of the method, Figure 3 Steps S310 to S330 of the method, Figure 4 Steps S410 to S420 of the method, Figure 5 Steps S510 to S540 of the method, Figure 6 Method steps S610 to S620.

[0100] An embodiment of the present invention further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the above-mentioned abnormality detection method for a mobile device.

[0101] In one embodiment, the computer readable storage medium stores computer executable instructions, which are executed by one or more control processors, for example, Figure 1 Steps S110 to S150 of the method, Figure 2 Steps S210 to S230 of the method, Figure 3 Steps S310 to S330 of the method, Figure 4 Steps S410 to S420 of the method, Figure 5 Steps S510 to S540 of the method, Figure 6 Method steps S610 to S620.

[0102] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0103] Those skilled in the art will appreciate that all or some of the steps and systems in the method disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include computer storage media (or non-transitory media) and communication media (or temporary media). As known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technology, CD-ROM, digital versatile disks (DVD), or other optical disk storage, magnetic cassettes, magnetic tapes, storage device storage, or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically includes computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0104] It should also be understood that the various implementations provided in the embodiments of the present invention can be combined arbitrarily to achieve different technical effects.

[0105] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0106] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0107] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0108] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above implementation. Those skilled in the art can also make various equivalent modifications or substitutions under the shared conditions that do not violate the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of the present invention.

Claims

1. A method for detecting anomalies in a mobile device, characterized in that: include: Obtaining a dynamic link library when a mobile device requests an application, and splitting the dynamic link library into a plurality of plug-in libraries; Obtaining first label data and multiple feature information of each plug-in library, inputting the feature information and the first label data into a support vector machine model to obtain a risk score of the plug-in library; wherein the feature information includes a word scoring feature, and the word scoring feature is obtained according to the following steps: obtaining a plug-in library name of the plug-in library, and splitting the plug-in library name into a plurality of words; selecting a target word from the words, and calculating a homogeneity feature and a difference feature of each target word; and obtaining a word scoring feature corresponding to the plug-in library based on the homogeneity feature and the difference feature; Obtaining a weight of the plug-in library according to the risk score using Newton's law of cooling; Obtaining a dynamic link library score based on the weight of the plug-in library and the corresponding risk score; It is determined whether the corresponding mobile device is an abnormal device according to the dynamic link library score.

2. The abnormality detection method for a mobile device according to claim 1, wherein: The calculation obtains the homogeneity features and difference features of each target word, including: Acquire second label data, and determine an abnormal plug-in library and a normal plug-in library among the plurality of plug-in libraries according to the second label data; Obtain a first request number of the abnormal plug-in library containing the target word, a second request number of all the abnormal plug-in libraries, and a third request number of the normal plug-in library containing the target word; The homogeneity feature is obtained according to the proportional relationship between the first number of requests and the second number of requests, and the difference feature is obtained according to the proportional relationship between the first number of requests and the third number of requests.

3. The abnormality detection method for a mobile device according to claim 1, wherein: The step of obtaining the word scoring feature corresponding to the plug-in library according to the homogeneity feature and the difference feature includes: Selecting the maximum value of the homogeneity feature and the maximum value of the difference feature among the homogeneity features and the difference features of all words in the plug-in library; The word scoring feature is obtained according to the product of the maximum value of the homogeneity feature and the maximum value of the difference feature.

4. The abnormality detection method for a mobile device according to claim 2, wherein: The characteristic information further includes at least one of hyphen information in the plug-in library name, character information in the plug-in library name, the number of the plug-in libraries in the dynamic link library containing the abnormal plug-in library, the number of the plug-in libraries under the dynamic link library, and the number of the words obtained by splitting.

5. The abnormality detection method for a mobile device according to claim 1, wherein: Inputting the feature information and the first label data into a support vector machine model to obtain a risk score for the plug-in library includes: Calculating correlation coefficients between multiple pieces of feature information; Obtaining a first preset threshold for feature screening; When the correlation coefficient between the feature information is greater than the first preset threshold, retaining at least one of the feature information; The retained feature information and the first label data are input into the support vector machine model to obtain the risk score.

6. The abnormality detection method for a mobile device according to claim 1, wherein: The determining whether the corresponding mobile device is an abnormal device according to the dynamic link library score includes: Obtaining a second preset threshold value obtained according to the abnormal dynamic link library sample; When the dynamic link library score is greater than the second preset threshold, the corresponding mobile device is determined to be an abnormal device.

7. A mobile device anomaly detection system, characterized in that: include: A data acquisition module is used to obtain a dynamic link library when a mobile device requests an application, and split the dynamic link library into several plug-in libraries; A data processing module is configured to obtain first label data and multiple feature information of each plug-in library, and input the feature information and the first label data into a support vector machine model to obtain a risk score for the plug-in library; wherein the feature information includes a word score feature, and the word score feature is obtained according to the following steps: obtaining a plug-in library name of the plug-in library and splitting the plug-in library name into a plurality of words; selecting a target word from the words and calculating a homogeneity feature and a difference feature of each target word; and obtaining a word score feature corresponding to the plug-in library based on the homogeneity feature and the difference feature; An anomaly scoring module, configured to obtain a weight of the plug-in library according to the risk score using Newton's law of cooling, and obtain a dynamic link library score by weighting the plug-in library weight and the corresponding risk score; The anomaly detection module is used to determine whether the corresponding mobile device is an abnormal device according to the dynamic link library score.

8. An electronic device, characterized in that: The device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the abnormality detection method for a mobile device according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that The storage medium stores a program, and the program is executed by a processor to implement the abnormality detection method for a mobile device according to any one of claims 1 to 6.

Images