Mobile Internet operating system third-party application risk analysis method and system

Abstract

The present invention belongs to the field of mobile Internet security technology, and particularly relates to a mobile Internet operating system third-party application risk analysis method and system for static and dynamic evaluation and detection of malicious applications, comprising: for dangerous permission risk sources and sensitive API function risk sources, using dangerous permissions and sensitive API functions to quantitatively evaluate the risk of privacy leakage of third-party applications; based on the quantitative evaluation results, using the function call graph structure features that characterize the calling relationship between functions and the multi-hop function node topology information to identify and distinguish the third-party application categories; by extracting the state transition relationship between the third-party application system calls, based on the system call sequence fingerprint features and using a convolutional neural network to identify and distinguish the third-party application categories. The present invention supplements the Android operating system security mechanism through the combination and complementarity of dynamic and static analysis detection, improves the accuracy of Android malicious application detection, and provides technical support for creating a good Android software ecological environment.

Description

Technical Field

[0001] The present invention belongs to the field of mobile Internet security technology, and in particular relates to a method and system for analyzing the risks of third-party applications in a mobile Internet operating system. Background Art

[0002] With the maturity and widespread adoption of 5G communication technology, human society will enter a new era of the Internet of Everything, in which mobile smart devices play a crucial role. The rapid development of the mobile internet is inseparable from the support of mobile operating systems, of which Android has become a leader. However, while the rich array of third-party applications in the Android system facilitates people's lives, they also pose increasingly severe information security challenges for users. A joint assessment report released by Kaspersky Lab and INTERPOL indicates that over 98% of mobile malware targets Android devices. The China Consumers Association's "App Personal Information Leakage Survey Report" indicates that personal information leakage is generally severe, with nearly 90% of respondents reporting experiencing personal information leaks due to app use. Furthermore, according to the "2019 Android Malware Special Report" released by the 360 ​​Cybersecurity Response Center, over 1.07 million mobile malware attacks were intercepted daily in 2019. The main attack methods included privacy theft, data usage, rogue behavior, and remote control. Therefore, it is necessary to take necessary protective measures to defend against malware and effectively protect users' personal privacy and property.

[0003] Although the Android system provides inherent security mechanisms such as digital signatures and permission control, relying solely on these safeguards is insufficient to fully guarantee system security. Consequently, Android application risk assessment and malicious application detection technologies have emerged as complementary technologies to the existing Android system security mechanisms. Android application risk assessment aims to identify privacy leakage risks in applications and assign security ratings to them, enabling users to understand these risks and take preventative measures. This allows developers to improve and enhance the robustness of their applications based on these risk indicators. Android malicious application detection technology can extract pattern characteristics from malicious applications, distinguishing between benign and malicious applications and further classifying malicious applications into families. This is crucial for creating application sample sets for subsequent research. In recent years, with the continuous development of artificial intelligence (AI) technology, machine learning and deep learning have been widely used in mobile application security analysis, demonstrating their promising application prospects. Static analysis and dynamic analysis are the primary methods for analyzing and extracting application features, depending on how machine learning features are acquired. Static analysis extracts component or code features without running the application, while dynamic analysis extracts behavioral features by running the application in a virtual machine or real machine environment. By learning and training various features obtained from static or dynamic analysis, and using machine learning algorithms to accurately grasp data patterns, we can achieve higher detection accuracy while greatly reducing manpower input, and build a more objective and sensitive Android application security detection model, which is of great significance for creating a healthy and sustainable Android ecosystem.

[0004] In existing Android application risk assessments, probabilistic analysis-based methods have been criticized for being unreliable. Machine learning-based methods typically use a single machine learning method to qualitatively evaluate applications. The results are entirely dependent on the quality of the classifier training, and the performance needs to be improved. In static analysis-based detection of Android malicious applications, methods using simple permission and API combinations have achieved high detection accuracy in distinguishing benign and malicious Android applications. However, using only this shallow information to characterize application behavior is not accurate or complete enough, as benign and malicious applications may overlap in permissions or APIs to a certain extent, making it difficult to distinguish them. In dynamic analysis-based detection of Android malicious applications, the system call sequence during application runtime is a commonly used feature. However, previous studies have focused more on the combination and frequency of system calls when processing system call sequences, without considering the logical and semantic relationships between adjacent system calls. Furthermore, because the system call sequences obtained through dynamic analysis are text sequences of varying lengths, previous natural language processing methods have incurred high computational complexity when simplifying these system call sequences. Summary of the Invention

[0005] To this end, the present invention provides a mobile Internet operating system third-party application risk analysis method and system, which can effectively solve the problem of Android malicious application evaluation and detection, supplement the Android operating system security mechanism, improve the accuracy of Android malicious application detection, and provide technical support for creating a good Android software ecological environment.

[0006] According to the design scheme provided by the present invention, a mobile Internet operating system third-party application risk analysis method is provided for static and dynamic evaluation and detection of malicious applications, including the following contents:

[0007] During the static analysis and assessment phase, we use dangerous permissions and sensitive API functions to quantitatively assess the privacy leakage risks of third-party applications. Based on the quantitative assessment results, we use the function call graph structure features that characterize the call relationships between functions and the topology of multi-hop function nodes to identify and distinguish third-party application categories.

[0008] During the dynamic analysis, assessment, and detection phase, the state transition relationship between third-party application system calls is extracted, and third-party application categories are identified and differentiated based on the system call sequence fingerprint features and a convolutional neural network. Combined with the identification and differentiation results of third-party application categories in the static analysis, assessment, and detection phase, the third-party application risks are finally determined.

[0009] As a third-party application risk analysis method for a mobile Internet operating system of the present invention, further, based on the use of dangerous permissions by malicious applications and benign applications in the dangerous permission groups set in the mobile Internet operating system, a machine learning method is used to mine and classify the use patterns of dangerous permissions by malicious applications and benign applications, and a quantitative evaluation is performed based on the classification results.

[0010] As a third-party application risk analysis method for a mobile Internet operating system of the present invention, an ensemble learning classifier is further used to explore the dangerous permission usage patterns of malicious applications and benign applications and to classify and quantitatively evaluate them, wherein the ensemble learning classifier includes: an odd number of individual classifiers with different structures, and the individual classifiers with different structures include at least a decision tree, a support vector machine, a deep convolutional network DNN, a convolutional neural network CNN and a deep belief network DBN. By voting on the classification output results of the individual classifiers, the risk of privacy leakage of third-party applications is quantitatively evaluated based on the voting results.

[0011] As a third-party application risk analysis method for a mobile Internet operating system of the present invention, further, sensitive API functions are clustered according to the dangerous permission groups set in the corresponding mobile Internet operating system, the risk assessment of sensitive API functions is converted into a risk assessment of the dangerous permission groups, the weight of each dangerous permission group is obtained based on information gain, and the privacy leakage risk of third-party applications is graded and quantitatively assessed according to the weight ranking.

[0012] As a third-party application risk analysis method for a mobile Internet operating system of the present invention, further, in obtaining the weight of each dangerous permission group based on the gain, known malicious applications and benign applications are used as a sample set, and the use of the dangerous permission group by sensitive API functions of each application in the sample set is divided into a subset that uses the dangerous permission group and a subset that does not use the dangerous permission group. The information entropy of the sample set is used to obtain the weight of the corresponding subset, and the information gain of the use of the dangerous permission group is calculated based on the subset weight. The information gain of each dangerous permission group in the sample set is normalized to obtain the corresponding weight, wherein the information gain calculation formula is expressed as: P is the dangerous permission group, D is the sample set, E(D) is the information entropy of the sample set, D n is a subset, E(D n ) is the subset information entropy.

[0013] As a third-party application risk analysis method for a mobile Internet operating system of the present invention, further, the structural features of a function call graph are used to identify and distinguish third-party applications. First, a directed graph consisting of a set of functions used by third-party applications as nodes and a set of call relationships between functions as edges is used as a function call graph; then, sensitive APIs known to be exploited by malicious applications are selected, and a sensitive API call subgraph in the function call graph is composed of a set of sensitive API call nodes and their neighbor nodes and a set of edges of call relationships between functions; a trained deep graph convolutional network is used to extract the structural feature vectors of all nodes in the sensitive API call subgraph and classify them to identify and distinguish third-party application categories.

[0014] As a third-party application risk analysis method for a mobile Internet operating system of the present invention, further, the state transition relationship between system calls is extracted. During the interaction between the simulator and the host side, the application automation testing tool and the system call tracking tool are used to extract the third-party application system call sequence, and the system call sequence is regarded as a Markov chain. The system call sequence state transition probability matrix is ​​obtained based on the Markov process; for the system call sequence state transition probability matrix, its grayscale image is used as the input of a trained convolutional neural network model, and the convolutional neural network model is used to classify and identify the third-party application category.

[0015] As a third-party application risk analysis method for a mobile Internet operating system of the present invention, further, in extracting system call sequence features, first, a third-party application is installed in a simulator, and then a system call tracking tool is used to track the application process and record the system call sequence executed by the application; and at the same time, a random event operation preset in an application automation testing tool is used to trigger the application behavior, and a text log storing the system call sequence is captured, wherein each line in the text log records a system call operation with a timestamp; finally, the system call sequence features are constructed based on the captured text log.

[0016] As a third-party application risk analysis method for the mobile Internet operating system of the present invention, further, for the grayscale image of the system call sequence state transition probability matrix, the TF-IDF algorithm is used to sort the feature importance of all extracted system call sequences, and the sorting results are selected as the input of the trained convolutional neural network model.

[0017] Furthermore, the present invention also provides a mobile Internet operating system third-party application risk analysis system for performing static and dynamic evaluation and detection on malicious applications, comprising: a static analysis module and a dynamic analysis module, wherein:

[0018] The static analysis module is used to quantitatively assess the privacy leakage risks of third-party applications by using dangerous permissions and sensitive API functions. Based on the quantitative assessment results, the module uses the function call graph structure features that represent the call relationships between functions and the topology information of multi-hop function nodes to identify and distinguish the categories of third-party applications.

[0019] The dynamic analysis module is used to extract the state transition relationship between third-party application system calls, identify and distinguish third-party application categories based on the system call sequence fingerprint features and using convolutional neural networks, and finally determine the third-party application risks by combining the identification and distinction results of third-party application categories by the static analysis module.

[0020] Beneficial effects of the present invention:

[0021] The present invention uses dynamic analysis and evaluation as a supplement to static analysis, making up for the deficiencies that may be affected by obfuscation and reinforcement methods in the static analysis process, and further improving the detection accuracy of malicious applications; from the perspective of feature representation, it realizes a top-down and gradually refined description of application features, and forms a comprehensive characterization of the application organization structure from different levels of interaction between the application and the system; through the coupling and complementarity of static analysis and dynamic analysis, and top-down feature representation and extraction, a complete Android malicious application evaluation and detection system is formed, which can perform Android application security detection more objectively and sensitively, and has good application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a flowchart of a method for analyzing third-party applications in a mobile Internet operating system according to an embodiment of the present invention;

[0023] Figure 2 This is a schematic representation of application features based on dangerous permissions in an embodiment;

[0024] Figure 3 This is a schematic diagram of the integrated learner structure in the embodiment;

[0025] Figure 4 This is a schematic diagram of the voting process for evaluating the likelihood of risk occurrence in the embodiment;

[0026] Figure 5 This is a schematic diagram of the risk consequence severity assessment process in the embodiment;

[0027] Figure 6 Schematic diagram of the distribution of dangerous permission groups in samples of benign and malicious applications in the embodiment;

[0028] Figure 7 This is a diagram showing part of the function call graph of a malicious application in the DroidKungfu family in the embodiment;

[0029] Figure 8 Schematic diagram of the aggregation of node structure features in the embodiment;

[0030] Figure 9 This is an example of a system call log in the embodiment;

[0031] Figure 10 Schematic diagram of the 25 most frequently used system calls in benign applications in the embodiment;

[0032] Figure 11 This is a diagram showing the 25 most frequently used system calls in malicious applications in the embodiment;

[0033] Figure 12 Schematic diagram of the Mann-Whitney U test results for 102 system calls in the embodiment;

[0034] Figure 13 Schematic diagram of the calculation results of the system call sequence transition probability matrix in the embodiment. DETAILED DESCRIPTION

[0035] In order to make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below with reference to the accompanying drawings and technical solutions.

[0036] An embodiment of the present invention provides a method for analyzing third-party application risks in a mobile Internet operating system, which is used to perform static and dynamic assessment and detection of malicious applications, and includes the following contents:

[0037] During the static analysis and assessment phase, we use dangerous permissions and sensitive API functions to quantitatively assess the privacy leakage risks of third-party applications. Based on the quantitative assessment results, we use the function call graph structure features that characterize the call relationships between functions and the topology of multi-hop function nodes to identify and distinguish third-party application categories.

[0038] During the dynamic analysis, assessment, and detection phase, the state transition relationship between third-party application system calls is extracted, and third-party application categories are identified and differentiated based on the system call sequence fingerprint features and a convolutional neural network. Combined with the identification and differentiation results of third-party application categories in the static analysis, assessment, and detection phase, the third-party application risks are finally determined.

[0039] See also Figure 1As shown in the paper, for the risk sources of dangerous permissions, the possibility of risk occurrence is assessed using ensemble learning, and the possibility of privacy leakage risk in applications is qualitatively and quantitatively described. For the risk sources of sensitive API functions, the severity of risk consequences based on information flow analysis is used to qualitatively and quantitatively describe the severity of the consequences of privacy leakage, solving the problem of quantitative assessment of Android application privacy risks. A sensitive function call graph feature representation method with structural features is used to extract structural feature vectors. For the constructed graph feature representation training set, a deep graph convolutional network can be used to implement application classification and detection tasks. By analyzing the differences in system call sequence patterns between benign and malicious applications, a data mining method is used to screen out the more important system call sets. The system call sequence is converted into a Markov transition probability matrix, and grayscale fingerprint features are generated for the application based on this matrix. This feature is used to classify and detect malicious applications on multiple convolutional neural network models. Through the coupling and complementarity of static analysis and dynamic analysis, and top-down feature representation and extraction, a complete Android malicious application assessment and detection system is formed, which includes risk source identification, risk possibility assessment, risk consequence severity assessment, static gap and dynamic analysis comprehensive risk assessment, to meet the needs of Android malicious application detection in actual application.

[0040] Furthermore, based on the use of dangerous permissions by malicious and benign applications in the dangerous permission groups set in the mobile Internet operating system, machine learning methods are used to explore and classify the use patterns of dangerous permissions by malicious and benign applications, and quantitative evaluation is performed based on the classification results.

[0041] Android system permissions are divided into four security levels. Dangerous permissions control access to sensitive information. To group dangerous permissions with similar functions together, Android 6.0 defines nine dangerous permission groups, covering 24 dangerous permissions, to control access to different forms of sensitive information. The division of these 24 dangerous permissions into groups and their functional meanings are shown in Table 1.

[0042] Table 1 Dangerous permissions and permission groups

[0043]

[0044] The types and number of dangerous permissions requested reflect the likelihood that an app will attempt to manipulate sensitive data. Benign and malicious apps differ in how they use dangerous permissions. Malicious apps typically request more dangerous permissions, leading to a higher risk of privacy leaks. Therefore, from a large sample of benign and malicious apps, we can identify distinct patterns in permission usage between the two types of apps. This usage can be used to assess the maliciousness of an app. Consequently, assessing the likelihood of an app's privacy leak risk translates to determining whether an app is malicious. Generally, malicious apps are more likely to pose a privacy leak risk, while benign apps are less likely.

[0045] In order to classify the types of applications, a machine learning method is used to mine the permission usage patterns of numerous benign and malicious applications and classify them. The 24 dangerous permissions in Table 1 will be used as features for machine learning classification. This patent generates a 25-bit dangerous permission feature vector for each application. Figure 2 As shown in the figure, each "APP" row represents the dangerous permission usage pattern of an application; each "Permission" column in the first 24 columns represents a dangerous permission. If an application requests a dangerous permission in AndroidManifest.xml, it will be represented as "1" in the corresponding dangerous permission position, otherwise it will be represented as "0"; the last column "Class" indicates the category to which the application belongs, "1" indicates that the application is a malicious application, and "0" indicates that the application is a benign application.

[0046] Furthermore, an ensemble learning classifier is used to explore the usage patterns of dangerous permissions by malicious and benign applications and to classify and quantitatively evaluate them. The ensemble learning classifier includes: an odd number of individual classifiers with different structures, and the individual classifiers with different structures include at least decision trees, support vector machines, deep convolutional networks (DNNs), convolutional neural networks (CNNs), and deep belief networks (DBNs). By voting on the classification output results of the individual classifiers, the risk of privacy leakage in third-party applications is quantitatively evaluated based on the voting results.

[0047] To avoid the absolute influence of a single classifier on the evaluation results, an ensemble learning classifier was created using five different machine learning classifiers. By combining a group of learners, better generalization performance is achieved than that of a single learner.

[0048] The ensemble learner structure used in risk probability assessment is as follows: Figure 3As shown in the figure, the ensemble includes two traditional machine learning classifiers: decision tree (DT) and support vector machine (SVM), as well as three neural network classifiers: deep neural network (DNN), convolutional neural network (CNN), and deep brief network (DBN). To obtain a more effective ensemble classifier, it is necessary to first train the individual learners separately to obtain the individual model with the best classification effect.

[0049] Decision tree: A decision tree is a tree-structured decision analysis model that divides nodes based on feature probabilities. This patent constructs a decision tree classification model based on the C4.5 algorithm. The hyperparameters that need to be adjusted during training are the tree depth and the minimum number of supported instances.

[0050] Support Vector Machine: Support Vector Machine is a linear classification model that achieves binary classification by solving the sample maximum margin hyperplane. To solve the problem of linearly inseparable samples, SVM uses a kernel function to map the original sample space to a higher-dimensional feature space, making the samples linearly separable in the high-dimensional space. The SVM used uses the Radial Basis Function (RBF) as the kernel function. There are two hyperparameters that need to be adjusted during training: the penalty factor C, which represents the tolerance for error. The larger C is, the more emphasis is placed on loss; and the dimensionality factor γ, which determines the number of support vectors after the data is mapped to the new feature space. Since it involves two changing parameters, a grid search method is required to determine the optimal values ​​of C and γ.

[0051] Deep Neural Networks: A deep neural network can be structured into input layers, hidden layers, and output layers. Hyperparameters that require adjustment during DNN training include the number of hidden layers and the number of nodes in each hidden layer.

[0052] Convolutional Neural Networks: The structure of a convolutional neural network can be divided into an input layer, a convolutional layer, a fully connected layer, and an output layer. Because the training data is one-dimensional, the convolutional layer uses one one-dimensional convolution, followed by a flattening layer. Two fully connected layers have 64 and 32 nodes, respectively, and the ReLU activation function is used in each layer. Hyperparameters that require adjustment during CNN training include the size and number of convolution kernels.

[0053] Deep Belief Networks: Deep Belief Networks are deep neural networks that use restricted Boltzmann machines (RBMs) to initialize weights and biases. Their basic structure consists of multiple RBMs and a traditional fully connected layer. Each RBM contains two layers of neurons: an explicit layer for receiving training data and a hidden layer for outputting feature vectors. In this embodiment, the hyperparameters that require adjustment when using a DBN include the number of hidden layers and the number of nodes in each hidden layer.

[0054] Each individual learner in the ensemble learner assesses the risk likelihood of the assessed application. During the assessment, each individual learner receives a risk vote. A vote cast (i.e., a classification output of "1") indicates a high likelihood of privacy leakage for the assessed application; a negative vote indicates a low likelihood. The total risk votes of the five individual learners are accumulated to obtain a quantitative risk score for the application. This score can be categorized into five levels, as shown in Table 2.

[0055] Table 2 Risk probability assessment scale

[0056]

[0057] The specific process of five classifiers voting to evaluate the possibility of privacy leakage risk of applications is as follows: Figure 4 As shown in the figure. The individual learners classify and identify applications with unknown security based on the dangerous permission characteristics. When the classification result is a benign application, it is considered that the risk of privacy leakage in the application is low. When the classification result is a malicious application, it is considered that the risk of privacy leakage in the application is high. The final possibility assessment result is the result of a joint vote by the five classifiers. The application with unknown security shown in the figure is judged by three individual learners to have a high risk of privacy leakage, and by two classifiers to have a low risk of privacy leakage. Therefore, it finally receives three risk votes, which corresponds to a quantitative score of 3 points in the risk probability scoring table, and a qualitative score of a high possibility of privacy leakage. According to the structure of the designed ensemble learner, the design of the risk probability assessment algorithm based on dangerous permissions is shown in Table 3.

[0058] Table 3 Risk probability assessment algorithm based on dangerous permissions

[0059]

[0060] Furthermore, sensitive API functions are clustered according to the dangerous permission groups set in the corresponding mobile Internet operating system, and the risk assessment of sensitive API functions is converted into a risk assessment of dangerous permission groups. The weight of each dangerous permission group is obtained based on information gain, and the privacy leakage risk of third-party applications is graded and quantitatively assessed according to the weight ranking.

[0061] There are thousands of sensitive Android API functions involving privacy information. Establishing an evaluation scale for each API function is a complex and time-consuming task. Therefore, we consider clustering sensitive API functions according to the corresponding dangerous permission groups, and converting the risk assessment of sensitive API functions into the risk assessment of dangerous permission groups. To this end, it is necessary to match sensitive API functions to corresponding dangerous permissions. Existing research work has proposed the Axplorer method to mine the correspondence between APIs and permissions. With the help of Axplorer's API and permission relationship mapping table, sensitive APIs can be classified into corresponding dangerous permission groups. Finally, the information gain weight of the dangerous permission group is used as the evaluation result of the severity of the risk consequences. The specific implementation process of the entire risk consequence severity assessment is as follows. Figure 5 As shown in the figure: First, FlowDroid is used to extract the sensitive API function set of the application. Then, the API and permission mapping relationship of Axplorer is used to obtain the dangerous permissions corresponding to the sensitive API functions. Furthermore, the permission group to which the dangerous permissions belong can be learned from Table 4. Finally, the corresponding consequence severity assessment level is obtained according to the permission group weight calculated based on information gain.

[0062] Furthermore, in obtaining the weight of each dangerous permission group based on the gain, known malicious applications and benign applications are used as sample sets, and the use of dangerous permission groups by sensitive API functions of each application in the sample set is analyzed. The sample set is divided into a subset that uses dangerous permission groups and a subset that does not use dangerous permission groups. The information entropy of the sample set is used to obtain the weight of the corresponding subset, and the information gain of the use of dangerous permission groups is calculated based on the subset weights. The information gain of each dangerous permission group in the sample set is normalized to obtain the corresponding weight.

[0063] The severity rating of the risk consequences is ultimately calculated by the information gain of the sensitive API corresponding to the dangerous permission group. To this end, it is necessary to randomly sample samples of benign and malicious applications to obtain the distribution of permission groups. In this case, 1,000 malicious applications were randomly selected from the Drebin dataset, and 1,000 benign applications that passed the VirusTotal security detection were randomly crawled from the 360 ​​Mobile Assistant App Store (http: / / zhushou.360.cn / ), resulting in a total of 2,000 application sample sets, which were used to calculate the information gain weight of each permission group. The decompiled AndroidManifest.xml files of all applications were analyzed and counted, and the number distribution of 9 dangerous permission groups in the benign application and malicious application sample sets was obtained as follows: Figure 6 shown.

[0064] Next, the weight of each dangerous authority group is calculated through information gain, and the severity of risk consequences is divided into levels according to the weight ranking.

[0065] Information entropy: It is a measure of the uncertainty of the amount of information in a set of characteristic attributes. Assume that the proportion of the k-th class of samples in the current sample set D is p k , then the information entropy E(D) of D is defined as:

[0066]

[0067] In the scenario of this case, there are two categories of sample sets. Category "0" is benign applications, and category "1" is malicious applications. Then p0 = p1 = 0.5. According to the formula, E(D) = -(2×0.5log20.5) = 1

[0068] Information gain: used to measure the amount of information contained in a feature attribute. The dangerous permission group P has two possible values: used and unused. Then, using P to divide the sample set D will produce two subsets, denoted as D n Calculate D according to formula (3-5) n The information entropy of D is given, and considering that different permission group subsets contain different numbers of application samples, n Assign weight That is, the more samples a permission group subset has, the greater its influence. Therefore, the information gain obtained by dividing the sample set D by whether or not the dangerous permission group is used can be calculated:

[0069]

[0070] Taking the SMS permission group as an example, the frequency of use of this permission group in benign applications is 154, and the frequency of unuse is 846; the frequency of use in malicious applications is 646, and the frequency of unuse is 354. Let the sample set that uses this permission group be D1, and the sample set that does not use this permission group be D0, then D1 = 154 + 646 = 800, D0 = 846 + 354 = 1200. The information entropy corresponding to D1 and D0 is calculated as follows:

[0071]

[0072]

[0073] Therefore, according to formula (3-6), the information gain of the SMS permission group is calculated as:

[0074]

[0075] Permission group weight: used to measure the severity of the consequences of leaking the controlled sensitive information. By calculating the information gain of each permission group P under the sample set D and performing normalization, the weight that should be assigned to each permission group can be obtained:

[0076]

[0077] The corresponding weights of each dangerous permission group that can be calculated are shown in Table 4:

[0078] Table 4 Weight calculation results corresponding to dangerous authority groups

[0079]

[0080] Based on the calculation results of the information gain weights of the permission groups, the severity of the consequences of privacy leakage risks can be divided into four levels according to the size of the weights:

[0081] (1) Light: Once the information protected by the dangerous permission group is leaked, it is difficult to accurately locate the individual. This level of permission groups includes calendar, sensor, and empty permission groups. For example, if the sensor information protected by the SENSORS permission group is leaked, it cannot be linked to a specific user.

[0082] (2) Less serious: Once the information protected by the dangerous permission group is leaked, the impact on the user is limited. This level of permission groups includes camera CAMERA and microphone MICROPHONE. For example, if the photo function protected by the CAMERA permission is illegally used, analyzing user characteristics through randomly taken photos is not targeted and feasible, so the impact on the user is limited;

[0083] (3) Severe: If the information protected by the dangerous permission group is leaked, the user will be monitored or their identity stolen. This level of permission groups includes Contacts, Location, and Storage. For example, if the geographic location information protected by the Location permission group is leaked, the user's location can be easily tracked.

[0084] (4) Extremely serious: Once the information protected by the dangerous permission group is leaked, the user's personal property will suffer losses. This level of permission groups includes SMS and phone calls. For example, if the content of a text message protected by the SMS permission group is leaked, cybercriminals can intercept the verification code from the bank, which will greatly threaten the security of the user's bank account.

[0085] When the results of information flow analysis and mapping correspond to multiple dangerous permission groups, the risk score with the highest severity is used as the final consequence severity score according to the predetermined risk consequence severity assessment scale. In summary, the risk consequence severity assessment algorithm based on sensitive API functions can be obtained, as shown in Table 5:

[0086] Table 5 Risk consequence severity assessment algorithm based on sensitive API functions

[0087]

[0088] Furthermore, the structural features of the function call graph are used to identify and distinguish third-party applications. First, a directed graph consisting of a set of functions used by third-party applications as nodes and a set of call relationships between functions as edges is formed as a function call graph; then, sensitive APIs known to be exploited by malicious applications are selected, and a sensitive API call subgraph in the function call graph is formed by a set of sensitive API call nodes and their neighboring nodes and a set of edges of call relationships between functions; a trained deep graph convolutional network is used to extract the structural feature vectors of all nodes in the sensitive API call subgraph and classify them to identify and distinguish the categories of third-party applications.

[0089] Function call graph: The function call graph G = (V, E) of an Android application is a directed graph consisting of a node set V and an edge set E, where V = {v i |i=1,2,...,n} represents the set of functions used by the application, and each v i ∈V represents a function name; E={<v i ,v j >|v i ,v j ∈V} represents the set of calling relationships between functions, and the ordered pair <v i ,v j >∈E represents the function vi For function v j The call.

[0090] Figure 7 This figure shows a partial function call graph for a malicious app from the DroidKungfu family (SHA1: a6f39574437c2de53ea881d589408753f2539e3c) from the Drebin dataset. Each node in the graph represents a function, labeled "class name: function method name (parameters)." Functions are connected by directed arrows, with the origin of the arrow being the calling function and the tail being the called function. The graph shows that a function may call multiple functions, for example, function a(android.content.Context) in the net.youmi.android.al class calls three different functions. A function may also be called by multiple functions, for example, function getSystemService(java.lang.String) in the android.content.Context class is called by two different functions.

[0091] The Android platform provides thousands of APIs. Analyzing all function calls not only consumes a large amount of computing resources but also fails to highlight the differences between different types of applications. Therefore, this solution focuses solely on sensitive APIs controlled by Android permissions, which allow applications to access sensitive resources and perform sensitive operations. This patent selects APIs from 11 sensitive class packages commonly exploited by malicious applications. These 11 packages cover the most sensitive resources of the Android system, such as SMS, call, location, and network information, as shown in Table 6.

[0092] Table 6 11 Android sensitive packages

[0093]

[0094] Sensitive API call subgraph: It is composed of the set V′ of sensitive API call nodes and their neighboring nodes and the set E′ of edges. It is the induced subgraph of the original function call graph and is denoted as SG = (V′, E′). The set of sensitive API nodes is denoted as V s ,but Where distance() is a function that calculates the shortest distance between two nodes, so E′={<v i ,v j >|v i ,v j ∈V′}.

[0095] The pseudo code of the algorithm for generating sensitive API call subgraph from the original function call graph is shown in Table 7:

[0096] Table 7 Sensitive API call subgraph generation algorithm

[0097]

[0098]

[0099] The time complexity analysis of the sensitive API call subgraph generation algorithm is as follows: The algorithm is divided into two consecutive processes: first, find whether the sensitive API node is included in the original function call graph, and then find the edge containing the sensitive node in the original function call graph. In the first process, assuming that the number of nodes in the original function call graph G is n, the set of sensitive API nodes V s The number of nodes in is m, and each time from V s In the first pass, a node is taken out and matched with all nodes in G. This means that each of the m nodes needs to be matched n times, so the time complexity of finding sensitive nodes is O(n×m). In the second pass, assuming that the number of sensitive nodes found in the first step is k, each of these nodes needs to be combined with nodes in the original graph G to determine whether an edge in the subgraph exists. Therefore, the time complexity of finding edges containing sensitive nodes is O(n×k). Therefore, the total time complexity of the algorithm should be O(n×m)+O(n×k)=O(n×m).

[0100] Given a graph G, let A be the adjacency matrix of G, n be the number of all nodes in G, each node has a c-dimensional structural feature vector x, and the structural feature vectors of all nodes constitute the feature matrix Each row of the matrix represents the structural feature vector of a node. Figure 8 As shown, node v i The aggregation features of can be obtained by weighted average of the structural features of its neighboring nodes, which can be written in matrix form as follows:

[0101]

[0102] in I is the identity matrix, The function is to add node v by adding a self-loop i own characteristics; yes The corresponding degree matrix, matrix elements By multiplying The operation normalizes the weights; is the parameter matrix that the neural network needs to train; f is the nonlinear activation function; is the output matrix of the graph convolutional layer.

[0103] By iterating the above formula, we can get the output of multiple graph convolutional layers superimposed:

[0104]

[0105] Among them H 0 =X, is the output of the lth graph convolutional layer.

[0106] The main function of the global pooling layer is to sort the feature descriptions extracted by the graph convolution layer according to the importance of the nodes, and then crop them to a uniform size to be input into the traditional convolutional layer and the fully connected layer. A basic assumption is that more important function nodes are often called more by other function nodes. In the initial stage, each function node is assigned the same PageRank score, and then according to the calling relationship between functions, the PageRank score of the current node is updated by all the nodes that call it in multiple rounds until convergence. In each round of PageRank score update process, the calling node distributes its current PageRank score evenly to the calling edge, and the called node sums the scores passed by all the edges pointing to this node to update the current PageRank score. Node v i PageRank score PR (v i ) can be calculated using the following formula, where v j is all calls to v i Function node, PR(v j ) is the node v j PageRank score, L(v j ) is the node v j The number of nodes pointing to other nodes, d is the correction factor, and N is the number of all nodes:

[0107]

[0108] The output of the lth graph convolutional layer is recorded as H l ,l=1,2,...,m, the input of the global pooling layer is the output cascade of each graph convolution layer [H 1 ,H 2 ,...,H mThe output of the graph convolution layer is an n-dimensional tensor, where each dimension represents a node's feature description. The output tensors are sorted in descending order by calculating the PageRank score of each node. The output of the global pooling layer uses a top-k approach to extract the first k output tensors, typically taking the number of nodes present in more than 60% of the graph. In this patent, k is set to 80. Finally, the output tensor size is unified by deleting the last nk rows of the graph convolution layer output tensor (or adding kn zero rows). The traditional convolutional layer and the fully connected layer are followed by the global pooling layer, including two one-dimensional convolutional layers, a maximum pooling layer and a fully connected layer: the first one-dimensional convolutional layer has 16 output channels, the convolution kernel size and stride are the sum of the number of nodes in the graph convolution layer; followed by a maximum pooling layer with a sampling kernel size of 2 and a stride of 2; followed by the second one-dimensional convolutional layer with 32 output channels, a convolution kernel size of 5 and a stride of 1; followed by a fully connected layer with 128 hidden nodes, and finally the softmax function outputs the classification result.

[0109] As a third-party application risk analysis method for a mobile Internet operating system in an embodiment of the present invention, further, the state transition relationship between system calls is extracted. During the interaction between the simulator and the host side, the application automation testing tool and the system call tracking tool are used to extract the third-party application system call sequence, and the system call sequence is regarded as a Markov chain. The system call sequence state transition probability matrix is ​​obtained based on the Markov process; for the system call sequence state transition probability matrix, its grayscale image is used as the input of a trained convolutional neural network model, and the convolutional neural network model is used to classify and identify the third-party application category.

[0110] The system call sequence is a finite list of system calls arranged sequentially in discrete time, denoted as S = (c1, c2, c3, ..., c n ), where c n Represents a single system call name. The system call sequence reflects the dynamic behavior of an application, with different system calls reflecting different behaviors. The interaction between the host and the Android emulator can be accomplished through Android Debug Bridge (ADB) commands. Extracting the application's system call sequence can be accomplished using the Android application automated testing tool Monkey and the system call tracing tool Strace. The main extraction process is as follows:

[0111] First, install the application in the Android 6.0 emulator. Then use the Strace tool to track the application process and record the system call sequence executed by the application. At the same time, execute the Monkey script in another command line to trigger the application's behavior by simulating 500 random events consisting of touch, click, and slide operations. The system call sequence is saved as a text log, with each line recording a system call operation with a timestamp. Finally, transfer the log saved in the Android emulator to the host system, uninstall the application, and reset the emulator. The steps and corresponding commands for capturing the system call log are shown in Table 8:

[0112] Table 8 System call log extraction steps and commands

[0113]

[0114] The following is a fragment of an application system call log extracted through the above operation: Figure 9 As shown, each line of the log represents a system call record, which can be divided into three parts: the first part [pid 3853] indicates that the currently active process number is 3853, the second part "hh:mm:ss" is the time when the system call occurred, and the third part is the name, parameters, and return value of the system call.

[0115] In this example, system call logs were extracted from 5,560 malicious apps from the Drebin dataset and an equal number of benign apps from 360 Mobile Assistant, resulting in a sample set containing 11,120 Android application system call sequence features. To facilitate subsequent research, the final extracted system call sequence format in this example retained only the system call names and chronological order. A total of 102 different system calls from the Android 6.0 system were extracted from all samples, as shown in Table 9.

[0116] Table 9 102 system calls included in the application sample

[0117]

[0118]

[0119] Among the 102 system calls shown in Table 9, there are 25 system calls that are unique to benign applications, and their serial numbers are marked with (#); there are 4 system calls that are unique to malicious applications, and their serial numbers are marked with (*); there are 73 system calls that are common to both. From the above data, it can be seen that there are a large number of identical system calls between benign applications and malicious applications. In order to further analyze the differences in the system call usage patterns between the two, in this embodiment, the number of all system calls will be counted and sorted according to the frequency of use. The names of the top 25 system calls in benign applications and malicious applications and their proportions are as follows: Figure 10 and Figure 11 As shown in the figure, we can observe that among the 25 most frequently used system calls by both benign and malicious applications, there are still 21 system calls that are common to both. Therefore, to determine whether system calls are an effective feature for distinguishing malicious and benign applications, we conducted a Mann-Whitney rank sum test on system calls in malicious and benign applications.

[0120] Mann-Whitney U test: This test is used to test whether the distribution of a variable in two independent samples is different. This test can compare two groups of samples without making any distributional assumptions. The test steps are as follows:

[0121] (1) Set the capacity to n A Sample A and capacity n B In sample B (n A +n B ) observations are arranged in order of size, with 1 assigned to the smallest observation, 2 to the second smallest observation, and so on. If there are identical observations, the rank is assigned to be the average of the sum of their ranks;

[0122] (2) Calculate the rank sum T of two samples A and T B ;

[0123] (3) According to T A and T B The formula for the Mann-Whitney U test is given. The test statistic is as follows:

[0124] U A =n A n B +n A (n A +1) / 2-T A

[0125] U B =n A n B +n B (n B+1) / 2-T B

[0126]

[0127] (4) When the significance level α is set: if Z>Z α / 2 or Z≤-Z α / 2 , we reject the null hypothesis H0.

[0128] The null hypothesis of the Mann-Whitney U test is H0: there is no significant difference in the system call patterns between benign applications and malicious applications; the alternative hypothesis is H1: there is a significant difference in the system call patterns between benign applications and malicious applications. For a system call, if a benign or malicious application uses this system call, then the sample value is set to 1, otherwise it is set to 0. Therefore, for each system call, a vector of length 11120 will be obtained, and a total of 102 such system call feature vectors can be obtained. The hypothesis test results of the corresponding system calls are plotted according to the marked serial numbers, and the following are obtained: Figure 12 The results are shown in red, with a significance level of α = 0.05. As can be seen from the results, 90 of the 102 system calls have p-values ​​less than 0.05, so with over 95% confidence, we can reject the null hypothesis H0 and accept H1, which states that there are significant differences in the system call usage patterns between benign and malicious applications, and that these differences can be used as features for classification detection.

[0129] In the Markov chain, let X = {X i , i=1,2,…} is a sequence of random variables in a discrete time random process, and S={s i , i=0,1,…t} represents the discrete state space of X. If X satisfies: P(X t+1 =s|X t =s t ,X t-1 =s t-1 ,...,X0=s0)=P(X t+1 =s|X t =s t ) in the form of a formula, i.e., the sequence t + The state at time 1 is only affected by the current state s at time t t , and has nothing to do with the earlier state, or in other words, all relevant information about the historical state is passed through the current state s t If it is reflected, the discrete-time random process X is said to have Markov characteristics, and its sequence is a Markov chain.

[0130] The system call sequence is a description of the system's operating status. The current system call status of the system is directly related to the system call at the previous moment, so the system call sequence can be regarded as a Markov chain.

[0131] In the transition probability, the conditional probability p is called ij (n) = P{X n+1 =j|X n =i} is a Markov chain {X n ,n∈T} at time n, the transition probability describes the probability of jumping from a Markov state i to the successor state j. Let the state space be I={1,2,…,n}, and the transition probability p between all states ij Constructing the transition probability matrix

[0132]

[0133] The transition probability matrix describes the probability statistical characteristics of the evolution between states of the Markov process, and the sum of the state transition probabilities in each row is equal to 1.

[0134] Table 10 System call sequence example

[0135]

[0136] Taking the system call sequence of length 10 in Table 10 as an example, the calculation results of its transition probability matrix are as follows: Figure 13 shown.

[0137] Based on the above process, we can get the generation algorithm of the system call sequence state transition matrix, as shown in Table 11

[0138] Table 11 System call sequence transition probability matrix generation algorithm

[0139]

[0140]

[0141] Each element between (0,1) of the obtained system call transition probability matrix is ​​further mapped to the interval (0,255). For the convenience of observation, in this embodiment, the value 0 can be mapped to white (R:255, G:255, B:255), the value 255 can be mapped to black (R:0, G:0, B:0), and the other values ​​can be mapped to grayscale colors that transition from black to white (R:gray ij ,G:gray ij ,B:gray ij ):

[0142] gray ij =(1-p ij)×255

[0143] The above formula can be used to convert the transition probability matrix into a corresponding grayscale image, which serves as the application's "fingerprint." Different applications typically have different fingerprint images, and this characteristic can be used to distinguish between benign and malicious applications. Malicious applications from the same family with similar malicious behaviors also share similar fingerprint images, which can be used to classify malicious applications by family.

[0144] To avoid generating an excessive number of sparse matrices when generating fingerprint features, the importance of the 102 system calls can be examined. Based on the requirements of the input layer of different neural network models, a relatively critical set of system calls can be selected by ranking them by importance. To this end, in this embodiment, the TF-IDF (term frequency-inverse document frequency) algorithm is used to rank the feature importance.

[0145] TF-IDF is commonly used in automatic text analysis in natural language processing to measure the importance of a keyword. In this embodiment, a system call is regarded as a term, then TF represents the frequency of a term appearing in all documents, and IDF represents the number of documents containing a term. i |inverse frequency of occurrence in all documents |D|. TF-IDF is the product of the two, such as As shown in the formula, TF-IDF is proportional to the number of times a term appears in a document, and inversely proportional to the number of times the term appears in the document.

[0146] By applying the TF-IDF algorithm to feature-rank all system call sequence texts extracted in this embodiment, the TF-IDF values ​​of 102 system calls were calculated and sorted in descending order. The TF-IDF ranking results for each system call are shown in Table 12. By retaining the first 67 system calls with TF-IDF values ​​no less than 1e-5 as the row and column indices of the fingerprint matrix, a grayscale image of the system call sequence fingerprint with a size of 67×67 was generated.

[0147] Table 12 TF-IDF ranking results of system calls

[0148]

[0149]

[0150] Furthermore, in this embodiment, the AlexNet model structure can be used as a convolutional neural network model to detect malicious Android applications. The AlexNet model is trained using the Android application system call sequence fingerprints generated above as model input to obtain the final detection model. The model structure can be composed of five convolutional layers, three pooling layers, and three fully connected layers. The classification results are obtained by performing convolution, pooling, and fully connected operations on the input.

[0151] Furthermore, based on the above method, an embodiment of the present invention also provides a mobile Internet operating system third-party application risk analysis system for performing static and dynamic evaluation and detection on malicious applications, comprising: a static analysis module and a dynamic analysis module, wherein:

[0152] The static analysis module is used to quantitatively assess the privacy leakage risks of third-party applications by using dangerous permissions and sensitive API functions. Based on the quantitative assessment results, the module uses the function call graph structure features that represent the call relationships between functions and the topology information of multi-hop function nodes to identify and distinguish the categories of third-party applications.

[0153] The dynamic analysis module is used to extract the state transition relationship between third-party application system calls, identify and distinguish third-party application categories based on the system call sequence fingerprint features and using convolutional neural networks, and finally determine the third-party application risks by combining the identification and distinction results of third-party application categories by the static analysis module.

[0154] Through four steps, namely, identifying the source of risk, assessing the likelihood of risk occurrence, assessing the severity of risk consequences, and conducting a comprehensive risk assessment, a complete risk assessment process is formed to assess Android application privacy risks. Static analysis and detection of malicious Android applications based on the structural features of the function call graph is utilized. Function call graph structural features are extracted through a method for generating a function call graph with structural features and a static analysis and detection algorithm for malicious Android applications based on a deep graph convolutional network. Dynamic analysis and detection of malicious Android applications based on system call sequence fingerprint features improves the accuracy of third-party application security risk assessment and detection in mobile internet operating systems through a combination of static and dynamic methods, facilitating practical application in real-world scenarios.

[0155] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0156] Based on the above method and / or system, an embodiment of the present invention also provides a server, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0157] Based on the above method and / or system, an embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, wherein the above method is implemented when the program is executed by a processor.

[0158] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not limiting, and thus other examples of the exemplary embodiments may have different values.

[0159] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0160] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A mobile internet operating system third-party application risk analysis method for static and dynamic evaluation and detection of malicious applications, characterized in that: Contains the following content: During the static analysis and assessment phase, we use dangerous permissions and sensitive API functions to quantitatively assess the privacy leakage risks of third-party applications. Based on the quantitative assessment results, we use the function call graph structure features that characterize the call relationships between functions and the topology of multi-hop function nodes to identify and distinguish third-party application categories. During the dynamic analysis, assessment, and detection phase, we extract the state transition relationships between third-party application system calls, identify and differentiate third-party application categories based on system call sequence fingerprints and a convolutional neural network. This is combined with the identification and differentiation results from the static analysis, assessment, and detection phase to ultimately determine third-party application risks. Among them, the structural features of the function call graph are used to identify and distinguish third-party applications. First, a directed graph consisting of a set of functions used by third-party applications as nodes and a set of call relationships between functions as edges is used as a function call graph; then, sensitive APIs known to be exploited by malicious applications are selected, and a sensitive API call subgraph in the function call graph is composed of a set of sensitive API call nodes and their neighboring nodes and a set of edges of call relationships between functions; a trained deep graph convolutional network is used to extract the structural feature vectors of all nodes in the sensitive API call subgraph and classify them to identify and distinguish the categories of third-party applications.

2. The method for analyzing third-party application risks in a mobile Internet operating system according to claim 1, wherein: Based on the usage of dangerous permissions set in the dangerous permission groups in the mobile Internet operating system by malicious and benign applications, machine learning methods are used to explore and classify the usage patterns of dangerous permissions by malicious and benign applications, and quantitative evaluation is performed based on the classification results.

3. The method for analyzing third-party application risks in a mobile Internet operating system according to claim 2, wherein: An ensemble learning classifier is used to explore the usage patterns of dangerous permissions by malicious and benign applications and to classify and quantitatively evaluate them. The ensemble learning classifier contains an odd number of individual classifiers with different structures. The individual classifiers with different structures include at least decision trees, support vector machines, deep convolutional networks (DNNs), convolutional neural networks (CNNs), and deep belief networks (DBNs). The classification output results of the individual classifiers are voted on, and the risk of privacy leakage in third-party applications is quantitatively assessed based on the voting results.

4. The method for analyzing third-party application risks in a mobile Internet operating system according to claim 1, wherein: Sensitive API functions are clustered according to the dangerous permission groups set in the corresponding mobile Internet operating systems, and the risk assessment of sensitive API functions is converted into a risk assessment of dangerous permission groups. The weight of each dangerous permission group is obtained based on information gain, and the privacy leakage risk of third-party applications is graded and quantitatively assessed according to the weight ranking.

5. The method for analyzing third-party application risks in a mobile Internet operating system according to claim 4, wherein: In obtaining the weight of each dangerous permission group based on gain, known malicious applications and benign applications are used as sample sets. The use of dangerous permission groups by sensitive API functions of each application in the sample set is divided into subsets that use dangerous permission groups and subsets that do not use dangerous permission groups. The information entropy of the sample set is used to obtain the weight of the corresponding subset. The information gain of the dangerous permission group is calculated based on the subset weight, and the information gain of each dangerous permission group in the sample set is normalized to obtain the corresponding weight. The information gain calculation formula is expressed as: P is the dangerous permission group, D is the sample set, E(D) is the information entropy of the sample set, D n is a subset, E(D n ) is the subset information entropy.

6. The method for analyzing third-party application risks in a mobile Internet operating system according to claim 1, wherein: To extract the state transition relationship between system calls, during the interaction between the simulator and the host, we use application automation testing tools and system call tracing tools to extract the third-party application system call sequence. We regard the system call sequence as a Markov chain and obtain the system call sequence state transition probability matrix based on the Markov process. For the system call sequence state transition probability matrix, its grayscale image is used as the input of the trained convolutional neural network model, and the convolutional neural network model is used to classify and identify the third-party application category.

7. The method for analyzing third-party application risks in a mobile Internet operating system according to claim 1, wherein: To extract the system call sequence features, first, install a third-party application in the simulator, then use the system call tracking tool to track the application process and record the system call sequence executed by the application; at the same time, use the random event operations preset in the application automation testing tool to trigger the application behavior and capture the text log that stores the system call sequence, where each line in the text log records the system call operation with a timestamp; finally, construct the system call sequence features based on the captured text log.

8. The method for analyzing third-party application risks in a mobile Internet operating system according to claim 6 or 7, wherein: For the grayscale image of the state transition probability matrix of the system call sequence, the TF-IDF algorithm is used to sort the feature importance of all the extracted system call sequences, and the sorting results are selected as the input of the trained convolutional neural network model.

9. A mobile Internet operating system third-party application risk analysis system for performing static and dynamic evaluation and detection of malicious applications, characterized in that: The method according to claim 1 is implemented, comprising: a static analysis module and a dynamic analysis module, wherein: The static analysis module is used to quantitatively assess the privacy leakage risks of third-party applications by using dangerous permissions and sensitive API functions. Based on the quantitative assessment results, the module uses the function call graph structure features that represent the call relationships between functions and the topology information of multi-hop function nodes to identify and distinguish the categories of third-party applications. The dynamic analysis module is used to extract the state transition relationship between third-party application system calls, identify and distinguish third-party application categories based on the system call sequence fingerprint features and using convolutional neural networks, and finally determine the third-party application risks by combining the identification and distinction results of third-party application categories by the static analysis module.

Images