Method, device and electronic device for detecting junk software

Abstract

The embodiments of the present application propose a method, device and electronic device for detecting junk software, the method comprising: extracting features to be detected from the software to be detected; detecting the features to be detected using preset rules to obtain a first detection result; inputting the features to be detected into a trained classification prediction model for detection to obtain a second detection result, wherein the trained classification prediction model is obtained by combining and training multiple features extracted by a logistic regression model LR feature extractor, a domain decomposition machine model FFM feature extractor and a deep neural network model DNN feature extractor; obtaining a final detection result based on the first detection result and the second detection result. The above method improves detection efficiency without significantly increasing time consumption and training costs.

Description

[Technical field]

[0001] The embodiments of the present application relate to the field of software detection technology, and in particular, to a method, device and electronic device for detecting junk software. [Background technology]

[0002] The existing methods for detecting spam software can be roughly divided into three categories. The first category is rule-based detection methods, which have the problem of low accuracy; the second category is detection methods based on feature learning such as artificial intelligence, which have disadvantages such as high training cost and long time consumption; the third category is detection methods that are improved from simple models, such as the combination of CNN and DNN, but the scope of application is limited. The convolution kernel of CNN is better at capturing image features, and RNN is better at capturing features of continuous sequences such as speech and text, but the performance in other fields is not very outstanding, and the number of training parameters is also high, and the training cost is high.

[0003] Therefore, it is an urgent problem to provide a detection method for junk software in smart devices that infringes on user privacy and device security without significantly increasing time and training costs and can also improve detection efficiency. [Summary of the invention]

[0004] The embodiments of the present application provide a method for detecting junk software, which improves detection efficiency without significantly increasing time consumption and training costs.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting junk software, which is applied to an electronic device, comprising: extracting features to be detected from the software to be detected; detecting the features to be detected using preset rules to obtain a first detection result, wherein the first detection result is used to indicate whether the software to be detected is junk software; inputting the features to be detected into a trained classification prediction model for detection to obtain a second detection result, wherein the second detection result is used to indicate whether the software to be detected is junk software, wherein the trained classification prediction model is obtained by combining and training multiple features extracted by a logistic regression model LR feature extractor, a domain decomposition machine model FFM feature extractor, and a deep neural network model DNN feature extractor; and obtaining a final detection result based on the first detection result and the second detection result.

[0006] The beneficial effect of the first aspect is to identify junk software by combining the two detection results of classification prediction based on rule judgment and feature extraction and training methods based on artificial intelligence. The classification prediction method uses three different types of feature extractors to capture features and conduct combined training on multiple features. It has low time and space complexity and fast calculation speed. In addition, due to the small number of training parameters, it can also ensure rapid iteration and response of results. In addition, the detection accuracy has also been optimized.

[0007] In a possible implementation, the feature to be detected includes at least one of a permission feature, an intent feature, an application programming interface API feature, and a system signature feature.

[0008] In a possible implementation, obtaining a final detection result according to the first detection result and the second detection result includes: obtaining a union of the first detection result and the second detection result to obtain the final detection result.

[0009] In one possible implementation, the training process of the classification prediction model includes: obtaining multiple software samples, the software samples including annotation information, and the annotation information is used to indicate that the software samples are normal software or junk software; obtaining the features to be detected of the software samples; inputting the features to be detected of the software samples into the LR feature extractor to obtain a first output; inputting the features to be detected of the software samples into the FFM feature extractor to obtain a second output; inputting the features to be detected of the software samples into the DNN feature extractor to obtain a third output; adding the result obtained by multiplying the logarithm of the first output by a preset first weight, the result obtained by multiplying the logarithm of the second output by a preset second weight, and the result obtained by multiplying the logarithm of the third output by a preset third weight, and then merging and training them through a regression loss function.

[0010] In a possible implementation manner, the acquiring the features to be detected of the software sample includes: performing data cleaning and feature screening on the acquired features to be detected of the software sample.

[0011] In a possible implementation, the FFM feature extractor normalizes the extracted cross features, and the normalization uses a Sigomoid function.

[0012] In a possible implementation, the formula of the FFM feature extractor is: Among them, y2 represents the second output, σ represents the Sigmoid function, and x i ,x j represents the input feature, b represents the bias term, w0 represents the constant term, and w i represents the coefficient of the first-order term, v i ,v j x i ,x j dense expression of .

[0013] In one possible implementation, the formula of the DNN feature extractor is: y3 = h l+1 ,h l+1 =f(Wl h l +b l ), where y3 represents the third output, h l+1 represents the output of the current layer, W l represents the weight matrix of the previous layer, h l represents the weight activation value of the previous hidden layer, b l Represents the weight bias of the previous layer.

[0014] In a second aspect, an embodiment of the present application provides a device for detecting junk software, which is applied to an electronic device, comprising: a feature extraction module, used to extract features to be detected from the software to be detected; a first result module, used to detect the features to be detected using preset rules, and obtain a first detection result, wherein the first detection result is used to indicate whether the software to be detected is junk software; a second result module, used to input the features to be detected into a trained classification prediction model for detection, and obtain a second detection result, wherein the second detection result is used to indicate whether the software to be detected is junk software, wherein the trained classification prediction model is obtained by combining and training multiple features extracted by a logistic regression model LR feature extractor, a domain decomposition machine model FFM feature extractor, and a deep neural network model DNN feature extractor; and a result generation module, used to obtain a final detection result based on the first detection result and the second detection result.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor; and at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the method provided in the first aspect.

[0016] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions enable the computer to execute the method provided in the first aspect.

[0017] It should be understood that the second to fourth aspects of the embodiments of the present application are consistent with the technical solutions of the first aspect of the embodiments of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here.

Brief Description of the Drawings

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of a method for detecting junk software provided in an embodiment of the present application;

[0020] Figure 2 A flowchart of a training process of a classification prediction model provided in an embodiment of the present application;

[0021] Figure 3 A schematic diagram of the structure of a device for detecting junk software provided in an embodiment of the present application;

[0022] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. [Specific implementation method]

[0023] In order to better understand the technical solution of this specification, the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0024] It should be clear that the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0025] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit this specification. The singular forms of "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0026] To facilitate those skilled in the art to understand the technical solution of the present application, the technical terms involved in the present application are explained below.

[0027] (1) LR: Logistic Regression is a classification model in machine learning. Due to its simplicity and high efficiency, it is widely used in practice.

[0028] (2) FFM: Field-aware Factorization Machines (FFM) is a method for capturing cross-features. Each feature belongs to a specific field, and there is a one-to-many relationship between field and feature.

[0029] (3) DNN: Deep Neural Network is a commonly used deep learning method that can better capture hidden features through learning multiple hidden layers.

[0030] (4) CNN: Convolutional Neural Networks (CNN) are a type of feedforward neural networks that include convolutional calculations and have a deep structure. They are one of the representative algorithms of deep learning.

[0031] (5)RNN: A recurrent neural network (RNN) is a type of recursive neural network that takes sequence data as input, performs recursion in the direction of sequence evolution, and all nodes (recurrent units) are connected in a chain-like manner.

[0032] (6) PCA: Principal Component Analysis, also known as principal component analysis technology, aims to use the idea of ​​dimensionality reduction to transform multiple indicators into a few comprehensive indicators.

[0033] The junk software detection methods in the prior art can be roughly divided into three categories. One is the rule-based detection method. For example, many common detection methods on the market match potentially risky junk software through a combination of scripting language and regular expressions. This method is relatively fast, but due to the limited rules, it is impossible to learn hidden features, and there is a problem of low accuracy. Some junk software can easily conceal detection through some encryption methods. Another type is a method based on feature learning such as artificial intelligence. For example, in academia, graph neural networks, knowledge graph construction, pre-training models and other methods are often used to perform complex reasoning and learning on hidden features. This type of method is often more accurate than the rule, but because the model is too complex, it often takes a very long time to train, and the number of parameters can even reach hundreds of millions, which has the disadvantages of high training cost and long time. The third type of detection method is an improvement on the simple model, such as the combination of CNN and DNN, the combination of RNN and DNN, etc. This type of method has a limited scope of application. The convolution kernel of CNN is better at capturing image features, and RNN is better at capturing features of continuous sequences such as speech and text. The performance effect is not outstanding in other fields, and the number of training parameters will also increase.

[0034] Based on the above problems, an embodiment of the present application provides a method for detecting junk software, which detects junk software that infringes on user privacy and device security in current smart devices, and improves efficiency compared to simple models without significantly increasing time and training costs.

[0035] Figure 1A flowchart of a method for detecting junk software provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method for detecting junk software is applied to an electronic device, and includes:

[0036] Step 101: extracting features to be detected from the software to be detected.

[0037] The feature to be detected includes at least one of a permission feature, an intent feature, an application programming interface API feature, and a system signature feature.

[0038] It should be noted that when we obtain some APKs to be identified, such as APKs in the Android system, we can decompile the Android APK file to obtain the decompiled intermediate file. The features to be detected related to detecting junk software may include static features, and static features may include permission settings (such as settings that can obtain user privacy information, send and receive information, etc.), intent settings (such as automatically calling methods to obtain user information in TelephoneManager, Location, SmsManager, etc.), API components, system signatures, etc. It can be understood that the features to be detected are not limited to the types described above, but may also include other types of features. The embodiments of the present application do not limit the types and quantities of the features to be detected.

[0039] Step 102: Detect the feature to be detected using a preset rule to obtain a first detection result, where the first detection result is used to indicate whether the software to be detected is junk software.

[0040] It should be noted that after extracting the features to be detected, some automated methods can be used to analyze the features to be detected to identify APKs that may have malicious behaviors. For example, the features to be detected are detected using preset rules to obtain a first detection result indicating whether the software to be detected is junk software. Using preset rules to detect the features to be detected can very quickly determine the detection result of whether the software to be detected is junk software through explicit features.

[0041] Step 103: Input the feature to be detected into a trained classification prediction model for detection to obtain a second detection result, wherein the second detection result is used to indicate whether the software to be detected is junk software, wherein the trained classification prediction model is obtained by combining and training multiple features extracted by a logistic regression model LR feature extractor, a domain decomposition machine model FFM feature extractor, and a deep neural network model DNN feature extractor.

[0042] It should be noted that after extracting the features to be detected, the features to be detected are input into a trained classification prediction model, and the classification prediction model outputs a second detection result indicating whether the software to be detected is junk software. Among them, the trained prediction model includes three feature extractors, namely, a logistic regression model LR feature extractor, a domain decomposition machine model FFM feature extractor, and a deep neural network model DNN feature extractor. Combining the multiple features extracted by the three feature extractors for the training of the three feature extractors can better mine deep features and improve the accuracy of detecting junk software.

[0043] Step 104: Obtain a final detection result according to the first detection result and the second detection result.

[0044] Wherein, obtaining the final detection result according to the first detection result and the second detection result may include: obtaining the final detection result by taking the union of the first detection result and the second detection result.

[0045] It should be noted that, in order to further improve the accuracy of detection, we can take the union of the junk software set filtered out according to the rules and the junk software set predicted by feature learning as the final recognition result.

[0046] The present invention combines the detection results of two methods, namely, classification prediction based on rule judgment and classification prediction based on artificial intelligence feature extraction and training methods, to identify junk software. The classification prediction model combines three different types of feature extractors to capture two types of features (memory features and generalization features), and combines the captured multiple features for training. Compared with the complex neural network model in academia, the present invention has low time and space complexity, fast calculation speed, and a small number of training parameters, which can ensure rapid iteration and response of results. Compared with the simple neural network and recall method in the industry, the present invention integrates multiple types of information and is also optimized in accuracy.

[0047] It is understandable that the method for detecting junk software provided in the embodiments of the present application can be applied to smart phones, tablet computers, vehicle-mounted devices or other electronic devices based on the Android platform.

[0048] Figure 2 A flow chart of a training process of a classification prediction model provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the training process of the classification prediction model includes:

[0049] Step 201: Acquire multiple software samples, wherein the software samples include annotation information, and the annotation information is used to indicate whether the software samples are normal software or junk software.

[0050] Among them, the embodiment of the present application can identify some APKs currently available on the market by marking, where 0 represents no junk software information and 1 represents junk software information. In order to better mine the deep features of junk software information, this information can be further input into the classification prediction model for identifying junk software that needs to be trained for training.

[0051] Step 202: Obtain the features to be detected of the software sample.

[0052] The feature to be detected includes at least one of a permission feature, an intent feature, an application programming interface API feature, and a system signature feature.

[0053] It should be noted that when we obtain some APKs to be identified, such as APKs in the Android system, we can decompile the Android APK file to obtain the decompiled intermediate file. The features to be detected related to detecting junk software may include static features, and static features may include permission settings (such as settings that can obtain user privacy information, send and receive information, etc.), intent settings (such as automatically calling methods to obtain user information in TelephoneManager, Location, SmsManager, etc.), API components, system signatures, etc. It can be understood that the features to be detected are not limited to the types described above, but may also include other types of features. The embodiments of the present application do not limit the types and quantities of the features to be detected.

[0054] The step of obtaining the features to be detected of the software sample includes: performing data cleaning and feature screening on the obtained features to be detected of the software sample.

[0055] It should be noted that the information obtained through automated methods is often mixed with a lot of dirty data, so the data needs to be simply cleaned before integration. For continuous features, remove values ​​that are obviously not in a reasonable range, for discrete features, remove values ​​that are not in a reasonable set, and remove garbled and unreasonable identifiers in the data. In order to facilitate the training of feature extractors such as LR and FFM, we can further consider discretizing some continuous features, which has a good effect on both computing time and learning cross-features.

[0056] After data cleaning, feature selection can be further performed. In the embodiment of the present application, principal component analysis (PCA) can be used to project data into the space of feature vectors in a relatively simple way to select the top 10-20 features with higher eigenvalues. Reducing the number of features not only reduces the training pressure, but also allows related features to have greater voice. After feature selection, the data can be input into the classification prediction model for training.

[0057] Step 203: Input the features to be detected of the software sample into the LR feature extractor to obtain a first output.

[0058] It should be noted that the model can be divided into three feature extractors, namely LR feature extractor, FFM feature extractor and DNN feature extractor. Considering better processing of discrete sparse features, the extracted static features can first be input into the LR feature extractor, where LR is a generalized linear model, and the formula of the LR feature extractor is: Where y1 represents the first output, x represents the original feature, represents the cross feature, W T represents the weight matrix and b represents the bias. This method is fast and efficient and the feature importance is easy to analyze.

[0059] Step 204: Input the features to be detected of the software sample into the FFM feature extractor to obtain a second output.

[0060] It should be noted that in order to better capture the cross-features between different features, the extracted static features can then be input into the FFM feature extractor. Since features often do not exist independently in actual situations, they usually cross-feature with other features. FM is a very lightweight cross-feature extractor, i.e. Where x is the input feature and v is the model parameter. In FM, all features share the parameter v. In order to further refine the attribution of cross-features, FFM attributes each dimension of features to a specific domain. The domain and feature are in a one-to-many relationship. In order to distinguish different domains, the parameter v is no longer shared when extracting cross-features, that is,

[0061] Furthermore, the embodiment of the present application improves the FFM feature extractor based on the idea of ​​FFM and extracts cross features. The formula of the improved FFM feature extractor is: Among them, y2 represents the second output, σ represents the Sigomoid function, and x i ,x j represents the input feature, b represents the bias term, w0 represents the constant term, and w i Represents the linear coefficient. Since the quadratic coefficient matrix W n×n For a symmetric square matrix, we can decompose it to reduce the number of parameters that need to be trained: Each coefficient w i,j = <v i ,v j >, where Therefore, i ,v jx i ,x j The dense expression of , or the latent vector of the i-th feature. Where σ is the Sigomoid function, the expression is By normalizing the features, more accurate and faster training can be achieved.

[0062] Step 205: Input the features to be detected of the software sample into the DNN feature extractor to obtain a third output.

[0063] It should be noted that in order to further improve the generalization ability of the model, the third feature extractor uses a deep feedforward neural network DNN. By converting sparse high-dimensional features into low-dimensional dense vectors, many hidden deep features can be mined during the training process. The calculation method for each layer of the network is: l+1 =f(W l h l +b l ), where h l+1 represents the output of the current layer, W l represents the weight matrix of the previous layer, h l represents the weight activation value of the previous hidden layer, b l represents the weight bias of the previous layer. The DNN feature extractor inputs the original feature x into the model and 2 =f(W 1 x+b 1 ) is input to the lower network, and after propagation through the l-layer DNN, the result of the last layer is extracted as the output of the DNN feature extractor, that is, y3 = h l+1 .

[0064] Step 206: Add the result obtained by multiplying the logarithm of the first output by the preset first weight, the result obtained by multiplying the logarithm of the second output by the preset second weight, and the result obtained by multiplying the logarithm of the third output by the preset third weight, and then merge and train them through the regression loss function.

[0065] It should be noted that after obtaining three different types of features through training, the embodiment of the present application takes the logarithm of the three outputs and adds them according to the preset weights, and then combines them for training through the regression loss function. The parameters involved can also be learned and updated during training. The final combination formula is: in, They represent the coefficient matrices of the LR feature extractor, FFM feature extractor, and DNN feature extractor, respectively. b represents the bias term. σ is the Sigmoid function, which normalizes the output value to the interval (0,1). P(Y=1|x) represents the probability of the classification prediction model predicting the true value. The final prediction result can be discretized into 0 or 1 to determine whether it is junk software.

[0066] In the embodiment of the present application, for memory features, that is, features that can be directly interpreted and acquired, they are extracted through the LR feature extractor. LR is a feature extractor widely used in the industry, with fast operation speed and good accuracy. The embodiment of the present application uses this method to simply recall the features. In addition, in order to capture the interaction between features, an improvement on the FFM feature extractor is used to perform a secondary screening of the features to capture as much first-order and high-order information of the features as possible, thereby improving the training effect of the model. For generalized features, that is, features that cannot be directly interpreted and acquired, the embodiment of the present application uses a DNN feature extractor to capture the hidden information in the features. After learning multiple hidden layers, the optimal features can be extracted, and then further integrated with the memory features to achieve the best effect of the present invention.

[0067] Figure 3 A schematic diagram of a junk software detection device provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, the device includes: a feature extraction module 301, a first result module 302, a second result module 303 and a result generation module 304, wherein:

[0068] The feature extraction module 301 is used to extract the features to be detected from the software to be detected;

[0069] A first result module 302, used to detect the feature to be detected using a preset rule to obtain a first detection result, wherein the first detection result is used to indicate whether the software to be detected is junk software;

[0070] The second result module 303 is used to input the feature to be detected into the trained classification prediction model for detection to obtain a second detection result, wherein the second detection result is used to indicate whether the software to be detected is junk software, wherein the trained classification prediction model is obtained by combining and training multiple features extracted by a logistic regression model LR feature extractor, a domain decomposition machine model FFM feature extractor, and a deep neural network model DNN feature extractor;

[0071] The result generating module 304 is used to obtain a final detection result according to the first detection result and the second detection result.

[0072] Figure 3 The apparatus for detecting junk software provided in the embodiment shown can be used to execute the present invention. Figure 1 The technical solution of the method embodiment shown, its implementation principle and technical effects can be further referred to the relevant description in the method embodiment.

[0073] It is understandable that the method for detecting junk software can be performed by the following devices: a chip or a chip module. Regarding the various modules / sub-modules / units contained in the various devices and products described in the above embodiments, they can be software modules / sub-modules / units, or hardware modules / sub-modules / units, or they can be partially software modules / sub-modules / units and partially hardware modules / sub-modules / units. For example, for various devices and products applied to or integrated in a chip, the various modules / sub-modules / units contained therein can all be implemented in the form of hardware such as circuits, or at least some of the modules / sub-modules / units can be implemented in the form of software programs, which run on a processor integrated inside the chip, and the remaining (if any) modules / sub-modules / units can be implemented in the form of hardware such as circuits; for various devices and products applied to or integrated in a chip module, the various modules / sub-modules / units contained therein can all be implemented in the form of hardware such as circuits, and different modules / sub-modules / units can be located in the same component (such as a chip, circuit module, etc.) or different components of the chip module, or at least some of the modules / sub-modules / unit can be implemented in the form of a software program, which runs on a processor integrated inside the chip module, and the remaining (if any) modules / sub-modules / units can be implemented in the form of hardware such as circuits; for various devices and products applied to or integrated in the terminal, the various modules / sub-modules / units contained therein can all be implemented in the form of hardware such as circuits, and different modules / sub-modules / units can be located in the same component (for example, a chip, circuit module, etc.) or in different components in the terminal, or, at least some of the modules / sub-modules / units can be implemented in the form of a software program, which runs on a processor integrated inside the terminal, and the remaining (if any) modules / sub-modules / units can be implemented in the form of hardware such as circuits.

[0074] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, Figure 4 A schematic diagram of the structure of an electronic device to which the method for detecting junk software provided by an embodiment of the present application can be applied, such as Figure 4 As shown, the electronic device may include at least one processor; and at least one memory connected to the processor in communication, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the instructions of this specification. Figure 1-2 The illustrated embodiment provides a method for detecting junk software.

[0075] The electronic device may be a smart electronic device such as a smart phone, a tablet computer or a laptop computer, and the present embodiment does not limit the form of the electronic device.

[0076] For example, Figure 4Taking a smart phone as an example, a schematic diagram of the structure of a terminal device is shown. Figure 4 As shown, the electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc. Furthermore, when the terminal device is a mobile phone, the terminal device may also include: antenna 1, antenna 2, mobile communication module 150, wireless communication module 160, audio module 170, speaker 170A, receiver 170B, microphone 170C, headphone interface 170D, and subscriber identification module (SIM) card interface 195, etc.

[0077] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may include more or fewer components than shown in the figure, or combine some components, or separate some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0078] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0079] The controller can be the nerve center and command center of the terminal device. The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of fetching and executing instructions.

[0080] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0081] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0082] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple groups of I2C buses. The processor 110 may be coupled to the touch sensor 180K, the charger, the flash, the camera 193, etc. through different I2C bus interfaces. For example: the processor 110 may be coupled to the touch sensor 180K through the I2C interface, so that the processor 110 communicates with the touch sensor 180K through the I2C bus interface, thereby realizing the touch function of the electronic device 100.

[0083] The I2S interface can be used for audio communication. In some embodiments, the processor 110 can include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to achieve communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 via the I2S interface to achieve the function of answering a call through a Bluetooth headset.

[0084] The PCM interface can also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via a PCM bus interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface to realize the function of answering calls via a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0085] The UART interface is a universal serial data bus for asynchronous communication. The bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, the UART interface is generally used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to implement the Bluetooth function. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 through the UART interface to implement the function of playing music through a Bluetooth headset.

[0086] The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI), a display serial interface (DSI), etc. In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to implement the shooting function of the electronic device 100. The processor 110 and the display screen 194 communicate via the DSI interface to implement the display function of the electronic device 100.

[0087] The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 with the camera 193, the display 194, the wireless communication module 160, the audio module 170, the sensor module 180, etc. The GPIO interface can also be configured as an I15c interface, an I14S interface, a UART interface, a MIPI interface, etc.

[0088] The USB interface 130 is an interface that complies with the USB standard specification, and can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the electronic device 100, and can also be used to transfer data between the electronic device 100 and a peripheral device. It can also be used to connect headphones to play audio through the headphones. The interface can also be used to connect other terminal devices, such as AR devices, etc.

[0089] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present invention is only a schematic illustration and does not constitute a structural limitation on the electronic device 100. In other embodiments of the present application, the electronic device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0090] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the electronic device 100. While the charging management module 140 is charging the battery 142, it may also power the terminal device through the power management module 141.

[0091] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and supplies power to the processor 110, the internal memory 121, the display screen 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0092] The wireless communication function of the electronic device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0093] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0094] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the electronic device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0095] The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be set in the same device as the mobile communication module 150 or other functional modules.

[0096] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the electronic device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0097] In some embodiments, the antenna 1 of the electronic device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the electronic device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-SCDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology, etc. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a Beidou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0098] The electronic device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

[0099] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0100] A series of graphical user interfaces (GUIs) can be displayed on the display screen 194 of the terminal device, and these GUIs are the main screens of the terminal device. Generally speaking, the size of the display screen 194 of the terminal device is fixed, and only limited controls can be displayed on the display screen 194 of the terminal device. A control is a GUI element, which is a software component included in an application program, and controls all data processed by the application program and interactive operations on the data. Users can interact with the control through direct manipulation to read or edit relevant information of the application program. Generally speaking, controls can include visual interface elements such as icons, buttons, menus, tabs, text boxes, dialog boxes, status bars, navigation bars, widgets, etc. For example, in an embodiment of the present application, the display screen 194 can display virtual buttons.

[0101] The electronic device 100 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0102] ISP is used to process the data fed back by camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to ISP for processing and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, ISP can be set in camera 193.

[0103] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the electronic device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0104] The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the electronic device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0105] Video codecs are used to compress or decompress digital videos. The electronic device 100 may support one or more video codecs. Thus, the electronic device 100 may play or record videos in a variety of coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0106] NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission mode between neurons in the human brain, it can quickly process input information and can also continuously self-learn. Through NPU, applications such as intelligent cognition of electronic device 100 can be realized, such as image recognition, face recognition, voice recognition, text understanding, etc.

[0107] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0108] The internal memory 121 can be used to store computer executable program codes, which include instructions. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the electronic device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the electronic device 100 by running instructions stored in the internal memory 121, and / or instructions stored in a memory provided in the processor.

[0109] The electronic device 100 can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0110] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110.

[0111] The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The electronic device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0112] The receiver 170B, also called a "earpiece", is used to convert audio electrical signals into sound signals. When the electronic device 100 receives a call or voice message, the voice can be received by placing the receiver 170B close to the human ear.

[0113] Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to microphone 170C to input the sound signal into microphone 170C. The electronic device 100 can be provided with at least one microphone 170C. In other embodiments, the electronic device 100 can be provided with two microphones 170C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the electronic device 100 can also be provided with three, four or more microphones 170C to collect sound signals, reduce noise, identify the sound source, realize directional recording function, etc.

[0114] The earphone interface 170D is used to connect a wired earphone and can be a USB interface 130 or a 3.5 mm open mobile terminal platform (OMTP) standard interface or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0115] The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. The capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The electronic device 100 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 194, the electronic device 100 detects the touch operation intensity according to the pressure sensor 180A. The electronic device 100 can also calculate the touch position according to the detection signal of the pressure sensor 180A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities can correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed.

[0116] The gyro sensor 180B can be used to determine the motion posture of the electronic device 100. In some embodiments, the angular velocity of the electronic device 100 around three axes (i.e., x, y, and z axes) can be determined by the gyro sensor 180B. The gyro sensor 180B can be used for anti-shake shooting. For example, when the shutter is pressed, the gyro sensor 180B detects the angle of the electronic device 100 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the electronic device 100 through reverse movement to achieve anti-shake. The gyro sensor 180B can also be used for navigation and somatosensory game scenes.

[0117] The air pressure sensor 180C is used to measure air pressure. In some embodiments, the electronic device 100 calculates the altitude through the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.

[0118] The magnetic sensor 180D includes a Hall sensor. The electronic device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip leather case. In some embodiments, when the electronic device 100 is a flip phone, the electronic device 100 can detect the opening and closing of the flip cover according to the magnetic sensor 180D. Then, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, the flip cover can be automatically unlocked.

[0119] The acceleration sensor 180E can detect the magnitude of the acceleration of the electronic device 100 in all directions (generally three axes). When the electronic device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the terminal device and is applied to applications such as horizontal and vertical screen switching and pedometers.

[0120] The distance sensor 180F is used to measure the distance. The electronic device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the electronic device 100 can use the distance sensor 180F to measure the distance to achieve fast focusing.

[0121] The proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The electronic device 100 emits infrared light outward through the light emitting diode. The electronic device 100 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the electronic device 100. When insufficient reflected light is detected, the electronic device 100 can determine that there is no object near the electronic device 100. The electronic device 100 can use the proximity light sensor 180G to detect that the user holds the electronic device 100 close to the ear to talk, so as to automatically turn off the screen to save power. The proximity light sensor 180G can also be used in leather case mode and pocket mode to automatically unlock and lock the screen.

[0122] The ambient light sensor 180L is used to sense the ambient light brightness. The electronic device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the electronic device 100 is in a pocket to prevent accidental touches.

[0123] The fingerprint sensor 180H is used to collect fingerprints. The electronic device 100 can use the collected fingerprint characteristics to implement fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0124] The temperature sensor 180J is used to detect temperature. In some embodiments, the electronic device 100 uses the temperature detected by the temperature sensor 180J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 180J exceeds a threshold, the electronic device 100 reduces the performance of a processor located near the temperature sensor 180J to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is lower than another threshold, the electronic device 100 heats the battery 142 to avoid abnormal shutdown of the electronic device 100 due to low temperature. In other embodiments, when the temperature is lower than another threshold, the electronic device 100 performs a boost on the output voltage of the battery 142 to avoid abnormal shutdown caused by low temperature.

[0125] The touch sensor 180K is also called a "touch control device". The touch sensor 180K can be set on the display screen 194. The touch sensor 180K and the display screen 194 form a touch screen, also called a "touch control screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the electronic device 100, which is different from the position of the display screen 194.

[0126] The bone conduction sensor 180M can obtain a vibration signal. In some embodiments, the bone conduction sensor 180M can obtain a vibration signal of a human vocal part vibrating bone block. The bone conduction sensor 180M can also contact the human pulse to receive a blood pressure pulse signal. In some embodiments, the bone conduction sensor 180M can also be set in an earphone and combined into a bone conduction earphone. The audio module 170 can parse out a voice signal based on the vibration signal of the vocal part vibrating bone block obtained by the bone conduction sensor 180M to realize a voice function. The application processor can parse the heart rate information based on the blood pressure pulse signal obtained by the bone conduction sensor 180M to realize a heart rate detection function. The button 190 includes a power button, a volume button, etc. The button 190 can be a mechanical button. It can also be a touch button. The electronic device 100 can receive a key input and generate a key signal input related to the user settings and function control of the electronic device 100.

[0127] Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations acting on different areas of the display screen 194, motor 191 can also correspond to different vibration feedback effects. Different application scenarios (for example: time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.

[0128] The indicator 192 may be an indicator light, which may be used to indicate the charging status, power changes, messages, missed calls, notifications, etc.

[0129] The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and separated from the electronic device 100 by inserting it into the SIM card interface 195 or pulling it out from the SIM card interface 195. The electronic device 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, and the like. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external memory cards. The electronic device 100 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the electronic device 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the electronic device 100 and cannot be separated from the electronic device 100.

[0130] Among them, the terminal device involved in the embodiment of the present application can be installed with an operating system, and application programs can be installed and run on the operating system, which is not limited by the embodiment of the present application.

[0131] It should be noted that the top end, bottom end, left end, right end, and above and below mentioned in the embodiments of the present application are relative, and are exemplary descriptions in specific implementation methods, and should not constitute limitations on the embodiments of the present application.

[0132] The present application provides a computer-readable storage medium storing computer instructions, which enable the computer to execute the instructions in this specification. Figure 1-2 The illustrated embodiment provides a method for detecting junk software.

[0133] The above-mentioned computer-readable storage medium can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM) or flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0134] Computer-readable signal media may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0135] The program code embodied on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0136] Computer program code for performing the operations of the present specification may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0137] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0138] In the description of the embodiments of the present invention, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0139] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this specification, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0140] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of this specification includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of this specification belong.

[0141] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0142] It should be noted that the terminals involved in the embodiments of the present application may include but are not limited to personal computers (PCs), personal digital assistants (PDAs), wireless handheld devices, tablet computers, mobile phones, MP3 players, MP4 players, etc.

[0143] In the several embodiments provided in this specification, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0144] In addition, each functional unit in each embodiment of this specification may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0145] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of this specification. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes.

[0146] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A method for detecting junk software, characterized in that: Used in electronic equipment, including: Extract features to be detected from the software to be detected; Detecting the feature to be detected using a preset rule to obtain a first detection result, where the first detection result is used to indicate whether the software to be detected is junk software; Input the feature to be detected into a trained classification prediction model for detection to obtain a second detection result, wherein the second detection result is used to indicate whether the software to be detected is junk software, wherein the trained classification prediction model is obtained by performing weighted combination training on features extracted from software samples by a logistic regression model LR feature extractor, a domain decomposition machine model FFM feature extractor, and a deep neural network model DNN feature extractor which are set in parallel; A final detection result is obtained according to the first detection result and the second detection result.

2. The method according to claim 1, characterized in that The feature to be detected includes at least one of a permission feature, an intent feature, an application programming interface API feature, and a system signature feature.

3. The method according to claim 1, characterized in that The obtaining a final detection result according to the first detection result and the second detection result includes: The first detection result and the second detection result are combined to obtain a final detection result.

4. The method according to claim 1, characterized in that: The training process of the classification prediction model includes: Acquire multiple software samples, wherein the software samples include annotation information, and the annotation information is used to indicate whether the software samples are normal software or junk software; Obtaining features to be detected of the software sample; Inputting the to-be-detected feature of the software sample into an LR feature extractor to obtain a first output; Inputting the to-be-detected feature of the software sample into the FFM feature extractor to obtain a second output; Inputting the to-be-detected features of the software sample into a DNN feature extractor to obtain a third output; The result obtained by multiplying the logarithm of the first output by the preset first weight, the result obtained by multiplying the logarithm of the second output by the preset second weight, and the result obtained by multiplying the logarithm of the third output by the preset third weight are added together, and then merged for training through the regression loss function.

5. The method according to claim 4, characterized in that The obtaining of the features to be detected of the software sample includes: performing data cleaning and feature screening on the obtained features to be detected of the software sample.

6. The method according to claim 4, characterized in that The FFM feature extractor performs normalization processing on the extracted cross features, and the normalization processing adopts the Sigmoid function.

7. The method according to claim 6, characterized in that The formula of the FFM feature extractor is: Among them, y2 represents the second output, σ represents the Sigmoid function, and x i ,x j represents the input feature, b represents the bias term, w0 represents the constant term, and w i represents the coefficient of the first-order term, v i ,v j x i ,x j dense expression of .

8. The method according to claim 4, characterized in that The formula of the DNN feature extractor is: y3 = h l+1 ,h l+1 =f(W l h l +b l ), where y3 represents the third output, h l+1 represents the output of the current layer, W l represents the weight matrix of the previous layer, h l represents the weight activation value of the previous hidden layer, b l Represents the weight bias of the previous layer.

9. A device for detecting junk software, characterized in that: Used in electronic equipment, including: A feature extraction module is used to extract features to be detected from the software to be detected; A first result module, used to detect the feature to be detected using a preset rule to obtain a first detection result, wherein the first detection result is used to indicate whether the software to be detected is junk software; A second result module is used to input the features to be detected into a trained classification prediction model for detection to obtain a second detection result, wherein the second detection result is used to indicate whether the software to be detected is junk software, wherein the trained classification prediction model is obtained by performing weighted combination training on the features extracted from the software samples by a logistic regression model LR feature extractor, a domain decomposition machine model FFM feature extractor and a deep neural network model DNN feature extractor which are set in parallel; The result generating module is used to obtain a final detection result according to the first detection result and the second detection result.

10. An electronic device, characterized in that: include: at least one processor; And at least one memory communicatively connected to the processor, wherein: the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute any method according to claims 1 to 7.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions enable the computer to execute the method according to any one of claims 1 to 7.

Images