A method for determining abnormal APP, computer equipment and medium

Abstract

This invention discloses a method, computer device, and medium for determining abnormal apps. The method includes the following steps: obtaining a list of target devices corresponding to the app to be identified; obtaining a list of apps corresponding to any target device ID; constructing a target app list based on m app lists; obtaining a first target list and a second target list based on the target app list; obtaining a target TGI list based on the first target list and the second target list; and traversing the target TGI list and determining that the app to be identified is an abnormal app when any target TGI is not less than a preset TGI threshold. This invention can use TGI to determine abnormal apps, avoid missing apps that cannot be parsed or that cannot be identified through app attribute information, simplify the process of identifying abnormal apps, and improve the accuracy of app identification.

Description

Technical Field

[0001] The present invention relates to the technical field of APP identification, and in particular to a method for determining an abnormal APP, a computer device and a medium. Background Art

[0002] With the popularization of network communications, many APPs will be installed in users' electronic devices to provide convenience for their daily lives.

[0003] At the same time, APPs also bring hidden dangers to user security. For example, some APPs may leak user privacy, or some abnormal APPs may cause economic losses. Therefore, it is necessary to identify abnormal APPs so that users can decide whether to install them. However, in current technology, abnormal APPs are generally identified through APP attribute information or APP installation packages. In this case, APPs that cannot be parsed or APPs that cannot be identified through APP attribute information will be missed, making it difficult to identify abnormal APPs and resulting in inaccurate APP identification.

[0004] In addition, it is impossible to avoid errors caused by continuous updates of the APP or similar APPs, which poses a hidden danger to the security of users' electronic devices. Summary of the invention

[0005] In order to solve the problems of the prior art, a target device list corresponding to the APP to be identified is obtained, and the corresponding APP list is obtained according to any target device ID, and a target APP list is constructed based on m APP lists, and a first target list and a second target list are obtained according to the target APP list, and a target TGI list is obtained according to the first target list and the second target list, and the target TGI list is traversed and when any target TGI is not less than a preset TGI threshold, the APP to be identified is determined to be an abnormal APP, and the abnormal APP can be determined by TGI, avoiding the omission of APPs that cannot be parsed or APPs that cannot be identified through APP attribute information, simplifying the process of identifying abnormal APPs, and improving the accuracy of APP identification. The embodiment of the present invention provides a method for determining abnormal APPs, a computer device, and a medium. The technical solution is as follows:

[0006] In one aspect, a method for determining an abnormal APP comprises the following steps:

[0007] S101, obtaining a target device list A=(A1, A2, A3, ..., Am) corresponding to the APP to be identified, where Ai refers to the i-th target device ID, i=1...m, and m is the number of target devices;

[0008] S103, according to Ai, obtain the APP list corresponding to Ai, so that the target APP list C = (C1, C2, C3, ..., Cz) is obtained according to the APP lists corresponding to m Ai, where Cx refers to the xth target APP, x = 1 ... z, and z is the number of target APPs;

[0009] S105, according to C, obtain the first target list F and the second target list Wherein, step S105 includes the following steps:

[0010] According to C, the number of devices corresponding to Cx is obtained and the number of devices corresponding to Cx is compared with a preset device number threshold;

[0011] When the number of devices corresponding to Cx is ≥ the device number threshold, the number of devices corresponding to Cx is inserted into the intermediate data list D=(D1, D2, D3, ..., Dp), where Dq refers to the number of devices corresponding to the first App, q=1...p, p is the number of the first App;

[0012] Based on Dq, the target proportion value Tq corresponding to Dq is obtained, so that Tq and the proportion threshold corresponding to Tq are Make a comparison;

[0013] when Insert Tq to F and Insert to

[0014] S107, according to F and Obtain a target TGI list G = (G1, G2, G3, ..., Gr), where Gj represents the TGI index corresponding to the j-th second App, j = 1 ... r, r is the number of second Apps;

[0015] S109, traversing G and when Gj≥preset TGI threshold, determining that the APP to be identified is an abnormal APP.

[0016] On the other hand, a computer device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the method for determining an abnormal APP as described above.

[0017] On the other hand, a computer-readable storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the method for determining an abnormal APP as described above.

[0018] The present invention provides a method for determining an abnormal APP, a computer device, and a medium, which have the following technical effects:

[0019] In the present invention, by obtaining a device list of the APP to be identified and a list of APPs corresponding to each device in the device list, the device ratio value of the APP pair and the corresponding ratio threshold are determined, and the TGI is calculated to identify abnormal APPs. The abnormal APPs can be determined by using the TGI to avoid missing APPs that cannot be parsed or APPs that cannot be identified through the attribute information of the APP, simplifying the process of identifying abnormal APPs and improving the accuracy of APP identification;

[0020] At the same time, the method determines the proportion threshold through sample data. On the one hand, the proportion threshold can be used to screen out some APPs, simplifying the calculation of TGI and improving efficiency. On the other hand, the proportion threshold can be used to calculate TGI by screening, thereby improving the accuracy of TGI and thus improving the accuracy of APP identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 is a flow chart of a method for determining an abnormal APP provided by an embodiment of the present invention;

[0023] Figure 2 It is a flowchart of step S105 provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0026] The method for determining abnormal APPs provided in an embodiment of the present invention can be applied to any computer device with data processing capabilities, which can be a terminal or a server. When the computer device executes the method for establishing an index table of a video library provided in an embodiment of the present invention, it can be executed independently or in a cluster collaborative manner.

[0027] The following describes a method for determining an abnormal APP of the present invention. Figure 1 It is a flowchart of a method for determining an abnormal APP provided by an embodiment of the present invention. This specification provides method operation steps as described in the embodiment or flowchart, but may include more or fewer operation steps based on conventional or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only execution order. When the actual system or server product is executed, it can be executed sequentially or in parallel according to the method shown in the embodiment or the accompanying drawings (for example, in a parallel processor or multi-threaded processing environment). Specifically, Figure 1 As shown, the method comprises the following steps:

[0028] S101. Obtain a target device list A=(A1, A2, A3, ..., Am) corresponding to the APP to be identified, where Ai refers to the i-th target device ID, i=1...m, m is the number of target devices and m is an integer greater than 1.

[0029] Specifically, the target device ID refers to the unique identifier corresponding to the device on which the APP to be identified is installed, wherein the device is a mobile terminal, which can be physically implemented as a mobile device such as a smart phone, a PAD, etc. that can install an application (such as an APP). Those skilled in the art know that the model, specifications and other parameters of the server and the mobile terminal do not affect the protection scope of the present invention.

[0030] In a specific embodiment, before step S101, it also includes: according to the name of the APP to be identified, traversing the negative sample APP list and judging whether the name of the APP to be identified is in the negative sample APP list; when the name of the APP to be identified exists in the negative sample APP list, determining that the APP to be identified is an abnormal APP; conversely, when the name of the APP to be identified does not exist in the negative sample APP list, executing step S101; wherein, the negative sample APP list is stored in a negative sample APP database, and the negative sample APP list refers to a list constructed based on the name of the abnormal APP, which can filter out some APPs and simplify the process of determining the abnormal APP.

[0031] Furthermore, step S101 includes: according to the name of the APP to be identified, obtaining from the target device database all device IDs of the device that has installed the APP to be identified within a preset time period to form A, wherein the preset time period can be set according to specific processing requirements. A large number of experiments have shown that, preferably, the preset time period is 3 months, which can ensure that there is enough data for calculating the target proportion value on the one hand, and avoid excessive data volume affecting the overall efficiency on the other hand.

[0032] S103, according to Ai, obtain the APP list corresponding to Ai, so that the target APP list C = (C1, C2, C3, ..., Cz) is obtained according to the APP lists corresponding to m Ai, where Cx refers to the xth target APP, x = 1 ... z, and z is the number of target APPs;

[0033] Specifically, the target APP refers to the APP installed on the device corresponding to the APP to be identified.

[0034] In a specific embodiment, step S103 includes: according to Ai, constructing an APP list from the names of all APPs installed on the device corresponding to Ai in the APP database, and then constructing C based on the m APP lists, which can facilitate the calculation of the number of devices corresponding to the APP, and then ensure that the proportion value is conducive to improving the accuracy of identifying abnormal APPs. Technical personnel in this field can construct the second APP list according to specific processing requirements, which will not be repeated here.

[0035] S105, according to C, obtain the first target list F and the second target list Among them, Figure 2 As shown, step S105 includes the following steps:

[0036] S1051. According to C, obtain the number of devices corresponding to Cx and compare the number of devices corresponding to Cx with a preset device number threshold;

[0037] S1053. When the number of devices corresponding to Cx is greater than or equal to the device number threshold, the number of devices corresponding to Cx is inserted into the intermediate data list D=(D1, D2, D3, ..., Dp), where Dq refers to the number of devices corresponding to the first App, q=1...p, and p is the number of the first App;

[0038] S1055: Based on Dq, obtain the target proportion value Tq corresponding to Dq, so that Tq is equal to the proportion threshold value corresponding to Tq Make a comparison;

[0039] S1057, when Insert Tq to F and Insert to ;

[0040] Specifically, the first APP refers to an APP in C, the number of devices in which the APP is installed is not less than the device number threshold; it can remove the interference of some APPs with less installation volume, reduce the calculation amount of the target proportion value and the proportion threshold, and thus facilitate the determination of abnormal APPs based on the target proportion value and the proportion threshold.

[0041] Specifically, Tq meets the following conditions:

[0042]

[0043] Specifically, Meet the following conditions:

[0044] in, It refers to the number of sample devices corresponding to the qth first App, λ is the threshold coefficient, M is the total number of sample devices and the order of magnitude of M is in the millions;

[0045] It can be further understood as: based on the name of the first App, the number of sample devices corresponding to the first App and the total number of sample devices are obtained from the sample database, and the total number of sample devices is in the order of millions. When the total number of sample devices is large enough, the accuracy of the proportion threshold can be guaranteed, which is conducive to determining abnormal APPs based on the target proportion value and the proportion threshold.

[0046] Furthermore, the method also includes the following method to determine the range of λ values;

[0047] The negative sample APP list is traversed and when the name of the first APP exists in the negative sample APP list, the value range of λ is 0.4 to 0.7.

[0048] The negative sample APP list is traversed and when the name of the first APP does not exist in the negative sample APP list, the value range of λ is 0.8 to 1.0.

[0049] It is further understood that: when the name of the first APP exists in the negative sample APP list, λ=0.5; otherwise, the name of the first APP does not exist in the negative sample APP list, λ=0.8; wherein, the value range of the threshold coefficient based on the negative sample APP list can improve the accuracy of determining the proportion threshold, which is conducive to determining abnormal APPs.

[0050] S107, according to F and Obtain a target TGI list G = (G1, G2, G3, ..., Gr), where Gj represents the TGI index corresponding to the j-th second App, j = 1 ... r, r is the number of second Apps;

[0051] Specifically, the second APP refers to an APP whose target proportion value is not less than its corresponding proportion threshold.

[0052] Specifically, Gj meets the following conditions:

[0053] Among them, Fj refers to the target proportion value corresponding to the jth second APP, It is the proportion threshold corresponding to Fj.

[0054] S109, traversing G and when Gj≥preset TGI threshold, determining that the APP to be identified is an abnormal APP.

[0055] Specifically, S109 also includes the following steps:

[0056] When Gj≥preset TGI threshold, insert the APP corresponding to Gj into the APP list B=(B1, B2, ..., Bs), where Bt refers to the tth APP name and s is the number of APPs;

[0057] Traverse B and obtain the number of targets corresponding to Bt in the negative sample APP list;

[0058] When the target number is greater than or equal to a preset target number threshold, the APP to be identified is determined to be an abnormal APP; otherwise, the APP to be identified is determined to be a non-abnormal APP.

[0059] In one embodiment, when the APP to be identified is an abnormal APP, the APP to be identified is inserted into the negative sample APP list, so that the negative sample APP list can be updated and enriched, which is useful for judging other APPs.

[0060] Specifically, the target device database, the sample database, the target APP database and the negative sample APP database are all known databases. Those skilled in the art can establish the above four databases according to actual processing methods, which will not be repeated here.

[0061] This embodiment provides a method for determining abnormal APPs, which obtains a device list of APPs to be identified and a list of APPs corresponding to each device in the device list, determines a device ratio value of an APP pair and a corresponding ratio threshold, calculates a TGI to identify abnormal APPs, and can use TGI to determine abnormal APPs, avoid missing APPs that cannot be parsed or cannot be identified through APP attribute information, simplify the process of identifying abnormal APPs, and improve the accuracy of APP identification;

[0062] At the same time, the method determines the proportion threshold through sample data. On the one hand, the proportion threshold can be used to screen out some APPs, simplifying the calculation of TGI and improving efficiency. On the other hand, the proportion threshold can be used to calculate TGI by screening, thereby improving the accuracy of TGI and thus improving the accuracy of APP identification.

[0063] An embodiment of the present invention also provides a computer device, including a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the method for determining an abnormal APP as described above.

[0064] The computer device of the embodiment of the present invention exists in various forms, including but not limited to:

[0065] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

[0066] (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0067] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0068] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0069] (5) Other electronic devices with data interaction functions.

[0070] An embodiment of the present invention also provides a storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to a method for determining an abnormal APP in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method for determining an abnormal APP provided in the above method embodiment.

[0071] Optionally, in this embodiment, the storage medium may be located in at least one of the multiple network servers of the computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0072] It should be noted that the sequence of the above embodiments of the present invention is for description only and does not represent the advantages and disadvantages of the embodiments. The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0073] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and electronic device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0074] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0075] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for determining abnormal APP, characterized in that: The method comprises the following steps: S101, obtaining a target device list A=(A1, A2, A3, ..., Am) corresponding to the APP to be identified, wherein Ai refers to the i-th target device ID, i=1...m, and m is the number of target devices, wherein before step S101, it also includes: according to the name of the APP to be identified, traversing the negative sample APP list and judging whether the name of the APP to be identified is in the negative sample APP list; when the name of the APP to be identified is in the negative sample APP list, determining that the APP to be identified is an abnormal APP; otherwise, when the name of the APP to be identified is not in the negative sample APP list, executing step S101; S103, according to Ai, obtain the APP list corresponding to Ai, so that the target APP list C = (C1, C2, C3, ..., Cz) is obtained according to the APP lists corresponding to m Ai, where Cx refers to the xth target APP, x = 1 ... z, and z is the number of target APPs; S105, according to C, obtain the first target list F and the second target list Wherein, step S105 includes the following steps: According to C, the number of devices corresponding to Cx is obtained and the number of devices corresponding to Cx is compared with a preset device number threshold; When the number of devices corresponding to Cx is ≥ the device number threshold, the number of devices corresponding to Cx is inserted into the intermediate data list D=(D1, D2, D3, ..., Dp), where Dq refers to the number of devices corresponding to the first App, q=1...p, p is the number of the first App; Based on Dq, the target proportion value Tq corresponding to Dq is obtained, so that Tq and the proportion threshold corresponding to Tq are Make a comparison; when Insert Tq to F and Insert to S107, according to F and Obtain a target TGI list G = (G1, G2, G3, ..., Gr), where Gj represents the TGI index corresponding to the j-th second App, j = 1 ... r, r is the number of second Apps; S109, traversing G and when Gj≥preset TGI threshold, determining that the APP to be identified is an abnormal APP.

2. The method for determining abnormal APP according to claim 1, characterized in that: The target device ID refers to the unique identifier corresponding to the device on which the APP to be identified is installed.

3. The method for determining abnormal APP according to claim 1, characterized in that: Tq meets the following conditions:

4. The method for determining abnormal APP according to claim 1, characterized in that: Meet the following conditions: in, It refers to the number of sample devices corresponding to the qth first App, λ is the threshold coefficient, and M is the total number of sample devices.

5. The method for determining abnormal APP according to claim 4, characterized in that: The method also includes determining the range of λ values ​​by the following method: Traversing the negative sample APP list and when the name of the first APP exists in the negative sample APP list, the value range of λ is 0.4 to 0.7; The negative sample APP list is traversed and when the name of the first APP does not exist in the negative sample APP list, the value range of λ is 0.8 to 1.

0.

6. The method for determining abnormal APP according to claim 1, characterized in that: Gj meets the following conditions: Among them, Fj refers to the target proportion value corresponding to the jth second APP, It is the proportion threshold corresponding to Fj.

7. The method for determining abnormal APP according to claim 1, characterized in that: S109 also includes the following steps: When Gj≥preset TGI threshold, insert the APP corresponding to Gj into the APP list B=(B1, B2, ..., Bs), where Bt refers to the tth APP name and s is the number of APPs; Traverse B and obtain the number of targets corresponding to Bt in the negative sample APP list; When the target number is greater than or equal to a preset target number threshold, the APP to be identified is determined to be an abnormal APP; Otherwise, it is determined that the APP to be identified is a non-abnormal APP.

8. An electronic device, characterized in that: It includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the method for determining an abnormal APP as described in any one of claims 1 to 7.

9. A computer-readable storage medium, wherein at least one instruction or at least one program is stored in the computer-readable storage medium, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method for determining an abnormal APP according to any one of claims 1 to 7.

Images