Application identification method, device, electronic device and storage medium

Abstract

The embodiment of the present invention discloses an application identification method, device, electronic device and storage medium. The method includes: obtaining the download link data of the application to be identified, and determining the download link IP data corresponding to the download link data; extracting the IP data features of the download link data according to the download link IP data; in the case where it is determined that the IP data features are not included in the IP filing whitelist database and are not included in the IP blacklist database, determining the application installation package data of the application to be identified according to the download link data; extracting the static features of the application to be identified according to the application installation package data, and in the case where it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions, determining that the application to be identified is an abnormal application. The technical solution of the embodiment of the present invention can quickly and accurately identify abnormal applications, and improve the recognition efficiency and recognition accuracy of abnormal applications.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular to an application recognition method, device, electronic device, and storage medium. Background Art

[0002] With the development of science and technology, smart phones are becoming more and more popular. Users can install various APPs (Applications) in smart phones to achieve different functions through APPs. For example, users install video players to play audio and video. However, with the popularity of smart phones, there are more and more types of APPs. In order to avoid abnormal APPs from bringing negative impacts to users, it is necessary to identify abnormal APPs.

[0003] The currently widely used method for identifying abnormal apps is usually based on deep packet inspection technology, which analyzes protocol data packets, transmission control protocol or user datagram protocol data streams, and then reorganizes the application layer information to obtain the content of the entire app, thereby realizing the identification of abnormal apps. However, existing abnormal apps change very quickly, exist for a short time, and have a high degree of counterfeiting. Therefore, existing application identification methods cannot quickly and accurately identify abnormal apps. Summary of the invention

[0004] The embodiments of the present invention provide an application recognition method, device, electronic device and storage medium, which can quickly and accurately recognize abnormal applications and improve the recognition efficiency and recognition accuracy of abnormal applications.

[0005] According to one aspect of the present invention, there is provided an application identification method, comprising:

[0006] Obtain download link data of the application to be identified, and determine download link IP (Internet Protocol) data corresponding to the download link data according to the download link data;

[0007] Extracting IP data features of the download link data according to the download link IP data;

[0008] When it is determined that the IP data feature is not included in the IP filing whitelist database, and the IP data feature is not included in the IP blacklist database, determining the application installation package data of the application to be identified according to the download link data;

[0009] The static features of the application to be identified are extracted according to the application installation package data, and when it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions, the application to be identified is determined to be an abnormal application.

[0010] According to another aspect of the present invention, there is provided an application identification device, comprising:

[0011] A download link IP data determination module, used to obtain download link data of the application to be identified, and determine download link IP data corresponding to the download link data according to the download link data;

[0012] An IP data feature extraction module, used to extract IP data features of the download link data according to the download link IP data;

[0013] An application installation package data determination module, used to determine the application installation package data of the to-be-identified application according to the download link data when it is determined that the IP data feature is not included in the IP filing whitelist database and the IP data feature is not included in the IP blacklist database;

[0014] The abnormal application identification module is used to extract the static features of the application to be identified based on the application installation package data, and determine that the application to be identified is an abnormal application when it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application identification method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application identification method described in any embodiment of the present invention when executed.

[0020] The technical solution of the embodiment of the present invention obtains the download link data of the application to be identified, determines the download link IP data corresponding to the download link data according to the download link data, extracts the IP data features of the download link data according to the download link IP data, and determines the application installation package data of the application to be identified according to the download link data when it is determined that the IP data features are not included in the IP filing whitelist database and the IP data features are not included in the IP blacklist database, so as to extract the static features of the application to be identified according to the application installation package data, so as to determine that the static features of the application to be identified meet the abnormal static feature library comparison conditions, and determine that the application to be identified is an abnormal application, thereby solving the problem that the existing application identification method cannot quickly and accurately identify abnormal APPs, and can quickly and accurately identify abnormal applications, thereby improving the recognition efficiency and recognition accuracy of abnormal applications.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of an application identification method provided by Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of an application identification method provided by Embodiment 2 of the present invention;

[0025] Figure 3 is an example flow chart of an application identification method provided by Embodiment 3 of the present invention;

[0026] Figure 4 is another example flow chart of an application identification method provided in Embodiment 3 of the present invention;

[0027] Figure 5 Schematic diagram of the network of the application identification method provided in the third embodiment of the present invention;

[0028] Figure 6 is a schematic diagram of an application identification device provided by a fourth embodiment of the present invention;

[0029] Figure 7 It is a schematic diagram of the structure of an electronic device that implements the application identification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatuses.

[0032] Embodiment 1

[0033] Figure 1 This is a flowchart of an application identification method provided by the first embodiment of the present invention. This embodiment is applicable to the case of quickly and accurately identifying abnormal applications. The method can be executed by an application identification device, which can be implemented by software and / or hardware, and can generally be directly integrated into an electronic device that executes the method. The electronic device can be a terminal device or a server device. The embodiment of the present invention does not limit the type of electronic device that executes the application identification method. Specifically, Figure 1 As shown, the application identification method may specifically include the following steps:

[0034] S110: Obtain download link data of the application to be identified, and determine download link IP data corresponding to the download link data according to the download link data.

[0035] The application to be identified may be any application that needs to be identified. The download link data may be link data that can download the application to be identified. The download link IP data may be IP data in the link data for downloading the application to be identified.

[0036] In an embodiment of the present invention, download link data of an application to be identified is obtained, and download link IP data corresponding to the download link data is determined based on the download link data. It should be noted that the embodiment of the present invention does not limit the specific implementation method of obtaining the download link data of the application to be identified, as long as the download link data of the application to be identified can be obtained. Optionally, determining the download link IP data corresponding to the download link data based on the download link data may include performing IP conversion on the download link data to obtain the download link IP data corresponding to the download link data.

[0037] S120: Extract IP data features of the download link data according to the download link IP data.

[0038] The IP data feature may be an IP feature of a download link of the application to be identified, for example, an IP location feature, etc., which is not limited in the embodiment of the present invention.

[0039] In an embodiment of the present invention, after obtaining the download link data of the application to be identified and determining the download link IP data corresponding to the download link data according to the download link data, the IP data features of the download link data can be further extracted according to the download link IP data.

[0040] S130. When it is determined that the IP data feature is not included in the IP filing whitelist database and the IP data feature is not included in the IP blacklist database, determine the application installation package data of the application to be identified according to the download link data.

[0041] The IP whitelist database may be a whitelist database composed of registered IPs. The IP blacklist database may be a blacklist database composed of abnormal IPs. The application installation package data may be data packet data capable of installing an application.

[0042] In an embodiment of the present invention, after extracting the IP data feature of the download link data according to the download link IP data, it can be further determined whether the IP data feature is included in the IP filing whitelist database. If the IP data feature is not included in the IP filing whitelist database, it is further determined whether the IP data feature is included in the IP blacklist database. If the IP data feature is not included in the IP blacklist database, the application installation package data of the application to be identified is determined according to the download link data.

[0043] It is understandable that if the IP data feature is included in the IP filing whitelist database, it means that the IP of the application to be identified is filed, that is, the application to be identified is not an abnormal application, then the identification of the application to be identified can be ended, and the identification of the next application to be identified can be entered. If the IP data feature is included in the IP blacklist database, it means that the IP of the application to be identified is an abnormal IP, that is, the application to be identified can be identified as an abnormal application, then the identification of the application to be identified can be ended, and the identification of the next application to be identified can be entered.

[0044] S140. Extract static features of the application to be identified based on the application installation package data, and determine that the application to be identified is an abnormal application when it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions.

[0045] Among them, the static features of the application to be identified may be stability features extracted from the application installation package data. The abnormal static feature library comparison condition may be a condition that, when the static features of the application to be identified are compared with the abnormal static features in the abnormal static feature library, it can be determined that the application to be identified is an abnormal application. Exemplarily, the abnormal static feature library comparison condition may be that the static features of the application to be identified are abnormal static features, etc., and the embodiments of the present invention do not limit this. The abnormal application may be an identified abnormal application, such as a fraud-related application or a virus-carrying application, etc., and the embodiments of the present invention do not limit this.

[0046] In an embodiment of the present invention, after determining the application installation package data of the application to be identified according to the download link data, the static features of the application to be identified can be further extracted according to the application installation package data, and it can be determined whether the static features of the application to be identified meet the abnormal static feature library comparison conditions. If the static features of the application to be identified meet the abnormal static feature library comparison conditions, it can be determined that the application to be identified is an abnormal application.

[0047] The technical solution of this embodiment obtains the download link data of the application to be identified, and determines the download link IP data corresponding to the download link data according to the download link data, extracts the IP data features of the download link data according to the download link IP data, and when it is determined that the IP data features are not included in the IP filing whitelist database, and the IP data features are not included in the IP blacklist database, determines the application installation package data of the application to be identified according to the download link data, so as to extract the static features of the application to be identified according to the application installation package data, and thus when it is determined that the static features of the application to be identified meet the comparison conditions of the abnormal static feature library, determines that the application to be identified is an abnormal application, which solves the problem that the existing application identification method cannot quickly and accurately identify abnormal APPs, can quickly and accurately identify abnormal applications, and improves the recognition efficiency and recognition accuracy of abnormal applications.

[0048] Embodiment 2

[0049] Figure 2 This is a flow chart of an application identification method provided in the second embodiment of the present invention. This embodiment is a further refinement of the above-mentioned technical solutions, and provides a variety of specific optional implementation methods for obtaining download link data of the application to be identified, determining that the static features of the application to be identified meet the abnormal static feature library comparison conditions, determining that the static features of the application to be identified do not meet the abnormal static feature library comparison conditions, and determining that the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions. The technical solution in this embodiment can be combined with the various optional solutions in one or more of the above-mentioned embodiments. Figure 2 As shown, the method may include the following steps:

[0050] S210, obtaining data to be analyzed of the application to be identified; wherein the data to be analyzed includes download link data and / or application installation package data.

[0051] The data to be analyzed may be Internet traffic data that needs to be analyzed.

[0052] In the embodiment of the present invention, the data to be analyzed of the application to be identified is obtained, and the specific data to be analyzed may include download link data, application installation package data, or may include download link data and application installation package data at the same time. It should be noted that the embodiment of the present invention does not limit the specific implementation method of obtaining the data to be analyzed of the application to be identified, as long as the acquisition of the data to be analyzed of the application to be identified can be achieved.

[0053] S220, determining whether the data to be analyzed includes the download link data; if so, executing S230; otherwise, executing S290.

[0054] In an embodiment of the present invention, after obtaining the data to be analyzed of the application to be identified, it can be further determined whether the data to be analyzed includes download link data. If the data to be analyzed includes download link data, the download link original information data can be further determined according to the download link data. If the data to be analyzed does not include download link data, it can be further determined whether the data to be analyzed includes application installation package data.

[0055] S230: Determine the download link original information data according to the download link data.

[0056] Among them, the original information data of the download link can be the original information data in the download link of the application to be identified, for example, it can be the registrant information data in the download link of the application to be identified, it can also be the domain name information data in the download link of the application to be identified, it can also be the link information data in the download link of the application to be identified, etc., and the embodiment of the present invention is not limited to this.

[0057] In the embodiment of the present invention, after determining that the data to be analyzed includes the download link data, the download link original information data may be further determined according to the download link data.

[0058] S240. Determine original information features of the download link data according to the download link original information data; wherein the original information features include at least one of a registrant feature, a domain name feature, and a link feature.

[0059] The original information feature may be a data feature in the original information data of the download link. Optionally, the original information feature may include at least one of a registrant feature, a domain name feature, and a link feature.

[0060] In the embodiment of the present invention, after determining the download link original information data according to the download link data, the original information features of the download link data can be further determined according to the download link original information data. Specifically, the original information features of the download link data can be determined according to the download link original information data, which can be to determine the registrant features of the download link data according to the registrant information data in the download link original information data, to determine the domain name features of the download link data according to the domain name information data in the download link original information data, and to determine the link features of the download link data according to the link information data in the download link original information data.

[0061] S250. When it is determined that the registrant feature is not included in the registrant information whitelist database, the domain name feature is not included in the domain name whitelist database, and the link feature is not included in the abnormal link blacklist database, obtain download link data of the application to be identified.

[0062] The registrant information whitelist database may be a whitelist database composed of registrant features of normal applications, the domain name whitelist database may be a whitelist database composed of domain name features of normal applications, and the abnormal link blacklist database may be a blacklist database composed of abnormal links of abnormal applications.

[0063] In an embodiment of the present invention, after determining the original information feature of the download link data according to the download link original information data, it can be further determined whether the registrant feature is included in the registrant information whitelist database. If it is determined that the registrant feature is not included in the registrant information whitelist database, it can be determined whether the domain name feature is included in the domain name whitelist database. If it is determined that the domain name feature is not included in the domain name whitelist database, it can be determined whether the link feature is included in the abnormal link blacklist data. If it is determined that the link feature is not included in the abnormal link blacklist database, the download link data of the application to be identified can be obtained.

[0064] It is understandable that if it is determined that the registrant feature is included in the registrant information whitelist database, it means that the registrant information of the application to be identified is the registrant information of a normal application, that is, the application to be identified is not an abnormal application, then the identification of the application to be identified can be ended and the identification of the next application to be identified can be entered. If it is determined that the domain name feature is included in the domain name whitelist database, it means that the domain name of the application to be identified is the domain name of a normal application, that is, the application to be identified is not an abnormal application, then the identification of the application to be identified can be ended and the identification of the next application to be identified can be entered. If it is determined that the link feature is included in the abnormal link blacklist database, it means that the link of the application to be identified is the same as the link of the abnormal application, that is, the application to be identified can be identified as an abnormal application, then the identification of the application to be identified can be ended and the identification of the next application to be identified can be entered.

[0065] S260: Determine download link IP data corresponding to the download link data according to the download link data.

[0066] S270: Extract IP data features of the download link data according to the download link IP data.

[0067] S280. When it is determined that the IP data feature is not included in the IP filing whitelist database and the IP data feature is not included in the IP blacklist database, determine the application installation package data of the application to be identified based on the download link data.

[0068] S290, determine whether the data to be analyzed includes the application installation package data; if so, execute S2100; otherwise, execute S2150.

[0069] In the embodiment of the present invention, after determining that the data to be analyzed does not include download link data, it can be further determined whether the data to be analyzed includes application installation package data. If the data to be analyzed includes application installation package data, static features of the application to be identified can be extracted based on the application installation package data. If the data to be analyzed does not include application installation package data, the identification of the application to be identified can be terminated and the identification of the next application to be identified can be entered.

[0070] S2100. Extract static features of the application to be identified based on the application installation package data.

[0071] S2110. Determine whether the static features of the application to be identified meet the abnormal static feature library comparison conditions; if not, execute S2120; if so, execute S2140.

[0072] Optionally, determining whether the static features of the application to be identified meet the comparison conditions of the abnormal static feature library may include: obtaining each static sub-feature in the static features of the application to be identified, and determining the hit static sub-features of the abnormal static feature library based on each static sub-feature; calculating the weight and value of each hit static sub-feature, and determining that the static features of the application to be identified meet the comparison conditions of the abnormal static feature library when the weight and value of each hit static sub-feature meets the abnormal static feature weight threshold.

[0073] Among them, the static sub-feature can be a sub-feature in the static feature of the application to be identified, for example, it can be an MD5 (Message Digest 5, information digest technology) feature, package name feature, attribution feature, application name feature or signature feature of the application to be identified, and the embodiment of the present invention does not limit this. The hit static sub-feature can be the same static sub-feature as the abnormal static feature in the abnormal static feature library. The abnormal static feature weight threshold can be a pre-set threshold of the weight and value of each hit static sub-feature.

[0074] Specifically, after extracting the static features of the application to be identified based on the application installation package data, each static sub-feature in the static features of the application to be identified can be further obtained to determine the hit static sub-features of the abnormal static feature library based on each static sub-feature, and calculate the weight and value of each hit static sub-feature, so that when the weight and value of each hit static sub-feature meets the abnormal static feature weight threshold, it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions. It is understandable that the weight values ​​of different static sub-features hitting the abnormal static feature library are different.

[0075] Optionally, determining that the static features of the application to be identified do not meet the comparison conditions of the abnormal static feature library may include: obtaining each static sub-feature in the static features of the application to be identified, and determining the hit static sub-features of the abnormal static feature library based on each static sub-feature; calculating the weight and value of each hit static sub-feature, and determining that the static features of the application to be identified do not meet the comparison conditions of the abnormal static feature library when the weight and value of each hit static sub-feature does not meet the abnormal static feature weight threshold.

[0076] Specifically, after extracting the static features of the application to be identified based on the application installation package data, the static sub-features in the static features of the application to be identified can be further obtained to determine the hit static sub-features of the abnormal static feature library based on each static sub-feature, and calculate the weight and value of each hit static sub-feature. Therefore, when the weight and value of each hit static sub-feature does not meet the abnormal static feature weight threshold, it is determined that the static features of the application to be identified do not meet the abnormal static feature library comparison conditions.

[0077] S2120. Extracting dynamic features of the application to be identified based on the application installation package data.

[0078] The dynamic features of the application to be identified may be dynamic variable features extracted from the application installation package data.

[0079] In an embodiment of the present invention, after determining that the static features of the application to be identified do not satisfy the abnormal static feature library comparison condition, the dynamic features of the application to be identified can be further extracted based on the application installation package data.

[0080] S2130. Determine whether the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions; if so, execute S2140; otherwise, execute S2150.

[0081] The abnormal dynamic feature library comparison condition may be a condition that, when the dynamic features of the application to be identified are compared with the abnormal dynamic features in the abnormal dynamic feature library, it is possible to determine that the application to be identified is an abnormal application. Exemplarily, the abnormal dynamic feature library comparison condition may be that the dynamic features of the application to be identified are abnormal dynamic features, etc., which is not limited in the embodiments of the present invention.

[0082] In an embodiment of the present invention, after extracting the dynamic features of the application to be identified based on the application installation package data, it can be further determined whether the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions. If the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions, it can be determined that the application to be identified is an abnormal application. If the dynamic features of the application to be identified do not meet the abnormal dynamic feature library comparison conditions, it means that the application to be identified cannot be identified, then the identification of the application to be identified can be terminated and the identification of the next application to be identified can be started.

[0083] Optionally, determining whether the dynamic features of the application to be identified meet the comparison conditions of the abnormal dynamic feature library includes: obtaining each dynamic sub-feature in the dynamic features of the application to be identified; determining the hit dynamic sub-features of the abnormal dynamic feature library based on each dynamic sub-feature; calculating the weight and value of each hit dynamic sub-feature, and determining that the dynamic features of the application to be identified meet the comparison conditions of the abnormal dynamic feature library when the weight and value of each hit dynamic sub-feature meets the abnormal dynamic feature weight threshold.

[0084] Among them, the dynamic sub-feature can be a sub-feature in the dynamic feature of the application to be identified, for example, it can be the payment information feature, SDK information feature, packaging information feature, customer service information feature, framework information feature, violation information feature, communication information feature, vulnerability information feature or interface information feature of the application to be identified, etc. The embodiment of the present invention is not limited to this.

[0085] Specifically, after extracting the dynamic features of the application to be identified based on the application installation package data, each dynamic sub-feature in the dynamic features of the application to be identified can be further obtained to determine the hit dynamic sub-features of the abnormal dynamic feature library based on each dynamic sub-feature, and calculate the weight and value of each hit dynamic sub-feature, so that when the weight and value of each hit dynamic sub-feature meets the abnormal dynamic feature weight threshold, it is determined that the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions. It is understandable that the weight values ​​of different dynamic sub-features hitting the abnormal dynamic feature library are different.

[0086] S2140: Determine that the application to be identified is an abnormal application.

[0087] Optionally, after determining that the application to be identified is an abnormal application, the method may further include: performing a collision analysis between the abnormal application and an abnormal type template library to determine the abnormal type of the abnormal application.

[0088] S2150: End the identification of the application to be identified and proceed to the identification of the next application to be identified.

[0089] The technical solution of this embodiment is to obtain the data to be analyzed of the application to be identified, and determine whether the data to be analyzed includes download link data. If the data to be analyzed includes download link data, the original information data of the download link is determined according to the download link data, and the original information features of the download link data are determined according to the original information data of the download link, so as to obtain the download link data of the application to be identified when it is determined that the registrant feature is not included in the registrant information whitelist database, the domain name feature is not included in the domain name whitelist database, and the link feature is not included in the abnormal link blacklist database, and the download link data of the application to be identified is obtained, and the download link IP data corresponding to the download link data is determined according to the download link data, and the IP data features of the download link data are extracted according to the download link IP data, so as to determine the application installation package data of the application to be identified according to the download link data when it is determined that the IP data feature is not included in the IP filing whitelist database, and the IP data feature is not included in the IP blacklist database. If the data to be analyzed does not include download link data, it is determined whether the data to be analyzed includes application installation package data. If the data to be analyzed does not include application installation package data, the identification of the application to be identified can be terminated and the identification of the next application to be identified can be entered. If the data to be analyzed includes application installation package data, the static features of the application to be identified can be extracted based on the application installation package data, and it is determined whether the static features of the application to be identified meet the abnormal static feature library comparison conditions. If the static features of the application to be identified meet the abnormal static feature library comparison conditions, the application to be identified is determined to be an abnormal application. If the static features of the application to be identified do not meet the abnormal static feature library comparison conditions, the dynamic features of the application to be identified are extracted based on the application installation package data, and it is determined whether the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions. If the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions, it is determined that the application to be identified is an abnormal application. If the dynamic features of the application to be identified do not meet the abnormal dynamic feature library comparison conditions, the identification of the application to be identified is terminated and the identification of the next application to be identified is entered. The problem that the existing application identification method cannot quickly and accurately identify abnormal APPs is solved, and abnormal applications can be quickly and accurately identified, thereby improving the identification efficiency and accuracy of abnormal applications.

[0090] Embodiment 3

[0091] The embodiment of the present invention is specifically described by taking the application scenario of fraud-related application identification as an example. Figure 3 is an example flow chart of an application identification method provided by Embodiment 3 of the present invention. Figure 3 As shown, the method may include the following steps:

[0092] (1) Obtain the download link with the .apk suffix of the application to be identified.

[0093] (2) Determine whether the download domain name of the download link is in the whitelist according to the application store channel whitelist and the APP download link whitelist. If the download domain name of the download link is in the whitelist, obtain the download link with the .apk suffix of the next application to be identified.

[0094] (3) If the download domain name of the download link is not a download domain name in the white list, determine whether the download link is a link in the black list. If the download link is a link in the black list, determine that the application to be identified is a fraudulent application.

[0095] (4) If the download link is not a link in the blacklist, determine whether the download link is from an overseas IP address. If the download link is not from an overseas IP address, obtain the download link of the next application to be identified with the .apk suffix.

[0096] (5) If the download link is from an overseas IP address, a download operation is initiated for the download link to download the installation package of the application to be identified.

[0097] (6) According to the fraudulent APP name library and the fraudulent APP package name library, determine whether the installation package of the application to be identified is in the fraudulent APP package name library or the fraudulent APP name library. If the installation package of the application to be identified is in the fraudulent APP package name library or the fraudulent APP name library, obtain the APP communication address and output the fraudulent APP classification, fraudulent APP name, package name, download link and communication address list information. If the installation package of the application to be identified is not in the fraudulent APP package name library or the fraudulent APP name library, manual analysis can be performed.

[0098] The above technical solution realizes basic filtering capabilities by building a whitelist mechanism to reduce unnecessary waste of analysis capabilities; filters out fraud-related objects that have been analyzed by building a blacklist detection mechanism; compares and filters the IP locations of download links based on the attribute that the fraud-related APP is deployed overseas; and decompiles the APP installation package to analyze whether the package name, signature, domain name and other information are consistent with the characteristics of the fraudulent APP, thereby improving the accuracy of identifying fraud-related applications.

[0099] Specifically, Figure 4is another example flow chart of an application identification method provided by Embodiment 3 of the present invention, such as Figure 4 As shown, the method may specifically include:

[0100] (1) Obtain the data to be analyzed of the application to be identified pushed by the hub platform or the Internet. Specifically, the data to be analyzed may include download link data or application installation package data. And determine whether the data to be analyzed needs to be downloaded. Specifically, if the data to be analyzed includes download link data, it needs to be downloaded. If the data to be analyzed includes application installation package data, it does not need to be downloaded.

[0101] (2) If the data to be analyzed includes download link data, the registrant information, domain name information, and link information of the download link data are obtained, and collision analysis is performed with the registrant information database, domain name registration database, and fraud-related link database respectively. If none of the above features collide successfully, the application installation package data is downloaded according to the download link data.

[0102] (3) Perform IP conversion on the application installation package data, obtain the IP features of the application to be identified, and perform collision analysis with the IP filing database and the IP database involved in the case. If the IP features of the application to be identified successfully collide with the IP database involved in the case, further URL sniffing is performed to analyze the fraudulent URL to fill the URL lineage feature database.

[0103] (4) If none of the above features collide successfully, perform basic analysis on the application installation package data. Specifically, obtain the MD5 feature, package name feature, attribution feature, application name feature, and signature feature of the application to be identified based on the application installation package data, collide each feature with the fraud-related static feature library, and calculate the sum of the feature weights of the successful collision. If the sum of the feature weights of the successful collision is greater than or equal to the preset weight threshold, the application to be identified is identified as a fraud-related application.

[0104] (5) If the sum of the weights of the features that have collided successfully is less than the preset weight threshold, the payment information features, SDK information features, packaging information features, customer service information features, framework information features, violation information features, communication information features, vulnerability information features, and interface information features of the application to be identified are obtained based on the application installation package data, and each feature is collided with the fraud-related dynamic feature library, and the sum of the weights of the features that have collided successfully is calculated. If the sum of the weights of the features that have collided successfully is greater than or equal to the preset weight threshold, the application to be identified is identified as a fraud-related application.

[0105] (6) After determining that the application to be identified is a fraudulent application, further collision analysis is performed on the fraudulent application and the fraudulent type template library to determine the fraudulent type of the fraudulent application, thereby outputting the identification result of the fraudulent application.

[0106] The above technical solution constructs basic databases such as the registrant information database, domain name registration database, and IP registration database during the analysis process. At the same time, it constructs feature databases such as the fraud link database, the fraud IP database, and the URL lineage feature database in combination with the shallow characteristics of fraud. To further ensure the accuracy of the research and judgment results, static sandbox and dynamic sandbox research and judgment capabilities are constructed for fraud-related APPs, and a fraud-related static feature database, a fraud-related dynamic feature database, and a fraud-related type template database are constructed for analysis capabilities to accurately calibrate the detection results and types.

[0107] The software and hardware environment required for the application identification method is: Linux CentOS release 7.4x86_64 or above system, Apache, tomcat and other software; the web security detection engine supports single-machine deployment and multiple-machine deployment; single-machine test environment: one device is configured with CPU 32 cores, 128G memory, 10M bandwidth (shared), and 8T hard disk; multiple-machine test environment: two devices are configured with CPU 16 cores, 64G memory, 10M bandwidth (shared), and 4T hard disk.

[0108] Figure 5 : is a network diagram of the application identification method provided in the third embodiment of the present invention, such as Figure 5 As shown, firstly, the fraud-related APPs are sorted out as needed, and the fraud-related APP features, common elements, etc. are manually extracted as a basis, and the features are sorted into a recognizable APP anti-fraud feature library; the user's real-time access traffic is detected to obtain the user's Internet access records, and then the user's Internet access records are extracted to obtain the APP download link; after obtaining the download link, the automated download process can be executed, and the fraud-related APP automated analysis mechanism is started (including collision with the APP anti-fraud feature library, static feature extraction, i.e., dynamic feature extraction), and the corresponding analysis results are output; the analysis results are pushed to relevant departments for early warning, blocking and fraud-related identification.

[0109] The above technical solution can effectively and automatically discover and warn fraud-related applications in batches, effectively reducing the occurrence of Internet-related fraud cases.

[0110] Embodiment 4

[0111] Figure 6 is a schematic diagram of an application identification device provided by Embodiment 4 of the present invention, such as Figure 6As shown, the device includes: a download link IP data determination module 610, an IP data feature extraction module 620, an application installation package data determination module 630 and an abnormal application identification module 640, wherein:

[0112] The download link IP data determination module 610 is used to obtain the download link data of the application to be identified, and determine the download link IP data corresponding to the download link data according to the download link data;

[0113] An IP data feature extraction module 620, configured to extract IP data features of the download link data according to the download link IP data;

[0114] An application installation package data determination module 630, configured to determine the application installation package data of the to-be-identified application according to the download link data when it is determined that the IP data feature is not included in the IP filing whitelist database and the IP data feature is not included in the IP blacklist database;

[0115] The abnormal application identification module 640 is used to extract the static features of the application to be identified based on the application installation package data, and determine that the application to be identified is an abnormal application when it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions.

[0116] The technical solution of this embodiment obtains the download link data of the application to be identified, and determines the download link IP data corresponding to the download link data according to the download link data, extracts the IP data features of the download link data according to the download link IP data, and when it is determined that the IP data features are not included in the IP filing whitelist database, and the IP data features are not included in the IP blacklist database, determines the application installation package data of the application to be identified according to the download link data, so as to extract the static features of the application to be identified according to the application installation package data, and thus when it is determined that the static features of the application to be identified meet the comparison conditions of the abnormal static feature library, determines that the application to be identified is an abnormal application, which solves the problem that the existing application identification method cannot quickly and accurately identify abnormal APPs, can quickly and accurately identify abnormal applications, and improves the recognition efficiency and recognition accuracy of abnormal applications.

[0117] Optionally, the download link IP data determination module 610 can be specifically used to: obtain the data to be analyzed of the application to be identified; wherein the data to be analyzed includes download link data and / or application installation package data; when it is determined that the data to be analyzed includes download link data, determine the download link original information data according to the download link data; determine the original information characteristics of the download link data according to the download link original information data; wherein the original information characteristics include at least one of the registrant characteristics, domain name characteristics and link characteristics; when it is determined that the registrant characteristics are not included in the registrant information whitelist database, the domain name characteristics are not included in the domain name whitelist database, and the link characteristics are not included in the abnormal link blacklist database, obtain the download link data of the application to be identified.

[0118] Optionally, the download link IP data determination module 610 can be further used to: when it is determined that the data to be analyzed includes application installation package data, extract static features of the application to be identified based on the application installation package data; when it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions, determine that the application to be identified is an abnormal application.

[0119] Optionally, the abnormal application identification module 640 can be specifically used to: obtain each static sub-feature in the static features of the application to be identified, and determine the hit static sub-features of the abnormal static feature library based on each static sub-feature; calculate the weight and value of each hit static sub-feature, and when the weight and value of each hit static sub-feature meets the abnormal static feature weight threshold, determine that the static features of the application to be identified meet the abnormal static feature library comparison conditions.

[0120] Optionally, the abnormal application identification module 640 can also be specifically used to: extract the dynamic features of the application to be identified based on the application installation package data when it is determined that the static features of the application to be identified do not meet the comparison conditions of the abnormal static feature library; and determine that the application to be identified is an abnormal application when it is determined that the dynamic features of the application to be identified meet the comparison conditions of the abnormal dynamic feature library.

[0121] Optionally, the abnormal application identification module 640 may also be specifically used to: obtain each static sub-feature in the static feature of the application to be identified, and determine the hit static sub-feature of the hit abnormal static feature library according to each static sub-feature;

[0122] The weight and value of each hit static sub-feature is calculated, and when the weight and value of each hit static sub-feature does not meet the abnormal static feature weight threshold, it is determined that the static feature of the application to be identified does not meet the abnormal static feature library comparison condition.

[0123] Optionally, the abnormal application identification module 640 can also be specifically used to: obtain each dynamic sub-feature in the dynamic features of the application to be identified; determine the hit dynamic sub-features of the abnormal dynamic feature library based on each dynamic sub-feature; calculate the weight and value of each hit dynamic sub-feature, and when the weight and value of each hit dynamic sub-feature meets the abnormal dynamic feature weight threshold, determine that the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions.

[0124] The application identification device provided in the embodiment of the present invention can execute the application identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0125] Embodiment 5

[0126] Figure 7 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0127] like Figure 7 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0128] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0129] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as the application recognition method.

[0130] In some embodiments, the application identification method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the application identification method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the application identification method in any other appropriate manner (e.g., by means of firmware).

[0131] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0132] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0133] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0134] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0135] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0136] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0137] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0138] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An application identification method, characterized in that: include: Obtain download link data of the application to be identified, and determine download link IP data corresponding to the download link data according to the download link data; Extracting IP data features of the download link data according to the download link IP data; When it is determined that the IP data feature is not included in the IP filing whitelist database, and the IP data feature is not included in the IP blacklist database, determining the application installation package data of the application to be identified according to the download link data; Extracting static features of the application to be identified according to the application installation package data, and determining that the application to be identified is an abnormal application when it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions; The step of obtaining download link data of the application to be identified includes: Acquire data to be analyzed of the application to be identified; wherein the data to be analyzed includes download link data and / or application installation package data; In the case where it is determined that the data to be analyzed includes the download link data, determining the download link original information data according to the download link data; Determining original information features of the download link data according to the download link original information data; wherein the original information features include at least one of registrant features, domain name features, and link features; When it is determined that the registrant feature is not included in the registrant information whitelist database, the domain name feature is not included in the domain name whitelist database, and the link feature is not included in the abnormal link blacklist database, the download link data of the application to be identified is obtained.

2. The method according to claim 1, characterized in that After obtaining the data to be analyzed of the application to be identified, it also includes: In the case where it is determined that the data to be analyzed includes the application installation package data, extracting static features of the application to be identified according to the application installation package data; When it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions, the application to be identified is determined to be an abnormal application.

3. The method according to claim 1 or 2, characterized in that: The step of determining whether the static features of the application to be identified meet the abnormal static feature library comparison condition includes: Obtaining each static sub-feature in the static feature of the application to be identified, and determining a hit static sub-feature of a hit abnormal static feature library according to each static sub-feature; The weight and value of each hit static sub-feature is calculated, and when the weight and value of each hit static sub-feature meets the abnormal static feature weight threshold, it is determined that the static feature of the application to be identified meets the abnormal static feature library comparison condition.

4. The method according to claim 1 or 2, characterized in that: After extracting the static features of the application to be identified according to the application installation package data, the method further includes: When it is determined that the static features of the application to be identified do not meet the abnormal static feature library comparison conditions, extracting the dynamic features of the application to be identified based on the application installation package data; When it is determined that the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison conditions, the application to be identified is determined to be an abnormal application.

5. The method according to claim 4, characterized in that The determining that the static features of the application to be identified do not meet the abnormal static feature library comparison condition includes: Obtaining each static sub-feature in the static feature of the application to be identified, and determining a hit static sub-feature of a hit abnormal static feature library according to each static sub-feature; The weight and value of each hit static sub-feature is calculated, and when the weight and value of each hit static sub-feature does not meet the abnormal static feature weight threshold, it is determined that the static feature of the application to be identified does not meet the abnormal static feature library comparison condition.

6. The method according to claim 4, characterized in that The determining that the dynamic features of the application to be identified meet the abnormal dynamic feature library comparison condition includes: Acquire each dynamic sub-feature in the dynamic feature of the application to be identified; Determine the hit dynamic sub-feature of the hit abnormal dynamic feature library according to each of the dynamic sub-features; The weight and value of each hit dynamic sub-feature is calculated, and when the weight and value of each hit dynamic sub-feature meets the abnormal dynamic feature weight threshold, it is determined that the dynamic feature of the application to be identified meets the abnormal dynamic feature library comparison condition.

7. An application recognition device, characterized in that: include: A download link IP data determination module, used to obtain download link data of the application to be identified, and determine download link IP data corresponding to the download link data according to the download link data; An IP data feature extraction module, used to extract IP data features of the download link data according to the download link IP data; An application installation package data determination module, used to determine the application installation package data of the to-be-identified application according to the download link data when it is determined that the IP data feature is not included in the IP filing whitelist database and the IP data feature is not included in the IP blacklist database; an abnormal application identification module, used to extract static features of the application to be identified based on the application installation package data, and determine that the application to be identified is an abnormal application when it is determined that the static features of the application to be identified meet the abnormal static feature library comparison conditions; The download link IP data determination module is specifically used for: Acquire data to be analyzed of the application to be identified; wherein the data to be analyzed includes download link data and / or application installation package data; In the case where it is determined that the data to be analyzed includes the download link data, determining the download link original information data according to the download link data; Determining original information features of the download link data according to the download link original information data; wherein the original information features include at least one of registrant features, domain name features, and link features; When it is determined that the registrant feature is not included in the registrant information whitelist database, the domain name feature is not included in the domain name whitelist database, and the link feature is not included in the abnormal link blacklist database, the download link data of the application to be identified is obtained.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the application identification method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the application identification method according to any one of claims 1 to 6 when executed.

Images