Detection method and device for gray application software

Abstract

The application discloses a kind of detection methods and devices for grey application software, comprising: in dynamic sandbox, the running environment of application software and the use process of user are simulated, the application program is decompiled synchronously by static analysis engine, the access window of application software is identified, and the corresponding access permission is obtained, the running environment permission applied by application software is authorized, each running stage of application software is entered by inputting access permission, and internal content and external link appearing in the running process are recorded;Identify internal content, output the probability of risk existence;Run external link, identify the address and content of access target, and output the probability of risk existence;According to the probability of risk existence, judge whether application software belongs to grey application software or not.The above technical scheme is used, whether application software belongs to grey application software or not is judged on content, and the accuracy and detection efficiency of detection result are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network information supervision, and particularly relates to a detection method and device for gray application software. BACKGROUND

[0002] The development speed of mobile communication devices is getting faster and faster, and the number and types of application software are also increasing dramatically.

[0003] In the early stage of the development of mobile communication devices, application software needs to be audited manually before being put on the market and updated. However, due to the large number and variety of application software, it is difficult to audit each application software manually, and the efficiency is very low, which will affect the time of putting application software on the market and updating. Therefore, in order to improve the efficiency, computer software programs are designed to audit application software.

[0004] The auditing scheme adopted in the prior art is mainly to determine whether the application software will attack the running environment, illegally obtain and use information. However, many gray software that violates the rules is not intended to attack the running environment, but involves many illegal contents, and the application software will be disguised to some extent, and the illegal contents will not be displayed on the running interface, but will be displayed in certain running interfaces or will be implanted in the application software. The existing auditing scheme will miss this kind of gray software, and will further cause adverse effects on the network environment. SUMMARY

[0005] The present application provides a detection method and device for gray application software, which aims to identify the contents in the application software and the external links involved by simulating the running of the application software and obtaining the access permission, to determine whether the application software belongs to gray application software in terms of content, and to improve the accuracy and efficiency of the detection result by introducing and analyzing the behavior and information traces of the user group of the application software.

[0006] Technical solution: The application provides a detection method for gray application software, comprising: inputting the application software into a static analysis engine and a dynamic sandbox; simulating the running environment of the application software and the use process of the user in the dynamic sandbox, synchronously decompiling the application program through the static analysis engine, identifying the access window of the application software, and obtaining the corresponding access permission, authorizing the running environment permission applied by the application software, entering each running stage of the application software through the input access permission, and recording the internal content and external link appearing in the running process; identifying the internal content, and outputting the probability of existing risk; running the external link, identifying the address and content of the access target, and outputting the probability of existing risk; obtaining the target link accessed by the user group of the application software in a specific time interval of using the software, identifying the address and content of the target link, and outputting the probability of existing risk; identifying the forwarding address of the access permission data of the application software, and outputting the probability of existing risk; identifying the forwarding address of the running environment data obtained by the application software through the running environment permission, and outputting the probability of existing risk; and judging whether the application software belongs to gray application software according to the probability of existing risk.

[0007] Specifically, the dynamic sandbox simulates the running time and running address of the application software; the running time and running address are determined according to the use time and use address distribution of the user group of the application software.

[0008] Specifically, according to the login mode of the access window, the corresponding third-party application program or communication number is simulated.

[0009] Specifically, the content identification of the access target and the target link comprises: using a corresponding identification model to identify the content of data in a document format, a picture format and a sound format.

[0010] Specifically, the target link accessed by the user group of the application software in a specific time interval of using the software comprises: excluding the external link appearing in the running process; and the specific time interval is determined according to the average time of using the application software by the user.

[0011] Specifically, the forwarding address of the access permission data is identified, comprising: identifying whether there is an association between the forwarding address and the issuer of the access permission data.

[0012] Specifically, the forwarding address of the access permission data is identified, comprising: identifying whether there is an association between the forwarding address and the issuer of the application software.

[0013] Specifically, the forwarding address of the running environment data is identified, comprising: identifying whether there is an association between the forwarding address and the issuer of the application software.

[0014] Specifically, if the access permission corresponding to the access window cannot be acquired, information traces of a user group of the application software in a specific time interval are identified, and access permission data therein is extracted for the access window.

[0015] The application further provides a detection device for gray application software, comprising an input unit, a simulation unit, an identification unit and a judgment unit, wherein:

[0016] The input unit is configured to input the application software into a static analysis engine and a dynamic sandbox; the simulation unit is configured to simulate a running environment of the application software and a use process of a user in the dynamic sandbox, to synchronously decompile the application program through the static analysis engine, to identify an access window of the application software, to acquire corresponding access permissions, to authorize the application software to apply for the running environment permissions, to enter each running stage of the application software through the input access permissions, and to record internal contents and external links occurring in the running process; the identification unit is configured to identify the internal contents, to output a probability of existing risks, to run the external links, to identify addresses and contents of access targets, and to output the probability of existing risks; to acquire target links accessed by a user group of the application software in a specific time interval of using the software, to identify addresses and contents of the target links, and to output the probability of existing risks; to identify a forwarding address of access permission data of the application software, and to output the probability of existing risks; to identify a forwarding address of running environment data acquired by the application software through the running environment permissions, and to output the probability of existing risks; and the judgment unit is configured to judge whether the application software belongs to the gray application software according to the probability of existing risks.

[0017] Advantages: Compared with the prior art, the application has the following remarkable advantages: judging whether the application software belongs to the gray application software in the content, and improving the accuracy and efficiency of the detection result. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 A flowchart of a detection method for gray application software is provided. DETAILED DESCRIPTION

[0019] The technical solutions of the application are further described below with reference to the drawings.

[0020] Referring to Figure 1 A flowchart of a detection method for gray application software is provided.

[0021] Step 1: input the application software into a static analysis engine and a dynamic sandbox.

[0022] In practice, a dynamic sandbox is a security mechanism in the field of computer security, providing an isolated environment for running programs. It simulates the runtime environment of application software, allowing the application to run. Because some applications embed illegal external links, actively loading illegal content through these links during operation, or allowing users to access such content themselves, these situations cannot be effectively identified simply by examining the application's code. Simulation is necessary to detect these violations. Furthermore, in some cases, applications implement protective measures on their code, making it difficult to effectively identify critical information; therefore, simulation is also required.

[0023] In practice, the dynamic sandbox can also be connected to the network when needed.

[0024] In practice, the static analysis engine is used to decompile application software programs, parse the program code, identify access windows, and obtain corresponding access permissions. An access window specifically refers to a window (login window) that requires the input of specific permission or account information before the application software allows access to subsequent stages of operation; access permissions specifically refer to specific permission or account information.

[0025] In practice, some applications may hide entry points or set up multiple entry points to conceal illegal information. Each entry point has a different interface, which may not be recognizable by the appearance of the interface alone. Therefore, a static analysis engine is needed to identify the entry point and, where possible, obtain the corresponding access permissions to access the next interface.

[0026] Step 2: Simulate the application software's operating environment and user usage process in a dynamic sandbox. Simultaneously, decompile the application software through a static analysis engine, identify the application software's access windows, obtain corresponding access permissions, authorize the application software with the requested operating environment permissions, enter each stage of the application software's operation by entering access permissions, and record the internal content and external links that appear during the operation.

[0027] In this embodiment of the invention, the dynamic sandbox simulates the running time and running address of the application software; the running time and running address are determined based on the usage time and usage address distribution of the application software's user group.

[0028] In practice, when the application software is running in a dynamic sandbox simulation environment, the static analysis engine simultaneously identifies the access windows to avoid missing any critical access windows.

[0029] In practice, some applications impose specific requirements on runtime and address to evade detection. These applications may display specific content or access windows only at certain times or addresses, or they may block specific content or access windows at certain times or addresses. Such content or access windows are highly likely to contain illegal information, thus requiring strict review. To more effectively and accurately determine which runtime or address complies with the application's requirements, the usage time and address distribution of the application's user base can be obtained. Based on the time and address distributions, the most frequently occurring times and addresses can be simulated sequentially (with the user base's authorization). The runtime address specifically refers to the IP address of the application.

[0030] In this embodiment of the invention, the corresponding third-party application or communication number is simulated according to the login method of the access window.

[0031] In practice, access permissions for application software may require authorization information from third-party software or verification of a mobile phone number (communication number). In these cases, access can be accessed through simulation. Of course, the simulation involved here does not refer to imitation, but rather to using real information to simulate the login scenario.

[0032] In practice, both internal content and external links are recorded during software operation. External links specifically refer to links displayed within the application that can be used to access other targets or download other applications. Since some applications only serve a guiding role, providing ways to further access illegal content without actually involving illegal content themselves, thus circumventing regulation, these external links are also detected.

[0033] In practice, a trained link recognition model can be used to identify external links to determine whether information belongs to an external link, or to output the probability of it belonging to an external link. If the probability is higher than the set standard probability, it is considered to belong to an external link.

[0034] Step 3: Identify internal content and output the probability of risk; run external links, identify the address and content of the access target, and output the probability of risk; obtain the target links accessed by the application software's user group within a specific time interval of using the software, identify the address and content of the target links (the same process needs to be run for the target links), and output the probability of risk; identify the forwarding address of the application software's access permission data and output the probability of risk; identify the forwarding address of the runtime environment data obtained by the application software through runtime environment permissions and output the probability of risk.

[0035] In practice, corresponding recognition models are used to perform content recognition on data in document, image, and audio formats.

[0036] In practice, when identifying internal content and the content of target links, some gray-area applications may display the corresponding illegal content or links in image (icon format, including PDF format) or sound format in order to evade detection. Therefore, to circumvent this, it is necessary to use appropriate recognition models, such as text recognition models, image text extraction models, and sound recognition models.

[0037] In practice, the link recognition model can also be used in the content recognition process. If an external link is found, the external link will be run and detected according to the external link recognition method. That is, the external link will be run to identify the address and content of the access target and output the probability of risk.

[0038] In practice, after identifying content in various formats, some applications circumvent regulations by dividing external links or content with specific meanings into multiple different formats (documents, images, or audio). Therefore, identifying information in isolation of one format is insufficient to detect such circumvention schemes. Thus, after identifying information in various formats, a semantic recognition model can be used to combine and extract the information. If the combined information is determined to be an external link according to the corresponding link recognition model, the external link can be executed. In some cases, due to limitations of the semantic or content recognition models, external links may lack or have additional information during identification and acquisition, making direct execution impossible. In such cases, a web search engine can be used to retrieve the external link information, thereby obtaining relevant search information. This information can then be used to correct the external link or identify the search information to determine if there is any illegal content and output the probability of risk.

[0039] In this embodiment of the invention, the target links accessed by the user group of the application software within a specific time interval of using the software are obtained, while external links that appear during the operation are excluded.

[0040] In this embodiment of the invention, the specific time interval is determined based on the average time the user spends using the application software.

[0041] In practice, since it is difficult to accurately identify all content in an application software, especially external links, using only an identification model is not enough. Therefore, it is possible to obtain the target links accessed by the user group of the application software within a specific time period of using the software (with the authorization of the user group). The target links accessed by the user group within the time period may be illegal links provided by the application software. This can help to more effectively and accurately detect whether the application software is in violation of regulations.

[0042] In this embodiment of the invention, the forwarding address of the access permission data is identified, and it is determined whether there is an association between the forwarding address and the issuer of the access permission data, and whether there is an association between the forwarding address and the issuer of the application software.

[0043] In this embodiment of the invention, the forwarding address of the runtime environment data is identified, and it is determined whether there is an association between the forwarding address and the publisher of the application software.

[0044] In practice, when access permission data is accessed through an access window, especially when using authorization information from third-party applications or mobile phone numbers, the operation of the application can be detected. If it does not verify with the issuer of the access permission data, it indicates that there is a possibility of illegal use. If it does not transfer the access permission data and runtime environment data (relevant data obtained by the application in the runtime environment) to an address related to the issuer of the application, it also indicates that the application may be circumventing supervision and avoiding detection of the connection between the issuer and the actual transfer address. Such gray software also constitutes a violation of content regulations.

[0045] In practice, if no correlation is found, the actual forwarding address can be retrieved and identified. Relevant databases and search engines can be used to check whether the forwarding address has been marked as dangerous or illegal, as a factor to consider whether there is any risk.

[0046] In this embodiment of the invention, if the corresponding access permissions for the access window cannot be obtained, the information traces of the user group of the application software in a specific time interval are identified, and the access permission data therein is extracted for use in accessing the window.

[0047] In practice, access permissions for certain specific access windows are difficult to obtain, but the content corresponding to these windows is highly likely to be illegal. Such access permissions may be provided to the user group through other means. Therefore, by obtaining the information traces of the user group in a specific time interval (obtaining the relevant information with the authorization of the user group), a semantic recognition model can be used to determine which information involves access permissions (account and password) and other related information, and this type of information can be extracted for use through the access window.

[0048] In practice, the identification of content, external link addresses, and forwarding addresses, as well as the judgment of risk probability, can be achieved using a trained risk identification model.

[0049] Step 4: Determine whether the application software belongs to the gray area based on the probability of the risk.

[0050] In practice, a standard risk probability can be set. If any of the four risk probabilities in step 3 has a higher probability than the standard risk probability, the application software can be judged to be a gray application software.

[0051] The present invention also provides a detection device for gray application software, comprising: an input unit, an analog unit, a recognition unit, and a judgment unit, wherein:

[0052] The input unit is used to input the application software into the static analysis engine and the dynamic sandbox;

[0053] The simulation unit is used to simulate the application software's operating environment and the user's usage process in a dynamic sandbox. Simultaneously, it decompiles the application through a static analysis engine, identifies the application software's access windows, obtains corresponding access permissions, authorizes the application software with the operating environment permissions it requests, allows the application software to enter each stage of its operation by inputting access permissions, and records the internal content and external links that appear during the operation.

[0054] The identification unit is used to identify internal content and output the probability of risk; run external links, identify the address and content of the access target, and output the probability of risk; obtain target links accessed by the user group of the application software within a specific time interval of using the software, identify the address and content of the target link, and output the probability of risk; identify the forwarding address of the application software's access permission data and output the probability of risk; and identify the forwarding address of the application software's runtime environment data obtained through runtime environment permissions and output the probability of risk.

[0055] The judgment unit is used to determine whether the application software belongs to the gray application software based on the probability of the existence of risk.

[0056] In this embodiment of the invention, the simulation unit is used to simulate the running time and running address of the application software in the dynamic sandbox; the running time and running address are determined based on the usage time and usage address distribution of the application software's user group.

[0057] In this embodiment of the invention, the simulation unit is used to simulate a corresponding third-party application or communication number based on the login method of the access window.

[0058] In this embodiment of the invention, the recognition unit is used to perform content recognition on data in document format, image format, and audio format using a corresponding recognition model.

[0059] In this embodiment of the invention, the identification unit is used to exclude external links that appear during operation; the specific time interval is determined based on the average time the user spends using the application software.

[0060] In this embodiment of the invention, the identification unit is used to identify whether there is an association between the forwarding address and the issuer of the access permission data; to identify whether there is an association between the forwarding address and the issuer of the application software; and to identify whether there is an association between the forwarding address and the issuer of the application software.

[0061] In this embodiment of the invention, the simulation unit is used to identify information traces of the application software's user group within a specific time interval and extract the access permission data therein for use in accessing the window if the corresponding access permission cannot be obtained.

Claims

1. A method for detecting gray-area application software, characterized in that, include: Input the application software into the static analysis engine and the dynamic sandbox; The application software's runtime environment and user usage process are simulated in a dynamic sandbox. Simultaneously, the application is decompiled through a static analysis engine to identify the application software's access windows and obtain the corresponding access permissions. The runtime environment permissions requested by the application software are granted, and the application software can enter each stage of its operation by entering access permissions. The internal content and external links that appear during the operation are also recorded. Identify internal content and output the probability of risk. Run external links, using appropriate recognition models for the addresses and content of the accessed targets. Perform content recognition on data in document, image, and audio formats. After identifying information in various formats, use a link recognition model. If an external link is found, run that external link. Alternatively, use a semantic recognition model to combine and extract content from information in various formats. If the combined information belongs to an external link, run that external link and output the probability of risk. Obtain target links accessed by the application software's user group within a specific time interval of using the software, exclude external links that appear during operation, identify the addresses and content of the target links, and output the probability of risk. Identify the address to which application software forwards access permission data and output the probability of a risk. Identify the forwarding address of runtime environment data obtained by application software through runtime environment permissions, and output the probability of risk. Determine whether an application software belongs to the gray area based on the probability of the risk it poses.

2. The detection method for gray application software according to claim 1, characterized in that, The runtime and address of the dynamic sandbox simulation application software are determined based on the usage time and address distribution of the application software's user group.

3. The detection method for gray application software according to claim 2, characterized in that, The process of identifying the access window of the application software and obtaining the corresponding access permissions includes: Based on the login method accessed through the window, simulate the corresponding third-party application or communication number.

4. The detection method for gray application software according to claim 3, characterized in that, The acquisition of target links accessed by the user group of the application software within a specific time interval of using the software includes: The specific time interval is determined based on the average time users spend using the application software.

5. The detection method for gray application software according to claim 4, characterized in that, The forwarding address for the access permission data is identified, including: Identify whether there is a connection between the forwarding address and the issuer of the access permission data.

6. The detection method for gray application software according to claim 4, characterized in that, The forwarding address for the access permission data is identified, including: Identify whether there is an association between the forwarding address and the publisher of the application software.

7. The detection method for gray application software according to claim 4, characterized in that, The address for forwarding the runtime environment data is identified, including: Identify whether there is a connection between the forwarding address and the publisher of the application software.

8. The detection method for gray application software according to claim 4, characterized in that, If the corresponding access permissions for the access window cannot be obtained, then the information traces of the application software's user group within a specific time interval are identified, and the access permission data is extracted for use in accessing the window.

9. A detection device for gray application software, characterized in that, include: The system comprises an input unit, an analog unit, a recognition unit, and a judgment unit, wherein: The input unit is used to input the application software into the static analysis engine and the dynamic sandbox; The simulation unit is used to simulate the application software's operating environment and the user's usage process in a dynamic sandbox. Simultaneously, it decompiles the application through a static analysis engine, identifies the application software's access windows, obtains the corresponding access permissions, authorizes the application software to obtain the operating environment permissions, allows the application software to enter each stage of the application software's operation by inputting access permissions, and records the internal content and external links that appear during the operation. The identification unit is used to identify internal content and output the probability of risk; run external links, apply corresponding identification models to the address and content of the access target, perform content identification on data in document, image, and audio formats, and after identifying information of various formats, use a link identification model. If an external link is found, the external link is run; or a semantic recognition model is used to combine and extract content from information of various formats. If the combined information belongs to an external link, the external link is run, and the probability of risk is output; obtain target links accessed by the user group of the application software within a specific time interval of using the software, exclude external links that appear during operation, identify the address and content of the target links, and output the probability of risk; identify the forwarding address of the application software's access permission data and output the probability of risk; identify the forwarding address of the application software's runtime environment data obtained through runtime environment permissions and output the probability of risk. The judgment unit is used to determine whether the application software belongs to the gray application software based on the probability of the existence of risk.

Images