A method and device for detecting abnormal access to an interface of a power mobile terminal

Abstract

The present application discloses a method and device for detecting abnormal access to the interface of a power mobile terminal. The method includes: obtaining the target power mobile terminal to be detected and determining the target business type corresponding to the target power mobile terminal; obtaining a target program associated with the target business type from at least one program deployed by the target power mobile terminal; collecting all interface call sequences of the target program during operation; using a target anomaly detection model corresponding to the target business type to detect all interface call sequences corresponding to the target program, and obtaining a target detection result corresponding to the target power mobile terminal. The present application obtains the interface call sequence and the anomaly detection model of the corresponding program according to the business type corresponding to the power mobile terminal, and detects the interface call sequence through the anomaly detection model, which can effectively detect abnormal access to the interface of the power mobile terminal for different business types, and make up for the lack of security protection of the power mobile terminal.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for detecting abnormal access to an interface of a power mobile terminal. Background Art

[0002] At present, anomaly detection based on interface calls mainly targets normal software and malware popular in the market, and lacks research on anomaly detection for mobile business-related software of power mobile terminals. In addition, traditional Android interface call sequence dynamic analysis tools such as Cuckoo sandBox, APIMonitor, DroidBox, etc. are all built based on virtual sandbox and simulator environments, while some business software of power mobile terminals has anti-sandbox and anti-simulator situations and cannot run in virtual environments. Therefore, traditional interface call sequence dynamic analysis methods are not applicable to power mobile business software. Summary of the invention

[0003] In order to solve the above technical problem or at least partially solve the above technical problem, the present application provides a method and device for detecting abnormal access to an interface of a power mobile terminal.

[0004] According to one aspect of an embodiment of the present application, there is provided a method for detecting abnormal access to an interface of a power mobile terminal, including:

[0005] Acquire a target power mobile terminal to be detected currently, and determine a target service type corresponding to the target power mobile terminal;

[0006] acquiring a target program associated with the target service type from at least one program deployed by the target power mobile terminal;

[0007] Collect all interface call sequences of the target program during its operation;

[0008] The target anomaly detection model corresponding to the target business type is used to detect all interface call sequences corresponding to the target program to obtain a target detection result corresponding to the target power mobile terminal, wherein the target detection result is used to indicate whether there is abnormal access to the target power mobile terminal.

[0009] Furthermore, the acquisition of all interface call sequences of the target program during operation includes:

[0010] Obtaining a first installation package corresponding to the target program;

[0011] Deploying the target program on a target simulator using the first installation package;

[0012] Running the target program through the target simulator and capturing the running file of the target program within a preset time period;

[0013] The interface name, interface parameters and interface type of the called interface are extracted from the running file, and the interface calling sequence is generated based on the interface name, interface parameters and interface type.

[0014] Further, the use of the target anomaly detection model corresponding to the target business type to detect all interface call sequences corresponding to the target program to obtain the target detection result corresponding to the target electric mobile terminal includes:

[0015] Determining a target anomaly detection model corresponding to the target business type from at least one anomaly detection model;

[0016] Inputting all interface call sequences of the target program into the target anomaly detection model, so that the target anomaly detection model extracts target features corresponding to all interface call sequences, and determines the target access type corresponding to the target feature based on the correspondence between the feature and the access type;

[0017] The target access type is determined as the target detection result.

[0018] Furthermore, the method further comprises:

[0019] Obtain a first training sample and a second training sample, wherein the first training sample includes a first interface call sequence of a normal program associated with each service type, and the second training sample includes a second interface call sequence of a malicious program associated with each service type;

[0020] Obtaining a first label corresponding to the first training sample and a second label corresponding to the second training sample, wherein the first label is used to mark a normal access type corresponding to the first training sample, and the second label is used to mark an abnormal access type corresponding to the second training sample;

[0021] The first training sample, the second training sample, the first label and the second label are used to train the deep learning network model corresponding to each business type to obtain the anomaly detection model corresponding to each business type.

[0022] Further, the obtaining of the first training sample and the second training sample includes:

[0023] Acquire a power mobile terminal corresponding to each service type, and acquire a second installation package corresponding to a normal program associated with the service type from the power mobile terminal;

[0024] Obtaining a third installation package corresponding to the malicious program;

[0025] Deploy the normal program on the target simulator using the second installation package, and deploy the malicious program on the target simulator using the third installation package;

[0026] Running the normal program and the malicious program through the target simulator, collecting a first running file of the normal program within a preset time period, and a second running file of the malicious program within the preset time period;

[0027] Extracting a first interface call sequence corresponding to the normal program from the first running file, and extracting a second interface call sequence corresponding to the malicious program from the second running file;

[0028] The first interface call sequence is determined as the first training sample, and the second interface call sequence is determined as the second training sample.

[0029] Further, extracting the first interface call sequence corresponding to the normal program from the first running file, and extracting the second interface call sequence corresponding to the malicious program from the second running file, includes:

[0030] Calculating a first information gain value corresponding to each interface call carried by the first running file, and using the interface call with the largest first information gain value to form the first interface call sequence;

[0031] The second information gain value corresponding to each interface call carried by the second running file is calculated, and the interface call with the largest second information gain value is used to form the second interface call sequence.

[0032] Furthermore, the deep learning network model includes: an embedding network, a convolutional network and a classification network;

[0033] The using the first training sample, the second training sample, the first label, and the second label to train the deep learning network model corresponding to each service type to obtain the anomaly detection model corresponding to each service type includes:

[0034] Converting the first interface call sequence included in the first training sample and the second interface call sequence included in the second training sample into a first word vector and a second word vector respectively through the embedding layer;

[0035] Extracting a first feature of the first word vector through the convolution layer, and extracting a second feature of the second word vector;

[0036] The classification layer learns the first corresponding relationship between the first feature and the normal access type, and learns the second corresponding relationship between the second feature and the abnormal access type, so as to obtain the abnormality detection model corresponding to each business type.

[0037] According to another aspect of an embodiment of the present application, there is also provided a terminal abnormal access detection device, including:

[0038] A first acquisition module is used to acquire a target power mobile terminal to be detected and determine a target service type corresponding to the target power mobile terminal;

[0039] A second acquisition module, configured to acquire a target program associated with the target service type from at least one program deployed by the target power mobile terminal;

[0040] A collection module, used to collect all interface call sequences of the target program during its operation;

[0041] A detection module is used to use a target anomaly detection model corresponding to the target business type to detect all interface call sequences corresponding to the target program, and obtain a target detection result corresponding to the target electric mobile terminal, wherein the target detection result is used to indicate whether there is abnormal access to the target electric mobile terminal.

[0042] According to another aspect of an embodiment of the present application, a storage medium is further provided, which includes a stored program, and the above steps are executed when the program is run.

[0043] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; wherein: the memory is used to store computer programs; and the processor is used to execute the steps in the above method by running the program stored in the memory.

[0044] The embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps in the above method.

[0045] The above-mentioned technical solution provided by the embodiment of the present application has the following advantages over the prior art: the method provided by the embodiment of the present application obtains the interface call sequence and the anomaly detection model of the corresponding program according to the business type corresponding to the electric mobile terminal, and detects the interface call sequence through the anomaly detection model, which can effectively detect abnormal interface access of the electric mobile terminal for different business types, thereby making up for the lack of security protection at the electric mobile terminal level. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0048] Figure 1 A flowchart of a method for detecting abnormal access to an interface of a power mobile terminal provided in an embodiment of the present application;

[0049] Figure 2 A flowchart of a method for detecting abnormal access to an interface of a power mobile terminal provided by another embodiment of the present application;

[0050] Figure 3 A block diagram of a device for detecting abnormal access to an interface of a power mobile terminal provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. The schematic embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0053] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another similar entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0054] The embodiment of the present application provides a method and device for detecting abnormal access to the interface of a power mobile terminal. The method provided by the embodiment of the present invention can be applied to any required electronic device, for example, it can be an electronic device such as a server, a terminal, etc., which is not specifically limited here. For the convenience of description, it is referred to as an electronic device in the following.

[0055] According to one aspect of the embodiments of the present application, a method embodiment of a method for detecting abnormal access to an interface of a power mobile terminal is provided. Figure 1 A flowchart of a method for detecting abnormal access to an interface of a power mobile terminal provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:

[0056] Step S11, obtaining a target power mobile terminal to be detected, and determining a target service type corresponding to the target power mobile terminal.

[0057] The method provided in the embodiment of the present application is applied to an intelligent mobile terminal for data processing, and the intelligent mobile terminal may be a laptop computer, a tablet computer, etc. Specifically, the intelligent mobile terminal may obtain a detection task, extract a terminal identifier from the detection task, and query the electric mobile terminal corresponding to the terminal identifier, and determine the electric mobile terminal as the target electric mobile terminal to be detected. At the same time, the business carried by the target electric mobile terminal may be determined from a preset business type table based on the terminal identifier, and the target business type of the target electric mobile terminal may be determined based on the business carried by the target electric mobile terminal. The target business type may be: production type, marketing type, office type, etc.

[0058] As an example, when the services carried by the target power mobile terminal include: mobile inspection, and / or mobile monitoring services, the corresponding target service type is the production type. When the services carried by the target power mobile terminal include: mobile marketing services, etc., the corresponding target service type is the marketing type. When the services carried by the target power mobile terminal include: office, mobile learning and news services, etc., the corresponding target service type is the office type.

[0059] Step S12: acquiring a target program associated with the target service type from at least one program deployed in the target power mobile terminal.

[0060] In an embodiment of the present application, after determining the target service type corresponding to the target power mobile terminal, the program currently deployed by the target power mobile terminal is obtained, and the target program associated with the target service type is obtained from the deployed programs.

[0061] As an example, when the target business type is production type, the target programs in the target power mobile terminal include: monitoring program, production scheduling program, etc. When the target business type is office type, the target programs in the target power mobile terminal include: approval program, recording program, etc.

[0062] Step S13, collecting all interface call sequences of the target program during its operation.

[0063] In the embodiment of the present application, all interface call sequences of the target program during operation are collected, including the following steps A1-A4:

[0064] Step A1, obtaining a first installation package corresponding to the target program.

[0065] Step A2: deploy the target program on the target simulator using the first installation package.

[0066] Step A3, running the target program through the target simulator, and capturing the running file of the target program within a preset time period.

[0067] Step A4, extracting the interface name, interface parameters and interface type of the called interface from the running file, and generating an interface calling sequence based on the interface name, interface parameters and interface type.

[0068] In an embodiment of the present application, a first installation package (i.e., an apk installation package) of a target program in a power mobile terminal is collected, and then the target program is installed in an Android emulator using the first installation package. For target programs that cannot be run in the Android emulator, they are installed in a real device with root permissions enabled, and the real device and the computer are connected via a USB data cable so that data can be transmitted to each other.

[0069] After starting the Android emulator or connecting to a real device with root permissions, open the Android DeviceMonitor tool to check whether there is an online Android device. If so, enter the Android shell through the adb command line, set ro.debuggable = 1 to debuggable mode, and restart the device through the stop; start; command.

[0070] If it does not exist, run the target program on the Android emulator, select the corresponding process in the process list to start the Method Profiling function to start monitoring the software operation, and enter the Android shell through the adb command, start the Monkey tool to simulate manual screen clicks, and after the software runs for a preset time, end the Method Profiling function to stop monitoring the software operation, automatically generate a trace file in the AppData / Temp directory, and start the Dmtracedump tool in the command line to parse the trace file to get the running file. Extract the interface name, interface parameters and interface type of the called interface from the running file, and generate an interface call sequence based on the interface name, interface parameters and interface type.

[0071] Step S14, using the target anomaly detection model corresponding to the target business type to detect all interface call sequences of the target program, and obtain a target detection result corresponding to the target power mobile terminal, wherein the target detection result is used to indicate whether there is abnormal access to the target power mobile terminal.

[0072] In the embodiment of the present application, the target anomaly detection model corresponding to the target service type is used to detect all interface call sequences of the target program to obtain the target detection result corresponding to the target power mobile terminal, including the following steps B1-B3:

[0073] Step B1: Determine a target anomaly detection model corresponding to a target business type from at least one anomaly detection model.

[0074] Step B2, input all interface call sequences of the target program into the target anomaly detection model, so that the target anomaly detection model extracts the target features corresponding to all interface call sequences, and determines the target access type corresponding to the target feature based on the correspondence between the feature and the access type.

[0075] Step B3, determining the target access type as the target detection result.

[0076] In the embodiment of the present application, since different business types correspond to different detection models, the target anomaly detection model is determined by the target business type. The detection model can be based on the CNN-BiLSTM neural network model built based on the PyTorch framework, wherein the model includes five layers: the first layer (Word2vec embedding layer): the Word2vec algorithm is used as the embedding layer to convert the input interface call sequence into a word vector of the same dimension and input the neural network. The second layer (convolution layer): the multi-channel multi-core fusion convolution layer is used to extract the target features of the interface call sequence, and is nonlinearly activated by the ReLU function. The third layer (pooling layer): the pooling layer simplifies the network complexity, compresses the training features, and reduces the training parameters through the downsampling operation. The fourth layer (bidirectional long short-term memory recurrent neural network layer): the bidirectional BiLSTM layer trains and learns the input data, fully captures the contextual semantic relationship of the interface call sequence from the target features, and combines the Dropout mechanism to prevent the model from overfitting. The fifth layer (fully connected layer): the interface call sequence is classified by the fully connected layer and the softmax function to obtain the target access type, and the target access type is determined as the target detection result.

[0077] The method provided in the embodiment of the present application obtains the interface call sequence and the anomaly detection model of the corresponding program according to the business type corresponding to the electric mobile terminal, and detects the interface call sequence through the anomaly detection model. It can effectively detect abnormal interface access of the electric mobile terminal for different business types, and make up for the lack of security protection at the electric mobile terminal level.

[0078] exist Figure 2 A flowchart of a method for detecting abnormal access to an interface of a power mobile terminal provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the method may include the following steps:

[0079] Step S21, obtaining a first training sample and a second training sample, wherein the first training sample includes a first interface calling sequence of a normal program associated with each service type, and the second training sample includes a second interface calling sequence of a malicious program associated with each service type.

[0080] In the embodiment of the present application, obtaining the first training sample and the second training sample includes the following steps C1-C6:

[0081] Step C1, obtaining a power mobile terminal corresponding to each service type, and obtaining a second installation package corresponding to a normal program associated with the service type from the power mobile terminal;

[0082] Step C2, obtaining a third installation package corresponding to the malicious program;

[0083] Step C3, using the second installation package to deploy a normal program on the target simulator, and using the third installation package to deploy a malicious program on the target simulator;

[0084] Step C4, running a normal program and a malicious program through a target simulator, collecting a first running file of the normal program within a preset time period, and a second running file of the malicious program within a preset time period;

[0085] Step C5, extracting a first interface call sequence corresponding to a normal program from the first running file, and extracting a second interface call sequence corresponding to a malicious program from the second running file;

[0086] Step C6: determine the first interface call sequence as a first training sample, and determine the second interface call sequence as a second training sample.

[0087] In an embodiment of the present application, the second installation packages of the programs of the power mobile terminal under different business types are collected respectively, and the third installation package of the malicious program is downloaded from the Virusshare website. Then, the programs of the power mobile terminal and the malicious program are installed on the Android emulator. For application software that cannot be run on the Android emulator, they are installed on a real device with root permissions enabled, and the real device and the computer are connected via a USB data cable so that data can be transmitted to each other.

[0088] After starting the Android emulator or connecting to a real device with root permissions, open the Android DeviceMonitor tool to check whether there is an online Android device. If so, enter the Android shell through the adb command line, set ro.debuggable = 1 to debuggable mode, and restart the device through the stop; start; command.

[0089] If it does not exist, run the target program on the Android emulator, select the corresponding process in the process list to start the Method Profiling function to start monitoring the software operation, and enter the Android shell through the adb command, start the Monkey tool to simulate manual screen clicks, and after the software runs for a preset time, end the Method Profiling function to stop monitoring the software operation, automatically generate a trace file in the AppData / Temp directory, and start the Dmtracedump tool in the command line to parse the trace file to get the running file. Extract the interface name, interface parameters and interface type of the called interface from the running file, and generate an interface call sequence based on the interface name, interface parameters and interface type.

[0090] Step S22, obtaining a first label corresponding to the first training sample and a second label corresponding to the second training sample, wherein the first label is used to mark the normal access type corresponding to the first training sample, and the second label is used to mark the abnormal access type corresponding to the second training sample.

[0091] In the embodiment of the present application, extracting a first interface call sequence corresponding to a normal program from a first running file, and extracting a second interface call sequence corresponding to a malicious program from a second running file, includes the following steps D1-D2:

[0092] Step D1, calculating a first information gain value corresponding to each interface call carried by the first running file, and using interface calls with larger first information gain values ​​to form a first interface call sequence;

[0093] Step D2, calculating the second information gain value corresponding to each interface call carried by the second running file, and using the interface calls with larger second information gain values ​​to form a second interface call sequence.

[0094] In the embodiment of the present application, the formula for calculating the first information gain value corresponding to each interface call carried by the first operation file and the formula for calculating the second information gain value corresponding to each interface call carried by the second operation file are as follows:

[0095] H(Y)=-∑p(y)log2p(y) (1)

[0096] H(Y|X)=∑p(x)H(Y|X=x) (2)

[0097] IG(x)=H(Y)-H(Y|X) (3)

[0098] In the formula, Y represents all samples, X identifies a certain interface call, the total sample information entropy H(Y) is calculated by formula (1), the conditional entropy H(Y|X) of each interface is calculated by formula (2), and the information gain value IG(X) of each interface is calculated by formula (3).

[0099] Then, the interface call sequence with the largest information gain value in the first running file, or the interface call sequence with an information gain value greater than a preset threshold, is used as the first interface call sequence, and the interface call sequence with the largest information gain value in the first running file, or the interface call sequence with an information gain value greater than the preset threshold, is used as the second interface call sequence.

[0100] Step S23, using the first training sample, the second training sample, the first label and the second label to train the deep learning network model corresponding to each business type, to obtain the anomaly detection model corresponding to each business type.

[0101] In the embodiment of the present application, the deep learning network model includes: an embedding layer, a convolution layer, and a classification layer;

[0102] In the embodiment of the present application, the deep learning network model corresponding to each service type is trained using the first training sample, the second training sample, the first label, and the second label to obtain an anomaly detection model corresponding to each service type, including the following steps D1-D3:

[0103] Step D1, converting a first interface call sequence included in a first training sample and a second interface call sequence included in a second training sample into a first word vector and a second word vector respectively through an embedding layer;

[0104] Step D2, extracting a first feature of the first word vector and a second feature of the second word vector through a convolutional layer;

[0105] Step D3, learning the first corresponding relationship between the first feature and the normal access type, and learning the second corresponding relationship between the second feature and the abnormal access type through the classification layer, to obtain an abnormality detection model corresponding to each business type.

[0106] In an embodiment of the present application, a CNN-BiLSTM neural network model is built based on the PyTorch framework, wherein the model comprises five layers: the first layer (Word2vec embedding layer): the Word2vec algorithm is used as the embedding layer to convert the input API call sequence into a word vector of the same dimension and input it into the neural network. The second layer (convolutional layer): the multi-channel multi-core fusion convolutional layer is used to extract the features of the API call sequence, and is nonlinearly activated by the ReLU function. The third layer (pooling layer): the pooling layer simplifies the network complexity, compresses the training features, and reduces the training parameters through the downsampling operation. The fourth layer (bidirectional long short-term memory recurrent neural network layer): the bidirectional BiLSTM layer trains and learns the input data, fully captures the contextual semantic relationship of the API sequence, and combines the Dropout mechanism to prevent the model from overfitting. The fifth layer (fully connected layer): the normal samples (first training samples) and malicious samples (second training samples) are classified by the fully connected layer and the softmax function.

[0107] In the embodiment of the present application, the training sets of interface call sequences of production type, marketing type and office type are respectively input into the CNN-BiLSTM model for training and learning to generate three types of abnormal access detection models. Then, the test sets of interface call sequences in production, marketing and office application scenarios are respectively input into the corresponding interface abnormal access detection models to test the detection effect of the models. If the detection accuracy meets the requirements, otherwise, the model parameters are adjusted to continue training.

[0108] It should be noted that the detection accuracy of the CNN-BiLSTM deep learning algorithm proposed in the embodiment of the present application is better than that of the traditional machine learning algorithms KNN, SVM, decision tree and random forest. Therefore, the present invention can provide an effective API abnormal access detection model for power mobile terminals in different application scenarios, and can be used to assist in the safety status assessment of power mobile terminals, making up for the lack of safety protection at the power mobile terminal level.

[0109] Figure 3 This is a block diagram of a detection device for abnormal access to a power mobile terminal interface provided by an embodiment of the present application. The device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. Figure 3 As shown, the device comprises:

[0110] The first acquisition module 31 is used to acquire the target power mobile terminal to be detected and determine the target service type corresponding to the target power mobile terminal.

[0111] The second acquisition module 32 is used to acquire a target program associated with a target service type from at least one program deployed in the target power mobile terminal.

[0112] The collection module 33 is used to collect all interface call sequences of the target program during its operation.

[0113] The detection module 34 is used to detect all interface call sequences corresponding to the target program using the target anomaly detection model corresponding to the target business type, and obtain the target detection result corresponding to the target power mobile terminal, wherein the target detection result is used to indicate whether there is abnormal access to the target power mobile terminal.

[0114] In an embodiment of the present application, the acquisition module 33 is used to obtain a first installation package corresponding to a target program; deploy the target program on a target simulator using the first installation package; run the target program through the target simulator and capture the running file of the target program within a preset time period; extract the interface name, interface parameters and interface type of the called interface from the running file, and generate an interface call sequence based on the interface name, interface parameters and interface type.

[0115] In an embodiment of the present application, the detection module 34 is used to determine a target anomaly detection model corresponding to a target business type from at least one anomaly detection model; input all interface call sequences of the target program into the target anomaly detection model so that the target anomaly detection model extracts target features corresponding to all interface call sequences, and determines the target access type corresponding to the target feature based on the correspondence between the feature and the access type; and determines the target access type as the target detection result.

[0116] In an embodiment of the present application, the terminal abnormal access detection device also includes: a training module, used to obtain a first training sample and a second training sample, wherein the first training sample includes a first interface call sequence of a normal program associated with each business type, and the second training sample includes a second interface call sequence of a malicious program associated with each business type; obtain a first label corresponding to the first training sample and a second label corresponding to the second training sample, wherein the first label is used to mark the normal access type corresponding to the first training sample, and the second label is used to mark the abnormal access type corresponding to the second training sample; use the first training sample, the second training sample, the first label and the second label to train a deep learning network model corresponding to each business type to obtain an abnormality detection model corresponding to each business type.

[0117] In an embodiment of the present application, a training module is used to obtain an electric mobile terminal corresponding to each business type, and obtain a second installation package corresponding to a normal program associated with the business type from the electric mobile terminal; obtain a third installation package corresponding to a malicious program; use the second installation package to deploy a normal program on a target simulator, and use the third installation package to deploy a malicious program on the target simulator; run the normal program and the malicious program through the target simulator, collect the first running file of the normal program within a preset time period, and the second running file of the malicious program within a preset time period; extract the first interface call sequence corresponding to the normal program from the first running file, and extract the second interface call sequence corresponding to the malicious program from the second running file; determine the first interface call sequence as a first training sample, and determine the second interface call sequence as a second training sample.

[0118] In an embodiment of the present application, a training module is used to calculate a first information gain value corresponding to each interface call carried by a first running file, and use interface calls with larger first information gain values ​​to form a first interface call sequence; calculate a second information gain value corresponding to each interface call carried by a second running file, and use interface calls with larger second information gain values ​​to form a second interface call sequence.

[0119] In an embodiment of the present application, the deep learning network model includes: an embedding network, a convolutional network, and a classification network.

[0120] A training module is used to convert a first interface call sequence included in a first training sample and a second interface call sequence included in a second training sample into a first word vector and a second word vector respectively through an embedding layer; extract a first feature of the first word vector through a convolution layer, and extract a second feature of the second word vector; learn a first corresponding relationship between the first feature and a normal access type, and learn a second corresponding relationship between the second feature and an abnormal access type through a classification layer, so as to obtain an anomaly detection model corresponding to each business type.

[0121] The present application also provides an electronic device, such as Figure 4 As shown, the electronic device may include: a processor 1501 , a communication interface 1502 , a memory 1503 and a communication bus 1504 , wherein the processor 1501 , the communication interface 1502 , and the memory 1503 communicate with each other via the communication bus 1504 .

[0122] Memory 1503, used for storing computer programs;

[0123] The processor 1501 is used to implement the steps of the above embodiment when executing the computer program stored in the memory 1503.

[0124] The communication bus mentioned in the above terminal can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0125] The communication interface is used for communication between the above terminal and other devices.

[0126] The memory may include a random access memory (RAM) or a non-volatile memory, such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0127] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0128] In another embodiment provided in the present application, a computer-readable storage medium is also provided, which stores instructions. When the computer-readable storage medium is executed on a computer, the computer executes a method for detecting abnormal access to an interface of a power mobile terminal as described in any of the above embodiments.

[0129] In another embodiment provided in the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute a method for detecting abnormal access to an interface of a power mobile terminal as described in any one of the above embodiments.

[0130] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk SolidState Disk), etc.

[0131] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

[0132] The above description is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest range consistent with the principles and novel features applied for herein.

Claims

1. A method for detecting abnormal access to an interface of a power mobile terminal, characterized in that: include: Acquire a target power mobile terminal to be detected currently, and determine a target service type corresponding to the target power mobile terminal; acquiring a target program associated with the target service type from at least one program deployed by the target power mobile terminal; Collect all interface call sequences of the target program during its operation; Detecting all interface call sequences corresponding to the target program using the target anomaly detection model corresponding to the target business type, and obtaining a target detection result corresponding to the target electric mobile terminal, wherein the target detection result is used to indicate whether there is abnormal access to the target electric mobile terminal; The method also includes: obtaining a first training sample and a second training sample, wherein the first training sample includes a first interface call sequence of a normal program associated with each business type, and the second training sample includes a second interface call sequence of a malicious program associated with each business type; obtaining a first label corresponding to the first training sample and a second label corresponding to the second training sample, wherein the first label is used to mark a normal access type corresponding to the first training sample, and the second label is used to mark an abnormal access type corresponding to the second training sample; and using the first training sample, the second training sample, the first label and the second label to train a deep learning network model corresponding to each business type to obtain an anomaly detection model corresponding to each business type.

2. The method according to claim 1, characterized in that The collecting of all interface call sequences of the target program during its operation includes: Obtaining a first installation package corresponding to the target program; Deploying the target program on a target simulator using the first installation package; Running the target program through the target simulator and capturing the running file of the target program within a preset time period; The interface name, interface parameters and interface type of the called interface are extracted from the running file, and the interface calling sequence is generated based on the interface name, interface parameters and interface type.

3. The method according to claim 1, characterized in that The using the target anomaly detection model corresponding to the target business type to detect all interface call sequences corresponding to the target program to obtain the target detection result corresponding to the target electric mobile terminal includes: Determining a target anomaly detection model corresponding to the target business type from at least one anomaly detection model; Inputting all interface call sequences of the target program into the target anomaly detection model, so that the target anomaly detection model extracts target features corresponding to all interface call sequences, and determines the target access type corresponding to the target feature based on the correspondence between the feature and the access type; The target access type is determined as the target detection result.

4. The method according to claim 1, characterized in that: The obtaining of the first training sample and the second training sample comprises: Acquire a power mobile terminal corresponding to each service type, and acquire a second installation package corresponding to a normal program associated with the service type from the power mobile terminal; Obtaining a third installation package corresponding to the malicious program; Deploy the normal program on the target simulator using the second installation package, and deploy the malicious program on the target simulator using the third installation package; Running the normal program and the malicious program through the target simulator, collecting a first running file of the normal program within a preset time period, and a second running file of the malicious program within the preset time period; Extracting a first interface call sequence corresponding to the normal program from the first running file, and extracting a second interface call sequence corresponding to the malicious program from the second running file; The first interface call sequence is determined as the first training sample, and the second interface call sequence is determined as the second training sample.

5. The method according to claim 4, characterized in that The extracting the first interface call sequence corresponding to the normal program from the first running file, and extracting the second interface call sequence corresponding to the malicious program from the second running file, comprises: Calculate the first information gain value corresponding to each interface call carried by the first running file, and use the interface call with the largest first information gain value or the first gain information value greater than a preset threshold to form the first interface call sequence; The second information gain value corresponding to each interface call carried by the second running file is calculated, and the second interface call sequence is composed of the interface call with the largest second information gain value or the first gain information value greater than a preset threshold.

6. The method according to claim 1, characterized in that The deep learning network model includes: an embedding layer, a convolution layer and a classification layer; The using the first training sample, the second training sample, the first label, and the second label to train the deep learning network model corresponding to each service type to obtain the anomaly detection model corresponding to each service type includes: Converting the first interface call sequence included in the first training sample and the second interface call sequence included in the second training sample into a first word vector and a second word vector respectively through the embedding layer; Extracting a first feature of the first word vector through the convolution layer, and extracting a second feature of the second word vector; The classification layer learns the first corresponding relationship between the first feature and the normal access type, and learns the second corresponding relationship between the second feature and the abnormal access type, so as to obtain the abnormality detection model corresponding to each business type.

7. A terminal abnormal access detection device, characterized in that: include: A first acquisition module is used to acquire a target power mobile terminal to be detected and determine a target service type corresponding to the target power mobile terminal; A second acquisition module, configured to acquire a target program associated with the target service type from at least one program deployed by the target power mobile terminal; A collection module, used to collect all interface call sequences of the target program during its operation; a detection module, configured to detect all interface call sequences corresponding to the target program using a target anomaly detection model corresponding to the target service type, and obtain a target detection result corresponding to the target electric mobile terminal, wherein the target detection result is used to indicate whether there is abnormal access to the target electric mobile terminal; The detection device also includes: a training module, used to obtain a first training sample and a second training sample, wherein the first training sample includes a first interface call sequence of a normal program associated with each business type, and the second training sample includes a second interface call sequence of a malicious program associated with each business type; obtain a first label corresponding to the first training sample, and a second label corresponding to the second training sample, wherein the first label is used to mark the normal access type corresponding to the first training sample, and the second label is used to mark the abnormal access type corresponding to the second training sample; use the first training sample, the second training sample, the first label and the second label to train a deep learning network model corresponding to each business type to obtain an abnormality detection model corresponding to each business type.

8. A storage medium, characterized in that: The storage medium includes a stored program, wherein the program executes the method according to any one of claims 1 to 6 when executed.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; wherein: Memory, used to store computer programs; A processor, configured to execute the method according to any one of claims 1 to 6 by running a program stored in a memory.

Images