A method for testing an Android application sandbox operating environment

Abstract

The present invention relates to the technical field of sandbox operating environment testing, and discloses a method for testing the sandbox operating environment of an Android application, including: obtaining operating environment status information of an Android application; constructing a sandbox operating environment inference model based on a probability graph method; using an improved EM algorithm to train and optimize the sandbox operating environment inference model; based on the sandbox operating environment inference model after training and optimization, real-time calculation of the probability of whether the program operating environment is a sandbox environment; constructing a sandbox environment probability linear extraction model, solving the model to obtain operating environment linear data, and judging whether the operating environment of the current Android program is a sandbox environment according to the environment linear data. The method of the present invention uses whether the operating environment is a sandbox environment as a hidden variable, and obtains the probability that the Android application operating environment is a sandbox environment by reversely inferring the hidden variable probability, thereby improving the sandbox operating environment detection accuracy and detection speed.

Description

Technical Field

[0001] The present invention relates to the technical field of sandbox operating environment testing and identification, and in particular to a method for testing an Android application sandbox operating environment. Background Art

[0002] In the field of computer security, sandbox is an isolated environment provided for running programs. It is usually used for experiments with programs that are from untrusted sources, destructive, or whose intentions cannot be determined. However, the rapid development of MOBA games in recent years has attracted more and more Android users. Sandbox technologies such as Android emulators have led to Android applications originally used on mobile terminals being ported to PCs for use, destroying the fairness and user experience of MOBA games. Although related studies have attempted to detect sandbox environments, most of them were simply judged based on specific features, with high errors and other problems. To address this problem, this patent proposes a method for testing the sandbox operating environment of Android applications, which is used to accurately and quickly detect whether Android applications are running in a sandbox environment to ensure fairness and user experience. Summary of the invention

[0003] In view of this, the present invention provides a method for testing the sandbox operating environment of an Android application, the purpose of which is to (1) construct a sandbox operating environment inference model based on a probability graph method of conditional probability and Bayesian probability, wherein the sandbox operating environment inference model uses operating environment state information as an observed variable and whether the operating environment is a sandbox environment as a hidden variable, obtains the probability that the Android application operating environment is a sandbox environment at any time by reversely inferring the hidden variable probability, extracts the linear data of the operating environment of the Android application running on a mobile terminal system based on the operating environment sandbox probability time series data set, and judges that the operating environment of the Android application is a sandbox environment if the linear data of the operating environment exceeds a threshold, thereby improving the accuracy of sandbox operating environment detection; (2) improve the traditional EM algorithm, so as to quickly determine a better algorithm iteration initial value, thereby obtaining a local optimal solution near the initial value based on the better initial value, reducing the number of algorithm iterations, avoiding the situation in which the traditional EM iterative algorithm randomly selects an initial value, the number of algorithm iterations is large, and the training effect of the model parameter vector is easily unstable, thereby improving the stability of the model parameters, and being able to quickly obtain a more stable and better model parameter vector.

[0004] To achieve the above object, the present invention provides a method for testing an Android application sandbox operating environment, comprising the following steps:

[0005] S1: Detecting the running environment of the program when the Android application is running, and obtaining running environment status information, wherein the running environment status information includes process information and mobile terminal status information;

[0006] S2: constructing a sandbox operating environment inference model based on a probability graph method, wherein the sandbox operating environment inference model uses operating environment status information as an observed variable and whether the operating environment is a sandbox environment as a hidden variable, and obtains the probability that the Android application operating environment is a sandbox environment by reversely inferring the hidden variable probability;

[0007] S3: According to the method in step S1, the operating environment status information and the corresponding sandbox environment judgment results are collected to form a sandbox operating environment judgment training set, and the improved EM algorithm is used to perform parameter training optimization on the sandbox operating environment inference model based on the training set, so as to shorten the model training time and obtain the sandbox operating environment inference model after training optimization;

[0008] S4: Based on the sandbox operating environment inference model after training optimization, the probability of whether the program operating environment is a sandbox environment is calculated in real time to obtain an operating environment sandbox probability time series data set, wherein the time series range in the operating environment sandbox probability time series data set is the time range of the Android application running;

[0009] S5: Based on the runtime sandbox probability time series data set, a sandbox environment probability linear extraction model is constructed, and the model is solved to obtain the runtime environment linear data. If the runtime environment linear data exceeds the specified threshold, it means that the runtime environment of the current Android program is a sandbox environment, otherwise it is not a sandbox environment.

[0010] As a further improvement method of the present invention:

[0011] Optionally, in the step S1, the operating environment of the Android application is detected when it is running, and the operating environment status information is obtained, wherein the operating environment status information includes process information and mobile terminal status information, including:

[0012] When the Android application is running, the monitoring process built into the Android application is used to obtain the operating environment status information, wherein the operating environment status information includes process information and mobile terminal status information. The process of obtaining the operating environment status information is as follows:

[0013] S11: Setting the process switch value of the monitoring process to {0, 1}, wherein when the Android application is running, the process switch value of the monitoring process is updated to 1, indicating that the monitoring process is turned on, and when the Android application is not running, the process switch value of the monitoring process is updated to 0, indicating that the monitoring process is turned off;

[0014] S12: When the Android application is running, the process switch value of the monitoring process is updated to 1, indicating that the monitoring process is turned on; the monitoring process traverses the process list in the mobile terminal system at the current moment to obtain process information of the running environment state, and the format of each process in the process information is process = {Name, parameter, return, stack, time}, where process represents the process, Name represents the process name, parameter represents the process parameter, return represents the process return value, stack represents the process call stack, and time represents the time when the process is generated;

[0015] In an embodiment of the present invention, the process information includes registration table information and communication process in a mobile terminal system, and the mobile terminal system is a system where the Android application is running;

[0016] S13: The monitoring process collects mobile terminal status information of the mobile terminal system at the current moment, wherein the mobile terminal status information includes CPU usage, memory usage, and network usage of the mobile terminal system;

[0017] S14: Using the collected process information and mobile terminal status information as the operating environment status information of the Android application running at the current moment.

[0018] Optionally, in step S2, a sandbox operating environment inference model is constructed based on a probability graph method, wherein the sandbox operating environment inference model uses operating environment state information as an observed variable and whether the operating environment is a sandbox environment as a hidden variable, including:

[0019] Constructing a sandbox operating environment inference model, wherein the sandbox operating environment inference model uses operating environment status information as an observed variable and whether the operating environment is a sandbox environment as a hidden variable, inputs the operating environment status information into the sandbox operating environment inference model, and the model outputs a probability value that the operating environment is a sandbox environment;

[0020] The sandbox operating environment inference model includes an input layer and a probability calculation layer. The input layer is used to receive the operating environment status information and send the operating environment status information to the probability calculation layer. The probability calculation layer is a probability graph model G=(E, V), where E represents a node in the probability graph model, and the node includes a process node pro, a mobile terminal status information node host, and a sandbox environment judgment node Sandbox. V represents an edge in the probability graph model, and the edge is a directed edge. The directed edge pro→Sandbox represents the probability P (Sandbox|p Sandbox) that the operating environment is a sandbox environment Sandbox when there is a process pro in the mobile terminal system. ro), wherein each process node pro in the probability graph model G includes the process information of the process, and the process node pro is connected to the sandbox environment judgment node Sandbox to form an edge, and each mobile terminal status information node host in the probability graph model G is a numerical representation of any {CPU usage, memory usage, network usage} in the mobile terminal status information, and the numerical representation is {obj: number}, wherein obj∈{CPU usage, memory usage, network usage}, number is the numerical value of the corresponding usage, and the mobile terminal status information node host is connected to the sandbox environment judgment node Sandbox to form an edge;

[0021] For the input sandbox operating environment, the operating environment status information F of the model input layer is inferred:

[0022] F={(pro 1，F , pro 2，F ,...,pro i，F ,...,pro n，F ),(CPU F , Memory F , Net F )}

[0023] in:

[0024] pro i，F is the process information of the i-th process in the running environment status information F, and n represents the total number of processes in the running environment status information F;

[0025] CPU F , Memory F , Net F is the numerical representation of the CPU usage, memory usage and network usage in the operating environment status information F;

[0026] Any of the pro i，F ∈PRO, PRO represents the set of process nodes in the probability computing layer, any CPU F , Memory F, Net F ∈HOST, HOST is the set of mobile terminal status information nodes in the probability calculation layer. The input layer receives the operating environment status information F, parses the operating environment status information F, and converts the process information (pro 1，F , pro 2，F ,...,pro i，F ,...,pro n，F ) and mobile terminal status information (CPU F , Memory F , Net F ) is assigned to the nodes in the probability calculation layer. The probability calculation layer calculates the probability P(Sandbox|F) that the Android application running environment is the sandbox environment Sandbox when the running environment status information of the mobile terminal system is F:

[0027]

[0028] host F =P(Sandbox|CPU F )+P(Sandbox|Memory F )+P(Sandbox|Net F )

[0029] in:

[0030] δ(·) is the sigmoid function;

[0031] b i For pro i，F The bias value of the node in the probability calculation layer, w i For pro i，F The weight of the node in the probability calculation layer, the bias values ​​and weights of different process nodes in the process node set PRO in the probability calculation layer are used as the parameter vector θ=(B, W) to be solved of the model, where B is the bias vector composed of the bias values ​​of different process nodes in the model, and W is the weight vector composed of the weights of different process nodes in the model;

[0032] P(Sandbox|pro i，F ) indicates that in the presence of process pro i，F In the case of , the probability that the operating environment is a sandbox environment;

[0033] P(Sandbox|CPU F ) indicates that the CPU usage is CPU F In the case of , the probability that the operating environment is a sandbox environment;

[0034] P(Sandbox|Memory F ) indicates that the memory usage is Memory F In the case of , the probability that the operating environment is a sandbox environment;

[0035] P(Sandbox|Net F ) indicates that the network utilization rate is Net F In the case of , the probability that the operating environment is a sandbox environment;

[0036] The prior probability P(Sandbox|pro i，F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F ) and the model parameter vector θ are the model parameters to be trained and optimized; compared with the traditional algorithm, this scheme constructs a sandbox operating environment judgment training set for sandbox operating environment judgment based on conditional probability and Bayesian probability, and quickly obtains a usable model based on the prior probability of the training set and the EM iterative algorithm, thereby realizing the probability calculation of whether the program running environment is a sandbox environment.

[0037] Optionally, the step S3 collects the operating environment status information and the corresponding sandbox environment judgment result to form a sandbox operating environment judgment training set, including:

[0038] According to the method in step S1, the operating environment status information is collected, and the corresponding sandbox environment judgment result is manually judged, and the two constitute a sandbox operating environment judgment training set. The format of the sandbox operating environment judgment training set data is:

[0039] data = {data1, data2}

[0040] data1={process j =(pro j , label j )|j∈[1,J]}

[0041] data2={(Info r，k , label r，k )|k∈[1, K], r=1, 2, 3}

[0042] in:

[0043] data1 is the process information data set, data2 is the mobile terminal status information data set;

[0044] label is the sandbox environment judgment result, label = {0, 1}, label j =0 means that the running environment of the jth process in the process information dataset is not a sandbox environment, label j =1 indicates that the running environment of the jth process in the process information dataset is a sandbox environment;

[0045] process j represents the jth process in the process information dataset, pro j represents the process information of the jth process in the process information dataset, and J represents the total number of processes in the process information dataset;

[0046] Info r，k It represents the utilization rate of the kth mobile terminal system in the mobile terminal status information dataset at index r, r = 1, 2, 3, index 1 represents CPU, index 2 represents memory, index 3 represents network, and K represents the total number of mobile terminal systems in the mobile terminal status information dataset.

[0047] Optionally, in the step S3, the improved EM algorithm is used to perform parameter training optimization on the sandbox operating environment inference model based on the training set to obtain the sandbox operating environment inference model after training optimization, including:

[0048] The improved EM algorithm is used to perform parameter training optimization on the sandbox operating environment inference model based on the training set to obtain the sandbox operating environment inference model after training optimization. The parameters to be optimized include the prior probability P (Sandbox|pro i，F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F ) and model parameter vector θ, the parameter training optimization process is:

[0049] S31: The process information and mobile terminal status information in the training set are used as nodes of the probability calculation layer in the sandbox operating environment inference model, and the sandbox environment judgment node Sandbox is set to calculate the prior probability P (Sandbox|pro i，F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F );

[0050] S32: Set the current iteration number of the model parameter vector to in The initial value of The model parameter vector of the iteration is θ

[0051] S33: Construct the objective function Loss for model parameter vector optimization:

[0052]

[0053] in:

[0054] The probability that the jth process in the process information dataset output by the sandbox running environment inference model is in a sandbox environment, The probability that the kth mobile terminal system is a sandbox environment is output by the sandbox operating environment inference model according to the usage rate of the kth mobile terminal system on the indicator r in the mobile terminal status information dataset;

[0055] Randomly generate 20 groups of model parameter vectors, use the generated 20 groups of model parameter vectors as model parameter vectors of a sandbox operating environment inference model, calculate the objective function values ​​of the inference models of different sandbox operating environments, and select the model parameter vector that minimizes the model objective function value as the initial model parameter vector θ 0 ;

[0056] S34: Execute the E-step model parameter vector iteration, and calculate the expectation of the sandbox operating environment inference model based on the sandbox operating environment judgment training set data:

[0057]

[0058] in:

[0059] E(·) represents the expected calculation;

[0060] d represents the indicator data in the sandbox operating environment judgment training set data, and the indicator data includes process information and the usage rate of different indicators in the mobile terminal system;

[0061] label={0, 1}, a label indicating whether the Android application running environment is a sandbox environment. label=0 indicates that the Android application running environment is not a sandbox environment, and label=1 indicates that the Android application running environment is a sandbox environment.

[0062] S35: Execute M-step model parameter vector iteration to solve the problem such that The largest model parameter vector is taken as the The model parameter vector of the iteration

[0063] S36: Determine the Whether the iteration reaches the termination condition, if it reaches the termination condition, then output As the model parameter vector obtained by training optimization, the sandbox operating environment inference model after training optimization is constructed; if the termination condition is not met, let Returning to step S34, the termination condition is:

[0064]

[0065] in:

[0066] T stands for transpose;

[0067] If G<ε, it means that the termination condition is met, where ε is the preset termination threshold, ε>0.

[0068] In an embodiment of the present invention, the traditional EM iterative algorithm cannot guarantee a global optimal solution, that is, the obtained solution will change with different initial values ​​and has the characteristic of "initial sensitivity". In view of this, this scheme introduces an initial value selection method based on the objective function, by constructing an objective function for optimizing the model parameter vector, randomly generating 20 groups of model parameter vectors, and implementing the generated model parameter vectors as a sandbox operating environment inference model, calculating the objective function values ​​of different sandbox operating environment inference models, and selecting the model parameter vector that minimizes the model objective function value as the initial model parameter vector, wherein the model parameter vector with the smallest model objective function value can minimize the inference error of the sandbox operating environment inference model, thereby obtaining a local optimal solution near the initial value based on a better initial value, thereby avoiding the situation where the traditional EM iterative algorithm randomly selects initial values, resulting in unstable training effect of the model parameter vector.

[0069] Optionally, in step S4, the probability of whether the program running environment is a sandbox environment is calculated based on the sandbox running environment inference model after training optimization, and a running environment sandbox probability time series data set is obtained, including:

[0070] The collected operating environment status information is input into the sandbox operating environment inference model after training and optimization, and the probability of whether the program operating environment is a sandbox environment is calculated based on the sandbox operating environment inference model after training and optimization to obtain an operating environment sandbox probability time series data set, wherein the time series range in the operating environment sandbox probability time series data set is the time range of the Android application running, and the representation form of the operating environment sandbox probability time series data set D is:

[0071] D={P(Sandbox|F(t0)), P(Sandbox|F(t1)),..., P(Sandbox|F(t s ))}

[0072] in:

[0073] F(t0) is the running environment status information at time t0, P(Sandbox|F(t0)) represents the probability that the program running environment is a sandbox environment at time t0. The Android application starts running at time t0. s End of run at this moment.

[0074] Optionally, in the step S5, a sandbox environment probability linear extraction model is constructed, and the model is solved to obtain the operating environment linear data. If the operating environment linear data exceeds a specified threshold, it indicates that the operating environment of the current Android program is a sandbox environment, otherwise it is not a sandbox environment, including:

[0075] Construct a sandbox environment probabilistic linear extraction model, the sandbox environment probabilistic linear extraction model is:

[0076] Y=aX+c

[0077] in:

[0078] X is the time series information [t0, ..., t s ], the Android application starts running at time t0 and s End the operation at the moment;

[0079] Y represents the probability information of the sandbox environment, which is the time series information [t0, ..., t s ] is the probability that the program running environment in the sandbox environment, Y = [P(Sandbox|F(t0)), ..., P(Sandbox|F(t s ))];

[0080] a, c are the linear data of the operating environment to be solved;

[0081] The linear data of the operating environment in the constructed sandbox environment probabilistic linear extraction model is solved, and the solution formula is:

[0082]

[0083]

[0084] in:

[0085] x t represents time t, y t represents the probability that the program running environment is a sandbox environment at time t, n t is the time series information [t0, ..., t s ];

[0086] If the solved a is greater than the threshold A, and c is greater than the threshold C, where A and C are both positive numbers, it means that as the running time increases, the probability that the program running environment is a sandbox environment increases, and the probability that the program running environment is a sandbox environment at the initial moment is relatively high. Therefore, the current Android application running environment is a sandbox environment, otherwise it is not.

[0087] In order to solve the above problems, the present invention also provides an Android application sandbox operating environment testing device, characterized in that the device comprises:

[0088] The data collection module is used to detect the operating environment of the program when the Android application is running, obtain the operating environment status information, and build a sandbox operating environment judgment training set;

[0089] A sandbox operating environment inference device is used to construct a sandbox operating environment inference model based on a probability graph method, and use an improved EM algorithm to perform parameter training optimization on the sandbox operating environment inference model based on a training set to obtain a sandbox operating environment inference model after training optimization, and perform real-time calculation of the probability of whether the program operating environment is a sandbox environment based on the sandbox operating environment inference model after training optimization to obtain a sandbox operating environment probability time series data set;

[0090] The sandbox environment judgment device is used to build a sandbox environment probability linear extraction model based on the operating environment sandbox probability time series data set, and solve the model to obtain the operating environment linear data. If the operating environment linear data exceeds the specified threshold, it means that the operating environment of the current Android program is a sandbox environment, otherwise it is not.

[0091] In order to solve the above problem, the present invention further provides an electronic device, the electronic device comprising:

[0092] a memory storing at least one instruction; and

[0093] The processor executes the instructions stored in the memory to implement the above-mentioned Android application sandbox operating environment testing method.

[0094] In order to solve the above problems, the present invention also provides a computer-readable storage medium, in which at least one instruction is stored. The at least one instruction is executed by a processor in an electronic device to implement the above-mentioned Android application sandbox operating environment testing method.

[0095] Compared with the prior art, the present invention proposes a method for testing the sandbox operating environment of an Android application, which has the following advantages:

[0096] First, this scheme improves the traditional EM algorithm, so as to use the improved EM algorithm to perform parameter training optimization on the sandbox operating environment inference model based on the training set, and obtain the sandbox operating environment inference model after training optimization. The parameter training optimization process is as follows: the process information and mobile terminal status information in the training set are used as nodes of the probability calculation layer in the sandbox operating environment inference model, and the sandbox environment judgment node Sandbox is set, and the prior probability P (Sandbox|pro i，F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F ); Set the current iteration number of the model parameter vector to in The initial value of The model parameter vector for the iteration is Construct the objective function Loss for model parameter vector optimization:

[0097]

[0098] in: The probability that the jth process in the process information dataset output by the sandbox running environment inference model is in a sandbox environment, The probability that the kth mobile terminal system is a sandbox environment is outputted by the sandbox operating environment inference model according to the usage rate of the kth mobile terminal system on the indicator r in the mobile terminal status information data set; 20 groups of model parameter vectors are randomly generated, and the generated 20 groups of model parameter vectors are respectively used as model parameter vectors of a sandbox operating environment inference model, and the objective function values ​​of different sandbox operating environment inference models are calculated, and the model parameter vector that minimizes the model objective function value is selected as the initial model parameter vector θ 0 ; Execute the E-step model parameter vector iteration, and calculate the expectation of the sandbox operating environment inference model based on the sandbox operating environment judgment training set data:

[0099]

[0100] Where: E(·) represents the expected calculation; d represents the indicator data in the sandbox operating environment judgment training set data, and the indicator data includes process information and the usage rate of different indicators in the mobile terminal system; label = {0, 1}, which represents the label of whether the Android application operating environment is a sandbox environment, label = 0 means that the Android application operating environment is not a sandbox environment, and label = 1 means that the Android application operating environment is a sandbox environment; perform M-step model parameter vector iteration to solve the problem of The largest model parameter vector is taken as the The model parameter vector of the iteration Judgement Whether the iteration reaches the termination condition, if it reaches the termination condition, then output As the model parameter vector obtained by training optimization, the sandbox operating environment inference model after training optimization is constructed; if the termination condition is not met, let Return to step E, the termination condition is:

[0101]

[0102] Where: T represents transposition; if G < ε, it means that the termination condition is reached, where ε is a preset termination threshold, ε> 0. In the embodiment of the present invention, the traditional EM iterative algorithm cannot guarantee the global optimal solution, that is, the obtained solution will change with different initial values, and has the characteristic of "initial sensitivity". In view of this, this scheme introduces an initial value selection method based on the objective function, by constructing an objective function for optimizing the model parameter vector, randomly generating 20 groups of model parameter vectors, and implementing the generated model parameter vector as a sandbox operating environment inference model, calculating the objective function values ​​of different sandbox operating environment inference models, and selecting the model parameter vector that minimizes the model objective function value as the initial model parameter vector, wherein the model parameter vector with the smallest model objective function value can minimize the inference error of the sandbox operating environment inference model, thereby obtaining a local optimal solution near the initial value based on a better initial value, avoiding the situation that the traditional EM iterative algorithm randomly selects initial values, the number of algorithm iterations is large, and it is easy to cause the unstable training effect of the model parameter vector, thereby improving the stability of the model parameters, and being able to quickly obtain a more stable and better model parameter vector.

[0103] At the same time, this scheme proposes a sandbox environment probability linear extraction model, by inputting the collected operating environment state information into the sandbox operating environment inference model after training and optimization, and calculating the probability of whether the program operating environment is a sandbox environment based on the sandbox operating environment inference model after training and optimization, to obtain an operating environment sandbox probability time series data set, wherein the time series range in the operating environment sandbox probability time series data set is the time range of the Android application running, and the operating environment sandbox probability time series data set D is represented as:

[0104] D={P(Sandbox|F(t0)), P(Sandbox|F(t1)),..., P(Sandbox|F(t s ))}

[0105] Where: F(t0) is the running environment status information at time t0, P(Sandbox|F(t0)) represents the probability that the program running environment at time t0 is a sandbox environment. The Android application starts running at time t0. s At the same time, this solution constructs a sandbox environment probability linear extraction model, which is:

[0106] Y=aX+c

[0107] Where: X is the time series information [t0, ..., t s ], the Android application starts running at time t0 and s The operation ends at the moment; Y represents the probability information of the sandbox environment, which is the probability information of the time series information [t0, ..., t s ] is the probability that the program running environment in the sandbox environment, Y = [P(Sandbox|F(t0)), ..., P(Sandbox|F(t s ))]; a, c are the linear data of the operating environment to be solved; the linear data of the operating environment in the constructed sandbox environment probabilistic linear extraction model is solved, and the solution formula is:

[0108]

[0109]

[0110] Where: x t represents time t, y t represents the probability that the program running environment is a sandbox environment at time t, n t is the time series information [t0, ..., t s ]; if the solved a is greater than the threshold A, c is greater than the threshold C, where A and C are both positive numbers, it means that with the increase of running time, the probability that the program running environment is a sandbox environment is getting bigger and bigger, and the probability that the program running environment is a sandbox environment at the initial moment is relatively large, so the current Android application running environment is a sandbox environment, otherwise it is not, and the Android application running environment recognition and judgment based on time series data and probabilistic graph model is realized. This scheme does not involve the calculation and transformation of feature dimensions, the model calculation complexity is low, and a usable model can be trained quickly to achieve faster running environment judgment. BRIEF DESCRIPTION OF THE DRAWINGS

[0111] Figure 1 A flowchart of a method for testing an Android application sandbox operating environment provided by an embodiment of the present invention;

[0112] Figure 2 A functional module diagram of an Android application sandbox operating environment testing device provided by an embodiment of the present invention;

[0113] Figure 3 A schematic diagram of the structure of an electronic device for implementing a method for testing an Android application sandbox operating environment provided by an embodiment of the present invention.

[0114] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0115] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0116] The embodiment of the present application provides a method for testing the sandbox operating environment of an Android application. The execution subject of the method for testing the sandbox operating environment of an Android application includes but is not limited to at least one of the electronic devices such as a server and a terminal that can be configured to execute the method provided by the embodiment of the present application. In other words, the method for testing the sandbox operating environment of an Android application can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc.

[0117] Embodiment 1:

[0118] S1: When the Android application is running, the running environment of the program is detected to obtain the running environment status information, wherein the running environment status information includes process information and mobile terminal status information.

[0119] In the step S1, the operating environment of the Android application is detected when it is running, and the operating environment status information is obtained, wherein the operating environment status information includes process information and mobile terminal status information, including:

[0120] When the Android application is running, the monitoring process built into the Android application is used to obtain the operating environment status information, wherein the operating environment status information includes process information and mobile terminal status information. The process of obtaining the operating environment status information is as follows:

[0121] S11: Setting the process switch value of the monitoring process to {0, 1}, wherein when the Android application is running, the process switch value of the monitoring process is updated to 1, indicating that the monitoring process is turned on, and when the Android application is not running, the process switch value of the monitoring process is updated to 0, indicating that the monitoring process is turned off;

[0122] S12: When the Android application is running, the process switch value of the monitoring process is updated to 1, indicating that the monitoring process is turned on; the monitoring process traverses the process list in the mobile terminal system at the current moment to obtain process information of the running environment state, and the format of each process in the process information is process = {Name, parameter, return, stack, time}, where process represents the process, Name represents the process name, parameter represents the process parameter, return represents the process return value, stack represents the process call stack, and time represents the time when the process is generated;

[0123] In an embodiment of the present invention, the process information includes registration table information and communication process in a mobile terminal system, and the mobile terminal system is a system in which an Android application is running;

[0124] S13: The monitoring process collects mobile terminal status information of the mobile terminal system at the current moment, wherein the mobile terminal status information includes CPU usage, memory usage, and network usage of the mobile terminal system;

[0125] S14: Using the collected process information and mobile terminal status information as the operating environment status information of the Android application running at the current moment.

[0126] S2: Construct a sandbox operating environment inference model based on the probability graph method, wherein the sandbox operating environment inference model uses the operating environment status information as the observed variable and whether the operating environment is a sandbox environment as the hidden variable, and obtains the probability that the Android application operating environment is a sandbox environment by reversely inferring the hidden variable probability.

[0127] In the step S2, a sandbox operating environment inference model is constructed based on a probability graph method, wherein the sandbox operating environment inference model uses operating environment state information as an observed variable and whether the operating environment is a sandbox environment as a hidden variable, including:

[0128] Constructing a sandbox operating environment inference model, wherein the sandbox operating environment inference model uses operating environment status information as an observed variable and whether the operating environment is a sandbox environment as a hidden variable, inputs the operating environment status information into the sandbox operating environment inference model, and the model outputs a probability value that the operating environment is a sandbox environment;

[0129] The sandbox operating environment inference model includes an input layer and a probability calculation layer. The input layer is used to receive the operating environment status information and send the operating environment status information to the probability calculation layer. The probability calculation layer is a probability graph model G=(E, V), where E represents a node in the probability graph model, and the node includes a process node pro, a mobile terminal status information node host, and a sandbox environment judgment node Sandbox. V represents an edge in the probability graph model, and the edge is a directed edge. The directed edge pro→Sandbox represents the probability P (Sandbox|p Sandbox) that the operating environment is a sandbox environment Sandbox when there is a process pro in the mobile terminal system. ro), wherein each process node pro in the probability graph model G includes the process information of the process, and the process node pro is connected to the sandbox environment judgment node Sandbox to form an edge, and each mobile terminal status information node host in the probability graph model G is a numerical representation of any {CPU usage, memory usage, network usage} in the mobile terminal status information, and the numerical representation is {obj: number}, wherein obj∈{CPU usage, memory usage, network usage}, number is the numerical value of the corresponding usage, and the mobile terminal status information node host is connected to the sandbox environment judgment node Sandbox to form an edge;

[0130] For the input sandbox operating environment, the operating environment status information F of the model input layer is inferred:

[0131] F={(pro 1，F , pro 2，F ,...,pro i，F ,...,pro n，F ),(CPU F , Memory F , Net F )}

[0132] in:

[0133] pro i，F is the process information of the i-th process in the running environment status information F, and n represents the total number of processes in the running environment status information F;

[0134] CPU F , Memory F , Net F is the numerical representation of the CPU usage, memory usage and network usage in the operating environment status information F;

[0135] Any of the pro i，F ∈PRO, PRO represents the set of process nodes in the probability computing layer, any CPU F , Memory F, Net F ∈HOST, HOST is the set of mobile terminal status information nodes in the probability calculation layer. The input layer receives the operating environment status information F, parses the operating environment status information F, and converts the process information (pro 1，F , pro 2，F ,...,pro i，F ,...,pro n，F ) and mobile terminal status information (CPU F , Memory F , Net F ) is assigned to the nodes in the probability calculation layer. The probability calculation layer calculates the probability P(Sandbox|F) that the Android application running environment is the sandbox environment when the running environment status information of the mobile terminal system is F:

[0136]

[0137] host F =P(Sandbox|CPU F )+P(Sandbox|Memory F )+P(Sandbox|Net F )

[0138] in:

[0139] δ(·) is the sigmoid function;

[0140] b i For pro i，F The bias value of the node in the probability calculation layer, w i For pro i，F The weight of the node in the probability calculation layer, the bias values ​​and weights of different process nodes in the process node set PRO in the probability calculation layer are used as the parameter vector θ=(B, W) to be solved of the model, where B is the bias vector composed of the bias values ​​of different process nodes in the model, and W is the weight vector composed of the weights of different process nodes in the model;

[0141] P(Sandbox|pro i，F ) indicates that in the presence of process pro i，F In the case of , the probability that the operating environment is a sandbox environment;

[0142] P(Sandbox|CPU F ) indicates that the CPU usage is CPU F In the case of , the probability that the operating environment is a sandbox environment;

[0143] P(Sandbox|Memory F ) indicates that the memory usage is Memory F In the case of , the probability that the operating environment is a sandbox environment;

[0144] P(Sandbox|Net F ) indicates that the network utilization rate is Net F In the case of , the probability that the operating environment is a sandbox environment;

[0145] The prior probability P(Sandbox|pro i，F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F ) and the model parameter vector θ are the model parameters to be trained and optimized; compared with the traditional algorithm, this scheme constructs a sandbox operating environment judgment training set for sandbox operating environment judgment based on conditional probability and Bayesian probability, and quickly obtains a usable model based on the prior probability of the training set and the EM iterative algorithm, thereby realizing the probability calculation of whether the program running environment is a sandbox environment.

[0146] S3: According to the method in step S1, the operating environment status information and the corresponding sandbox environment judgment results are collected to form a sandbox operating environment judgment training set, and the improved EM algorithm is used to optimize the parameters of the sandbox operating environment inference model based on the training set, thereby shortening the model training time and obtaining the sandbox operating environment inference model after training optimization.

[0147] The step S3 collects the operating environment status information and the corresponding sandbox environment judgment results to form a sandbox operating environment judgment training set, including:

[0148] According to the method in step S1, the operating environment status information is collected, and the corresponding sandbox environment judgment result is manually judged, and the two constitute a sandbox operating environment judgment training set. The format of the sandbox operating environment judgment training set data is:

[0149] data = {data1, data2}

[0150] data1={process j =(pro j , label j )|j∈[1,J]}

[0151] data2={(Info r，k , label r，k )|k∈[1, K], r=1, 2, 3}

[0152] in:

[0153] data1 is the process information data set, data2 is the mobile terminal status information data set;

[0154] label is the sandbox environment judgment result, label = {0, 1}, label j =0 means that the running environment of the jth process in the process information dataset is not a sandbox environment, label j =1 indicates that the running environment of the jth process in the process information dataset is a sandbox environment;

[0155] process j represents the jth process in the process information dataset, pro j represents the process information of the jth process in the process information dataset, and J represents the total number of processes in the process information dataset;

[0156] Info r，k It represents the utilization rate of the kth mobile terminal system in the mobile terminal status information dataset at index r, r = 1, 2, 3, index 1 represents CPU, index 2 represents memory, index 3 represents network, and K represents the total number of mobile terminal systems in the mobile terminal status information dataset.

[0157] In the step S3, the improved EM algorithm is used to perform parameter training optimization on the sandbox operating environment inference model based on the training set to obtain the sandbox operating environment inference model after training optimization, including:

[0158] The improved EM algorithm is used to perform parameter training optimization on the sandbox operating environment inference model based on the training set to obtain the sandbox operating environment inference model after training optimization. The parameters to be optimized include the prior probability P (Sandbox|pro i，F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F ) and model parameter vector θ, the parameter training optimization process is:

[0159] S31: The process information and mobile terminal status information in the training set are used as nodes of the probability calculation layer in the sandbox operating environment inference model, and the sandbox environment judgment node Sandbox is set to calculate the prior probability P (Sandbox|pro i，F )、P(Sandbox|CPU F )、P(Sandbox|Memory F)、P(Sandbox|Net F );

[0160] S32: Set the current iteration number of the model parameter vector to in The initial value of The model parameter vector for the iteration is

[0161] S33: Construct the objective function Loss for model parameter vector optimization:

[0162]

[0163] in:

[0164] The probability that the jth process in the process information dataset output by the sandbox running environment inference model is in a sandbox environment, The probability that the kth mobile terminal system is a sandbox environment is output by the sandbox operating environment inference model according to the usage rate of the kth mobile terminal system on the indicator r in the mobile terminal status information dataset;

[0165] Randomly generate 20 groups of model parameter vectors, use the generated 20 groups of model parameter vectors as model parameter vectors of a sandbox operating environment inference model, calculate the objective function values ​​of the inference models of different sandbox operating environments, and select the model parameter vector that minimizes the model objective function value as the initial model parameter vector θ 0 ;

[0166] S34: Execute the E-step model parameter vector iteration, and calculate the expectation of the sandbox operating environment inference model based on the sandbox operating environment judgment training set data:

[0167]

[0168] in:

[0169] E(·) represents the expected calculation;

[0170] d represents the indicator data in the sandbox operating environment judgment training set data, and the indicator data includes process information and the usage rate of different indicators in the mobile terminal system;

[0171] label={0, 1}, a label indicating whether the Android application running environment is a sandbox environment. label=0 indicates that the Android application running environment is not a sandbox environment, and label=1 indicates that the Android application running environment is a sandbox environment.

[0172] S35: Execute M-step model parameter vector iteration to solve the problem such that The largest model parameter vector is taken as the The model parameter vector of the iteration

[0173] S36: Determine the Whether the iteration reaches the termination condition, if it reaches the termination condition, then output As the model parameter vector obtained by training optimization, the sandbox operating environment inference model after training optimization is constructed; if the termination condition is not met, let Returning to step S34, the termination condition is:

[0174]

[0175] in:

[0176] T stands for transpose;

[0177] If G<ε, it means that the termination condition is met, where ε is the preset termination threshold, ε>0.

[0178] S4: Based on the sandbox operating environment inference model after training and optimization, the probability of whether the program operating environment is a sandbox environment is calculated in real time to obtain a time series data set of the operating environment sandbox probability, wherein the time series range in the operating environment sandbox probability time series data set is the time range for the Android application to run.

[0179] In the step S4, the probability of whether the program running environment is a sandbox environment is calculated based on the sandbox running environment inference model after training and optimization, and a running environment sandbox probability time series data set is obtained, including:

[0180] The collected operating environment status information is input into the sandbox operating environment inference model after training and optimization, and the probability of whether the program operating environment is a sandbox environment is calculated based on the sandbox operating environment inference model after training and optimization to obtain an operating environment sandbox probability time series data set, wherein the time series range in the operating environment sandbox probability time series data set is the time range of the Android application running, and the representation form of the operating environment sandbox probability time series data set D is:

[0181] D={P(Sandbox|F(t0)), P(Sandbox|F(t1)),..., P(Sandbox|F(t s ))}

[0182] in:

[0183] F(t0) is the running environment status information at time t0, P(Sandbox|F(t0)) represents the probability that the program running environment is a sandbox environment at time t0. The Android application starts running at time t0. s End of run at this moment.

[0184] S5: Based on the runtime sandbox probability time series data set, a sandbox environment probability linear extraction model is constructed, and the model is solved to obtain the runtime environment linear data. If the runtime environment linear data exceeds the specified threshold, it means that the runtime environment of the current Android program is a sandbox environment, otherwise it is not a sandbox environment.

[0185] In the step S5, a sandbox environment probability linear extraction model is constructed, and the model is solved to obtain the linear data of the operating environment. If the linear data of the operating environment exceeds a specified threshold, it indicates that the operating environment of the current Android program is a sandbox environment, otherwise it is not a sandbox environment, including:

[0186] Construct a sandbox environment probabilistic linear extraction model, the sandbox environment probabilistic linear extraction model is:

[0187] Y=aX+c

[0188] in:

[0189] X is the time series information [t0, ..., t s ], the Android application starts running at time t0 and s End the operation at the moment;

[0190] Y represents the probability information of the sandbox environment, which is the probability that the program running environment in the time series information [t0, ..., ts] is a sandbox environment, Y = [P(Sandbox|F(t0)), ..., P(Sandbox|F(t s ))];

[0191] a, c are the linear data of the operating environment to be solved;

[0192] The linear data of the operating environment in the constructed sandbox environment probabilistic linear extraction model is solved, and the solution formula is:

[0193]

[0194]

[0195] in:

[0196] x t represents time t, y t represents the probability that the program running environment is a sandbox environment at time t, n t is the time series information [t0, ..., ts ];

[0197] If the solved a is greater than the threshold A, and c is greater than the threshold C, where A and C are both positive numbers, it means that as the running time increases, the probability that the program running environment is a sandbox environment increases, and the probability that the program running environment is a sandbox environment at the initial moment is relatively high. Therefore, the current Android application running environment is a sandbox environment; otherwise, it is not.

[0198] In an embodiment of the present invention, the same Android application is run in 100 different mobile terminal systems, of which the program running environment of 60 mobile terminal systems is a sandbox environment. When the Android application is running, the time series data of the running environment status information of the 100 mobile terminal systems are collected to form an experimental data set. The Android application sandbox running environment test comparison algorithm is set to include a support vector machine method, a DS evidence method and the method proposed by the present invention. The training comparison algorithm is deployed in the same terminal environment, and the training data set is a sandbox running environment judgment training set data. The experimental data sets are input into different comparison algorithms respectively. The sandbox environment detection accuracy of the support vector machine method is 80%, that is, the program running environment of 80% of the 100 different mobile terminal systems is correctly judged. The sandbox environment detection time is 8 seconds, and the model training deployment training time is 2 hours; the sandbox environment detection accuracy of the DS evidence method is 66%, the sandbox environment detection time is 12 seconds, and the model training deployment training time is 35 minutes; the sandbox environment detection accuracy of the method proposed by the present invention is 83%. , the sandbox environment detection time is 8 seconds, and the model training and deployment training time is 37 minutes; compared with the set comparison algorithm, the method proposed in the present invention can achieve the highest sandbox environment detection accuracy, and compared with the support vector machine method, it takes a lot of time to train and deploy the model. The DS evidence method is prone to conflicting evidence when processing the operating environment status information of the mobile terminal system, resulting in a long detection time and low detection accuracy. The method proposed in the present invention uses Bayesian probability and an improved EM iterative algorithm to solve the model parameters, and can quickly deploy and train to obtain a usable model. The operating environment status information is used as the observed variable, and whether the operating environment is a sandbox environment is used as the hidden variable. The probability of the Android application operating environment being a sandbox environment at any time is obtained by reversely inferring the hidden variable probability. The linear data of the operating environment of the Android application running in the mobile terminal system is extracted based on the operating environment sandbox probability time series data set. If the linear data of the operating environment exceeds the threshold, the operating environment of the Android application is judged to be a sandbox environment, thereby improving the sandbox operating environment detection accuracy and detection speed.

[0199] Embodiment 2:

[0200] like Figure 2, which is a functional module diagram of an Android application sandbox operating environment testing device provided by an embodiment of the present invention, which can implement the Android application sandbox operating environment testing method in Example 1.

[0201] The Android application sandbox operating environment testing device 100 of the present invention can be installed in an electronic device. According to the functions to be implemented, the Android application sandbox operating environment testing device can include a data acquisition module 101, a sandbox operating environment inference device 102, and a sandbox environment judgment device 103. The module of the present invention can also be called a unit, which refers to a series of computer program segments that can be executed by an electronic device processor and can complete fixed functions, which are stored in the memory of the electronic device.

[0202] The data collection module 101 is used to detect the operating environment of the program when the Android application is running, obtain the operating environment status information, and build a sandbox operating environment judgment training set;

[0203] The sandbox operating environment inference device 102 is used to construct a sandbox operating environment inference model based on a probability graph method, use an improved EM algorithm to perform parameter training optimization on the sandbox operating environment inference model based on a training set, obtain the sandbox operating environment inference model after training optimization, and perform real-time calculation of the probability of whether the program operating environment is a sandbox environment based on the sandbox operating environment inference model after training optimization to obtain a sandbox operating environment probability time series data set;

[0204] The sandbox environment judgment device 103 is used to construct a sandbox environment probability linear extraction model based on the operating environment sandbox probability time series data set, and solve the model to obtain the operating environment linear data. If the operating environment linear data exceeds the specified threshold, it means that the operating environment of the current Android program is a sandbox environment, otherwise it is not.

[0205] In detail, each module in the Android application sandbox operating environment testing device 100 in the embodiment of the present invention is used in the same manner as described above. Figure 1 The technical means are the same as the Android application sandbox operating environment testing method described in, and can produce the same technical effects, so I will not go into details here.

[0206] Embodiment 3:

[0207] like Figure 3 , is a schematic diagram of the structure of an electronic device for implementing a method for testing an Android application sandbox operating environment provided by an embodiment of the present invention.

[0208] The electronic device 1 may include a processor 10 , a memory 11 and a bus, and may also include a computer program stored in the memory 11 and executable on the processor 10 , such as an Android application sandbox operating environment test program 12 .

[0209] Among them, the memory 11 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example: SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of the electronic device 1, such as a mobile hard disk of the electronic device 1. In other embodiments, the memory 11 can also be an external storage device of the electronic device 1, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 1. Further, the memory 11 can also include both an internal storage unit of the electronic device 1 and an external storage device. The memory 11 can not only be used to store application software and various types of data installed in the electronic device 1, such as the code of the Android application sandbox operating environment test program 12, but also can be used to temporarily store data that has been output or is to be output.

[0210] The processor 10 may be composed of an integrated circuit in some embodiments, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips, etc. The processor 10 is the control core (Control Unit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes or executes programs or modules (such as Android application sandbox operating environment test programs) stored in the memory 11, and calls data stored in the memory 11 to execute various functions of the electronic device 1 and process data.

[0211] The bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is configured to realize connection and communication between the memory 11 and at least one processor 10, etc.

[0212] Figure 3 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 3 The structure shown does not constitute a limitation on the electronic device 1, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0213] For example, although not shown, the electronic device 1 may also include a power source (such as a battery) for supplying power to each component. Preferably, the power source may be logically connected to the at least one processor 10 through a power management device, so that the power management device can realize functions such as charging management, discharging management, and power consumption management. The power source may also include any components such as one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, etc. The electronic device 1 may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0214] Furthermore, the electronic device 1 may also include a network interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device 1 and other electronic devices.

[0215] Optionally, the electronic device 1 may further include a user interface, which may be a display, an input unit (such as a keyboard), or a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode) touch device. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device 1 and to display a visual user interface.

[0216] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0217] The Android application sandbox operating environment test program 12 stored in the memory 11 in the electronic device 1 is a combination of multiple instructions. When running in the processor 10, it can achieve:

[0218] Detect the running environment of the program when the Android application is running and obtain the running environment status information;

[0219] Construct a sandbox operating environment inference model based on the probabilistic graph method;

[0220] Collect the operating environment status information and the corresponding sandbox environment judgment results to form a sandbox operating environment judgment training set, use the improved EM algorithm to perform parameter training optimization on the sandbox operating environment inference model based on the training set, and obtain the sandbox operating environment inference model after training optimization;

[0221] Based on the sandbox operating environment inference model after training and optimization, the probability of whether the program operating environment is a sandbox environment is calculated in real time to obtain a time series data set of the operating environment sandbox probability;

[0222] Based on the runtime sandbox probability time series data set, a sandbox environment probability linear extraction model is constructed, and the model is solved to obtain the runtime environment linear data. If the runtime environment linear data exceeds the specified threshold, it means that the runtime environment of the current Android program is a sandbox environment, otherwise it is not a sandbox environment.

[0223] Specifically, the specific implementation method of the processor 10 for the above instructions can refer to Figures 1 to 3 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0224] It should be noted that the serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. And the terms "including", "comprising" or any other variants thereof in this article are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "including a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0225] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0226] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for testing an Android application sandbox operating environment, characterized in that: The method comprises: S1: Detecting the running environment of the program when the Android application is running, and obtaining running environment status information, wherein the running environment status information includes process information and host status information; S2: constructing a sandbox operating environment inference model based on a probability graph method, wherein the sandbox operating environment inference model uses operating environment status information as an observed variable and whether the operating environment is a sandbox environment as a hidden variable, and obtains the probability that the Android application operating environment is a sandbox environment by reversely inferring the hidden variable probability; Constructing a sandbox operating environment inference model, wherein the sandbox operating environment inference model uses operating environment status information as an observed variable and whether the operating environment is a sandbox environment as a hidden variable, inputs the operating environment status information into the sandbox operating environment inference model, and the model outputs a probability value that the operating environment is a sandbox environment; The sandbox operating environment inference model includes an input layer and a probability calculation layer. The input layer is used to receive the operating environment status information and send the operating environment status information to the probability calculation layer. The probability calculation layer is a probability graph model G=(E, V), where E represents a node in the probability graph model, and the node includes a process node pro, a host status information node host, and a sandbox environment judgment node Sandbox. V represents an edge in the probability graph model, and the edge is a directed edge. The directed edge pro→Sandbox represents the probability P(Sandbox|Sandbox) that the operating environment is a sandbox environment Sandbox when the process pro exists in the host system. pro), wherein each process node pro in the probability graph model G includes the process information of the process, and the process node pro is connected to the sandbox environment judgment node Sandbox to form an edge, and each host status information node host in the probability graph model G is a numerical representation of any {CPU usage, memory usage, network usage} in the host status information, and the numerical representation is {obj: number}, wherein obj∈{CPU usage, memory usage, network usage}, number is the numerical value of the corresponding usage, and the host status information node host is connected to the sandbox environment judgment node Sandbox to form an edge; For the input sandbox operating environment, the operating environment status information F of the model input layer is inferred: F={(pro 1,F ,pro 2,F ,...,pro i,F ,...,pro n,F ),(CPU F ,Memory F ,Net F )} in: pro i，F is the process information of the i-th process in the running environment status information F, and n represents the total number of processes in the running environment status information F; CPU F , Memory F , Net F is the numerical representation of the CPU usage, memory usage and network usage in the operating environment status information F; Any of the pro i，F ∈PRO, PRO represents the set of process nodes in the probability computing layer, any CPU F , Memory F , Net F ∈HOST, HOST is the set of host state information nodes in the probability calculation layer. The input layer receives the running environment state information F, parses the running environment state information F, and converts the process information (pro 1，F , pro 2，F ,...,pro i，F ,...,pro n,F ) and host status information (CPU F , Memory F , Net F ) is distributed to the nodes in the probability calculation layer. When the probability calculation layer calculates the operating environment status information of the host system as F, the probability P(Sandbox|F) that the operating environment is the sandbox environment Sandbox: host F =P(Sandbox|CPU F )+P(Sandbox|Memory F )+P(Sandbox|Net F ) in: δ(·) is the sigmoid function; b i For pro i，F The bias value of the node in the probability calculation layer, w i For pro i，F The weight of the node in the probability calculation layer, the bias values ​​and weights of different process nodes in the process node set PRO in the probability calculation layer are used as the parameter vector θ=(B, W) to be solved of the model, where B is the bias vector composed of the bias values ​​of different process nodes in the model, and W is the weight vector composed of the weights of different process nodes in the model; P(Sandbox|pro i,F ) indicates that in the presence of process pro i，F In the case of , the prior probability that the operating environment is the sandbox environment; P(Sandbox|CPU F ) indicates that the CPU usage is CPU F In the case of , the prior probability that the operating environment is the sandbox environment; P(Sandbox|Memory F ) indicates that the memory usage is Memory F In the case of , the prior probability that the operating environment is the sandbox environment; P(Sandbox|Net F ) indicates that the network utilization rate is Net F In the case of , the prior probability that the operating environment is the sandbox environment; The prior probability P(Sandbox|pro i,F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F ) and the model parameter vector θ are the model parameters to be trained and optimized; S3: According to the method in step S1, the operating environment status information and the corresponding sandbox environment judgment results are collected to form a sandbox operating environment judgment training set, and the improved EM algorithm is used to perform parameter training optimization on the sandbox operating environment inference model based on the training set to obtain the sandbox operating environment inference model after training optimization, wherein the improved EM algorithm process includes: The improved EM algorithm is used to perform parameter training optimization on the sandbox operating environment inference model based on the training set to obtain the sandbox operating environment inference model after training optimization. The parameters to be optimized include the prior probability P (Sandbox|pro i，F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F ) and the model parameter vector θ, the parameter training optimization process is: S31: The process information and host status information in the training set are used as nodes in the probability calculation layer of the sandbox operating environment inference model, and the sandbox environment judgment node Sandbox is set to calculate the prior probability P (Sandbox|pro i,F )、P(Sandbox|CPU F )、P(Sandbox|Memory F )、P(Sandbox|Net F ); S32: Set the current iteration number of the model parameter vector to in The initial value of The model parameter vector for the iteration is S33: Construct the objective function Loss for model parameter vector optimization: in: label j =0 means that the running environment of the jth process in the process information data set is not a sandbox environment; label j =1 indicates that the running environment of the jth process in the process information dataset is a sandbox environment; J represents the total number of processes in the process information dataset; K represents the total number of host systems in the host status information dataset; The probability that the jth process in the process information dataset output by the sandbox running environment inference model is in a sandbox environment, The sandbox running environment inference model outputs the probability that the kth host system is a sandbox environment based on the usage rate of the kth host system on the indicator r in the host status information dataset; Randomly generate 20 groups of model parameter vectors, use the generated 20 groups of model parameter vectors as model parameter vectors of a sandbox operating environment inference model, calculate the objective function values ​​of the inference models of different sandbox operating environments, and select the model parameter vector that minimizes the model objective function value as the initial model parameter vector θ 0 ; S34: Execute the E-step model parameter vector iteration, and calculate the expectation of the sandbox operating environment inference model based on the sandbox operating environment judgment training set data: in: E(·) represents the expected calculation; d represents the indicator data in the sandbox operating environment judgment training set data, and the indicator data includes process information and usage rates of different indicators of the host; label={0, 1}, a label indicating whether the Android application running environment is a sandbox environment. label=0 indicates that the Android application running environment is not a sandbox environment, and label=1 indicates that the Android application running environment is a sandbox environment. S35: Execute M-step model parameter vector iteration to solve the problem such that The largest model parameter vector is taken as the The model parameter vector of the iteration S36: Determine the Whether the iteration reaches the termination condition, if it reaches the termination condition, then output As the model parameter vector obtained by training optimization, the sandbox operating environment inference model after training optimization is constructed; if the termination condition is not met, let Returning to step S34, the termination condition is: in: T stands for transpose; If G<ε, it means that the termination condition is met, where ε is the preset termination threshold, ε>0; S4: Based on the sandbox operating environment inference model after training optimization, the probability of whether the program operating environment is a sandbox environment is calculated in real time to obtain an operating environment sandbox probability time series data set, wherein the time series range in the operating environment sandbox probability time series data set is the time range of the Android application running; S5: Based on the runtime sandbox probability time series data set, a sandbox environment probability linear extraction model is constructed, and the model is solved to obtain the runtime environment linear data. If the runtime environment linear data exceeds the specified threshold, it means that the runtime environment of the current Android program is a sandbox environment, otherwise it is not a sandbox environment.

2. A method for testing an Android application sandbox operating environment as claimed in claim 1, characterized in that: In the step S1, the operating environment of the Android application is detected when it is running, and the operating environment status information is obtained, wherein the operating environment status information includes process information and host status information, including: When the Android application is running, the monitoring process built into the Android application is used to obtain the operating environment status information, wherein the operating environment status information includes process information and host status information. The process of obtaining the operating environment status information is as follows: S11: Setting the process switch value of the monitoring process to {0, 1}, wherein when the Android application is running, the process switch value of the monitoring process is updated to 1, indicating that the monitoring process is turned on, and when the Android application is not running, the process switch value of the monitoring process is updated to 0, indicating that the monitoring process is turned off; S12: When the Android application is running, the process switch value of the monitoring process is updated to 1, indicating that the monitoring process is turned on; the monitoring process traverses the process list in the host system at the current moment to obtain process information of the running environment state, and the format of each process in the process information is process = {Name, parameter, return, stack, time}, where process represents the process, Name represents the process name, parameter represents the process parameter, return represents the process return value, stack represents the process call stack, and time represents the time when the process is generated; S13: The monitoring process collects host status information of the host system at the current moment, wherein the host status information includes CPU usage, memory usage, and network usage of the host system; S14: Using the collected process information and host status information as the running environment status information of the Android application at the current moment.

3. The method for testing an Android application sandbox operating environment as claimed in claim 1, characterized in that: The step S3 collects the operating environment status information and the corresponding sandbox environment judgment results to form a sandbox operating environment judgment training set, including: According to the method in step S1, the operating environment status information is collected, and the corresponding sandbox environment judgment result is manually judged, and the two constitute a sandbox operating environment judgment training set. The format of the sandbox operating environment judgment training set data is: data = {data1, data2} data1={process j =(pro j ,label j )|j∈[1,J]} data2={(Info r,k ,label r，k )|k∈[1,K],r=1,2,3} in: data1 is the process information data set, data2 is the host status information data set; label is the sandbox environment judgment result, label = {0, 1}, label j =0 means that the running environment of the jth process in the process information dataset is not a sandbox environment, label j =1 indicates that the running environment of the jth process in the process information dataset is a sandbox environment; process j represents the jth process in the process information dataset, pro j represents the process information of the jth process in the process information dataset, and J represents the total number of processes in the process information dataset; Info r，k It represents the utilization rate of the kth host system in the host status information dataset at index r, r = 1, 2, 3, index 1 represents the CPU, index 2 represents the memory, index 3 represents the network, and K represents the total number of host systems in the host status information dataset.

4. The method for testing an Android application sandbox operating environment as claimed in claim 1, characterized in that: In the step S4, the probability of whether the program running environment is a sandbox environment is calculated based on the sandbox running environment inference model after training and optimization, and a running environment sandbox probability time series data set is obtained, including: The collected operating environment status information is input into the sandbox operating environment inference model after training and optimization, and the probability of whether the program operating environment is a sandbox environment is calculated based on the sandbox operating environment inference model after training and optimization to obtain an operating environment sandbox probability time series data set, wherein the time series range in the operating environment sandbox probability time series data set is the time range of the Android application running, and the representation form of the operating environment sandbox probability time series data set D is: D={P(Sandbox|F(t0)),P(Sandbox|F(t1)),...,P(Sandbox|F(t s ))} in: F(t0) is the running environment status information at time t0, P(Sandbox|F(t0)) represents the probability that the program running environment is a sandbox environment at time t0. The Android application starts running at time t0. s End of run at this moment.

5. The method for testing an Android application sandbox operating environment as claimed in claim 1, characterized in that: In the step S5, a sandbox environment probability linear extraction model is constructed, and the model is solved to obtain the linear data of the operating environment. If the linear data of the operating environment exceeds a specified threshold, it indicates that the operating environment of the current Android program is a sandbox environment, otherwise it is not a sandbox environment, including: Construct a sandbox environment probabilistic linear extraction model, the sandbox environment probabilistic linear extraction model is: Y=aX+c in: X is the time series information [t0, ..., t s ], the Android application starts running at time t0 and s End the operation at the moment; Y represents the probability information of the sandbox environment, which is the time series information [t0, ..., t s ] is the probability that the program running environment in the sandbox environment, Y = [P(Sandbox|F(t0)), ..., P(Sandbox|F(t s ))]; a, c are the linear data of the operating environment to be solved; The linear data of the operating environment in the constructed sandbox environment probabilistic linear extraction model is solved, and the solution formula is: in: x t represents time t, y t represents the probability that the program running environment is a sandbox environment at time t, and nt is the time sequence information [t0, ..., t s ]; If the solved a is greater than the threshold A, and c is greater than the threshold C, where A and C are both positive numbers, it means that as the running time increases, the probability that the program running environment is a sandbox environment increases, so the current Android application running environment is a sandbox environment; otherwise, it is not.

Images