A method for identifying abnormal APKs, an electronic device, and a readable storage medium.

Abstract

This invention discloses a method, electronic device, and readable storage medium for identifying abnormal APKs. The method includes the following steps: obtaining a target APK list; obtaining a first target word list and a second target word list based on the decompiled files of the APKs in the target APK list; obtaining a target word list based on the first and second target word lists and storing it in a sample database; inputting any target word from the target word list into a third model to obtain an expanded word vector, which is then stored in the sample database; and determining whether the APK to be tested is an abnormal APK based on the sample database. The technical solution of this invention ensures that the data in the sample database is sufficient and complete, which is beneficial to improving the accuracy of identifying abnormal APKs, and also optimizes the data in the database.

Description

Technical Field

[0001] This invention relates to the field of APK identification technology, and in particular to a method, electronic device, and readable storage medium for identifying abnormal APKs. Background Technology

[0002] Currently, there are many types of Android installation packages (APKs) on the Android platform. Among them, abnormal APK types can have negative effects on users, such as leaking user information or inserting abnormal plugins.

[0003] In existing technologies, the number of abnormal APKs installed on devices is limited. This is partly because APKs are encrypted and cannot be identified, and partly because abnormal APKs are constantly updated, making it impossible for the database to identify updated APKs. This negatively impacts user experience and affects user security. Summary of the Invention

[0004] To address the problems of existing technologies, this invention calculates the TF and TextRank values ​​corresponding to keywords in the text after decompiling any APK, and then selects target words based on these TF and TextRank values ​​to expand a number of related words. These related words and target words are stored in a sample database, ensuring sufficient and complete data in the database, which helps improve the accuracy of identifying abnormal APKs and also optimizes the data in this database. This invention provides a method, electronic device, and readable storage medium for identifying abnormal APKs. The technical solution is as follows:

[0005] On one hand, a method for identifying abnormal APKs, the method comprising the following steps:

[0006] S101. Obtain the target APK list A = (A1, A2, A3, ..., A... m ), where A i This refers to the i-th target APK, where m is the number of target APKs;

[0007] S103, According to A i The corresponding target text D i A was obtained i The corresponding target keyword list (A) i1 A i2 A i3 , ..., A iz ), A ir This refers to the r-th target keyword, where r = 1...z, and z is the number of keywords;

[0008] S105, according to D iThis yields the first target list B = (B1, B2, B3, ..., B...). λ ) and second target list Among them, B x This refers to the x-th first target word, where x = 1...λ, and λ is the number of first target words. This refers to the y-th second target word, where y = 1...γ, and γ is the number of second target words;

[0009] S107, according to B and The sample word list C = (C1, C2, C3, ..., C...) is obtained. n ) Stored in the sample word database, where C j This refers to the keyword of the j-th sample, where j = 1...n, and n is the number of sample keywords;

[0010] S109, Place any C j Inputting into the third model yields C j The corresponding word vector (C) j1 C j2 C j3 , ..., C jk And store it in the sample database, wherein C jt It refers to C j The corresponding t-th target related word, t = 1...k, where k is the number of target related words;

[0011] S1011. Based on the sample database, determine whether the APK to be tested is an abnormal APK.

[0012] On the other hand, an electronic device includes a processor and a memory, the memory storing at least one instruction or at least one program segment, the at least one instruction or the at least one program segment being loaded and executed by the processor to implement the method for identifying abnormal APKs as described in any of the preceding claims.

[0013] On the other hand, a computer-readable storage medium stores at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the method for identifying abnormal APKs as described in any of the preceding claims.

[0014] The present invention provides a method, electronic device, and readable storage medium for identifying abnormal APKs, which have the following technical effects:

[0015] This invention obtains a list of target APKs, and based on the decompiled files of the APKs in the target APK list, obtains a first target word list and a second target word list. Based on the first target keyword list and the second target word list, a target word list is obtained and stored in a sample database. Any target word from the target word list is input into a third model to obtain an expanded word vector, which is then stored in the sample database. Based on the sample database, it is determined whether the APK to be tested is an abnormal APK. Therefore, the technical solution of this invention ensures that the data in the sample database is sufficient and complete, which is beneficial to improving the accuracy of identifying abnormal APKs, and also optimizes the data in this database. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating a method for identifying abnormal APKs provided in an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0020] like Figure 1 As shown, this embodiment provides a method for identifying abnormal APKs, the method including the following steps:

[0021] S101. Obtain the target APK list A = (A1, A2, A3, ..., A... m ), where A i This refers to the i-th target APK, where m is the number of target APKs.

[0022] Specifically, the target APK is an APK with anomaly identifiers, wherein A1 to A... m Having the same anomaly identifier, it is possible to calculate keywords in APKs of the same type, and then expand the sample database through keywords, which is beneficial for determining the type of APK to be tested.

[0023] S103, According to A i The corresponding target text D i A was obtained i The corresponding target keyword list (A) i1 A i2 A i3 , ..., A iz ), A ir This refers to the r-th keyword, and z is the number of keywords.

[0024] In one specific embodiment, the method further includes determining D using the following method. i :

[0025] A i The code is decompiled to obtain a target code package, which includes several target files, each of which is a number of lines of editable code.

[0026] The Chinese text extracted from any line of edited code is used as the target statement. A separator is inserted between target statements in adjacent lines, and the same separator is inserted between adjacent target files, resulting in D. i .

[0027] Specifically, the target statement includes one or more combinations of single characters, single phrases, and a paragraph; this facilitates word segmentation, avoids incorrect or missed word segmentation, simplifies the calculation of TF and TextRank values, and also improves the accuracy of TF and TextRank value calculation.

[0028] Preferably, the separator can be any stop word in the stop word library, such as " / " or "\", for example, login / packaging / ... / involving, etc.

[0029] Specifically, those skilled in the art can use any decompilation software to perform the decompilation process, and the decompilation process will not be described in detail here.

[0030] S105, according to D iThis yields the first target list B = (B1, B2, B3, ..., B...). λ ) and second target list Among them, B x This refers to the x-th first target word, where x = 1...λ, and λ is the number of first target words. It refers to the y-th second target word, where y = 1...γ, and γ is the number of second target words.

[0031] Step S105 further includes the following steps:

[0032] D i After performing word segmentation and deduplication, the first keyword list T = (T1, T2, T3, ..., T...) is obtained. p The list of TF values ​​corresponding to T is S = (S1, S2, S3, ..., S...). p ), T α It refers to the αth first keyword and S α It refers to T α The corresponding TF values ​​are α = 1...p, where p is the number of first keywords, and S1 ≥ S2 ≥ S3 ≥ ... ≥ S p ;

[0033] Initialize B = null and iterate through S;

[0034] When α ≤ preset sequence number threshold, T α Insert into B.

[0035] Specifically, the first keyword refers to the D i The target sentence in the text is segmented using the first word segmentation method and deduplicated to obtain keywords. The first word segmentation method refers to traversing D... i The method of segmenting the target sentence using stop words in the stop word library as intervals is known to those skilled in the art. Any segmentation method and deduplication method can obtain the first keyword, so it will not be elaborated here.

[0036] In a specific embodiment, when α ≤ a preset sequence number threshold and S α =S α+1 =S α+ 2 = ...S α+r >S α+r+1 When, transfer the first keyword corresponding to T1 to T α+r The corresponding first keyword is inserted into B; this avoids missing keywords and ensures that enough related words can be expanded based on the keywords and stored in the sample word database, which is beneficial for identifying abnormal APKs.

[0037] Specifically, λ = α or α + r, r = 1...p-1.

[0038] At the same time, the same D i Perform word segmentation and deduplication to obtain a list of second keywords. and List of corresponding textrank values This refers to the second keyword of the β term and It means The corresponding TextRank values, β = 1...q, where q is the number of second keywords,

[0039] S205, Initialization And traversal

[0040] S206. When β ≤ the specified sequence number threshold, Insert to

[0041] Specifically, the second keyword refers to the analysis of D. i The target sentence in the text is segmented using the second word segmentation method and deduplicated to obtain keywords. The second word segmentation method is the same as or different from the first word segmentation method. The second word segmentation method refers to traversing D... i The method of segmenting the target sentence using stop words from other stop word libraries as intervals is known to those skilled in the art. Any segmentation method and deduplication method can be used to obtain the first keyword, so it will not be elaborated here.

[0042] In one specific embodiment, when β ≤ a preset sequence number threshold and At that time, The corresponding second keyword to The corresponding second keywords are all inserted into It can avoid missing keywords and ensure that enough related words can be expanded based on keywords and stored in the sample word database, which is helpful for identifying abnormal APKs.

[0043] Specifically, γ = β or β + h, h = 1...q-1.

[0044] S107, according to B and The sample keyword list C = (C1, C2, C3, ..., C...) is obtained. n ) Stored in the sample word database, where C j This refers to the j-th sample keyword, where j = 1...n, and n is the number of sample keywords;

[0045] Specifically, the method further includes determining C using the following method:

[0046] Initialize C = null and iterate through B and

[0047] when When Bx is inserted into C, a keyword list can be obtained through TF-IDF and textrank values. The intersection of the two keyword lists is selected, which improves the accuracy of word selection and reduces interference from other words, thus ensuring the accuracy of identifying abnormal APKs.

[0048] S109, Place any C j Inputting into the LDA model yields C j The corresponding word vector (C) j1 C j2 C j3 , ..., C jk And store it in the sample database, where C jt It refers to C j The corresponding t-th target related word, t=1……k, where k is the number of target related words.

[0049] Specifically, the target related words refer to words that have the same or similar meaning as the sample keywords.

[0050] The above-mentioned two methods of selecting target words can ensure the accuracy of target word expansion. At the same time, expanding the target words to obtain word vectors increases the amount of data in the sample database and the accuracy of identifying abnormal APKs.

[0051] S1011. Based on the sample database, determine whether the APK to be tested is an abnormal APK.

[0052] Specifically, step S1011 further includes the following steps:

[0053] Obtain the text corresponding to the APK to be tested, the text including several keywords to be tested;

[0054] Traverse the sample database to obtain the outliers corresponding to the APK to be tested;

[0055] When the outlier value is greater than or equal to the preset similarity threshold, the APK to be tested is determined to be an abnormal APK.

[0056] Specifically, the method for determining whether the text corresponding to the APK to be tested is the same as the text corresponding to the target APK is not described in detail here.

[0057] Specifically, those skilled in the art can use any method to obtain outlier values ​​to determine whether the APK under test is an abnormal APK, which will not be elaborated here.

[0058] This embodiment provides a method for identifying abnormal APKs. On the one hand, it ensures that the data in the sample database is sufficient and complete, which helps to improve the accuracy of identifying abnormal APKs. On the other hand, it avoids omitting target words and expands based on target words, thereby optimizing the data in the sample database.

[0059] Embodiments of the present invention also provide an electronic device, including a processor and a memory, wherein the memory stores at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the method for identifying abnormal APKs as described above.

[0060] The computer device of this invention exists in various forms, including but not limited to:

[0061] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., tPhone), multimedia phones, feature phones, and low-end phones, etc.

[0062] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MtDs, and UMPCs, such as the tPad.

[0063] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players (such as tPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0064] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0065] (5) Other electronic devices with data interaction functions.

[0066] Embodiments of the present invention also provide a computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to implementing a method for identifying abnormal APKs in the method embodiments, wherein the at least one instruction or the at least one program is loaded and executed by the processor to implement the method for identifying abnormal APKs provided in the above method embodiments.

[0067] Optionally, in this embodiment, the storage medium may be located at at least one of the multiple network servers in a computer network. Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0068] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method of identifying an abnormal APK, the method comprising: The method comprises the following steps: S101、Obtain a target APK list A = (A1, A2, A3, …, Am) m ), wherein A i represents the ith target APK, and m represents the number of target APKs. S103, According to A i The corresponding target text D i A was obtained i The corresponding target keyword list (A) i1 A i2 A i3 , ..., A iz A ir This refers to the r-th keyword, where r = 1...z, and z is the number of keywords; S105、According to D i , obtain the first target list B= (B1, B2, B3, …, B λ ) and the second target list `B= (B1, B2, B3, …, B γ ), wherein B x represents the xth first target word, x=1……λ, λ is the number of first target words, and `B y represents the yth second target word, y=1……γ, γ is the number of second target words; S107. Based on B and `B, obtain the sample word list C = (C1, C2, C3, ..., C...). n ) stored in the sample word database, where C j This refers to the keyword of the j-th sample, where j=1……n, and n is the number of sample keywords; the method further includes determining C as follows: Initializing C=Null and traversing B and `B; When B x = B y , B x is inserted into C; S109、the any C j input to the third model, to obtain C j corresponding word vector (C j1 , C j2 , C j3 , …, C jk ) and stored to the sample database, wherein C jt refers to C j corresponding to the tth target associated word, t=1 … k, k is the number of target associated words; S1011, determining whether the APK to be tested is an abnormal APK based on the sample database; wherein the method further comprises the following method for determining an abnormal APK: Obtaining the text corresponding to the APK to be tested, wherein the text comprises a plurality of keywords to be tested; Traversing the sample database to obtain the abnormal value corresponding to the APK to be tested; When the abnormal value is greater than or equal to a preset similarity threshold, it is determined that the APK to be tested is an abnormal APK.

2. The method of claim 1, wherein, The target APK is an APK with an abnormal identifier.

3. The method of identifying an abnormal APK according to claim 2, wherein, A1... A m have the same exception identification.

4. The method of claim 1, wherein, The method further comprises determining D i : A i The decompilation processing is performed to obtain a target code package, wherein the target code package includes a plurality of target files, and the target files are a plurality of lines of edited codes. The Chinese corpus of the edited code of any row is taken as a target sentence, and a separator is inserted between the adjacent target sentences and the same separator is inserted between the adjacent target files, to obtain D i .

5. The method of identifying an abnormal APK according to claim 4, wherein, The target sentence comprises one or more combinations of a single word, a single phrase, and a paragraph of sentences.

6. The method of identifying an abnormal APK according to claim 4, wherein, The separator can be any stop word in the stop word library.

7. An electronic device, comprising: The processor and the memory, the memory has at least one instruction or at least one program, the at least one instruction or the at least one program is loaded and executed by the processor to realize the method for identifying abnormal APK as claimed in any one of claims 1-6.

8. A computer readable storage medium, the computer readable storage medium has at least one instruction or at least one program, the at least one instruction or the at least one program is loaded and executed by the processor to realize the method for identifying abnormal APK as claimed in any one of claims 1-6.

Images