Detection method, device and equipment applied to application software and storage medium

Abstract

The disclosure provides a detection method and device applied to application software, equipment and a storage medium, which can be applied to the technical field of information security. The method comprises the following steps: generating a target class dependency graph corresponding to the target application software according to the relationship between multiple classes in the target application software; dividing the target class dependency graph into M target class dependency subgraphs, wherein M is greater than or equal to 1; determining M characteristic information according to the M target class dependency subgraphs; searching each characteristic information in the target database to obtain M search results matched with the M characteristic information; and determining the detection result of the target application software according to the M search results.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and more specifically to a detection method, apparatus, device, and storage medium for application software. Background Technology

[0002] With the development of computer technology, the types and functions of application software have also developed rapidly, and various application software may have various security risks.

[0003] In related technologies, the entire application software is typically inspected to determine if it is abnormal. However, since abnormal code constitutes only a small portion of the application's code, the overall behavior of the application can mask the characteristics of the abnormal code, thus affecting the anomaly detection results. Therefore, these technologies suffer from low accuracy in application software detection. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a detection method, apparatus, device and storage medium for application software.

[0005] According to a first aspect of this disclosure, a detection method for application software is provided, comprising:

[0006] Based on the relationships between multiple classes in the target application software, generate a target class dependency graph corresponding to the aforementioned target application software;

[0007] The above target class dependency graph is divided into regions to obtain M target class dependency subgraphs, where M is greater than or equal to 1;

[0008] Based on the above M target class dependency subgraphs, determine M feature information;

[0009] For each of the M features mentioned above, a search is performed in the target database to obtain M search results that match the M features; and

[0010] Based on the above M search results, the detection results of the target application software are determined.

[0011] According to embodiments of this disclosure, determining M feature information based on the M target class dependency subgraphs includes:

[0012] For the m-th target class dependency subgraph among the M target class dependency subgraphs mentioned above, the m-th target class dependency subgraph includes N classes, where N is greater than or equal to 1, m is greater than or equal to 1, and m is less than or equal to M:

[0013] Generate N sub-feature information corresponding to the above N classes; and

[0014] Based on the above N sub-feature information, generate the m-th feature information corresponding to the above m-th target class dependency subgraph.

[0015] According to embodiments of this disclosure, the generation of N sub-feature information corresponding to the aforementioned N classes includes:

[0016] Get the K functions contained in the nth class among the above N classes, where K is greater than or equal to 1, n is greater than or equal to 1, and n is less than or equal to N;

[0017] Generate K function feature information; and

[0018] Based on the encoding order of the K functions in the target application software and the feature information of the K functions, the nth sub-feature information corresponding to the nth class is generated.

[0019] According to embodiments of this disclosure, the process of generating the nth sub-feature information corresponding to the nth class based on the encoding order of the K functions in the target application software and the feature information of the K functions includes:

[0020] Following the above encoding order, the above K functional feature information is input into the Long Short-Term Memory network in the form of a sequence, and the above nth sub-feature information is output.

[0021] According to embodiments of this disclosure, the generation of K function feature information includes:

[0022] Based on the execution code of the aforementioned K functions, generate K control flow graphs corresponding to the aforementioned K functions; and

[0023] The graph embedding algorithm is used to process the above K control flow graphs to generate the above K function feature information.

[0024] According to embodiments of this disclosure, the target class dependency graph includes nodes and edges, where the nodes represent classes and the edges represent the dependencies between classes.

[0025] The above-described region partitioning of the target class dependency graph yields M target class dependency subgraphs, including:

[0026] Determine the dependency threshold corresponding to the above target class dependency graph; and

[0027] Based on the aforementioned dependency threshold, the target class dependency graph is divided into the aforementioned M target class dependency subgraphs, wherein the dependency degree of each edge in the aforementioned target class dependency subgraph is greater than or equal to the aforementioned dependency threshold.

[0028] According to embodiments of this disclosure, the search results include a first search result; the search for each of the M feature information in the target database to obtain M search results matching the M feature information includes:

[0029] Determine the target database corresponding to the i-th feature among the above M feature information, where the target database includes an abnormal database or a non-abnormal database, i is greater than or equal to 1, and i is less than or equal to M;

[0030] The target hash function is used to process the i-th feature information to determine the hash classification result of the i-th feature information;

[0031] Based on the hash classification results above, L target feature information is obtained from the target database above. The target feature information includes abnormal feature information or non-abnormal feature information, and L is greater than or equal to 1.

[0032] Calculate the similarity between the i-th feature information and the L target feature information to obtain L first similarity scores; and

[0033] In response to determining that at least one of the L first similarities is greater than or equal to a similarity threshold, a first retrieval result matching the i-th feature information is determined.

[0034] According to embodiments of this disclosure, the search results further include a second search result; the method further includes:

[0035] In response to determining that all L of the first similarities are less than the aforementioned similarity threshold,

[0036] If the target database is determined to be a non-abnormal database and the target feature information is determined to be non-abnormal feature information, then according to the hash classification result, L abnormal feature information is obtained from the abnormal database; the similarity between the i-th feature information and the L abnormal feature information is calculated to obtain L second similarities; in response to determining that at least one of the L second similarities is greater than or equal to the similarity threshold, a second retrieval result matching the i-th feature information is determined;

[0037] If the target database is determined to be an abnormal database and the target feature information is an abnormal feature information, L non-abnormal feature information is obtained from the non-abnormal database according to the hash classification result; the similarity between the i-th feature information and the L non-abnormal feature information is calculated to obtain L third similarities; in response to determining that at least one of the L third similarities is greater than or equal to the similarity threshold, a second retrieval result matching the i-th feature information is determined.

[0038] According to embodiments of this disclosure, the determination of the target database matching the i-th feature information among the M feature information includes:

[0039] Obtain the i-th application interface set corresponding to the i-th feature information mentioned above; and

[0040] If it is determined that the target application interface exists in the i-th application interface set mentioned above, the aforementioned abnormal database is identified as the target database; and

[0041] If it is determined that there is no target application interface in the i-th application interface set, the non-abnormal database is identified as the target database.

[0042] According to embodiments of this disclosure, determining the detection result of the target application software based on the M search results includes:

[0043] If it is determined that all M features represented by the above M search results are non-abnormal features, then the detection result of the above target application software is determined to be non-abnormal; and

[0044] If it is determined that there are abnormal features among the M search results, the detection result of the target application software is determined to be abnormal.

[0045] A second aspect of this disclosure provides a detection apparatus for application software, comprising: a graph generation module, configured to generate a target class dependency graph corresponding to the target application software based on the relationships between multiple classes in the target application software;

[0046] The region partitioning module is used to partition the above target class dependency graph into regions, resulting in M ​​target class dependency subgraphs.

[0047] The feature determination module is used to determine M feature information based on the above M target class dependency subgraphs, where M is greater than or equal to 1;

[0048] The retrieval module is used to retrieve each of the M features from the target database, obtaining M retrieval results that match the M features; and

[0049] The detection result determination module is used to determine the detection result of the target application software based on the above M search results.

[0050] A third aspect of this disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the detection method applied to application software.

[0051] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the detection method described above applied to application software.

[0052] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the detection method described above for application software.

[0053] The embodiments of this disclosure convert the target application software into a target class dependency graph, divide the target class dependency graph into multiple class dependency subgraphs, and perform feature extraction and retrieval on the class dependency subgraphs. This solves the technical problem of low detection accuracy caused by the overall features of the application software masking abnormal features, thus improving the detection accuracy. Furthermore, using the feature information of the target class dependency subgraphs for retrieval can also accurately locate abnormal parts. Attached Figure Description

[0054] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0055] Figure 1 The illustration schematically depicts an application scenario of the detection method for application software according to an embodiment of the present disclosure;

[0056] Figure 2 A flowchart illustrating a detection method applied to application software according to an embodiment of the present disclosure is shown schematically;

[0057] Figure 3 This diagram illustrates an application scenario of target detection application software according to an embodiment of the present disclosure.

[0058] Figure 4 A flowchart illustrating the determination of feature information according to an embodiment of the present disclosure is shown schematically;

[0059] Figure 5 A flowchart illustrating the determination of sub-feature information according to an embodiment of the present disclosure is shown schematically;

[0060] Figure 6 This diagram illustrates an application scenario of determining feature information according to a specific embodiment of the present disclosure.

[0061] Figure 7 This diagram illustrates an application scenario for constructing an abnormal database and non-abnormal data according to embodiments of the present disclosure.

[0062] Figure 8 This schematically illustrates a structural block diagram of a detection device applied to application software according to an embodiment of the present disclosure; and

[0063] Figure 9 A block diagram schematically illustrates an electronic device suitable for application to a detection method for application software according to an embodiment of the present disclosure. Detailed Implementation

[0064] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0065] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0066] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0067] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0068] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of data (including but not limited to user personal information) comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and they do not violate public order and good morals.

[0069] In related technologies, when performing anomaly detection on application software, features are typically extracted from the perspective of the entire application software to detect whether the application software is abnormal. In practical applications, in order to take advantage of the popularity of the original application, developers can generate repackaged application software by modifying or adding parts of the original application's code.

[0070] For repackaged application software, since the repackaged application software and the original application have a lot of the same code, similar interface and functions, the detection method based on the entire application software makes the overall behavior characteristics of the application mask the behavior characteristics of abnormal code, resulting in the inability to detect the repackaged application software as abnormal software.

[0071] Therefore, the technology still suffers from the problem of low detection accuracy of application software.

[0072] Embodiments of this disclosure provide a detection method for application software, comprising: generating a target class dependency graph corresponding to the target application software based on the relationships between multiple classes in the target application software; dividing the target class dependency graph into regions to obtain M target class dependency subgraphs, wherein M is greater than or equal to 1; determining M feature information based on the M target class dependency subgraphs; for each feature information in the M feature information, retrieving each feature information in a target database to obtain M retrieval results matching the M feature information; and determining the detection result of the target application software based on the M retrieval results.

[0073] Figure 1 The illustration depicts an application scenario of the detection method for application software according to an embodiment of the present disclosure.

[0074] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0075] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0076] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0077] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0078] It should be noted that the application software detection method provided in this disclosure embodiment can generally be executed by server 105. Correspondingly, the application software detection device provided in this disclosure embodiment can generally be located in server 105. The application software detection method provided in this disclosure embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the application software detection device provided in this disclosure embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0079] For example, the server generates a target class dependency graph corresponding to the target application software based on the relationships between multiple classes in the target application software; then, the target class dependency graph is divided into regions to obtain M target class dependency subgraphs; for each target class dependency subgraph, feature information is determined based on the target class dependency subgraph to obtain M feature information, where M is greater than or equal to 1; for each of the M feature information, each feature information is retrieved in the target database to obtain M retrieval results that match the M feature information; and based on the M retrieval results, the detection result of the target application software is determined.

[0080] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0081] The following will be based on Figure 1 The described scene, through Figures 2-7 The method for detecting application software according to the disclosed embodiments will be described in detail.

[0082] Figure 2 A flowchart illustrating a detection method applied to application software according to an embodiment of the present disclosure is shown schematically.

[0083] like Figure 2 As shown, the method includes operations S210 to S250.

[0084] According to embodiments of this disclosure, application software, in contrast to system software, is a collection of various programming languages ​​available to users, and applications written in those languages. Application software includes non-abnormal application software, which provides normal functional services to users; it also includes abnormal application software, which can also provide normal functional services, but may pose various security risks during the service provision process, such as data loss, data leakage, and electronic device malfunctions.

[0085] According to embodiments of this disclosure, since the target application software to be detected may be abnormal or non-abnormal, the detection process determines whether the target application software is abnormal or non-abnormal.

[0086] In operation S210, a target class dependency graph corresponding to the target application software is generated based on the relationships between multiple classes in the target application software.

[0087] According to embodiments of this disclosure, in the field of computers, a class is a user-defined reference data type, also known as a class type. Each class contains a data description and a set of one or more functions for manipulating data or passing messages.

[0088] The target application software contains multiple classes, and these classes have various relationships, such as dependency, association, inheritance, generalization, composition, and aggregation. Taking dependency as an example, if class A depends on the definition of class B, then there is a dependency relationship between class A and class B, and class A depends on class B.

[0089] According to embodiments of this disclosure, a Class Dependency Graph (CDG) is a graphical representation of the control dependencies and data dependencies between classes in an application software. Data dependencies define the constraints between data, while control dependencies define the constraints on statement execution.

[0090] According to embodiments of this disclosure, various relationships between multiple classes in the application software are determined through static analysis of the application software code. Based on the relationships between the multiple classes, a target class dependency graph corresponding to the target application software is generated.

[0091] According to embodiments of this disclosure, nodes in the target class dependency graph represent classes, and edges represent dependencies between multiple classes. The target class dependency graph represents the data dependencies and control dependencies between multiple classes within the target application software in a holistic manner.

[0092] In operation S220, the target class dependency graph is divided into regions to obtain M target class dependency subgraphs, where M is greater than or equal to 1.

[0093] According to embodiments of this disclosure, there are varying degrees of dependency among multiple classes in the target class dependency graph.

[0094] For example, the dependency between multiple classes can be represented by the weights of the edges in the target class dependency graph. The smaller the edge weight, the weaker the association and the lower the dependency between the two classes connected by the edge; the larger the edge weight, the stronger the association and the higher the dependency between the two classes connected by the edge.

[0095] According to embodiments of this disclosure, after generating the target class dependency graph, the target class dependency graph can be divided into M target class dependency subgraphs based on the dependency degree between multiple classes, where M is greater than or equal to 1.

[0096] According to embodiments of this disclosure, multiple target class dependency subgraphs may include multiple numbers of nodes and edges. For example, the first target class dependency subgraph includes 5 nodes and 4 edges, and the second target class dependency subgraph includes 4 nodes and 6 edges.

[0097] In operation S230, M feature information are determined based on M target class dependency subgraphs.

[0098] According to embodiments of this disclosure, after dividing the target class dependency graph into M target class dependency subgraphs, feature extraction is performed on each class dependency subgraph to obtain feature information of each class dependency subgraph, and finally M feature information are obtained.

[0099] According to embodiments of this disclosure, the feature information includes the code semantic features of the classes themselves in the target class dependency subgraph, as well as the dependency relationships and calling relationships between multiple classes in the target class dependency subgraph.

[0100] According to embodiments of this disclosure, the feature information may take the form of a feature vector.

[0101] In operation S240, for each of the M feature information, a search is performed in the target database to obtain M search results that match the M feature information.

[0102] According to embodiments of this disclosure, the target database includes an anomaly database and a non-anomaly database, which are used to store anomaly feature information and non-anomaly feature information, respectively.

[0103] According to embodiments of this disclosure, after determining M feature information, target feature information similar to each feature information is determined in the target database to determine M retrieval results matching the M feature information. The retrieval results include a judgment result indicating whether the target feature information exists; they may also include target feature information most similar to that feature information; and they may also include abnormal results, such as whether an anomaly exists.

[0104] For example, for the first feature information, a search in the anomaly database yields the first search result matching the first feature information as "No similar target feature information, no anomaly". For example, for the second feature information, a search in the non-anomaly database yields the second search result matching the second feature information as "Similar target feature information exists, the most similar target feature information is XXX, no anomaly".

[0105] According to embodiments of this disclosure, M feature information can be retrieved simultaneously in the target database, or the M feature information can be retrieved sequentially; this disclosure does not limit this.

[0106] In operation S250, the detection results of the target application software are determined based on M search results.

[0107] According to embodiments of this disclosure, after determining M search results that match M feature information, the detection result of the target application software is jointly determined based on the search results of the M feature information. The detection result includes abnormal or non-abnormal.

[0108] For example, if all M search results are non-abnormal, the detection result can be determined to be non-abnormal. If one of the M search results is abnormal, the detection result is determined to be abnormal, and the abnormal search result is output.

[0109] According to embodiments of this disclosure, the detection result may also include the type of the target application software, such as whether it is a repackaged application software or a copy of other software.

[0110] For example, for each feature, the search results indicate that similar target feature information exists in the non-abnormal database, which can determine that the target application software to be detected is a copy of other software or a repackaged security software.

[0111] According to embodiments of this disclosure, since the detection of application software in related technologies is based on the overall detection of the application software, the detection accuracy is low when the proportion of abnormal code in the entire application software is low. For example, most of the code in the repackaged application software is the same as or similar to the non-abnormal original application software, making the overall characteristics of the repackaged application software similar to those of the original application software, resulting in the inability to accurately detect whether the repackaged application software is abnormal.

[0112] The embodiments of this disclosure convert the target application software into a target class dependency graph, divide the target class dependency graph into multiple class dependency subgraphs, and perform feature extraction and retrieval on the class dependency subgraphs. This solves the technical problem of low detection accuracy caused by the overall features of the application software masking abnormal features, thus improving the detection accuracy. Furthermore, using the feature information of the target class dependency subgraphs for retrieval can also accurately locate abnormal parts.

[0113] Therefore, the embodiments of this disclosure generate a target class dependency graph corresponding to the target application software based on the relationships between multiple classes in the target application software; divide the target class dependency graph into regions to obtain M target class dependency subgraphs; determine M feature information based on the M target class dependency subgraphs; for each of the M feature information, search for each feature information in the target database to obtain M search results matching the M feature information; and determine the detection result of the target application software based on the M search results, thereby realizing the anomaly detection of the application software and improving the accuracy of detection.

[0114] Figure 3 The illustration shows an application scenario diagram of the target detection application software according to an embodiment of the present disclosure.

[0115] like Figure 3As shown, application scenario 300 includes target application software 310, target class dependency graph 320, target class dependency subgraph 330, feature information 340, retrieval results 350, and detection results 360. The target class dependency subgraph 330 includes M target class dependency subgraphs, namely the first target class dependency subgraph 330_1…the m-th target class dependency subgraph 330_m…the M-th target class dependency subgraph 330_M. The feature information 340 includes M feature information, namely the first feature information 340_1…the m-th feature information 340_m…the M-th feature information 340_M. The retrieval results 350 include M retrieval results, namely the first retrieval result 350_1…the m-th retrieval result 350_m…the M-th retrieval result 350_M.

[0116] According to embodiments of this disclosure, static analysis is performed on the code of the target application software 310 to generate a target class dependency graph 320. Based on the dependencies between multiple classes, the target class dependency graph 320 is divided into multiple target class dependency subgraphs 330, such as the first target class dependency subgraph 330_1...the mth target class dependency subgraph 330_m...the Mth target class dependency subgraph 330_M.

[0117] After obtaining the target class dependency subgraph 330, feature extraction is performed on the target class dependency subgraph 330 to obtain feature information 340, so as to retrieve the search result 350 in the target database based on the feature information 340. After feature extraction on each target class dependency subgraph, the first feature information 340_1...the m-th feature information 340_m...the M-th feature information 340_M can be obtained.

[0118] For each target class dependency subgraph, a search is performed in the target database to obtain the search results that match each target class dependency subgraph. For example, the first search result 350_1 matches the first target class dependency subgraph 330_1, the m-th search result 350_m matches the m-th target class dependency subgraph 330_m, and the M-th search result 350_M matches the M-th target class dependency subgraph 330_M.

[0119] By combining the M search results, a detection result 360 corresponding to the target application software is obtained.

[0120] Figure 4 A flowchart illustrating the determination of feature information according to an embodiment of the present disclosure is shown schematically.

[0121] like Figure 4 As shown, flowchart 400 includes operations S431 to S432, which can be used as a specific embodiment of operation S230.

[0122] According to an embodiment of this disclosure, for the m-th target class dependency subgraph among M target class dependency subgraphs, the m-th target class dependency subgraph includes N classes, where N is greater than or equal to 1, m is greater than or equal to 1, and m is less than or equal to M.

[0123] In operation S431, N sub-feature information corresponding to N classes is generated.

[0124] In operation S432, based on N sub-feature information, the m-th feature information corresponding to the m-th target class dependency subgraph is generated.

[0125] According to embodiments of this disclosure, N classes in the m-th target class dependency subgraph are processed to obtain N sub-feature information. Each sub-feature information can characterize the semantic feature information of the corresponding class.

[0126] According to embodiments of this disclosure, a graph embedding algorithm can be used to perform feature processing on N classes in the m-th target class dependency subgraph to obtain a feature vector corresponding to each class, and then the feature vector corresponding to each class can be used as the sub-feature information of that class.

[0127] According to embodiments of this disclosure, after determining N sub-feature information for N classes, a graph embedding algorithm can be used to fuse the N sub-feature information with the m-th feature information corresponding to the m-th class-dependent subgraph. For example, the N feature vectors corresponding to the N classes can be fused into a single feature vector, and this class feature vector can be used as the m-th feature information.

[0128] As another specific embodiment, for the m-th class dependency subgraph, after generating N sub-feature information corresponding to N classes, the N sub-feature information can be filled into the corresponding N nodes in the m-th class dependency subgraph. Alternatively, the m-th class dependency subgraph can be updated using the N sub-feature information as nodes.

[0129] Then, based on the N sub-feature information corresponding to the N nodes in the m-th class-dependent subgraph, the feature information of the m-th class-dependent subgraph, such as the feature vector, is used in the graph embedding algorithm.

[0130] According to embodiments of this disclosure, the method for determining the M-1 feature information corresponding to the remaining M-1 class dependency subgraphs is the same as the method described above, and will not be repeated here.

[0131] According to embodiments of this disclosure, in M ​​class dependency subgraphs, the number of nodes and edges in each class dependency subgraph can be different. For example, the j-th class dependency subgraph may include P classes, corresponding to P nodes, where j is greater than or equal to 1, and j is less than or equal to M, and P is greater than or equal to 1.

[0132] The embodiments of this disclosure first process each class in the target class dependency subgraph to obtain sub-feature information corresponding to each class, and then obtain the feature information of the target class dependency subgraph based on the sub-feature information of all classes in the target class dependency subgraph. The feature information of the target class dependency subgraph is determined according to the semantic features of the classes and the dependency relationships between classes, which helps to improve the detection accuracy.

[0133] Figure 5 A flowchart illustrating the determination of sub-feature information according to an embodiment of the present disclosure is shown schematically.

[0134] like Figure 5 As shown, flowchart 500 includes operations S5311 to S5313, which can be used as a specific embodiment of operation S431.

[0135] This disclosure describes a method for determining sub-feature information, using the nth class in the mth target class dependency subgraph as an example. For the other N-1 classes and classes in other target class dependency subgraphs, the method and process for determining sub-feature information are also described. Figure 5 The same or similar as those recorded in the text.

[0136] In operation S5311, obtain the K functions contained in the nth class among N classes, where K is greater than or equal to 1, n is greater than or equal to 1, and n is less than or equal to N.

[0137] During operation of S5312, K function feature information are generated.

[0138] In operation S5313, based on the encoding order of K functions in the target application software and the feature information of K functions, the nth sub-feature information corresponding to the nth class is generated.

[0139] According to embodiments of this disclosure, the class includes functions for implementing various functionalities, such as functions for calling interfaces, functions for accessing data, and functions for implementing loops, conditional statements, and other logic. These diverse functions can represent various semantic information. Therefore, the code of each function is analyzed, and a graph embedding algorithm is used to generate function feature information, such as a function feature vector, corresponding to each function. This function feature information is used to characterize the semantic features of the function.

[0140] When the nth class includes K functions, a graph embedding algorithm is used to generate K function feature information corresponding to the K functions, such as K function feature vectors.

[0141] According to embodiments of this disclosure, multiple classes containing the same functions can perform various functions due to differences in the order of use or nesting of functions. Therefore, based on the encoding order of the K functions within the target application software, the feature information of the K functions is fused into the nth sub-feature information corresponding to the nth class.

[0142] The embodiments of this disclosure can obtain accurate sub-feature information by analyzing the semantic features of multiple functions within a class and the calling dependencies between functions, which helps to improve the accuracy of detection.

[0143] According to embodiments of this disclosure, based on the encoding order of K functions within the target application software and the feature information of the K functions, the nth sub-feature information corresponding to the nth class is generated, including:

[0144] According to the encoding order, K function feature information is input into the Long Short-Term Memory network in the form of a sequence, and the nth sub-feature information is output.

[0145] According to embodiments of this disclosure, a Long Short-Term Memory (LSTM) network can be trained using a training set of function feature information to learn the dependencies and calling relationships between functions.

[0146] According to embodiments of this disclosure, a directed sequence including K function feature information is formed in the encoding order. Before inputting the function feature information into the long short-term memory network, the obvious dependencies between functions are first represented in the directed sequence.

[0147] According to embodiments of this disclosure, the step of generating a directed sequence may include: concatenating K function feature information in the encoding order to obtain a directed sequence. For example, the function feature information can be feature vectors of functions. The concat function is used to concatenate the feature vectors of K functions to obtain the feature vector of the directed sequence, so that the feature vector of the directed sequence can be input into a long short-term memory network to output the nth sub-feature information. The nth sub-feature information can also be a feature vector.

[0148] According to embodiments of this disclosure, since a class can include multiple functions, the length of function feature information characterizing the semantic features of functions is relatively long, resulting in a very long directed sequence. By utilizing a Long Short-Term Memory (LSTM) network to process function feature information containing function call relationships, it is ensured that the output sub-feature information includes both the semantic features of functions and the call relationships between functions. This also solves the technical problem of low detection accuracy caused by gradient vanishing and gradient exploding during feature extraction, thereby achieving the technical effect of improving detection accuracy.

[0149] According to embodiments of this disclosure, the step of generating K function feature information includes: generating K control flow graphs corresponding to the K functions based on the execution code of the K functions; and processing the K control flow graphs using a graph embedding algorithm to generate K function feature information.

[0150] According to embodiments of this disclosure, by analyzing the execution code of functions in the application software, all paths and flow directions traversed during the execution of each function are abstracted and displayed in the control flow graph, so as to generate K control flow graphs corresponding to K functions.

[0151] According to embodiments of this disclosure, by processing the control flow graph of each function using a graph embedding algorithm, function feature information corresponding to each function, such as the function's feature vector, can be generated, thereby obtaining the function feature information of K functions in the nth class.

[0152] Figure 6 The diagram illustrates an application scenario of determining feature information according to a specific embodiment of the present disclosure.

[0153] like Figure 6 As shown in the figure, the application scenario diagram 600 includes a function 601_mn, function feature information 602_mn, sub-feature information 603_m, and the m-th feature information 604_m.

[0154] The m-th class dependency subgraph includes N classes, and the n-th class includes the function 601_mn. The function 601_mn includes K functions, namely the 1st function 601_mn1, the k-th function 601_mnk, and the Kth function 601_mnK.

[0155] According to embodiments of this disclosure, for each function, a corresponding control flow graph can be generated based on the function's execution code. Then, a graph embedding algorithm is used to process the control flow graph to generate function feature information. For the first function 601_mn1…the kth function 601_mnk…the Kth function 601_mnK, feature information for the first function 602_mn1…the kth function 602_mnk…the Kth function 602_mnK is generated respectively.

[0156] Since the nth class includes K functions, the feature information of the first function (602_mn1...), the feature information of the kth function (602_mnk...), and the feature information of the Kth function (602_mnK) are input into the Long Short-Term Memory (LSTM) network according to the encoding order of the K functions, and the nth sub-feature information (603_mn) is output. For the other classes in the dependency subgraph of the mth class, the first sub-feature information (603_m1...), the Nth sub-feature information (603_mN) excluding the nth sub-feature information (603_mn) are generated respectively using the same or similar methods.

[0157] According to an embodiment of this disclosure, after generating the sub-feature information of N classes in the m-th class dependency subgraph according to the above steps, a graph embedding algorithm is used to merge the 1st sub-feature information 603_m1...the nth sub-feature information 603_mn...the Nth sub-feature information 603_mN into the m-th feature information 604_m.

[0158] According to embodiments of this disclosure, the target class dependency graph includes nodes and edges, where nodes represent classes and edges represent the dependencies between classes. Dividing the target class dependency graph into M target class dependency subgraphs may include the following steps.

[0159] Determine the dependency threshold corresponding to the target class dependency graph;

[0160] Based on the dependency threshold, the target class dependency graph is divided into M target class dependency subgraphs, where the dependency degree of each edge in the target class dependency subgraph is greater than or equal to the dependency threshold.

[0161] According to embodiments of this disclosure, a dependency threshold corresponding to a target dependency graph is determined based on the target application software.

[0162] According to embodiments of this disclosure, various application software can correspond to various dependency thresholds. For example, the dependency threshold can be related to the functionality of the application software; the higher the functional complexity, the higher the dependency threshold. Alternatively, the dependency threshold can also be related to the business type; for application software with a transaction-type business, the dependency threshold is high; for other types of application software, the corresponding dependency threshold is low.

[0163] According to embodiments of this disclosure, the dependency threshold may also be related to application software size or other factors.

[0164] According to embodiments of this disclosure, after determining the dependency threshold, edges with a dependency degree lower than the dependency threshold are deleted from the target class dependency graph, thereby partitioning the target class dependency graph and generating multiple target class dependency subgraphs.

[0165] According to embodiments of this disclosure, dependency can be reflected by the weight of the edges.

[0166] The embodiments of this disclosure divide the class dependency graph into regions based on dependency thresholds, which not only preserves important dependencies between classes, but also avoids low detection accuracy caused by the overall behavioral characteristics masking abnormal code characteristics, thereby improving detection accuracy.

[0167] According to embodiments of this disclosure, the retrieval results include a first retrieval result. For each of the M feature information pieces, a retrieval is performed in a target database to obtain M retrieval results matching the M feature information pieces, including: determining a target database corresponding to the i-th feature information among the M feature information pieces, where the target database includes an abnormal database or a non-abnormal database, i is greater than or equal to 1, and i is less than or equal to M; processing the i-th feature information using a target hash function to determine the hash classification result of the i-th feature information; obtaining L target feature information pieces from the target database based on the hash classification result, where the target feature information includes abnormal feature information or non-abnormal feature information, and L is greater than or equal to 1; calculating the similarity between the i-th feature information and the L target feature information pieces to obtain L first similarities; and determining a first retrieval result matching the i-th feature information piece in response to determining that at least one of the L first similarities is greater than or equal to a similarity threshold.

[0168] According to embodiments of this disclosure, for the i-th feature among M feature information, a target database corresponding to the i-th feature information is first determined. The target database includes an abnormal database and a non-abnormal database. The abnormal database includes multiple abnormal feature information, and the non-abnormal database includes multiple non-abnormal feature information.

[0169] According to embodiments of this disclosure, the target database corresponding to the i-th feature information can be either an abnormal database or a non-abnormal database.

[0170] According to an embodiment of this disclosure, when the target database corresponding to the i-th feature information is an abnormal database, after determining the hash classification result of the i-th feature information, L target feature information are obtained from the abnormal database based on the hash classification result, where all current target feature information is abnormal. A first retrieval result matching the i-th feature information is determined by calculating the first similarity between the i-th feature information and the L target feature information, and finding that at least one of the L first similarities is greater than or equal to a similarity threshold.

[0171] For example, if the target feature information is obtained from an abnormal database, and one of the L first similarities is greater than or equal to the similarity threshold, it indicates that the first target feature information is similar to the i-th feature information, the i-th feature information is abnormal feature information, and the output first search result is abnormal.

[0172] According to embodiments of this disclosure, when the target database corresponding to the i-th feature information is a non-abnormal database, after determining the hash classification result of the i-th feature information, L target feature information are obtained from the non-abnormal database based on the hash classification result, where all current target feature information is non-abnormal. A first retrieval result matching the i-th feature information is determined by calculating the first similarity between the i-th feature information and the L target feature information, and finding that at least one of the L first similarities is greater than or equal to a similarity threshold.

[0173] For example, if the target feature information is obtained from a non-abnormal database, and one of the L first similarities is greater than or equal to the similarity threshold, it indicates that the first target feature information is similar to the i-th feature information, the i-th feature information belongs to non-abnormal feature information, and the output first search result is non-abnormal.

[0174] According to embodiments of this disclosure, the method further includes: in response to determining that at least one of the L first similarities is greater than or equal to a similarity threshold, returning target feature information corresponding to the highest first similarity.

[0175] According to embodiments of this disclosure, processing the i-th feature information using a target hash function to determine the hash classification result of the i-th feature information may include: determining a target hash function that satisfies the Locality Sensitive Hashing (LSH) algorithm; processing the i-th feature information using the target hash function, hashing the i-th feature information into a preset data bucket, and using the bucket number of the data bucket as the hash classification result.

[0176] For example, the target hash function can include a random hyperplane hash function.

[0177] According to embodiments of this disclosure, the number of data buckets can be determined based on the accuracy of the retrieval results, and the data buckets can be stored in the form of hash tables. Each hash table can contain one or more hash functions. For example, this disclosure uses 20 hash tables, and each hash table contains 9 hash functions.

[0178] According to embodiments of this disclosure, obtaining L target feature information from the target database based on the hash classification result includes: obtaining the first L target feature data from the data bucket corresponding to the hash classification result in the target database.

[0179] According to embodiments of this disclosure, the number of target feature data obtained is related to the number of data buckets, thereby improving retrieval speed while ensuring retrieval accuracy. For example, if there are L / 2 data buckets, the number of target feature data obtained is L.

[0180] According to embodiments of this disclosure, the first similarity can be cosine similarity.

[0181] The embodiments of this disclosure achieve feature information retrieval by determining a target database corresponding to the i-th feature information among M feature information; processing the i-th feature information using a target hash function to determine the hash classification result of the i-th feature information; obtaining L target feature information from the target database based on the hash classification result; calculating the similarity between the i-th feature information and the L target feature information to obtain L first similarities; and determining a first retrieval result matching the i-th feature information in response to determining that at least one of the L first similarities is greater than or equal to a similarity threshold. The embodiments of this disclosure, by employing a target hash function, can improve retrieval accuracy and efficiency; by determining the target database, it helps optimize the retrieval process and improve retrieval efficiency.

[0182] According to embodiments of this disclosure, the search results also include a second search result. The above method further includes:

[0183] In response to determining that all L first similarities are less than the similarity threshold, and assuming that the target database is a non-abnormal database and the target feature information is a non-abnormal feature information, L abnormal feature information is obtained from the abnormal database based on the hash classification result; the similarity between the i-th feature information and the L abnormal feature information is calculated to obtain L second similarities; in response to determining that at least one of the L second similarities is greater than or equal to the similarity threshold, a second retrieval result matching the i-th feature information is determined;

[0184] In response to determining that all L first similarities are less than the similarity threshold, and assuming that the target database is an abnormal database and the target feature information is an abnormal feature information, L non-abnormal feature information is obtained from the non-abnormal database based on the hash classification result; the similarity between the i-th feature information and the L non-abnormal feature information is calculated to obtain L third similarities; in response to determining that at least one of the L third similarities is greater than or equal to the similarity threshold, a second retrieval result matching the i-th feature information is determined.

[0185] According to embodiments of this disclosure, if all L first similarities are less than the similarity threshold, it indicates that there is no feature information similar to the i-th feature information in the current target database, and a search can be performed again in another database different from the target database.

[0186] For example, if the target database is a non-abnormal database, L anomalous feature information is obtained from the anomalous database, and L second similarities are calculated. If it is determined that one of the L second similarities is greater than or equal to a similarity threshold, it indicates that an anomalous feature information matching the i-th feature information has been retrieved from the anomalous database, and the second retrieval result is determined to be anomalous.

[0187] For example, if the target database is an abnormal database, L non-abnormal feature information is obtained from the non-abnormal database, and L second similarities are calculated. In response to the determination that one of the L second similarities is greater than or equal to a similarity threshold, it indicates that a non-abnormal feature information matching the i-th feature information has been retrieved from the non-abnormal database, and the second retrieval result is determined to be non-abnormal.

[0188] According to embodiments of this disclosure, when the target database is determined to be a non-abnormal database, in response to determining that L second similarities are all less than the similarity threshold, the second retrieval result matching the i-th feature information is determined to be pending or non-abnormal.

[0189] According to embodiments of this disclosure, when the target database is determined to be an abnormal database, in response to determining that all L third similarities are less than the similarity threshold, the second search result matching the i-th feature information is determined to be pending or non-abnormal.

[0190] The embodiments of this disclosure perform searches from both abnormal and non-abnormal databases, utilizing a secondary search method to avoid detection errors caused by missed detections or other operations.

[0191] Figure 7 The diagram illustrates an application scenario for constructing abnormal databases and non-abnormal data according to embodiments of the present disclosure.

[0192] like Figure 7 As shown in the figure, the application scenario diagram 700 includes non-abnormal application software 701, abnormal application software 702, non-abnormal database 703, suspicious database 704, filtered data 705, and abnormal database 706.

[0193] According to embodiments of this disclosure, the construction of abnormal and non-abnormal databases can be achieved through multiple abnormal application software and multiple non-abnormal software.

[0194] According to an embodiment of this disclosure, as a data source for constructing the non-abnormal database 703, non-abnormal feature data is generated by sequentially performing processes such as "generating a class dependency graph, region partitioning, and feature extraction" on the non-abnormal application software 701. The generated non-abnormal feature data is then stored in the non-abnormal database 703. The operations such as generating the class dependency graph, region partitioning, and feature extraction are similar to steps S210 to S230 and will not be described again here.

[0195] According to embodiments of this disclosure, the abnormal application software 702 is processed by "generating a class dependency graph, region partitioning, and feature extraction" to obtain a suspicious database 704. Since the abnormal application software 702 includes both abnormal and non-abnormal code, the suspicious database 704 includes undifferentiated abnormal and non-abnormal feature information.

[0196] The non-abnormal feature information in the non-abnormal database 703 is used to filter the feature information in the suspicious database 704, resulting in filtered feature information 705. Filtered feature information 705 includes the distinguished non-abnormal feature information 7051 and abnormal feature information 7052. Then, abnormal feature information 7052 is stored in the abnormal database 706 to gradually improve the abnormal database.

[0197] As another data source for constructing the non-abnormal database 703, the non-abnormal feature information 7051 in the filtered feature information 705 is added to the non-abnormal database 703.

[0198] According to embodiments of this disclosure, in the filtering step, the cosine similarity between all feature information in the suspicious database and feature information in the non-abnormal database is calculated. When the cosine similarity is greater than 70%, the feature information in the suspicious database is identified as non-abnormal feature information; when the cosine similarity is less than or equal to 70%, the feature information in the suspicious database is identified as anomalous feature information.

[0199] According to embodiments of this disclosure, determining a target database that matches the i-th feature among M feature information includes:

[0200] Obtain the set of application interfaces corresponding to the i-th feature information; and

[0201] If the target application interface is determined to exist in the i-th application interface set, the abnormal database is identified as the target database; and

[0202] If it is determined that the target application interface does not exist in the i-th application interface set, the non-abnormal database is determined as the target database.

[0203] According to embodiments of this disclosure, for the i-th feature information corresponding to the i-th class dependency subgraph, the i-th set of application programming interfaces (APIs) corresponding to the i-th feature information is obtained. The i-th set of application programming interfaces includes all application programming interfaces (APIs) involved in the i-th class dependency subgraph.

[0204] The existence of a target application interface in the i-th application interface set is determined by matching the application interfaces in the i-th application interface set with the application interfaces in the risky application interface set. The target application interface is an interface that belongs to the risky application interface set.

[0205] According to embodiments of this disclosure, the step of determining a risky application interface set includes: obtaining three different risky application interface subsets, and obtaining the risky application interface set by calculating the union of these three risky application interface subsets.

[0206] For example, the first subset of risky APIs consists of the 260 APIs most relevant to anomalous applications, the second subset consists of 112 APIs related to dangerous permissions, and the third subset consists of 70 APIs related to anomalous operations. By calculating the union of these three API subsets, we can obtain 426 APIs, thus forming the risky API set.

[0207] According to embodiments of this disclosure, the i-th application interface set contains the target application interface, indicating that the i-th feature information has a high probability of being abnormal feature information. Therefore, the abnormal database is identified as the target database so that retrieval can be performed in the abnormal database first, which helps to reduce the retrieval volume and improve retrieval efficiency.

[0208] According to embodiments of this disclosure, if there is no target application interface in the i-th application interface set, the probability that the i-th feature information is non-abnormal feature information is high. Therefore, the non-abnormal database is identified as the target database so that retrieval can be performed in the non-abnormal database first, which helps to reduce the retrieval volume and improve retrieval efficiency.

[0209] The embodiments of this disclosure determine the order of database retrieval by judging the application programming interface, which helps to reduce the amount of retrieval and improve retrieval efficiency.

[0210] According to embodiments of this disclosure, if it is determined that all M features represented by the M search results are non-abnormal, the detection result of the target application software is determined to be non-abnormal. If it is determined that an anomalous feature exists among the M features represented by the M search results, the detection result of the target application software is determined to be abnormal.

[0211] According to embodiments of this disclosure, as long as there is one abnormal feature, the application software can be determined to be abnormal. Even when the proportion of abnormal code in the entire application software is low, the application software can still be accurately detected as abnormal.

[0212] Figure 8 The diagram illustrates a structural block diagram of a detection apparatus for application software according to an embodiment of the present disclosure.

[0213] like Figure 8 As shown, the detection device 800 for application software in this embodiment includes an image generation module 810, a region division module 820, a feature determination module 830, a retrieval module 840, and a detection result determination module 850.

[0214] Graph generation module 810 is used to generate a target class dependency graph corresponding to the target application software based on the relationships between multiple classes in the target application software. In one embodiment, graph generation module 810 can be used to perform the operation S210 described above, which will not be repeated here.

[0215] The region partitioning module 820 is used to partition the above target class dependency graph into regions to obtain M target class dependency subgraphs. In one embodiment, the region partitioning module 820 can be used to perform the operation S210 described above, which will not be repeated here.

[0216] The feature determination module 830 is used to determine M feature information based on the aforementioned M target class dependency subgraphs, where M is greater than or equal to 1. In one embodiment, the feature determination module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0217] The retrieval module 840 is used to retrieve each of the M feature information from the target database, obtaining M retrieval results that match the M feature information. In one embodiment, the retrieval module 840 can be used to perform the operation S240 described above, which will not be repeated here.

[0218] The detection result determination module 850 is used to determine the detection result of the target application software based on the M search results mentioned above. In one embodiment, the detection result determination module 850 can be used to perform the operation S250 described above, which will not be repeated here.

[0219] According to embodiments of this disclosure, the feature determination module 830 includes a first determination submodule and a second determination submodule.

[0220] The first determining submodule is used to generate N sub-feature information corresponding to N classes. In one embodiment, the first determining submodule can be used to perform the operation S431 described above, which will not be repeated here.

[0221] The second determining submodule is used to generate the m-th feature information corresponding to the m-th target class dependency subgraph based on the N sub-feature information. In one embodiment, the second determining submodule can be used to perform the operation S432 described above, which will not be repeated here.

[0222] According to embodiments of this disclosure, the first determining submodule includes a first determining unit, a second determining unit, and a third determining unit.

[0223] The first determining unit is used to obtain K functions contained in the nth class among N classes, where K is greater than or equal to 1, n is greater than or equal to 1, and n is less than or equal to N. In one embodiment, the first determining unit can be used to perform the operation S5311 described above, which will not be repeated here.

[0224] The second determining unit is used to generate K function feature information. In one embodiment, the second determining unit can be used to perform the operation S5312 described above, which will not be repeated here.

[0225] The third determining unit is used to generate the nth sub-feature information corresponding to the nth class based on the encoding order of the K functions in the target application software and the feature information of the K functions. In one embodiment, the third determining unit can be used to perform the operation S5313 described above, which will not be repeated here.

[0226] According to an embodiment of this disclosure, the third determining unit includes an output subunit, which is used to input K functional feature information into the long short-term memory network in the form of a sequence according to the encoding order, and output the nth sub-feature information.

[0227] According to embodiments of this disclosure, the second determining unit includes a first determining subunit and a second determining subunit.

[0228] The first determining subunit is used to generate K control flow graphs corresponding to the K functions based on the execution code of the K functions.

[0229] The second determining subunit is used to process K control flow graphs using a graph embedding algorithm to generate K function feature information.

[0230] According to embodiments of this disclosure, the region segmentation module 820 includes a threshold-dependent determination submodule and a segmentation submodule.

[0231] The dependency threshold determination submodule is used to determine the dependency threshold corresponding to the dependency graph of the target class.

[0232] The partitioning module is used to divide the target class dependency graph into M target class dependency subgraphs based on the dependency threshold, wherein the dependency degree of each edge in the target class dependency subgraph is greater than or equal to the dependency threshold.

[0233] According to embodiments of this disclosure, the retrieval module 840 includes a database determination submodule, a classification submodule, an acquisition submodule, a calculation submodule, and a first response submodule.

[0234] The database determination submodule is used to determine the target database corresponding to the i-th feature among M feature information. The target database includes abnormal databases or non-abnormal databases, where i is greater than or equal to 1 and i is less than or equal to M.

[0235] The classification submodule is used to process the i-th feature information using the target hash function to determine the hash classification result of the i-th feature information.

[0236] The acquisition submodule is used to retrieve L target feature information from the target database based on the hash classification results. The target feature information includes abnormal feature information or non-abnormal feature information, and L is greater than or equal to 1.

[0237] The calculation submodule is used to calculate the similarity between the i-th feature information and the L target feature information to obtain the L first similarity scores.

[0238] The first response submodule is used to determine the first retrieval result that matches the i-th feature information in response to determining that at least one of the L first similarities is greater than or equal to the similarity threshold.

[0239] According to embodiments of this disclosure, the retrieval module 840 further includes a second response submodule and a third response submodule.

[0240] The second response submodule is used to respond to the determination that L first similarities are all less than the similarity threshold, and in the case that the target database is a non-abnormal database and the target feature information is non-abnormal feature information, to obtain L abnormal feature information from the abnormal database according to the hash classification result; to calculate the similarity between the i-th feature information and the L abnormal feature information to obtain L second similarities; and to respond to the determination that at least one of the L second similarities is greater than or equal to the similarity threshold, to determine the second retrieval result that matches the i-th feature information.

[0241] The third response submodule is used to respond to the determination that all L first similarities are less than the similarity threshold, and in the case that the target database is an abnormal database and the target feature information is abnormal feature information, to obtain L non-abnormal feature information from the non-abnormal database according to the hash classification result; to calculate the similarity between the i-th feature information and the L non-abnormal feature information to obtain L third similarities; and to respond to the determination that at least one of the L third similarities is greater than or equal to the similarity threshold, to determine the second retrieval result that matches the i-th feature information.

[0242] According to embodiments of this disclosure, the database determination submodule includes an acquisition unit, an abnormal database determination unit, and a non-abnormal database determination unit.

[0243] The acquisition unit is used to acquire the i-th application interface set corresponding to the i-th feature information.

[0244] The abnormal database determination unit is used to determine the abnormal database as the target database when it is determined that the target application interface exists in the i-th application interface set.

[0245] The non-abnormal database determination unit is used to determine the non-abnormal database as the target database when it is determined that there is no target application interface in the i-th application interface set.

[0246] According to embodiments of this disclosure, the detection result determination module 850 includes an anomaly determination submodule and a non-anomaly determination submodule.

[0247] The anomaly determination submodule is used to determine that the detection result of the target application software is non-abnormal if it is determined that all M features represented by the M search results are non-abnormal features.

[0248] The non-anomaly determination submodule is used to determine that the detection result of the target application software is abnormal when it is determined that there are abnormal features among the M features represented by the M search results.

[0249] According to embodiments of this disclosure, any multiple modules among the graph generation module 810, region partitioning module 820, feature determination module 830, retrieval module 840, and detection result determination module 850 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the graph generation module 810, region partitioning module 820, feature determination module 830, retrieval module 840, and detection result determination module 850 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the graph generation module 810, region division module 820, feature determination module 830, retrieval module 840, and detection result determination module 850 may be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0250] Figure 9 A block diagram schematically illustrates an electronic device suitable for application to a detection method for application software according to an embodiment of the present disclosure.

[0251] like Figure 9 As shown, an electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0252] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0253] According to embodiments of this disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0254] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0255] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0256] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the detection method for application software provided in embodiments of this disclosure.

[0257] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0258] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0259] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0260] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0261] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0262] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0263] The specific embodiments described above further illustrate the purpose, technical solutions, and beneficial effects of this disclosure. It should be understood that the above descriptions are merely specific embodiments of this disclosure and are not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.

Claims

1. A detection method for application software, comprising: Based on the relationships between multiple classes in the target application software, a target class dependency graph corresponding to the target application software is generated. The target class dependency graph is divided into regions to obtain M target class dependency subgraphs, where M is greater than or equal to 1. Based on the M target class dependency subgraphs, determine M feature information; For each of the M feature information, a search is performed in the target database to obtain M search results that match the M feature information; Based on the M search results, the detection result of the target application software is determined; The step of determining M feature information based on the M target class dependency subgraphs includes: For the m-th target class dependency subgraph among the M target class dependency subgraphs, the m-th target class dependency subgraph includes N classes, where N is greater than or equal to 1, m is greater than or equal to 1, and m is less than or equal to M: Generate N sub-feature information corresponding to the N classes; Based on the N sub-feature information, generate the m-th feature information corresponding to the m-th target class dependency subgraph; The generation of N sub-feature information corresponding to the N classes includes: Obtain the K functions contained in the nth class among the N classes, where K is greater than or equal to 1, n is greater than or equal to 1, and n is less than or equal to N; Generate K function feature information; According to the encoding order of the K functions in the target application software, the feature information of the K functions is input into the Long Short-Term Memory network in the form of a sequence, and the nth sub-feature information corresponding to the nth class is output.

2. The method according to claim 1, wherein, The generation of K function feature information includes: Based on the execution code of the K functions, generate K control flow graphs corresponding to the K functions; and The K control flow graphs are processed using a graph embedding algorithm to generate the K function feature information.

3. The method according to claim 1, wherein, The target class dependency graph includes nodes and edges, where nodes represent classes and edges represent the dependency between classes; The target class dependency graph is divided into regions to obtain M target class dependency subgraphs, including: Determine the dependency threshold corresponding to the target class dependency graph; and Based on the dependency threshold, the target class dependency graph is divided into the M target class dependency subgraphs, wherein the dependency degree of each edge in the target class dependency subgraph is greater than or equal to the dependency threshold.

4. The method according to claim 1, wherein, The search results include a first search result; the step of searching the target database for each of the M feature information to obtain M search results matching the M feature information includes: Determine the target database corresponding to the i-th feature among the M feature information, wherein the target database includes an abnormal database or a non-abnormal database, i is greater than or equal to 1, and i is less than or equal to M; The target hash function is used to process the i-th feature information to determine the hash classification result of the i-th feature information; Based on the hash classification result, L target feature information are obtained from the target database. The target feature information includes abnormal feature information or non-abnormal feature information, and L is greater than or equal to 1. Calculate the similarity between the i-th feature information and the L target feature information to obtain L first similarity scores; and In response to determining that at least one of the L first similarities is greater than or equal to a similarity threshold, a first retrieval result matching the i-th feature information is determined.

5. The method according to claim 4, wherein, The search results also include second search results; the method further includes: In response to determining that all L first similarities are less than the similarity threshold, If the target database is determined to be a non-abnormal database and the target feature information is non-abnormal feature information, then according to the hash classification result, L abnormal feature information are obtained from the abnormal database; the similarity between the i-th feature information and the L abnormal feature information is calculated to obtain L second similarities; in response to determining that at least one of the L second similarities is greater than or equal to the similarity threshold, a second retrieval result matching the i-th feature information is determined; If the target database is determined to be an abnormal database and the target feature information is an abnormal feature information, L non-abnormal feature information are obtained from the non-abnormal database according to the hash classification result; the similarity between the i-th feature information and the L non-abnormal feature information is calculated to obtain L third similarities; in response to determining that at least one of the L third similarities is greater than or equal to the similarity threshold, a second retrieval result matching the i-th feature information is determined.

6. The method according to claim 4, wherein, The determination of the target database that matches the i-th feature among the M feature information includes: Obtain the i-th application interface set corresponding to the i-th feature information; and If it is determined that the target application interface exists in the i-th application interface set, the abnormal database is identified as the target database; and If it is determined that there is no target application interface in the i-th application interface set, the non-abnormal database is determined as the target database.

7. The method according to claim 1, wherein, The step of determining the detection result of the target application software based on the M search results includes: If the M search results are determined to represent all M feature information as non-abnormal features, then the detection result of the target application software is determined to be non-abnormal; and If it is determined that there are abnormal features among the M features represented by the M search results, the detection result of the target application software is determined to be abnormal.

8. A detection device for application software, comprising: The graph generation module is used to generate a target class dependency graph corresponding to the target application software based on the relationships between multiple classes in the target application software. The region partitioning module is used to partition the target class dependency graph into regions to obtain M target class dependency subgraphs, where M is greater than or equal to 1. The feature determination module is used to determine M feature information based on the M target class dependency subgraphs; The retrieval module is used to retrieve each of the M features from the target database, obtaining M retrieval results that match the M features; and The detection result determination module is used to determine the detection result of the target application software based on the M search results; The feature determination module is further configured to: for the m-th target class dependency subgraph among the M target class dependency subgraphs, the m-th target class dependency subgraph includes N classes, where N is greater than or equal to 1, m is greater than or equal to 1, and m is less than or equal to M: Generate N sub-feature information corresponding to the N classes; Based on the N sub-feature information, generate the m-th feature information corresponding to the m-th target class dependency subgraph; The generation of N sub-feature information corresponding to the N classes includes: Obtain the K functions contained in the nth class among the N classes, where K is greater than or equal to 1, n is greater than or equal to 1, and n is less than or equal to N; Generate K function feature information; According to the encoding order of the K functions in the target application software, the feature information of the K functions is input into the Long Short-Term Memory network in the form of a sequence, and the nth sub-feature information corresponding to the nth class is output.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images