Application control method, device and storage medium

Abstract

The embodiments of the present application provide an application management method, device and storage medium. The method includes: obtaining pop-up window startup information, the pop-up window startup information includes target application information and pop-up window startup frequency, wherein the target application information includes the identification of the target application, the abnormal characteristics of the target application and the behavior information of the target application starting the pop-up window, and the target application is the application that starts the pop-up window; when the pop-up window startup frequency exceeds a preset number, the target application information is input into a trained application recognition model to calculate the target risk score, and the risk level of the target application is obtained based on the target risk score; the target application is graded and managed according to the risk level of the target application. In this way, the abnormal application is managed based on the risk score of the application, and then the background pop-up window of the abnormal application is intercepted, which can more accurately block the background pop-up window advertisements of the abnormal application, and will not affect the pop-up window function of the normal application, and the application can be displayed and promoted normally.

Description

Technical Field

[0001] The present application relates to the field of terminal technology, and in particular to an application management method, device and storage medium. Background Art

[0002] With the development of terminal technology, the types of applications that can be supported in terminal devices are increasing. Some of these applications will frequently pop up advertisements on the desktop, lock screen interface or other application interfaces of the terminal device after being started.

[0003] In some implementations, a virtual private network (VPN) is set up in the terminal device to intercept the network connection request of the advertising URL library, so that the application cannot obtain the display resources of the advertisement, and thus the advertisement pop-up window cannot be popped up.

[0004] However, the VPN-based method of blocking ad pop-ups is not flexible enough, which affects the normal ad display and promotion of the application. Summary of the invention

[0005] The embodiments of the present application provide an application management method, device and storage medium, which are applied in the field of terminal technology, help to improve the user experience of terminal devices, and do not affect the normal advertising display and promotion of applications in the terminal devices.

[0006] In the first aspect, an embodiment of the present application proposes an application management method. The method includes: obtaining pop-up window startup information, the pop-up window startup information includes target application information and pop-up window startup frequency, wherein the target application information includes the identification of the target application, the abnormal characteristics of the target application and the behavior information of the target application starting the pop-up window, and the target application is the application that starts the pop-up window; when the pop-up window startup frequency exceeds a preset number, the target application information is input into a trained application recognition model to calculate the target risk score, and the risk level of the target application is obtained based on the target risk score; the target application is graded and managed according to the risk level of the target application. In this way, abnormal applications are managed based on the risk score of the application, and then the background pop-up windows of abnormal applications are intercepted, which can more accurately block the background pop-up window advertisements of abnormal applications, and will not affect the pop-up window function of normal applications, and the application can be displayed and promoted normally.

[0007] In one possible implementation, the abnormal features of the target application include: a self-starting keep-alive feature, a background pop-up window connecting to an advertising website feature, a counterfeit system application feature and / or a hidden feature; the behavior of the target application starting a pop-up window includes: after the target application monitors a triggering event, the target application starts a pop-up window.

[0008] In one possible implementation, the target application information is input into a trained application identification model to calculate the target risk score, and the risk level of the target application is obtained based on the target risk score, including: performing a sum operation on the risk score corresponding to the target application information to obtain the target risk score; when the target risk score is greater than a first threshold, the risk level of the target application is determined to be high risk; when the target risk score is less than or equal to the first threshold and greater than a second threshold, the risk level of the target application is determined to be medium risk; when the target risk score is less than or equal to the second threshold, the risk level of the target application is determined to be low risk. In this way, the target risk score is calculated comprehensively through the target application information, and based on the comparison of the target risk score and the first threshold and / or the second threshold, the risk level of the target application can be determined more accurately, which helps to improve the accuracy of subsequent management and control.

[0009] In one possible implementation, target applications are graded and managed according to their risk levels, including: when the risk level of the target application is high risk, the user is reminded to uninstall the target application, and if the user refuses to uninstall, the target application is added to the risk management center; when the risk level of the target application is medium risk, the user is reminded to add the target application to the risk management center; when the risk level of the target application is low risk, the target application's identifier and target application information are sent to the cloud. In this way, high-risk target applications and medium-risk target applications can be added to the risk management center, so that the background pop-ups of high-risk target applications and medium-risk target applications can be intercepted later, so that high-risk target applications and medium-risk target applications cannot display background pop-up ads, which not only improves the user experience but also does not affect the normal display and promotion of the application's ads.

[0010] In a possible implementation, after adding the target application to the risk control center, the method further includes: intercepting the pop-up window of the target application. In this way, the pop-up window of the target application is intercepted to prohibit the target application from launching background pop-up windows, so that the target application cannot pop up background pop-up ads, thereby improving the user experience.

[0011] In a possible implementation, the trained application identification model is obtained by taking the first application information as the input of the application identification model and training the application identification model with the loss function value being less than the third threshold as the goal; the first application information is the application information of any application with pop-up behavior; the loss function is used to indicate the difference between the target risk level and the application risk level output by the application identification model. In this way, the risk level of the target application can be determined based on the trained application identification model in the future.

[0012] In a possible implementation, the application identification model is trained in the cloud, and the trained application identification model is configured with a risk score corresponding to the target application information.

[0013] In the second aspect, an embodiment of the present application provides an application management and control device, a processing unit, for obtaining pop-up window startup information, the pop-up window startup information including target application information and pop-up window startup frequency, wherein the target application information includes the identification of the target application, abnormal characteristics of the target application and behavior information of the target application starting the pop-up window, and the target application is the application that starts the pop-up window; the processing unit is also used to input the target application information into a trained application recognition model to calculate the target risk score when the pop-up window startup frequency exceeds a preset number, and obtain the risk level of the target application based on the target risk score; the processing unit is also used to perform hierarchical management of the target application according to the risk level of the target application.

[0014] In one possible implementation, the abnormal features of the target application include: a self-starting keep-alive feature, a background pop-up window connecting to an advertising website feature, a counterfeit system application feature and / or a hidden feature; the processing unit is also used for the target application to start a pop-up window after the target application monitors a triggering event.

[0015] In one possible implementation, the processing unit is further used to perform a sum operation on the risk scores corresponding to the target application information to obtain a target risk score; the processing unit is further used to determine that the risk level of the target application is high risk when the target risk score is greater than a first threshold; the processing unit is further used to determine that the risk level of the target application is medium risk when the target risk score is less than or equal to the first threshold and greater than a second threshold; the processing unit is further used to determine that the risk level of the target application is low risk when the target risk score is less than or equal to the second threshold.

[0016] In one possible implementation, the processing unit is further used to remind the user to uninstall the target application when the risk level of the target application is high risk. If the user refuses to uninstall, the target application is added to the risk management center; the processing unit is further used to remind the user to add the target application to the risk management center when the risk level of the target application is medium risk; the processing unit is further used to send the target application identifier and target application information to the cloud when the risk level of the target application is low risk.

[0017] In a possible implementation, after the target application is added to the risk management and control center, the processing unit is also used to intercept pop-up windows of the target application.

[0018] In one possible implementation, a trained application identification model is obtained by taking the first application information as the input of the application identification model and training the application identification model with the value of the loss function being less than a third threshold as the goal; the first application information is the application information of any application with pop-up behavior; and the loss function is used to indicate the difference between the target risk level and the application risk level output by the application identification model.

[0019] In a possible implementation, the training of the application identification model is completed in the cloud, and the trained application identification model is configured with the risk score corresponding to the target application information.

[0020] In a third aspect, an embodiment of the present application provides a terminal device, which may also be referred to as a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc. The terminal device may be a mobile phone, a smart TV, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical surgery, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc.

[0021] The terminal device includes: a processor and a memory; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory, so that the terminal device executes the application management method described in the first aspect or any possible implementation of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the application management method described in the first aspect or any possible implementation of the first aspect is implemented.

[0023] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is run, the computer executes the application management method described in the first aspect or any possible implementation of the first aspect.

[0024] In a sixth aspect, an embodiment of the present application provides a chip, the chip including a processor, the processor being used to call a computer program in a memory to execute an application management method as described in the first aspect or any possible implementation of the first aspect.

[0025] It should be understood that the second to sixth aspects of the present application correspond to the technical solutions of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A schematic diagram of a scenario applicable to the embodiments of the present application;

[0027] Figure 2 A schematic diagram of the hardware structure of a terminal device provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of the software structure of a terminal device provided in an embodiment of the present application;

[0029] Figure 4 A flowchart of an application management method provided in an embodiment of the present application;

[0030] Figure 5 A flowchart of an application management method provided in an embodiment of the present application;

[0031] Figure 6a A schematic diagram of a reminder interface provided in an embodiment of the present application;

[0032] Figure 6b A schematic diagram of a management and control interface provided in an embodiment of the present application;

[0033] Figure 7 A flowchart of another application management method provided in an embodiment of the present application;

[0034] Figure 8 A schematic diagram of the structure of an application control device provided in an embodiment of the present application;

[0035] Fig. 9 A schematic diagram of the hardware structure of another terminal device provided in an embodiment of the present application;

[0036] Fig.10 A schematic diagram of the structure of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0038] In the embodiments of the present application, "at least one" refers to one or more, and "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0039] It should be noted that the "at..." in the embodiment of the present application can be the instant when a certain situation occurs, or a period of time after a certain situation occurs, and the embodiment of the present application does not specifically limit this. In addition, the display interface provided in the embodiment of the present application is only an example, and the display interface can also include more or less content.

[0040] With the development of terminal technology, the types of applications that can be supported in terminal devices are increasing.

[0041] Generally speaking, applications display advertisements distributed by the platform through an integrated advertising platform software development kit (SDK). These advertisements can be advertisements displayed when the application is running in the foreground, such as the splash screen advertisement of the application when the application is opened; they can also be advertisements that pop up when the application is running in the background and cover the interface of the application running in the foreground (hereinafter referred to as background pop-up advertisements), such as advertisements that pop up when the application is running in the background and cover the desktop, lock screen interface or other application interface. Background pop-up advertisements can be understood as pop-up windows (also called interfaces) that appear when the application is running in the background, and connect to the advertising website to obtain advertising resources, and fill the advertising resources into the pop-up window for display.

[0042] Some applications can display ads when running in the foreground, and can also pop up background pop-up ads when running in the background. Normal applications can be applications that moderately display or pop up background pop-up ads without affecting the user's experience of the application, while abnormal applications will frequently pop up background pop-up ads when running in the background. Among them, abnormal applications running in the background can be understood as the user's current visible interface is not any interface of the abnormal application, but usually the desktop or lock screen interface.

[0043] In the terminal device, there may be more than one abnormal application that frequently pops up background pop-up ads when running in the background. The user does not know which application these background pop-up ads come from. Some background pop-up ads may not be closed, which interferes with the user's normal use of the terminal device and seriously affects the user experience.

[0044] In some implementations, a VPN is set up in the terminal device to intercept network connection requests of the advertising URL library, so that the application cannot obtain display resources for the advertisements and thus cannot display the advertisements.

[0045] However, this method of intercepting network connection requests of the advertising URL library based on VPN and thus intercepting advertisements not only prevents background pop-up ads from popping up when the application is running in the background, but also blocks the normal advertising display and promotion of the application. This control method of intercepting both the background pop-up ads of the application and the ads displayed when running in the foreground is not flexible enough, which affects the normal advertising display and promotion of the application.

[0046] In other implementations, the background pop-up function of the application is turned off through the system permission switch in the terminal device, so that the application cannot pop up background pop-up ads.

[0047] However, turning off the background pop-up function in this way may cause the normal pop-up functions of some applications to be accidentally blocked.

[0048] In view of this, an embodiment of the present application provides an application management method, which identifies the risk level of an application based on the risk score of the application's behavior characteristics, and implements graded management of the application according to the risk level of the application, thereby more accurately shielding the background pop-up advertisements of the application and allowing the application to display and promote advertisements normally.

[0049] Figure 1 Schematic diagram of a scenario applicable to the embodiment of the present application is shown. Figure 1 As shown, under the premise that the terminal device 100 is connected to the network, when the user is using the terminal device 100, the application running in the background of the terminal device 100 may pop up a background pop-up advertisement 200 displayed on the desktop or lock screen interface of the terminal device 100.

[0050] The terminal device 100 may be a mobile phone, a tablet, a notebook or other terminal device. The present application embodiment uses the mobile phone as an example to illustrate the terminal device 100, and this example does not constitute a specific limitation on the present application embodiment. The advertisement content that may be displayed in the background pop-up advertisement 200.

[0051] It is understandable that the background pop-up advertisement 200 can be displayed as follows: Figure 1The small-screen format shown is displayed on the desktop, lock screen interface or other application interface of the terminal device 100, and can also be displayed in full-screen format on the desktop, lock screen interface or other application interface of the terminal device 100, or displayed in any other non-full-screen format on the desktop, lock screen interface or other application interface of the terminal device 100, which is not specifically limited to this embodiment of the present application.

[0052] When a user is using the terminal device 100, the terminal device 100 can manage the application based on the application management method provided in the embodiment of the present application.

[0053] Exemplarily, the application control method includes: obtaining pop-up window startup information, the pop-up window startup information includes target application information and pop-up window startup frequency, wherein the target application information includes the target application identifier, the abnormal characteristics of the target application and the behavior information of the target application starting the pop-up window, and the target application is the application that starts the pop-up window; when the pop-up window startup frequency exceeds a preset number, the target application information is input into the trained application recognition model to calculate the target risk score, and the risk level of the target application is obtained based on the target risk score; the target application is graded and controlled according to the risk level of the target application. In this way, the abnormal application is controlled based on the risk score of the application, and the background pop-up window of the abnormal application is intercepted, which can more accurately block the background pop-up window advertisement of the abnormal application, and does not affect the pop-up window function of the normal application, and enables the application to display and promote normal advertisements.

[0054] For example, Figure 2 A schematic diagram of the hardware structure of a terminal device 100 provided in an embodiment of the present application is shown.

[0055] It is understandable that the terminal device 100 may also be referred to as a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc. The terminal device may be a mobile phone, a smart TV, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical surgery, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal in smart home, etc.

[0056] The terminal device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0057] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0058] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0059] The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of instruction fetching and execution.

[0060] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0061] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the terminal device 100. While the charging management module 140 is charging the battery 142, it may also power the terminal device through the power management module 141.

[0062] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the terminal device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0063] The terminal device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or change display information.

[0064] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the terminal device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0065] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the terminal device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0066] The internal memory 121 can be used to store computer executable program codes, which include instructions. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area may store data created during the use of the terminal device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various functional applications and data processing of the terminal device 100 by running instructions stored in the internal memory 121 and / or instructions stored in a memory provided in the processor.

[0067] The touch sensor 180K is also called a "touch control device". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch control screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the terminal device 100, which is different from the position of the display screen 194.

[0068] The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The terminal device 100 may receive key input and generate key signal input related to user settings and function control of the terminal device 100.

[0069] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0070] The software system of the terminal device 100 may adopt a layered architecture, an event-driven architecture, a micro-kernel architecture, a micro-service architecture, or a cloud architecture. The embodiment of the present invention takes the Android system of a layered architecture as an example to exemplify the software structure of the terminal device 100.

[0071] For example, Figure 3 A software structure diagram of a terminal device 100 provided in an embodiment of the present application is shown in FIG. Figure 3 As shown, the layered architecture divides the software into several layers. Each layer has a clear role and division of labor, and the layers communicate with each other through software interfaces.

[0072] In some embodiments, the Android system can be divided into four layers, namely, from top to bottom, an application layer, an application framework layer, an Android runtime and system library, and a kernel layer.

[0073] In a possible manner, the application layer may include a series of application packages, for example, the application package may include third-party applications, system applications, settings, WIFI and other applications, wherein the third-party applications may be, for example, shopping applications, office applications, social applications, etc. The system application may be, for example, a mobile phone manager, etc.

[0074] It should be noted that in the embodiment of the present application, the system application may include an abnormal application identification module, an abnormal application control module, a risk control center (new behavior control), and a startup management module. Among them, the abnormal application identification module can identify the risk level of the application; the abnormal application control module can perform hierarchical control on the application; the applications in the risk control center that are controlled can be prohibited from background pop-ups, frequent notifications, network connections, etc.; the startup management module can prohibit the startup of the controlled application.

[0075] In a possible manner, the application framework layer provides an application programming interface (API) and a programming framework for applications in the application layer. The application framework layer may include an input system, a notification manager, a window manager, a package manager, a resource manager, and a view system, etc.

[0076] The input system is used to manage the programs of the input devices. For example, the input system can determine input operations such as mouse click operations, keyboard input operations, and touch sliding operations.

[0077] Among them, the notification manager enables applications to display notification information in the status bar, which can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as a notification of an application running in the background, or a notification that appears on the screen in the form of a dialog window, such as a text message prompt in the status bar, a reminder sound, an electronic device vibrating, an indicator light flashing, etc.

[0078] Among them, the window manager is used to manage window programs, and the window manager can obtain the size of the display screen.

[0079] Among them, the package manager is used for program management within the system, such as application installation, uninstallation and upgrade.

[0080] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, etc.

[0081] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0082] It should be noted that in an embodiment of the present application, the application framework layer may also include a behavior feature collector, so that the behavior feature collection module in the behavior feature collector can obtain the behavior that triggers the background pop-up window and the abnormal characteristics of the application that pops up the background pop-up window in the electronic device.

[0083] In a possible way, the Android runtime is responsible for the scheduling and management of the Android system, which may include core libraries and virtual machines.

[0084] Among them, the core library contains two parts: one part is the functional functions that need to be called by the Java language, and the other part is the Android core library.

[0085] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0086] The system library may include multiple functional modules, such as surface manager, media library, function library, 3D graphics processing library (such as OpenGL ES), etc.

[0087] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0088] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0089] The function library provides macros, type definitions, string operation functions, mathematical calculation functions, and input and output functions used in the C language.

[0090] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0091] The kernel layer is the layer between hardware and software. The kernel layer includes at least touch panel driver, LCD / LED screen driver, display driver, Bluetooth driver, WIFI driver, keyboard driver, shared memory driver and camera driver.

[0092] Hardware can be audio devices, Bluetooth devices, camera devices, sensor devices, etc.

[0093] Next, we combine the cloud and Figure 3 The corresponding embodiments are exemplarily described as follows. Figure 3 As shown, the application identification model can be pre-trained in the big data platform in the cloud, and the cloud can send the trained application identification model to the terminal device. When the frequency of pop-up windows of the application exceeds a preset number, the behavior feature collector of the application framework layer can obtain the dynamic behavior and static features of the application, and input the dynamic behavior and static features of the application into the application identification model in the abnormal application identification module to identify the risk level of the application. The abnormal application management and control module manages the application based on the risk level of the application.

[0094] The following, in conjunction with the accompanying drawings, describes in detail the technical solutions of the embodiments of the present application and how the technical solutions of the embodiments of the present application solve the above-mentioned technical problems with specific embodiments. The following specific embodiments can be implemented independently or in combination with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0095] Figure 4 The following is a flow chart of an application management method provided in an embodiment of the present application. Figure 4 As shown, the method may include:

[0096] S401: Obtain pop-up window startup information, the pop-up window startup information includes target application information and pop-up window startup frequency, wherein the target application information includes the target application identifier, abnormal characteristics of the target application and behavior information of the target application starting the pop-up window, and the target application is the application that starts the pop-up window.

[0097] In an embodiment of the present application, the pop-up window may be a background pop-up window, which may be understood as a window that is popped up by an application running in the background and covers other application interfaces, such as a pop-up window that is popped up by an application running in the background and covers the desktop or lock screen interface.

[0098] In the embodiment of the present application, the identifier of the target application can be used to represent the application that starts the pop-up window, and the identifier of the target application can be in any form such as field, character or value. For example, the identifier of the target application can be the package name of the target application.

[0099] In an embodiment of the present application, the abnormal characteristics of the target application may be characteristics used to determine whether the target application is an abnormal application. For example, the abnormal characteristics of the target application may include a self-starting and keeping alive feature, a background pop-up window connecting to an advertising website feature, a counterfeit system application feature and / or a hidden feature, etc. Among them, the self-starting and keeping alive feature may be that the application starts and keeps alive by itself, the background pop-up window connecting to an advertising website feature may be that the background pop-up window started by the application is connected to the advertising website, so that advertising display resources can be obtained, the counterfeit system application feature may be that the name of the application or the desktop icon is similar to the system application so as not to attract the user's attention, and the hidden feature may be that after the application is started, the desktop icon of the application disappears. It can be understood that there may be more than one abnormal feature of the target application corresponding to each pop-up window, and there may be multiple.

[0100] In the embodiment of the present application, the behavior information of the behavior of the target application starting a pop-up window may include the behavior information of the behavior of causing the application to pop up a pop-up window on the interface of the application running in the foreground when the application is running in the background. For example, after the target application monitors the triggering event, the target application starts the pop-up window. Exemplarily, the triggering event may be a system event as shown in Table 1. When the target application running in the background monitors any system event in Table 1, the target application pops up a pop-up window. This example does not constitute a specific limitation on the embodiment of the present application.

[0101] Table 1

[0102] System Events Home button (including gesture home events) Unlock screen Charging connection / disconnection Screen on / off Lock screen Wi-Fi disconnection Bluetooth disconnected Application installation and uninstallation Press the Back key Switch from background to foreground Shake it Volume Change Power changes Insert and remove secure digital (SD) card Wallpaper Change Timer

[0103] Exemplarily, after the application is started, it runs in the background and stays alive. When the application monitors system events, such as a broadcast of volume changes issued by the system, the application pops up a pop-up window on the desktop, lock screen interface, or other application interface, and records the frequency of pop-up window startup, the identification of the application that started the pop-up window, the behavioral information that triggered the application to start the pop-up window: volume change, and the abnormal characteristics of the application: staying alive.

[0104] It should be noted that the target application may be passively started after receiving a user's start operation, or may be started by other applications, or the target application may start itself by taking some means, such as using some system paths to start itself. The embodiments of this application do not specifically limit the way to start the application.

[0105] S402: When the frequency of pop-up window activation exceeds a preset number, the target application information is input into a trained application recognition model to calculate a target risk score, and the risk level of the target application is obtained based on the target risk score.

[0106] In an embodiment of the present application, the target risk score is used to determine the risk level of the target application. The risk level of the target application may include multiple levels. For example, the risk level of the target application may include a high risk level, a medium risk level, and a low risk level.

[0107] In a possible implementation, when the frequency of pop-up window activation exceeds a preset number, or when the number of pop-up window activations exceeds a preset value within a preset time period, the embodiment of the present application can obtain the risk level of the target application based on the acquired target application information.

[0108] For example, an application identification model that determines the risk level of a target application based on target application information can be pre-trained, and then the risk level of the target application is obtained based on the application identification model. The specific model training method will be described in detail in subsequent steps and will not be described here.

[0109] In an embodiment of the present application, the obtained risk level of the target application can be recorded in the terminal device, so that the target application can be subsequently controlled in a graded manner based on the recorded risk level of the target application.

[0110] S403: Perform hierarchical management and control on the target application according to its risk level.

[0111] In a possible implementation, target applications of different risk levels correspond to different management and control strategies. The management and control strategies may be rules for managing applications. For example, the management and control strategies may include reminding users to uninstall applications, adding applications to the risk management center, reminding users to add applications to the risk management center, prohibiting application startup, etc.

[0112] In the embodiment of the present application, applications added to the risk management center after the risk level is determined, applications that are uninstalled, applications that are prohibited from starting, and other applications may be abnormal applications, and applications other than abnormal applications may be normal applications.

[0113] In the embodiment of the present application, by obtaining pop-up window startup information, the pop-up window startup information includes target application information and pop-up window startup frequency, wherein the target application information includes the identification of the target application, the abnormal characteristics of the target application and the behavior information that triggers the target application to start the pop-up window, and the target application is the application that starts the pop-up window; when the pop-up window startup frequency exceeds the preset number, the target application information is input into the trained application recognition model to calculate the target risk score, and the risk level of the target application is obtained based on the target risk score; the target application is graded and controlled according to the risk level. In this way, applications with different risk levels are graded and controlled, so that the pop-up windows of abnormal applications can be shielded, so that the abnormal application cannot display background pop-up ads, and the pop-up window function of normal applications is not affected, and the application can display and promote normal ads, which effectively improves the flexibility of application management.

[0114] On the basis of the above embodiments, in order to more clearly describe the technical solutions of the embodiments of the present application, for example, please refer to Figure 5 , Figure 5 A schematic diagram of a process of an application management method provided in an embodiment of the present application is shown, and the method includes:

[0115] S501: collecting status and behavior characteristics.

[0116] The status may include device status and application status. The device status refers to the status of the terminal device, which may include screen off / on, stationary / moving, and locked / unlocked, etc. The application status may include foreground running / background running, full screen / non-full screen, and floating / transparent, etc.

[0117] Among them, behavioral features may include static features of applications and dynamic behaviors of applications. Static features of applications may include registered system monitoring events and permissions. Registered system monitoring events may include: lock screen / screen on / screen off, network status changes, and Bluetooth / wifi connections, etc. Permissions may include permissions to obtain contacts / text messages / call logs and prohibit lock screen, etc. Static features of applications may also include features such as application developer area, application area, and application installation source.

[0118] It should be noted that the static features of the application can be collected when the terminal device downloads the application, or when the terminal device obtains the installation package of the application, the terminal device can collect the static features of the application.

[0119] Application dynamic behaviors may include abnormal pop-up window categories, hidden behavior categories, self-start and keep-alive categories, and information acquisition categories. Abnormal pop-up window categories may include desktop / lock screen pop-ups, unclear notifications, and background pop-ups connecting to advertising resource websites; hidden behavior categories may include hiding desktop icons and hiding taskbars; self-start and associated startup of applications; information acquisition categories may include screen off / lock screen, background permission usage, data acquisition, etc. It is understandable that the behavior characteristics may be the target application information in the embodiments of the present application. In a possible implementation, the above-mentioned status and behavior characteristics may also be obtained when obtaining the pop-up startup information.

[0120] For example, each time a pop-up window pops up, the device status and application status, application static features, and application dynamic behaviors at that time are recorded.

[0121] In the embodiment of the present application, by collecting rich status and behavior characteristics to comprehensively identify applications, the accuracy of application identification is effectively improved.

[0122] S502: Identify the target application based on the application identification model to obtain the risk level of the target application.

[0123] In a possible implementation, when the frequency of pop-up window activation exceeds a preset number, or when the number of pop-up window activations exceeds a preset value within a preset time period, the embodiment of the present application can obtain the risk level of the target application based on the collected status and behavior characteristics.

[0124] For example, an application identification model that determines the risk level of the target application based on the collected state and behavior characteristics can be pre-trained, and then the risk level of the target application can be obtained based on the application identification model. The specific model training method is similar or the same as the training method of the application identification model that determines the risk level of the target application based on the target application information in the subsequent steps, and will not be repeated here.

[0125] Optionally, the target application information is input into a trained application identification model to calculate the target risk score, and the risk level of the target application is obtained based on the target risk score, including: performing a sum operation on the risk scores corresponding to the target application information to obtain the target risk score; when the target risk score is greater than a first threshold, determining that the risk level of the target application is high risk; when the target risk score is less than or equal to the first threshold and greater than a second threshold, determining that the risk level of the target application is medium risk; when the target risk score is less than or equal to the second threshold, determining that the risk level of the target application is low risk.

[0126] In the embodiment of the present application, the risk score, the first threshold and the second threshold corresponding to the target application information can be parameters configured when training the application recognition model in the cloud, and these parameters can be flexibly configured and debugged in the cloud. The target risk score corresponding to the combination of different abnormal features of each target application and the behavior information of different behaviors of starting pop-up windows is different.

[0127] In a possible implementation, the pre-trained model is configured with a risk score corresponding to the target application information, a first threshold and a second threshold. The acquired target application information is input into the pre-trained application identification model. The application identification model performs a sum operation on the risk scores corresponding to the target application information of the same target application to obtain the target risk score of the target application. The target risk score of the target application is compared with the first threshold and / or the second threshold to determine the risk level of the target application.

[0128] Exemplarily, the pre-trained model is configured with a risk score R1 corresponding to the feature of a background pop-up window connected to an advertising website, and a risk score R2 corresponding to the behavior of monitoring a pop-up window after the screen is unlocked. The first threshold is M, and the second threshold is N. When the application monitors that a background pop-up window pops up after the terminal device unlocks the screen, and the background pop-up window is connected to an advertising website, the target risk score of the application is R1+R2. When R1+R2 exceeds M, the risk level of the application is determined to be high risk. When R1+R2 is between M and N, the risk level of the application is determined to be medium risk. When R1+R2 is less than or equal to M, the risk level of the application is determined to be low risk.

[0129] In an embodiment of the present application, the target risk score is comprehensively calculated through the target application information. Based on the comparison between the target risk score and the first threshold and / or the second threshold, the risk level of the target application can be determined more accurately, which helps to improve the accuracy of subsequent management and control.

[0130] S503: Perform hierarchical management on the target application according to its risk level, including: when the risk level of the target application is high risk, remind the user to uninstall the target application. If the user refuses to uninstall, add the target application to the risk management center; when the risk level of the target application is medium risk, remind the user to add the target application to the risk management center; when the risk level of the target application is low risk, send the target application identifier and target application information to the cloud.

[0131] Exemplarily, when the mobile phone detects that the risk level of the target application is high risk, an uninstall interface is displayed to remind the user to uninstall the target application. If the user refuses to uninstall, the target application is added to the risk management center for management, and the user does not need to be reminded whether to add the target application to the risk management center. When the mobile phone detects that the risk level of the target application is medium risk, a reminder interface is displayed to remind the user to add the target application to the risk management center. When the mobile phone detects that the risk level of the target application is low risk, the target application identifier and target application information can be sent to the cloud for subsequent analysis, and there is no need to manage target applications with low risk levels.

[0132] For example, Figure 6a A schematic diagram of a reminder interface provided in an embodiment of the present application, when the mobile phone detects that the risk level of the target application is medium risk, the following is displayed Figure 6a The interface shown in the figure. Figure 6a The interface shown may include notification 601, notification information 602, prompt button 603, continue to use button 604 and control button 605, wherein notification 601 prompts the user that "abnormal application is found", and notification information 602 prompts the user that "'Application A' frequently displays pop-up ads on the desktop or lock screen, affecting the device usage experience. It is recommended to control to prohibit abnormal application behavior."

[0133] For example, Figure 6b A schematic diagram of a management and control interface provided in an embodiment of the present application is shown.

[0134] In such Figure 6a In the interface shown, when the mobile phone detects the user's trigger operation on the control button 605, it displays Figure 6b The interface shown in the figure. Figure 6b The interface shown may include a one-click control button 606, a list of uncontrolled risk applications 607, a list of controlled risk applications 608, and a notification message "To reduce the threat of risk applications, risk applications will be prohibited from popping up ads in the background of desktop, lock screen and other interfaces after control". Among them, the list of uncontrolled risk applications 607 may include the application names of multiple uncontrolled applications and the corresponding application properties: abnormal applications, and an uninstall button, wherein applications with abnormal application properties may include applications that frequently pop up background advertisements on the desktop, lock screen interface or other application interfaces, as well as other applications that have a more serious impact on the user's use of the terminal device. The list of controlled risk applications 608 may include the application names of multiple controlled applications and the corresponding application properties: abnormal applications, and an uninstall button.

[0135] In the embodiment of the present application, by reminding the user to uninstall the target application with a high risk level, if the user does not uninstall, the target application will be added to the risk management center, and the user will be reminded to add the target application with a medium risk level to the risk management center, and the target application with a low risk level can be controlled. In this way, the target application with a high risk level and the target application with a medium risk level can be added to the risk management center, so that the background pop-up windows of the target application with a high risk level and the target application with a medium risk level can be intercepted later, so that the target application with a high risk level and the target application with a medium risk level cannot display the background pop-up window advertisement, which not only improves the user experience but also does not affect the normal display and promotion of the application advertisement.

[0136] Optionally, after adding the target application to the risk control center, the method further includes: intercepting pop-up windows of the target application.

[0137] In a possible implementation, after the target application is added to the risk management center, the pop-up window of the target application is intercepted to prohibit the target application from launching a background pop-up window.

[0138] It should be noted that when the target application has more and more frequent behaviors that disturb the user, after adding the target application to the risk management center, the terminal device can further prohibit the behavior of the target application and / or the behavior that triggers the behavior of the target application. Exemplarily, prohibiting the behavior of the target application and / or the behavior that triggers the behavior of the target application may include prohibiting sensitive permissions, prohibiting network connections, and prohibiting frequent notifications.

[0139] In the embodiment of the present application, the pop-up window of the target application is intercepted to prohibit the target application from launching the background pop-up window, so that the target application cannot pop up the background pop-up window advertisement, thereby improving the user experience.

[0140] In the embodiment of the present application, the target application is identified through state and behavior feature collection and based on the application identification model, and the risk level of the target application is obtained. When the risk level of the target application is high risk, the user is reminded to uninstall the target application. If the user refuses to uninstall, the target application is added to the risk management center; when the risk level of the target application is medium risk, the user is reminded to add the target application to the risk management center; when the risk level of the target application is low risk, the target application identifier and target application information are sent to the cloud. In this way, applications of different risk levels are managed in a graded manner, so that the pop-up windows of abnormal applications can be shielded, so that abnormal applications cannot display background pop-up ads, and the pop-up window function of normal applications is not affected, and the application can display and promote normal ads.

[0141] On the basis of the above embodiments, in order to more clearly describe the technical solutions of the embodiments of the present application, for example, please refer to Figure 7 , Figure 7A flow chart of another application management method provided in an embodiment of the present application is shown, and the method includes:

[0142] S701: The terminal device perceives the behavioral characteristics of the application.

[0143] In the embodiment of the present application, the behavior feature may be the target application information in the embodiment of the present application, and the behavior feature may include the dynamic behavior of the application and the static feature of the application.

[0144] It should be noted that the features collected by the terminal device are group characteristics and do not involve user identity characteristics.

[0145] In a possible implementation, the terminal device collects the behavioral features of the application and reports a large number of behavioral features to the cloud for training the application recognition model.

[0146] S702: Apply recognition model training.

[0147] In the embodiment of the present application, the training of the application recognition model can be completed in the cloud.

[0148] Exemplarily, the cloud performs big data analysis or artificial intelligence (AI) modeling based on a large amount of received behavioral features to obtain an application recognition model.

[0149] For example, when big data analysis is performed based on a large number of behavioral characteristics, some applications can be determined to be abnormal applications after the analysis is completed. These abnormal applications can be added to the abnormal application library. When the terminal device obtains the abnormal application library from the cloud, if the target application is in the abnormal application library, the terminal device can quickly determine that the target application is an abnormal application based on the abnormal application library without making a judgment, thereby managing and controlling the target application.

[0150] Optionally, the trained application identification model can be obtained by taking the first application information as the input of the application identification model and training the application identification model with the value of the loss function being less than a third threshold as the goal; the first application information is the application information of any application with pop-up behavior; the loss function is used to indicate the difference between the target risk level and the application risk level output by the application identification model.

[0151] Exemplarily, when training a model, at least one training sample can be obtained, the training sample including a target risk level and first application information, the first application information is used as input of an application identification model, and the model is trained with the application risk level of the application corresponding to the first application information as output, and when the difference between the target risk level and the application risk level output by the application identification model meets a condition, a trained application identification model is obtained, and the trained application identification model is configured with risk scores corresponding to each target application information.

[0152] In an embodiment of the present application, the application identification model is obtained in advance by taking the first application information as the input of the application identification model and training with the value of the loss function being less than the third threshold as the goal, so that the risk level of the target application can be identified based on the application identification model later.

[0153] S703: Identify the risk level of the target application.

[0154] In a possible implementation, the cloud will send the trained application recognition model to the terminal device. When the pop-up window startup frequency of the target application exceeds the preset number, the terminal device will input the collected behavior characteristics of the target application into the trained application recognition model for identification to obtain the risk level of the target application, or the terminal device will determine whether the target application is an abnormal application based on the abnormal application library.

[0155] S704: Perform hierarchical management and control on the target application according to the risk level of the target application.

[0156] This step is similar or identical to the above step S503 and will not be described in detail here.

[0157] Optionally, control policy configuration can be performed in the cloud, and the control policy configuration is used to formulate control policies (also called control rules) for the controlled applications.

[0158] In a possible implementation, the cloud sends the formulated control policy to the terminal device periodically or when the formulated control policy changes, so as to update the control policy for high-risk applications and medium-risk applications in the terminal device.

[0159] Optionally, the user may choose to feed back target application information of the target application to the cloud based on the risk level of the target application identified by the application identification model.

[0160] For example, when the target application is identified as a medium-risk application, the terminal device displays the following Figure 6a In the reminder interface shown, when the user selects the continue button 604, the terminal device can re-upload the target application information of the target application to the cloud so that the application recognition model can be corrected later.

[0161] In an embodiment of the present application, a large number of behavioral features are reported to the cloud through the terminal device, and an application recognition model is pre-trained in the cloud based on these behavioral features and sent to the terminal device. When the frequency of pop-up windows in the terminal device exceeds a preset number, the application model begins to identify the risk level of the target application, and performs graded management and control on target applications of different risk levels, thereby shielding pop-ups of abnormal applications, making it impossible for abnormal applications to display background pop-up ads, without affecting the pop-up function of normal applications, and allowing the application to display and promote normal ads.

[0162] Combined with the above Figure 4-Figure 7 , the method provided in the embodiment of the present application is described, and the device for executing the above method provided in the embodiment of the present application is described below. Figure 8 As shown, Figure 8 A structural schematic diagram of an application control device provided in an embodiment of the present application. The application control device can be a terminal device in an embodiment of the present application, or a chip or chip system in the terminal device.

[0163] like Figure 8 As shown, the application management device 800 can be used in a communication device, a circuit, a hardware component or a chip, and the application management device includes: a display unit 801 and a processing unit 802. The display unit 801 is used to support the display of the reminder interface schematic diagram and the management interface, and the processing unit 802 is used to support the application management device to perform application management steps, for example, the processing unit is used to process Figure 4 Steps S401 to S403 in .

[0164] The processing unit 802 may be integrated with the display unit 801 , and the processing unit 802 and the display unit 801 may communicate with each other.

[0165] In a possible implementation, the application management and control apparatus may further include: a storage unit 804. The storage unit 804 may include one or more memories, and the memory may be a device in one or more devices or circuits for storing programs or data.

[0166] The storage unit 804 may exist independently and be connected to the processing unit 802 via a communication bus. The storage unit 804 may also be integrated with the processing unit 802.

[0167] Taking the application control device as an example, the chip or chip system of the terminal device in the embodiment of the present application, the storage unit 804 can store the computer execution instructions of the method of the terminal device, so that the processing unit 802 executes the method of the terminal device in the above embodiment. The storage unit 804 can be a register, a cache or a random access memory (RAM), etc., and the storage unit 804 can be integrated with the processing unit 802. The storage unit 804 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, and the storage unit 804 can be independent of the processing unit 802.

[0168] In a possible implementation, the application control device may further include: a communication unit 803. The communication unit 803 is used to support the application control device to interact with other devices. Exemplarily, when the application control device is an electronic device, the communication unit 803 may be a communication interface or an interface circuit. When the application control device is a chip or a chip system in an electronic device, the communication unit 803 may be a communication interface. For example, the communication interface may be an input / output interface, a pin or a circuit, etc.

[0169] The device of this embodiment can be used to execute the steps executed in the above method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0170] Fig. 9 A schematic diagram of the hardware structure of another terminal device provided in an embodiment of the present application is shown in FIG. Fig. 9 As shown, the terminal device includes a processor 901, a communication line 904 and at least one communication interface ( Fig. 9 The communication interface 903 is used as an example for explanation).

[0171] The processor 901 may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0172] Communications link 904 may include circuitry to transmit information between the above-described components.

[0173] The communication interface 903 uses any transceiver or other device for communicating with other devices or communication networks, such as Ethernet, wireless local area networks (WLAN), etc.

[0174] Possibly, the terminal device may further include a memory 902 .

[0175] The memory 902 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via a communication line 904. The memory may also be integrated with the processor.

[0176] The memory 902 is used to store computer-executable instructions for executing the solution of the present application, and the execution is controlled by the processor 901. The processor 901 is used to execute the computer-executable instructions stored in the memory 902, thereby implementing the method provided by the embodiment of the present application.

[0177] Possibly, the computer-executable instructions in the embodiments of the present application may also be referred to as application code, and the embodiments of the present application do not specifically limit this.

[0178] In a specific implementation, as an example, the processing 901 may include one or more CPUs, such as Fig. 9 CPU0 and CPU1 in.

[0179] In a specific implementation, as an embodiment, the terminal device may include multiple processors, such as Fig. 9 901 and processor 905 in the embodiment of the present invention. Each of these processors may be a single-CPU processor or a multi-CPU processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0180] For example, Fig.10 A schematic diagram of the structure of a chip provided in an embodiment of the present application. The chip 1000 includes one or more (including two) processors 1002 and a communication interface 1003 .

[0181] In some implementations, the memory 1004 stores the following elements: executable modules or data structures, or a subset thereof, or an extended set thereof.

[0182] In the embodiment of the present application, the memory 1004 may include a read-only memory and a random access memory, and provide instructions and data to the processor 1002. A portion of the memory 1004 may also include a non-volatile random access memory (NVRAM).

[0183] In the embodiment of the present application, the memory 1004, the communication interface 1003 and the processor 1002 are coupled together through the bus system 1001. The bus system 1001 may include a power bus, a control bus and a status signal bus in addition to a data bus. Fig.10 Various buses are labeled as bus system 1001.

[0184] The method described in the above embodiment of the present application can be applied to the processor 1002, or implemented by the processor 1002. The processor 1002 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 1002 or an instruction in the form of software. The above-mentioned processor 1002 can be a general-purpose processor (for example, a microprocessor or a conventional processor), a digital signal processor (digital signal processing, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC), a field-programmable gate array (field-programmable gate array, FPGA) or other programmable logic devices, discrete gates, transistor logic devices or discrete hardware components. The processor 1002 can implement or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present invention.

[0185] The steps of the method disclosed in the embodiment of the present application can be directly embodied as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in a decoding processor. Among them, the software module can be located in a mature storage medium in the field such as a random access memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable read only memory (EEPROM). The storage medium is located in the memory 1004, and the processor 1002 reads the information in the memory 1004 and completes the steps of the above method in combination with its hardware. Its implementation principle and technical effects are similar to those of the above-mentioned related embodiments, and will not be repeated here.

[0186] The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program. The above method is implemented when the computer program is executed by the processor. The method described in the above embodiment can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. If implemented in software, the function can be stored as one or more instructions or codes on a computer-readable medium or transmitted on a computer-readable medium. Computer-readable media can include computer storage media and communication media, and can also include any medium that can transfer a computer program from one place to another. The storage medium can be any target medium that can be accessed by a computer.

[0187] In one possible implementation, a computer readable medium may include RAM, ROM, compact disc read-only memory (CD-ROM) or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that is intended to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer. Moreover, any connection is appropriately referred to as a computer readable medium. For example, if the software is transmitted from a website, server or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wireless technology (such as infrared, radio and microwave), the coaxial cable, fiber optic cable, twisted pair, DSL or wireless technology such as infrared, radio and microwave are included in the definition of medium. Disks and optical disks as used herein include optical disks, laser disks, optical disks, digital versatile discs (DVD), floppy disks and Blu-ray discs, where disks usually reproduce data magnetically, while optical disks reproduce data optically using lasers. Combinations of the above should also be included in the scope of computer readable media.

[0188] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed, the computer executes the above method.

[0189] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0190] The above specific implementation methods further illustrate the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation methods of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present invention should be included in the scope of protection of the present invention.

Claims

1. An application management and control method, characterized in that: include: Obtain pop-up window startup information, status and behavior characteristics, the pop-up window startup information includes target application information and pop-up window startup frequency, wherein the target application information includes the identifier of the target application, the abnormal characteristics of the target application and the behavior information of the target application starting the pop-up window, the target application is the application that starts the pop-up window, the abnormal characteristics of the target application include: self-starting keep-alive characteristics, background pop-up window connection advertising website characteristics, counterfeit system application characteristics and / or hidden characteristics; the behavior of the target application starting the pop-up window includes: after the target application monitors the triggering event, the target application starts the pop-up window; the status includes the device status and the application status, the behavior characteristics include application static characteristics and application dynamic behavior; the application static characteristics include registered system monitoring events and permissions, and the application dynamic behavior includes abnormal pop-up window class, hidden behavior class, self-starting keep-alive class and information acquisition class; When the pop-up window activation frequency exceeds a preset number, the target application information, the state and the behavior characteristics are input into a trained application recognition model to obtain a target risk score; Obtaining a risk level of the target application based on the target risk score; When the risk level of the target application is high risk, the user is reminded to uninstall the target application. If the user refuses to uninstall, the target application is added to the risk management center; When the risk level of the target application is medium risk, a reminder interface is displayed to remind the user to add the target application to the risk management center; the reminder interface includes a notification, a first notification message, a prompt button, a continue use button, and a management button, wherein the notification prompts the user to find an abnormal application; the first notification message prompts the user that the target application frequently displays pop-up ads on the desktop or lock screen, affecting the device usage experience, and it is recommended to perform management to prohibit abnormal application behavior; When the risk level of the target application is low risk, sending the identifier of the target application and the target application information to the cloud; After adding the target application to the risk management and control center, the method further includes: Intercepting pop-up windows of the target application; When the reminder interface is displayed, the method further includes: In response to the user's triggering operation on the control button, a first interface is displayed; the first interface includes a one-click control button, a list of uncontrolled risk applications, a list of controlled risk applications, and a second notification message; the second notification message prompts the user that in order to reduce the threat of risk applications, risk applications will be prohibited from popping up advertisements in the background of desktop, lock screen and other interfaces after control; the list of uncontrolled risk applications includes the application name of at least one uncontrolled application and the corresponding application properties: abnormal application, and an uninstall button; the list of controlled risk applications includes the application name of at least one controlled application and the corresponding application properties: abnormal application, and an uninstall button; In response to the user triggering operation on the continue use button, the identifier of the target application and the target application information are sent to the cloud.

2. The method according to claim 1, characterized in that The obtaining the risk level of the target application based on the target risk score includes: When the target risk score is greater than a first threshold, the risk level of the target application is determined to be high risk; when the target risk score is less than or equal to the first threshold and greater than a second threshold, the risk level of the target application is determined to be medium risk; when the target risk score is less than or equal to the second threshold, the risk level of the target application is determined to be low risk.

3. The method according to claim 1 or 2, characterized in that: The trained application identification model is obtained by taking the first application information as the input of the application identification model and training the application identification model with the goal of a value of the loss function being less than a third threshold; The first application information is application information of any application with pop-up behavior; the loss function is used to indicate the difference between the target risk level and the application risk level output by the application identification model.

4. The method according to claim 3, characterized in that Also includes: The training of the application identification model is completed in the cloud, and the trained application identification model is configured with a risk score corresponding to the target application information.

5. A terminal device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the terminal device executes the method according to any one of claims 1 to 4.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images