Method and device for detecting a fake app, and terminal

Abstract

A kind of detection method and device of fake APP, terminal, the method includes: determining training data;Keyword extraction is carried out to the brief introduction of each pair of target APP and the brief introduction of suspected APP, and the data vector of each keyword is determined;Determine the weight value of each keyword, and the data vector of each keyword in the target APP is weighted based on the weight value Operation is carried out to obtain target APP data vector, and obtain suspected APP data vector;The vector comparison result of target APP data vector and suspected APP data vector is calculated, the absolute value of the vector comparison result is determined as first data vector, and the square of the vector comparison result is determined as second data vector;Obtain the training text vector of the pair of target APP and suspected APP;Training fake detection model.The present application can enhance the association between keywords in model training phase, reduce the misjudgment rate.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, and terminal for detecting counterfeit apps. Background Technology

[0002] With the rapid development of Internet technology and the widespread adoption of smart terminals, application (APP) related technologies have flourished. Various APPs that can meet users' application needs in different fields and on different issues have emerged one after another, and the problem of counterfeit APPs has become increasingly serious.

[0003] Existing counterfeit app detection technologies typically extract text descriptions (e.g., a brief introduction) and then compare the text similarity between the target app and the suspected app, or identify the app's image and then compare the image similarity between the target app and the suspected app. However, judging counterfeit results solely by comparing text or image similarity has a high false positive rate.

[0004] There is an urgent need for a method to detect counterfeit apps that can enhance the correlation between keywords during the model training phase, effectively improving the accuracy of counterfeit app detection and reducing the false positive rate. Summary of the Invention

[0005] The technical problem solved by this invention is to provide a method, device, and terminal for detecting counterfeit apps, which can enhance the correlation between keywords during the model training stage, effectively improve the detection accuracy of counterfeit apps, and reduce the false positive rate.

[0006] To address the aforementioned technical problems, this invention provides a method for detecting counterfeit apps, comprising: determining training data, wherein the training data includes descriptions of multiple target apps and descriptions of multiple suspected apps, as well as counterfeit judgment results between pairs of target apps and suspected apps; extracting keywords from the descriptions of each pair of target apps and suspected apps, and determining data vectors for each keyword, wherein the data vectors have a first preset number of dimensions; determining weight values ​​for each keyword, and performing weighted operations on the data vectors of each keyword in the target apps based on the weight values ​​to obtain target app data vectors, and performing weighted operations on the data vectors of each keyword in the suspected apps based on the weight values ​​to obtain suspected app data vectors; calculating a vector comparison result between the target app data vectors and the suspected app data vectors, determining the absolute value of the vector comparison result as a first data vector, and determining the square of the vector comparison result as a second data vector; concatenating at least the first data vector and the second data vector to obtain training text vectors for the pair of target apps and suspected apps; and training a counterfeit detection model based on the training text vectors of multiple pairs of target apps and suspected apps and the counterfeit judgment results.

[0007] Optionally, the method further includes: determining the text vectors of the target APP to be detected and the suspected APP to be detected; inputting the text vectors into the counterfeiting detection model to determine whether there is a counterfeiting relationship between the target APP to be detected and the suspected APP to be detected.

[0008] Optionally, before determining the data vectors of each keyword, the method further includes: using the word2vec algorithm to convert the preset corpus into a data vector with a first preset number of dimensions.

[0009] Optionally, before converting the preset corpus into a data vector of preset dimensions, the method further includes: performing noise reduction and / or word segmentation on the preset corpus.

[0010] Optionally, determining the weight value of each keyword includes: determining the first frequency of each keyword appearing in its respective description and the second frequency of the keyword appearing in a preset APP description database; and using the product of the logarithm of the second frequency and the first frequency as the weight value of the keyword.

[0011] Optionally, the first frequency of each keyword in its corresponding profile can be determined using the following formula:

[0012]

[0013] Among them, tf ijThis is used to indicate the first frequency of each keyword in its corresponding profile, where i represents the index of the i-th keyword, j represents the index of the j-th profile, and n... ij n represents the number of times the i-th keyword appears in the j-th description; k represents the index of the k-th word in the j-th description; K represents the total number of words in the j-th description; n represents the total number of words in the j-th description. kj This is used to represent the number of times the k-th word appears in the current j-th description; where i, j, k, and K are all positive integers, and 1 ≤ k ≤ K.

[0014] Optionally, the preset APP description database contains descriptions of multiple APPs; the logarithm of the reciprocal of the second frequency of each keyword appearing in the preset APP description database is determined using the following formula:

[0015]

[0016] Among them, idf i This is used to represent the logarithm of the second frequency of each keyword in the preset APP description database, where i represents the index of the i-th keyword, j represents the index of the j-th description, and t... i Used to represent the i-th keyword, d j Used to represent the j-th profile; |D| is used to represent the number of at least some apps in the app profile database, |{j:t i ∈d j}| is used to indicate that the description of at least a portion of the APP contains t i The number of apps; where i and j are both positive integers.

[0017] Optionally, the vector comparison result between the target APP data vector and the suspected APP data vector is: the difference between the target APP data vector and the suspected APP data vector; or, the quotient between the target APP data vector and the suspected APP data vector.

[0018] Optionally, at least the first data vector and the second data vector are concatenated, including: determining the type list vector of the paired target APP and suspected APP, wherein the type list vector is used to represent the APP types common to the target APP and suspected APP, and has a second preset number of dimensions; concatenating the first data vector, the second data vector and the type list vector to obtain the training text vector.

[0019] Optionally, the training text vector is a single-row, multi-column vector, wherein the number of columns in the training text vector is twice the first preset number and the sum of the second preset number.

[0020] Optionally, the step of training the counterfeit detection model based on the training text vectors of multiple pairs of target apps and suspected apps and the counterfeit judgment results includes: constructing a loss function and an initial training counterfeit detection model; substituting the training text vectors of the multiple pairs of target apps and suspected apps and the counterfeit judgment results into the initial training counterfeit detection model, and minimizing the loss function to determine the trained counterfeit detection model.

[0021] Optionally, constructing the loss function and the initial training spoofing detection model includes: using a classification tree algorithm to determine the initial training spoofing detection model; and / or using the XGboost algorithm to determine the loss function.

[0022] Optionally, the counterfeit detection model is represented as follows:

[0023]

[0024] in, The p-th classification tree is used to represent the counterfeit detection model, where P represents the number of classification trees in the classification tree algorithm, p represents the index of the p-th classification tree, q represents the target app, q' represents the suspected app, and x represents the counterfeit app. q Used to represent the target APP data vector, x q’ Used to represent suspected APP data vectors; |x q -x q′ | is used to represent the first data vector, |x q -x q′ | 2 Used to represent the second data vector, a qq′ Used to represent a list vector of types.

[0025] Optionally, the counterfeit detection model is represented as follows:

[0026]

[0027] in, The p-th classification tree is used to represent the counterfeit detection model, where P represents the number of classification trees in the classification tree algorithm, p represents the index of the p-th classification tree, q represents the target app, q' represents the suspected app, and x represents the counterfeit app. q Used to represent the target APP data vector, x q' Used to represent suspected APP data vectors, where p and P are positive integers, and 1 ≤ p ≤ P; |x q / x q′ | is used to represent the first data vector, |x q / x q′ | 2Used to represent the second data vector, a qq′ Used to represent a list vector of types.

[0028] Optionally, the loss function is expressed as follows:

[0029]

[0030] in, Used to represent the loss function, y is used to represent the calculation result obtained using the counterfeit detection model. qq′ The term is used to represent the counterfeit detection results in the training data, where M represents the logarithm of the target app and the suspected app, and m represents the index of the m-th pair of target and suspected apps. Used to represent the m-th Logistic loss function, where m and M are positive integers and 1 ≤ m ≤ M.

[0031] Optionally, the loss function is expressed as follows:

[0032]

[0033] in, Used to represent the loss function, y is used to represent the calculation result obtained using the counterfeit detection model. qq′ The term is used to represent the counterfeit detection results in the training data, where M represents the logarithm of the target app and the suspected app, and m represents the index of the m-th pair of target and suspected apps. The m-th Logistic loss function is used to represent the logistic loss function, where m and M are positive integers and 1 ≤ m ≤ M; P represents the number of classification trees in the classification tree algorithm, p represents the index of the p-th classification tree, and Ω(f p ) is used to represent the regularization penalty value of the p-th classification tree.

[0034] To address the aforementioned technical problems, this invention provides a device for detecting counterfeit apps, comprising: a data determination module for determining training data, the training data including descriptions of multiple target apps and descriptions of multiple suspected apps, as well as counterfeit judgment results between pairs of target apps and suspected apps; a word vector determination module for extracting keywords from the descriptions of each pair of target apps and suspected apps, and determining data vectors for each keyword, wherein the data vectors have a first preset number of dimensions; and a first data vector determination module for determining the weight value of each keyword, and performing a weighted operation on the data vectors of each keyword in the target apps based on the weight value to obtain the target app. The system comprises: a data vector, and a data vector for each keyword in the suspected APP, weighted according to the weight value, to obtain a suspected APP data vector; a second data vector determination module, used to calculate the vector comparison result of the target APP data vector and the suspected APP data vector, determine the absolute value of the vector comparison result as a first data vector, and determine the square of the vector comparison result as a second data vector; a text vector determination module, used to concatenate at least the first data vector and the second data vector to obtain the training text vector of the pair of target APP and suspected APP; and a training module, used to train a counterfeiting detection model based on the training text vectors of multiple pairs of target APP and suspected APP and the counterfeiting judgment result.

[0035] To address the aforementioned technical problems, embodiments of the present invention provide a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, performs the steps of the aforementioned method for detecting counterfeit apps.

[0036] To address the aforementioned technical problems, this invention provides a terminal, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it executes the steps of the aforementioned method for detecting counterfeit apps.

[0037] Compared with the prior art, the technical solution of the embodiments of the present invention has the following beneficial effects:

[0038] In this embodiment of the invention, by determining the training data, a pre-determined counterfeit detection result can be obtained for training. By determining the keyword data vectors and weight values, a weighted operation can be used to obtain the target APP data vector and the suspected APP data vector. Then, by calculating the vector comparison result and calculating the first and second data vectors, a training text vector is obtained. This allows the training text vector to reflect the strong correlation between the target APP and the suspected APP. The counterfeit detection model is trained using the training text vector with strong correlation. Compared to the prior art, which only compares the similarity between texts after text extraction or compares the similarity between images after image recognition, resulting in a high false positive rate, the solution of this embodiment of the invention can enhance the correlation between keywords during the model training stage, effectively improving the detection accuracy of counterfeit APPs and reducing the false positive rate. Furthermore, in this embodiment of the invention, only the brief descriptions of the target APP and the suspected APP can be used as the training basis. Compared to the prior art, which requires image recognition and image comparison processing in conjunction with the APP's attached images, the above solution can significantly reduce computational complexity and effectively improve detection efficiency.

[0039] Furthermore, the word2vec algorithm is used to convert the preset corpus into a data vector with a first preset number of dimensions. This can improve the accuracy of reflecting semantic and grammatical relationships and increase conversion efficiency during the process of converting text into data vectors.

[0040] Furthermore, before converting the preset corpus into a data vector of preset dimensions, the method further includes: performing noise reduction and / or word segmentation on the preset corpus. For example, words with less useful detection, such as modal particles and auxiliary words, can be removed, while words with greater useful detection, such as nouns and verbs, can be retained. Through the preprocessing step, the search and conversion efficiency is further improved.

[0041] Furthermore, the first frequency of each keyword in its description and the second frequency of that keyword in a pre-defined app description database are determined. The product of the reciprocal logarithm of the second frequency and the first frequency is used as the weight value of that keyword. Using this method, the higher the first frequency, the more frequently the keyword appears in its description, indicating greater importance of the keyword in the current app. Conversely, the lower the second frequency, the more frequently the keyword appears in the database, indicating a higher probability that the keyword is a common word (such as a particle or adverb), thus indicating lower importance. This helps to more accurately determine the weight value of the keyword.

[0042] Furthermore, a list vector of types for the paired target apps and suspected apps is determined. This list vector represents the app types shared by the target and suspected apps and has a second preset number of dimensions. The first data vector, the second data vector, and the list vector of types are concatenated to obtain the training text vector. Using this scheme, the training text vector can be formed by combining the shared classifications of the target and suspected apps. Since there are many shared app types, counterfeiting is more likely to occur. Therefore, the training text vector obtained by combining the list vector of types can serve as a better basis for detecting counterfeit apps.

[0043] Furthermore, a loss function and an initial training model for counterfeit detection are constructed. The training text vectors of the multiple pairs of target apps and suspected apps, along with the counterfeit judgment results, are substituted into the initial training model for counterfeit detection, and the loss function is minimized to determine the trained counterfeit detection model. By employing this approach, the detection accuracy and effectiveness of the trained counterfeit detection model can be effectively improved by minimizing the loss function and optimizing the model parameters.

[0044] Furthermore, the initial training spoofing detection model is determined by employing a classification tree algorithm; and / or, the loss function is determined by employing the XGboost algorithm. Since the spoofing detection result is used to indicate the probability of spoofing (e.g., a value of [0,1]), compared to other algorithms, the above algorithm has higher flexibility. For example, the strictness of the detection judgment can be relaxed / locked according to the threshold, which can effectively improve the computational efficiency and accuracy of the detection model.

[0045] Furthermore, by setting regularization penalty values ​​for multiple classification trees, the degree to which the model overfits the data can be limited, thereby further improving the detection accuracy of the counterfeit detection model and reducing the false positive rate. Attached Figure Description

[0046] Figure 1 This is a flowchart of a method for detecting counterfeit apps according to an embodiment of the present invention;

[0047] Figure 2 This is a schematic diagram of a working scenario for detecting counterfeit apps of target apps and suspected apps in an embodiment of the present invention;

[0048] Figure 3 yes Figure 1 A flowchart of a specific implementation of step S16;

[0049] Figure 4 This is a schematic diagram of the structure of a counterfeit APP detection device according to an embodiment of the present invention. Detailed Implementation

[0050] In existing technologies, the common approach is to extract text descriptions (e.g., a brief introduction) and then compare the text similarity between the target app and the suspected app, or to identify the app's image and then compare the image similarity between the target app and the suspected app. However, judging counterfeiting results solely by comparing text or image similarity has a high false positive rate.

[0051] Research has found that existing text similarity detection technologies typically employ keyword extraction and comparison methods. For example, keywords are extracted from the text of the target app and the suspected app, and the number or proportion of identical or similar keywords is recorded. If the number or proportion is high, the suspected app is judged to be a counterfeit app.

[0052] Similarly, in existing image similarity detection technologies, image recognition can be performed on the thumbnails of the target app and the suspected app, and then the identified keywords can be extracted. Then, a method similar to text similarity detection technology can be used to determine whether the suspected app is a counterfeit app.

[0053] However, the above detection techniques simply compare the number or proportion of keywords without considering the different importance of different keywords in the text or the relationship between the keywords, resulting in a high false positive rate.

[0054] In this embodiment of the invention, by determining the training data, a pre-determined counterfeit detection result can be obtained for training. By determining the data vectors and weight values ​​of the keywords, a weighted operation can be used to obtain the target APP data vector and the suspected APP data vector. Then, by calculating the vector comparison result and calculating the first and second data vectors, a training text vector is obtained. This allows the training text vector to reflect the strong correlation between the target APP and the suspected APP. The counterfeit detection model is trained using the training text vector with strong correlation. Compared to the prior art, which only compares the similarity between texts after text extraction or compares the similarity between images after image recognition, resulting in a high false positive rate, the solution of this embodiment of the invention can enhance the correlation between keywords during the model training stage, effectively improving the detection accuracy of counterfeit APPs and reducing the false positive rate. Furthermore, in this embodiment of the invention, only the brief introductions of the target APP and the suspected APP can be used as the training basis. Compared to the prior art, which requires image recognition and image comparison processing in conjunction with the APP's attached images, the above solution can significantly reduce computational complexity and effectively improve detection efficiency.

[0055] To make the above-mentioned objectives, features and beneficial effects of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0056] Reference Figure 1 , Figure 1 This is a flowchart of a method for detecting counterfeit apps in an embodiment of the present invention.

[0057] The method for detecting counterfeit apps may include steps S11 to S16:

[0058] Step S11: Determine the training data, which includes the introductions of multiple target apps and multiple suspected apps, as well as the counterfeiting judgment results between pairs of target apps and suspected apps.

[0059] Step S12: Extract keywords from the descriptions of each pair of target apps and suspected apps, and determine the data vector of each keyword, wherein the data vector has a first preset number of dimensions;

[0060] Step S13: Determine the weight value of each keyword, and perform a weighted operation on the data vector of each keyword in the target APP based on the weight value to obtain the target APP data vector; and perform a weighted operation on the data vector of each keyword in the suspected APP based on the weight value to obtain the suspected APP data vector.

[0061] Step S14: Calculate the vector comparison result of the target APP data vector and the suspected APP data vector, determine the absolute value of the vector comparison result as the first data vector, and determine the square of the vector comparison result as the second data vector;

[0062] Step S15: At least the first data vector and the second data vector are concatenated to obtain the training text vectors of the target APP and the suspected APP.

[0063] Step S16: Train a counterfeit detection model based on the training text vectors of multiple pairs of target apps and suspected apps, as well as the counterfeit judgment results.

[0064] In the specific implementation of step S11, the training data can be used to train the counterfeit detection model, and the counterfeit judgment results contained therein can be obtained in advance through manual judgment.

[0065] The description of the target app can be used to introduce the content, features, and functions of the target app, while the description of the suspected app can be used to introduce the content, features, and functions of the suspected app.

[0066] It is understood that, in the embodiments of the present invention, the introduction of each APP itself can be directly used as the detection object, and the content, features, functions, etc. of the APP can be extracted to obtain a more suitable introduction.

[0067] In step S12, keywords can be extracted from the descriptions of each pair of target apps and suspected apps.

[0068] Reference Figure 2 , Figure 2 This is a schematic diagram of a working scenario for detecting counterfeit apps of target apps and suspected apps in an embodiment of the present invention.

[0069] Specifically, Figure 2 The target app's title ("Children's Educational Games") and description are shown, as well as the suspected app's title ("Children's Educational Math Learning") and description.

[0070] In practice, the description can be denoised and / or segmented.

[0071] In one specific embodiment of the present invention, the introduction can be processed to retain keywords, such as retaining nouns, or retaining both nouns and verbs, to obtain various keywords.

[0072] like Figure 2 The target apps shown can retain nouns such as "children", "educational", "games", "primary school", "People's Education Edition", and "classroom" as keywords, and can also retain verbs such as "simulation" and "learning" as keywords.

[0073] In another specific embodiment of the present invention, non-keyword removal processing can be performed on the introduction, such as removing modal particles and auxiliary words, and the remaining content can be segmented to obtain various keywords. It should be noted that adverbs, nouns, etc. can also be removed to reduce the amount of data and complexity of subsequent processing.

[0074] In one specific embodiment of the present invention, before determining the data vector of each keyword, the data vector of each word in the corpus can be determined based on a preset corpus, so that the data vector of each word in the corpus can be directly used as the data vector of the keywords of the target APP and the suspected APP.

[0075] In a non-limiting corpus of an embodiment of the present invention, 99.56% of the words in existing languages ​​are contained, where words are used to refer to characters, words, phrases, etc. in the language.

[0076] Furthermore, a word-to-vector (word2vec) algorithm can be used to convert the preset corpus into a data vector with a first preset number of dimensions.

[0077] It should be noted that this is not a simple use of the word2vec algorithm to obtain data vectors, but rather a process of unifying the data vectors of each word to a first preset number of dimensions based on the data vectors obtained by the word2vec algorithm; or, before using the word2vec algorithm to obtain data vectors, the word2vec algorithm is modified in advance to ensure that the data vectors of each word obtained are all unified to a first preset number of dimensions.

[0078] Wherein, the first preset number of dimensions can be used to represent a data vector with one row and multiple columns, and the number of columns is the first preset number.

[0079] In this embodiment of the invention, the word2vec algorithm is used to convert a preset corpus into a data vector with a first preset number of dimensions. This can improve the accuracy of reflecting semantic and grammatical relationships and increase conversion efficiency during the process of converting text into data vectors.

[0080] Furthermore, the words in the corpus include at least words from the description of the target app and the description of the suspected app.

[0081] In this embodiment of the invention, by employing a corpus containing at least the words from the descriptions of the target app and the suspected app, the data vectors of each word in the corpus can be directly used as the data vectors of the keywords for the target app and the suspected app.

[0082] Furthermore, the preset corpus can be subjected to noise reduction and / or word segmentation.

[0083] In one specific embodiment of the present invention, the corpus can be processed to retain words, such as retaining nouns, or retaining nouns and verbs, to obtain individual words.

[0084] In another specific embodiment of the present invention, word removal processing can be performed on the corpus, such as removing modal particles and auxiliary words, and word segmentation processing can be performed on the remaining content to obtain individual words.

[0085] In this embodiment of the invention, before converting the preset corpus into a data vector of preset dimensions, the method further includes: performing noise reduction and / or word segmentation on the preset corpus. For example, words with less useful detection, such as modal particles and auxiliary words, can be removed, or words with greater useful detection, such as nouns and verbs, can be retained. Through the preprocessing step, the search and conversion efficiency is further improved.

[0086] Continue to refer to Figure 1 In the specific implementation of step S13, the weight value of each keyword is determined.

[0087] Furthermore, the step of determining the weight value of each keyword may include: determining the first frequency of each keyword appearing in its respective description and the second frequency of the keyword appearing in a preset APP description database; and using the product of the reciprocal of the second frequency and the first frequency as the weight value of the keyword.

[0088] Furthermore, the following formula can be used to determine the first frequency of each keyword appearing in its respective bio:

[0089]

[0090] Among them, tf ij This is used to indicate the first frequency of each keyword in its corresponding profile, where i represents the index of the i-th keyword, j represents the index of the j-th profile, and n... ij n represents the number of times the i-th keyword appears in the j-th description; k represents the index of the k-th word in the j-th description; K represents the total number of words in the j-th description; n represents the total number of words in the j-th description. kj This is used to represent the number of times the k-th word appears in the current j-th description; where i, j, k, and K are all positive integers, and 1 ≤ k ≤ K.

[0091] In this embodiment of the invention, the higher the first frequency, the more times the keyword appears in its description, and the greater the importance of the keyword in the current APP.

[0092] Furthermore, the preset APP description database contains descriptions of multiple APPs; the logarithm of the reciprocal of the second frequency of each keyword appearing in the preset APP description database can be determined using the following formula:

[0093]

[0094] Among them, idf i This is used to represent the logarithm of the second frequency of each keyword in the preset APP description database, where i represents the index of the i-th keyword, j represents the index of the j-th description, and t... i Used to represent the i-th keyword, d j |D| is used to represent the j-th profile; |D| is used to represent the number of at least some apps in the app profile database, |{j:t i ∈d j}| is used to indicate that the description of at least a portion of the APP contains t i The number of apps; where i and j are both positive integers.

[0095] in, This is used to indicate the second frequency of each keyword in the preset APP description database. log() is used to represent logarithmic operations, such as lg() with a base of 10, or other logarithmic operations with appropriate bases.

[0096] In this embodiment of the invention, the lower the second frequency, the more times the keyword appears in the database, the greater the possibility that the keyword is a common word (such as a particle, adverb, etc.), and the lower the importance of the keyword.

[0097] Among them, the inverse logarithm (idf) of the second frequency of each keyword in the preset APP description database. i It can also be expressed as inverse document frequency.

[0098] Furthermore, the weight value of the keyword can be determined using the following formula:

[0099] tfidf ij =tf ij ×idf i

[0100] Among them, tfidf ij Used to represent the weight value of the keyword, tf ij Used to indicate the first frequency of each keyword in its associated bio, idf i This is used to represent the logarithm of the second most frequent occurrence of each keyword in the preset APP description database.

[0101] In this embodiment of the invention, a first frequency of each keyword appearing in its corresponding description and a second frequency of that keyword appearing in a preset APP description database are determined. The product of the reciprocal of the second frequency and the first frequency is used as the weight value of the keyword. Using this scheme, the higher the first frequency, the more frequently the keyword appears in its corresponding description, indicating greater importance of the keyword in the current APP. Conversely, the lower the second frequency, the more frequently the keyword appears in the database, indicating a higher probability that the keyword is a common word (such as a particle or adverb), thus indicating lower importance. This helps to more accurately determine the weight value of the keyword.

[0102] Furthermore, among the multiple app descriptions contained in the preset app description database, at least the target app and the suspected app are included.

[0103] In this embodiment of the invention, by employing an APP description database that includes at least descriptions of the target APP and the suspected APP, a high degree of accuracy can be obtained in determining whether keywords are common words (such as auxiliary words, adverbs, etc.).

[0104] Then, the data vectors of each keyword in the target APP can be weighted based on the weight value to obtain the target APP data vector, and the data vectors of each keyword in the suspected APP can be weighted based on the weight value to obtain the suspected APP data vector.

[0105] In one specific embodiment of the present invention, a weighted summation method can be used to determine the target APP data vector and the suspected APP data vector respectively.

[0106] In another specific embodiment of the present invention, a weighted average method can be used to determine the target APP data vector and the suspected APP data vector respectively.

[0107] In the specific implementation of step S14, the vector comparison results of the target APP data vector and the suspected APP data vector can be calculated.

[0108] Furthermore, the vector comparison result between the target APP data vector and the suspected APP data vector can be: the difference between the target APP data vector and the suspected APP data vector; or, the quotient between the target APP data vector and the suspected APP data vector.

[0109] It should be noted that since the data vectors of each keyword have a first preset number of dimensions, the target APP data vector and the suspected APP data vector after weighted calculation also have a first preset number of dimensions. Therefore, calculations can be performed to obtain the vector comparison results with the first preset number of dimensions.

[0110] As a non-restrictive example, each keyword can be a data vector with 200 columns per row. The target APP data vector and the suspected APP data vector after weighted calculation are also data vectors with 200 columns per row, and the vector comparison result is also a data vector with 200 columns per row.

[0111] Then, the absolute value of the vector comparison result can be determined as the first data vector, and the square of the vector comparison result can be determined as the second data vector.

[0112] Specifically, it can be expressed using the following formula: |x q -x q′ | is used to represent the first data vector, |x q -xq′ | 2 This is used to represent the second data vector, where q represents the target app, q' represents the suspected app, and x... q Used to represent the target APP data vector, x q' Used to represent suspected APP data vectors.

[0113] Specifically, it can also be expressed using the following formula: |x q / x q′ | is used to represent the first data vector, |x q / x q′ | 2 This is used to represent the second data vector, where q represents the target app, q' represents the suspected app, and x... q Used to represent the target APP data vector, x q' Used to represent suspected APP data vectors.

[0114] In a non-limiting specific embodiment, taking a vector comparison result as a data vector with 200 columns in a single row as an example, the first data vector is also a data vector with 200 columns in a single row, and the second data vector is also a data vector with 200 columns in a single row.

[0115] In the specific implementation of step S15, at least the first data vector and the second data vector are concatenated to obtain the training text vectors of the target APP and the suspected APP.

[0116] In one specific embodiment of the present invention, the first data vector and the second data vector can be directly concatenated. For example, the second data vector can be placed after or before the first data vector to obtain the concatenated data vector (which can be called the training text vector).

[0117] Furthermore, the dimension of the training text vectors can be twice the first preset number.

[0118] In a non-limiting specific embodiment, taking the first data vector as a single-row 200-column data vector and the second data vector as a single-row 200-column data vector as an example, the training text vector can be a single-row 400-column data vector.

[0119] In another specific embodiment of the present invention, the training text vector can also be formed by combining the type list vector. For example, the type list vector can be placed after or before the first data vector and the second data vector to obtain the concatenated data vector (which can be called the training text vector).

[0120] Furthermore, at least the first data vector and the second data vector are concatenated, including: determining the type list vector of the paired target APP and suspected APP, wherein the type list vector is used to represent the APP types common to the target APP and suspected APP, and has a second preset number of dimensions; concatenating the first data vector, the second data vector and the type list vector to obtain the training text vector.

[0121] Each app can have one or more app types based on its content, functions, and uses, for example... Figure 2 The target app shown can be of the "educational", "children's", or "game" type.

[0122] The second preset number of dimensions can be used to represent a data vector with one row and multiple columns, with each column representing a type, and the number of columns being the second preset number.

[0123] In one non-limiting embodiment, the type list vector may have a single row of 21 columns to represent 21 preset APP types, wherein each column represents a preset type.

[0124] The type list vector is used to represent the APP types common to the target APP and the suspected APP, for example... Figure 2 The suspected apps shown can be of the "Education" or "Children" type. However, there is no "Game" type in the target app. Therefore, in the type list vector, the two rows corresponding to "Education" and "Children" can be represented by "1", and the other rows can be represented by "0".

[0125] Furthermore, the training text vector is a single-row, multi-column vector, wherein the number of columns in the training text vector is twice the first preset number and the sum of the second preset number.

[0126] In a non-limiting specific embodiment, taking a first data vector as a single-row 200-column data vector, a second data vector as a single-row 200-column data vector, a type list vector as a single-row 21-column data vector as an example, the training text vector is a single-row 421-column data vector.

[0127] In this embodiment of the invention, a type list vector is determined for the paired target app and suspected app. The type list vector represents the app types shared by the target app and suspected app, and has a second preset number of dimensions. The first data vector, the second data vector, and the type list vector are concatenated to obtain the training text vector. Using this scheme, the training text vector can be formed by combining the shared classifications of the target app and suspected app. Since there are many shared app types, counterfeiting is more likely to occur. Therefore, the training text vector obtained by combining the type list vector can better serve as the basis for detecting counterfeit apps.

[0128] In the specific implementation of step S16, a counterfeit detection model is trained based on the training text vectors of multiple pairs of target apps and suspected apps, as well as the counterfeit judgment results.

[0129] Reference Figure 3 , Figure 3 yes Figure 1 A flowchart of a specific implementation of step S16 is provided. The step of training the counterfeit detection model based on the training text vectors of multiple pairs of target apps and suspected apps and the counterfeit judgment results may include steps S31 to S32, which are described below.

[0130] In step S31, the loss function and the initial training model for counterfeit detection are constructed.

[0131] Furthermore, the steps of constructing the loss function and the initial training of the spoofing detection model may include: using a classification tree algorithm to determine the initial training of the spoofing detection model; and / or using the XGboost algorithm to determine the loss function.

[0132] In this embodiment of the invention, the initial training model for counterfeiting detection is determined by using a classification tree algorithm; and / or the loss function is determined by using the XGboost algorithm. Since the counterfeiting detection result is used to indicate the probability of counterfeiting (e.g., the value is selected as [0,1]), compared with other algorithms, the above algorithm has higher flexibility. For example, it can effectively improve the computational efficiency and accuracy of the detection model by relaxing / locking the threshold for detection judgment.

[0133] In one specific embodiment of the present invention, the counterfeit detection model can be represented as follows:

[0134]

[0135] in, The term is used to represent the counterfeit detection model, where P represents the number of classification trees in the classification tree algorithm, p represents the index of the p-th classification tree, q represents the target app, q' represents the suspected app, and x... q Used to represent the target APP data vector, x q’ Used to represent suspected APP data vectors; |x q -x q′ | is used to represent the first data vector, |x q -x q′ | 2 Used to represent the second data vector, a qq′ Used to represent a list vector of types.

[0136] In the above specific implementation, the first data vector and the second data vector are determined by calculating the difference between the target APP data vector and the suspected APP data vector, which can better improve the computational accuracy of the detection model.

[0137] In another specific embodiment of the present invention, the counterfeit detection model is represented as follows:

[0138]

[0139] in, The term is used to represent the counterfeit detection model, where P represents the number of classification trees in the classification tree algorithm, p represents the index of the p-th classification tree, q represents the target app, q' represents the suspected app, and x... q Used to represent the target APP data vector, x q’ Used to represent suspected APP data vectors, where p and P are positive integers, and 1 ≤ p ≤ P; |x q / x q′ | is used to represent the first data vector, |x q / x q′ | 2 Used to represent the second data vector, a qq′ Used to represent a list vector of types.

[0140] In the above specific implementation, the first data vector and the second data vector are determined by calculating the quotient of the target APP data vector and the suspected APP data vector, which can better improve the computational efficiency of the detection model.

[0141] It should be noted that, in the embodiments of the present invention, a random forest algorithm or other suitable algorithm may also be used to determine the initial training spoofing detection model; an exponential loss function or other suitable algorithm may also be used to determine the loss function.

[0142] In one specific embodiment of the present invention, the loss function is expressed as follows:

[0143]

[0144] in, y is used to represent the calculation result obtained using the counterfeit detection model. qq′ The term is used to represent the counterfeit detection results in the training data, where M represents the number of pairs of target apps and suspected apps, and m represents the index of the m-th pair of target apps and suspected apps. Used to represent the m-th Logistic loss function, where m and M are positive integers and 1 ≤ m ≤ M.

[0145] In another specific embodiment of the present invention, the loss function is expressed as follows:

[0146]

[0147] in, y is used to represent the calculation result obtained using the counterfeit detection model. qq′ The term is used to represent the counterfeit detection results in the training data, where M represents the number of pairs of target apps and suspected apps, and m represents the index of the m-th pair of target apps and suspected apps. The m-th Logistic loss function is used to represent the logistic loss function, where m and M are positive integers and 1 ≤ m ≤ M; P represents the number of classification trees in the classification tree algorithm, p represents the index of the p-th classification tree, and Ω(f p ) is used to represent the regularization penalty value of the p-th classification tree.

[0148] Wherein, Ω(f p This can be expressed using the following formula:

[0149]

[0150] Where γ and λ are manually set parameters, w is the vector formed by the values ​​of all leaf nodes in the classification tree, and T is the number of leaf nodes. is the L2 norm of the leaf node values.

[0151] In this embodiment of the invention, by setting regularization penalty values ​​for multiple classification trees, the degree to which the model overfits the data can be limited, thereby further improving the detection accuracy of the counterfeit detection model and reducing the false positive rate.

[0152] In step S32, the training text vectors of the multiple pairs of target apps and suspected apps, as well as the counterfeiting judgment results, are substituted into the initial training counterfeiting detection model, and the loss function is minimized to determine the trained counterfeiting detection model.

[0153] Specifically, in each iteration, the iteration result can be used as the input for the next iteration to minimize the loss function and optimize the model parameters in the counterfeit detection model in each iteration.

[0154] In this embodiment of the invention, a loss function and an initial training model for counterfeit detection are constructed. The training text vectors of the multiple pairs of target apps and suspected apps, along with the counterfeit judgment results, are substituted into the initial training model for counterfeit detection, and the loss function is minimized to determine the trained counterfeit detection model. By employing this approach, the detection accuracy and effectiveness of the trained counterfeit detection model can be effectively improved by minimizing the loss function and optimizing the model parameters.

[0155] Furthermore, the method also includes: determining the text vectors of the target APP to be detected and the suspected APP to be detected; inputting the text vectors into the counterfeiting detection model to determine whether there is a counterfeiting relationship between the target APP to be detected and the suspected APP to be detected.

[0156] It should be noted that after obtaining the target app and the suspected app to be detected, the methods described above can be used. Figure 1 The method shown determines the text vectors for determining the training text vectors.

[0157] Specifically, based on the target app and the suspected app to be detected, the following methods can be adopted: Figure 1 Steps S12 to S15 are shown to determine the text vector, thereby obtaining the judgment result of the spoofing detection model after inputting the text vector into the spoofing detection model.

[0158] In this embodiment of the invention, by determining the training data, a pre-determined counterfeit detection result can be obtained for training. By determining the data vectors and weight values ​​of the keywords, a weighted operation can be used to obtain the target APP data vector and the suspected APP data vector. Then, by calculating the vector comparison result and calculating the first and second data vectors, a training text vector is obtained. This allows the training text vector to reflect the strong correlation between the target APP and the suspected APP. The counterfeit detection model is trained using the training text vector with strong correlation. Compared to the prior art, which only compares the similarity between texts after text extraction or compares the similarity between images after image recognition, resulting in a high false positive rate, the solution of this embodiment of the invention can enhance the correlation between keywords during the model training stage, effectively improving the detection accuracy of counterfeit APPs and reducing the false positive rate. Furthermore, in this embodiment of the invention, only the brief introductions of the target APP and the suspected APP can be used as the training basis. Compared to the prior art, which requires image recognition and image comparison processing in conjunction with the APP's attached images, the above solution can significantly reduce computational complexity and effectively improve detection efficiency.

[0159] Reference Figure 4 , Figure 4 This is a schematic diagram of a counterfeit app detection device according to an embodiment of the present invention. The counterfeit app detection device may include:

[0160] The data determination module 41 is used to determine training data, which includes a description of multiple target apps and a description of multiple suspected apps, as well as the counterfeiting judgment results between pairs of target apps and suspected apps.

[0161] The word vector determination module 42 is used to extract keywords from the descriptions of each pair of target apps and suspected apps, and determine the data vectors of each keyword, wherein the data vectors have a first preset number of dimensions.

[0162] The first data vector determination module 43 is used to determine the weight value of each keyword, and to perform a weighted operation on the data vector of each keyword in the target APP based on the weight value to obtain the target APP data vector, and to perform a weighted operation on the data vector of each keyword in the suspected APP based on the weight value to obtain the suspected APP data vector.

[0163] The second data vector determination module 44 is used to calculate the vector comparison result of the target APP data vector and the suspected APP data vector, determine the absolute value of the vector comparison result as the first data vector, and determine the square of the vector comparison result as the second data vector.

[0164] The text vector determination module 45 is used to concatenate at least the first data vector and the second data vector to obtain the training text vectors of the target APP and the suspected APP.

[0165] Training module 46 is used to train a counterfeit detection model based on training text vectors of multiple pairs of target apps and suspected apps, as well as counterfeit judgment results.

[0166] about Figure 4 For more information on the working principle, operation, and beneficial effects of the device for detecting counterfeit apps shown, please refer to the preceding text and... Figures 1 to 3 The relevant descriptions will not be repeated here.

[0167] This invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it performs the steps of the above-described method for detecting counterfeit apps. The storage medium may include ROM, RAM, a disk, or an optical disk, etc. The storage medium may also include non-volatile memory or non-transitory memory, etc.

[0168] This invention also provides a terminal, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it performs the steps of the above-described method for detecting counterfeit apps. The terminal includes, but is not limited to, mobile phones, computers, tablets, servers, cloud platforms, and other terminal devices.

[0169] It should be understood that in the embodiments of this application, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0170] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0171] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means.

[0172] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can be physically included separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or in the form of hardware plus software functional units. For example, for various devices or products applied to or integrated into a chip, each module / unit contained therein can be implemented in hardware such as circuits, or at least some modules / units can be implemented in software programs that run on the processor integrated inside the chip, and the remaining (if any) modules / units can be implemented in hardware such as circuits; for various devices or products applied to or integrated into a chip module, each module / unit contained therein can be implemented in hardware such as circuits, and different modules / units can be located in the same component (e.g., chip, circuit module, etc.) or different components of the chip module, or at least some modules / units can be implemented in software programs that run on the processor integrated inside the chip module, and the remaining (if any) modules / units can be implemented in hardware such as circuits.

[0173] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article indicates that the preceding and following related objects have an "or" relationship.

[0174] In the embodiments of this application, "multiple" refers to two or more.

[0175] The descriptions of "first," "second," etc., appearing in the embodiments of this application are for illustrative purposes and to distinguish the objects being described. They have no order and do not indicate any special limitation on the number of devices in the embodiments of this application, nor do they constitute any limitation on the embodiments of this application.

[0176] While the present invention has been disclosed above, it is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.

Claims

1. A method for detecting counterfeit apps, characterized in that, include: The training data includes descriptions of multiple target apps and multiple suspected apps, as well as the counterfeiting judgment results between pairs of target apps and suspected apps. Keyword extraction is performed on the descriptions of each pair of target apps and suspected apps, and data vectors for each keyword are determined, wherein the data vectors have a first preset number of dimensions. The weight values ​​of each keyword are determined, and the data vectors of each keyword in the target APP are weighted based on the weight values ​​to obtain the target APP data vector. The data vectors of each keyword in the suspected APP are weighted based on the weight values ​​to obtain the suspected APP data vector. Calculate the vector comparison result between the target APP data vector and the suspected APP data vector, determine the absolute value of the vector comparison result as the first data vector, and determine the square of the vector comparison result as the second data vector; the vector comparison result between the target APP data vector and the suspected APP data vector is: the difference between the target APP data vector and the suspected APP data vector; or, the quotient between the target APP data vector and the suspected APP data vector. At least the first data vector and the second data vector are concatenated to obtain the training text vectors of the target APP and the suspected APP. A counterfeit detection model is trained based on the training text vectors of multiple pairs of target apps and suspected apps, as well as the counterfeit judgment results. Specifically, at least the first data vector and the second data vector are concatenated, including: Determine the type list vector of the paired target APP and suspected APP, wherein the type list vector is used to represent the APP types common to the target APP and suspected APP, and has a second preset number of dimensions; each APP has one or more APP types according to its content, function and purpose; The first data vector, the second data vector, and the type list vector are concatenated to obtain the training text vector.

2. The method for detecting counterfeit apps according to claim 1, characterized in that, The method further includes: Determine the text vectors of the target app to be detected and the suspected app to be detected; The text vector is input into the counterfeit detection model to determine whether there is a counterfeit relationship between the target APP to be detected and the suspected APP to be detected.

3. The method for detecting counterfeit apps according to claim 1, characterized in that, Before determining the data vectors for each keyword, the method further includes: The word2vec algorithm is used to convert a pre-defined corpus into a data vector with a first pre-defined number of dimensions.

4. The method for detecting counterfeit apps according to claim 3, characterized in that, Before converting the preset corpus into a data vector of preset dimensions, the method further includes: The preset corpus is subjected to noise reduction and / or word segmentation.

5. The method for detecting counterfeit apps according to claim 1, characterized in that, The determination of the weight value of each keyword includes: Determine the first frequency of each keyword in its corresponding description and the second frequency of that keyword in a pre-defined APP description database; The weight value of the keyword is the product of the logarithm of the reciprocal of the second frequency and the first frequency.

6. The method for detecting counterfeit apps according to claim 5, characterized in that, The first frequency of each keyword in its corresponding profile is determined using the following formula: Among them, tf ij This is used to indicate the first frequency of each keyword in its corresponding profile, where i represents the index of the i-th keyword, j represents the index of the j-th profile, and n... ij This is used to indicate the number of times the i-th keyword appears in the j-th description. k represents the index of the k-th word in the j-th description, K represents the total number of words in the current j-th description, and n represents the total number of words. kj Used to indicate the number of times the k-th word appears in the current j-th description; Where i, j, k, and K are all positive integers, and 1 ≤ k ≤ K.

7. The method for detecting counterfeit apps according to claim 5, characterized in that, The preset APP profile database contains profiles of multiple APPs; The following formula is used to determine the logarithm of the second frequency of each keyword in the preset APP description database: Among them, idf i This is used to represent the logarithm of the second frequency of each keyword in the preset APP description database, where i represents the index of the i-th keyword, j represents the index of the j-th description, and t... i Used to represent the i-th keyword, d j Used to represent the j-th introduction; |D| is used to indicate the number of at least some of the apps in the app profile database. Used to indicate that the description of at least some of the APPs contains t i The number of apps; Where i and j are both positive integers.

8. The method for detecting counterfeit apps according to claim 1, characterized in that, The training text vector is a single-row, multi-column vector, wherein the number of columns in the training text vector is twice the first preset number and the sum of the second preset number.

9. The method for detecting counterfeit apps according to claim 1, characterized in that, The training of the counterfeit detection model based on the training text vectors of multiple pairs of target apps and suspected apps, as well as the counterfeit judgment results, includes: Construct the loss function and the initial training model for counterfeit detection; The training text vectors of the multiple pairs of target apps and suspected apps, along with the counterfeiting judgment results, are substituted into the initial training counterfeiting detection model, and the loss function is minimized to determine the trained counterfeiting detection model.

10. The method for detecting counterfeit apps according to claim 9, characterized in that, The construction of the loss function and the initial training of the counterfeit detection model include: The initial training model for counterfeit detection is determined using a classification tree algorithm; And / or, The loss function is determined using the XGboost algorithm.

11. The method for detecting counterfeit apps according to claim 10, characterized in that, The counterfeit detection model is represented as follows: in, The p-th classification tree is used to represent the counterfeit detection model, where P represents the number of classification trees in the classification tree algorithm, p represents the index of the p-th classification tree, q represents the target app, q' represents the suspected app, and x represents the counterfeit app. q Used to represent the target APP data vector, x q’ Used to represent suspected APP data vectors; Used to represent the first data vector Used to represent the second data vector, Used to represent a list vector of types.

12. The method for detecting counterfeit apps according to claim 10, characterized in that, The counterfeit detection model is represented as follows: in, The p-th classification tree is used to represent the counterfeit detection model, where P represents the number of classification trees in the classification tree algorithm, p represents the index of the p-th classification tree, q represents the target app, q' represents the suspected app, and x represents the counterfeit app. q Used to represent the target APP data vector, x q’ Used to represent suspected APP data vectors, where p and P are positive integers, and 1≤p≤P; Used to represent the first data vector Used to represent the second data vector, Used to represent a list vector of types.

13. The method for detecting counterfeit apps according to claim 11 or 12, characterized in that, The loss function is expressed as follows: in, Used to represent the loss function, Used to represent the calculation results obtained using the counterfeit detection model. The term is used to represent the counterfeit detection results in the training data, where M represents the logarithm of the target app and the suspected app, and m represents the index of the m-th pair of target and suspected apps. Used to represent the m-th Logistic loss function, where m and M are positive integers and 1 ≤ m ≤ M.

14. The method for detecting counterfeit apps according to claim 11 or 12, characterized in that, The loss function is expressed as follows: in, Used to represent the loss function, Used to represent the calculation results obtained using the counterfeit detection model. The term is used to represent the counterfeit detection results in the training data, where M represents the logarithm of the target app and the suspected app, and m represents the index of the m-th pair of target and suspected apps. Used to represent the m-th Logistic loss function, where m and M are positive integers and 1 ≤ m ≤ M; P represents the number of classification trees in the classification tree algorithm, and p represents the index of the p-th classification tree. Used to represent the regularization penalty value of the p-th classification tree.

15. A device for detecting counterfeit apps, characterized in that, include: The data determination module is used to determine the training data, which includes the introductions of multiple target apps and multiple suspected apps, as well as the counterfeiting judgment results between pairs of target apps and suspected apps. The word vector determination module is used to extract keywords from the descriptions of each pair of target apps and suspected apps, and to determine the data vector of each keyword, wherein the data vector has a first preset number of dimensions. The first data vector determination module is used to determine the weight value of each keyword, and to perform a weighted operation on the data vector of each keyword in the target APP based on the weight value to obtain the target APP data vector, and to perform a weighted operation on the data vector of each keyword in the suspected APP based on the weight value to obtain the suspected APP data vector. The second data vector determination module is used to calculate the vector comparison result of the target APP data vector and the suspected APP data vector, determine the absolute value of the vector comparison result as the first data vector, and determine the square of the vector comparison result as the second data vector; the vector comparison result of the target APP data vector and the suspected APP data vector is: the difference between the target APP data vector and the suspected APP data vector; or, the quotient between the target APP data vector and the suspected APP data vector. The text vector determination module is used to concatenate at least the first data vector and the second data vector to obtain the training text vectors of the target APP and the suspected APP. The training module is used to train a counterfeit detection model based on training text vectors of multiple pairs of target apps and suspected apps, as well as counterfeit judgment results. The text vector determination module is used to determine the type list vectors of the paired target APP and suspected APP. The type list vectors represent the APP types common to the target APP and suspected APP, and have a second preset number of dimensions. Each APP has one or more APP types according to its content, function, and purpose. The first data vector, the second data vector, and the type list vector are concatenated to obtain the training text vector.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor, it performs the steps of the method for detecting counterfeit apps according to any one of claims 1 to 14.

17. A terminal comprising a memory and a processor, wherein the memory stores a computer program capable of running on the processor, characterized in that, When the processor runs the computer program, it performs the steps of the method for detecting counterfeit apps according to any one of claims 1 to 14.

Images