An application exception detection method, device, equipment and readable storage medium

Abstract

The application discloses an application anomaly detection method and device, equipment and a readable storage medium, and related embodiments can be applied to the fields of data security, application security, applet security, cloud security, privacy protection and the like. The method comprises the following steps: constructing a target node structure tree of an application to be detected, which comprises an interactive component and an extended description text; performing word segmentation processing on a target description short text in the target node structure tree to obtain a target description word segmentation; performing similarity matching on the target description word segmentation and word segmentation in a detection information dictionary to determine a detection information type of the target description word segmentation; and determining a detection result according to an event type of an event trigger attribute and the detection information type. By using the application, the cost and time consumption of anomaly detection on the application to be detected can be reduced.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an application anomaly detection method, apparatus, device, and readable storage medium. Background Technology

[0002] With the development of internet technology, third-party platform-integrated applications (mini-programs) have gradually become an indispensable service in people's lives.

[0003] As mini-programs become increasingly integrated into people's daily lives, the types and scope of personal information they involve are expanding. Anomalies may occur in the collection and use of some types of information, potentially leading to losses for the individuals involved. Therefore, anomaly detection should be performed on mini-programs before they go live. However, mini-programs have relatively few interfaces that can be called to retrieve information; most information is collected through the mini-program's interactive interface. Existing anomaly detection methods for mini-programs rely on dynamic triggering, requiring manual assessment of the types of information collected from the interactive interface to determine if an anomaly has occurred. This manual, dynamic detection method is costly, time-consuming, and prone to missed or false positives. Summary of the Invention

[0004] This application provides an application anomaly detection method, apparatus, device, and readable storage medium, which can reduce the cost and time spent on anomaly detection of the application to be detected.

[0005] This application provides an application anomaly detection method, including:

[0006] Construct a target node structure tree for the application to be tested; wherein, the target node structure tree contains one or more nodes; a node contains an interactive component and an extended description text corresponding to the interactive component;

[0007] The target description short text in the target node structure tree is segmented into words to obtain target description words; the target description short text refers to the extended description text contained in the nodes with event triggering attributes in the target node structure tree;

[0008] The similarity of the target description segmentation words with the segmentation words in the detection information dictionary is used to determine the detection information type of the target description segmentation words;

[0009] Based on the event type of the event triggering attribute and the detection information type, determine the detection result for the application to be detected.

[0010] One embodiment of this application provides an application anomaly detection device, including:

[0011] The building module is used to construct the target node structure tree for the application to be tested; wherein, the target node structure tree contains one or more nodes; a node contains an interactive component and an extended description text corresponding to the interactive component;

[0012] The word segmentation module is used to segment the target description short text in the target node structure tree to obtain target description words; the target description short text refers to the extended description text contained in the node with the event triggering attribute in the target node structure tree;

[0013] The matching module is used to perform similarity matching between the target description segmented words and the segmented words in the detection information dictionary to determine the detection information type of the target description segmented words;

[0014] The result determination module is used to determine the detection result for the application to be detected based on the event type of the event triggering attribute and the detection information type.

[0015] The building modules include:

[0016] The acquisition unit is used to acquire the source code data package corresponding to the application to be detected, and to obtain the layout file of the interactive components from the source code data package;

[0017] The parsing unit is used to perform tree-like parsing processing on the interactive component layout file to obtain the initial node structure tree; the initial node structure tree contains one or more nodes; each node contains one interactive component; the node structure relationship of the initial node structure tree is determined based on the structural relationship between interactive components in the interactive component layout file.

[0018] The extraction unit is used to extract the text attribute values ​​of each interactive component to obtain the description text corresponding to each interactive component.

[0019] The extension unit is used to extend the description text corresponding to each interactive component according to the node structure relationship in the initial node structure tree, so as to obtain the extended description text corresponding to each interactive component.

[0020] Adding units is used to add the extended description text corresponding to each interactive component into the node to which each interactive component belongs, thus obtaining the target node structure tree.

[0021] The acquisition unit includes:

[0022] The first acquisition subunit is used to acquire the source code data package corresponding to the application to be detected.

[0023] The format detection subunit is used to perform format detection on the source code data packet and obtain the format detection result.

[0024] The second acquisition subunit is used to decompile the source code data packet if the format detection result is a compressed compilation result, and to find the interactive component layout file from the decompiled source code data packet.

[0025] The second acquisition subunit is also used to search for the interactive component layout file in the source code data package if the format detection result is not a compressed compilation result.

[0026] The extended unit includes:

[0027] Traverse the extended sub-units, which are used to traverse the initial node structure tree. Based on the child node relationship of the traversed node, the description text corresponding to each interactive component is extended to obtain the transition description text corresponding to each interactive component.

[0028] The text determination sub-unit is used to use the transition description text corresponding to each interactive component as the extended description text corresponding to each interactive component if there is no node without explanatory description in the initial node structure tree; a node without explanatory description refers to a node whose associated transition description text does not belong to the explanatory type.

[0029] The supplementary extension sub-unit is used to supplement the transition description text corresponding to the interactive components contained in the unexplained description node according to the parent node relationship of the unexplained description node if there is an unexplained description node in the initial node structure tree, so as to obtain the extended description text corresponding to each interactive component.

[0030] Specifically, the traversal of the extended sub-unit is used to traverse the initial node structure tree to obtain the k-th node; k is a positive integer less than or equal to M, where M is the number of one or more nodes; if the child node relationship of the k-th node indicates that the k-th node has no child nodes, then the description text corresponding to the interactive component contained in the k-th node is used as the transition description text corresponding to the interactive component contained in the k-th node; if the child node relationship of the k-th node indicates that the k-th node has child nodes, then the child node corresponding to the k-th node is used as the target child node, and the description text corresponding to the interactive component contained in the target child node is added to the description text corresponding to the interactive component contained in the k-th node to obtain the transition description text corresponding to the interactive component contained in the k-th node.

[0031] Specifically, the supplementary extension sub-unit is used to: if there are nodes without explanatory descriptions in the initial node structure tree, obtain the parent node relationship of the nodes without explanatory descriptions; if the parent node relationship of the nodes without explanatory descriptions indicates that the nodes without explanatory descriptions have parent nodes, then supplement the target explanatory description text into the transition description text corresponding to the interactive components contained in the nodes without explanatory descriptions; the target explanatory description text refers to the text of the explanatory type in the transition description text corresponding to the interactive components contained in the parent node; both the supplemented transition description text and the transition description text corresponding to the interactive components contained in the explanatory description nodes are used as extended description text; the explanatory description nodes refer to the nodes in the initial node structure tree other than the nodes without explanatory descriptions.

[0032] The target description short text contains one or more target description short sentences;

[0033] The word segmentation module includes:

[0034] The short phrase traversal unit is used to traverse one or more target description short phrases and obtain the j-th target description short phrase; j is a positive integer; j is less than or equal to the number of one or more target description short phrases;

[0035] The language type determination unit is used to determine the language type corresponding to the j-th target description phrase, which is then used as the target language type.

[0036] The segmentation unit is used to call the word segmentation tool corresponding to the target language type to segment the target description short sentences, and obtain the short sentence target description word corresponding to the j-th target description short sentence;

[0037] The word segmentation determination unit is used to segment the short target description words corresponding to each target description short sentence as target description words.

[0038] The result determination module includes:

[0039] The weight acquisition unit is used to obtain the risk weight corresponding to the event type of the event triggering attribute;

[0040] The probability acquisition unit is used to acquire the risk probability corresponding to the type of detection information.

[0041] The weighting unit is used to weight the risk probabilities according to the risk weights to obtain the weighted risk probabilities;

[0042] The detection result generation unit is used to generate detection results for the application to be detected based on the weighted risk probability.

[0043] The matching module includes:

[0044] The target determination unit is used to determine the language type of the target description segmentation as the target language type.

[0045] The target determination unit is also used to use word segments in the detection information dictionary whose language type is the target language type as target search word segments;

[0046] The target matching unit is used to obtain the segment that has the highest similarity to the target description segment from the target search segment and use it as the target matching segment;

[0047] The information type determination unit is used to obtain the information type corresponding to the target matching word from the detection information dictionary, and use it as the detection information type of the target description word.

[0048] The aforementioned application anomaly detection device also includes:

[0049] The sample construction module is used to obtain at least two sample applications and construct a sample node structure tree for each sample application. A sample node structure tree contains one or more sample nodes. A sample node contains a sample interaction component and a sample extended description text corresponding to the sample interaction component.

[0050] The sample word segmentation module is used to perform word segmentation and extraction on the sample extended description text contained in the structure tree of at least two sample nodes to obtain sample words;

[0051] The clustering module is used to perform clustering processing on the sample word segments to obtain sample word segmentation clusters;

[0052] The annotation module is used to annotate the sample word segmentation clusters and determine the information type corresponding to the sample word segmentation clusters;

[0053] The dictionary addition module is used to add the information type corresponding to each sample word segment and the sample word cluster to which each sample word segment belongs to the initial dictionary, thereby obtaining the detection information dictionary.

[0054] The sample word segmentation module includes:

[0055] The word segmentation unit is used to segment the sample extended description text contained in the structure tree of at least two sample nodes to obtain one or more words;

[0056] The word segmentation filtering unit is used to filter invalid words from one or more word segments to obtain valid words;

[0057] The word segmentation deduplication unit is used to deduplicatize valid word segments to obtain sample word segments.

[0058] One embodiment of this application provides a computer device, including: a processor, a memory, and a network interface;

[0059] The processor is connected to the memory and the network interface. The network interface is used to provide a data communication network element, the memory is used to store a computer program, and the processor is used to call the computer program to execute the method in the embodiments of this application.

[0060] One aspect of this application provides a computer-readable storage medium storing a computer program adapted for loading by a processor and executing the methods described in this application.

[0061] One aspect of this application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method described in this application.

[0062] In this embodiment, a target node structure tree of the application to be detected is first constructed. Each node in the target node structure tree contains an interactive component and its corresponding extended description text. Then, the target description text in the target node structure tree is segmented to obtain target description segments. These target description segments are then matched for similarity with the segments in the detection information dictionary to determine the detection information type of the target description segments. Finally, the detection result for the application to be detected is determined based on the event type of the event trigger attribute and the detection information type. Here, the target description text refers to the extended description text contained in the nodes with event trigger attributes in the target node structure tree. Using the method provided in this embodiment, for the application to be detected, the target description text can be obtained by constructing a target node structure tree, and then semantic analysis can be performed on the target description text based on the detection information dictionary to obtain the detection result for the application to be detected. Based on this detection result, it can be determined whether the mini-program has any anomalies. The detection process for the application to be detected does not require manual intervention, which can reduce the cost and time consumption of anomaly detection and reduce the probability of missed or false positives. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1This is a schematic diagram of a network architecture provided in an embodiment of this application;

[0065] Figure 2 This is a schematic diagram illustrating an application scenario of an anomaly detection method provided in an embodiment of this application;

[0066] Figure 3 This is a flowchart illustrating an application anomaly detection method provided in an embodiment of this application;

[0067] Figure 4 This is a flowchart illustrating a method for constructing a target node structure tree according to an embodiment of this application;

[0068] Figure 5 This is a schematic diagram illustrating the process of obtaining an interactive component layout file according to an embodiment of this application;

[0069] Figure 6 This is a flowchart illustrating a method for generating a detection information dictionary according to an embodiment of this application;

[0070] Figure 7 This is a schematic diagram of the structure of an application anomaly detection device provided in an embodiment of this application;

[0071] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0072] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0073] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0074] Cloud security refers to the collective term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business models. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behavior. Through a large network of clients, it monitors abnormal software behavior on the network, obtains the latest information on Trojans and malware on the internet, sends it to the server for automatic analysis and processing, and then distributes solutions for viruses and Trojans to each client.

[0075] Mobile Mini Programs Security (MMPS) provides users with a one-stop security solution for the entire lifecycle of mini programs. This primarily includes functions such as mini program privacy compliance, security diagnostics, hardening, and security scanning, and offers both public cloud and private cloud services. MMPS is currently widely used in various industries such as new retail, finance, internet, and government, providing stable and effective security for the development, construction, and operation of mini programs for businesses and individuals.

[0076] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0077] Natural Language Processing (NLP) is an important field within computer science and artificial intelligence. It studies the theories and methods for enabling effective communication between humans and computers using natural language. NLP is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field involves natural language—the language people use in daily life—and thus it has a close relationship with linguistic research. NLP techniques typically include text processing, semantic understanding, machine translation, question answering, and knowledge graphs.

[0078] Machine Learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0079] Deep learning (DL) learns the inherent patterns and hierarchical representations of sample data. The information gained during this learning process greatly aids in interpreting data such as text, images, and sound. Its ultimate goal is to enable machines to possess analytical and learning capabilities like humans, allowing them to recognize data such as text, images, and sound. Deep learning is a complex machine learning algorithm that has achieved results in speech and image recognition far exceeding those of previous related technologies.

[0080] Please see Figure 1 , Figure 1 This is a schematic diagram of a network architecture provided in an embodiment of this application. For example... Figure 1 As shown, the network architecture may include a service server 100 and a cluster of terminal devices. The cluster of terminal devices may include terminal devices 10a, 10b, 10c, ..., 10n. Each terminal device in the cluster may have a communication connection with the service server 100. For example, terminal device 10a may have a communication connection with the service server 100, terminal device 10b may have a communication connection with the service server 100, and terminal device 10c may have a communication connection with the service server 100. The communication connection is not limited to a specific method. It may be a direct or indirect connection via wired communication, a direct or indirect connection via wireless communication, or other methods. This application does not impose any restrictions on these methods.

[0081] It should be understood that, such as Figure 1 Each terminal device in the terminal cluster shown can have an application client installed. When the application client runs on each terminal device, it can interact with the aforementioned... Figure 1The business servers 100 shown interact with each other, enabling each business server 100 to receive business data from each terminal device. The application client can be a software management application, instant messaging application, payment application, browser, or other application client with the ability to display text, images, and other data information. This application client can be a standalone client or an embedded sub-client integrated into another client (such as an instant messaging client, social networking client, video client, etc.); no limitation is made here.

[0082] like Figure 1 As shown, each terminal device in the terminal device cluster can obtain the application to be tested by running the application client and send it as business data to the business server 100. The business server 100 can perform anomaly detection on the application to be tested and obtain the detection result. The application to be tested can include third-party platform-integrated applications (mini-programs) and mobile applications (APPs). APPs mainly refer to software installed on terminal devices, requiring a corresponding system to run, used to improve the shortcomings of the original system and for personalization; mini-programs are applications that can be used without downloading and installation, but are usually attached to an app, meaning they can be accessed by scanning a QR code or searching through that app. When the application to be tested obtains and uses object information, there may be certain anomalies. For example, if it obtains the object's mobile phone number and uploads it to the cloud, the object's privacy and security may be leaked, meaning the application to be tested has privacy and security risks. However, because the application under test obtains object information in various ways and involves a wide variety of object information, the object may not necessarily be able to detect the abnormality of the application under test. Therefore, before using the application under test, an anomaly detection can be performed on the application under test to obtain the detection results and determine the abnormality of the application under test based on the detection results.

[0083] In one feasible embodiment, taking a mini-program as an example, since mini-programs can be used without downloading and installing, they only need authorization from an app to access them. Users of that app can directly access the mini-program's page by scanning a QR code and then perform corresponding operations. As the types and number of mini-programs gradually increase, different mini-programs will obtain object information of different types. Before authorizing a mini-program, the application platform usually needs to perform anomaly detection to prevent the user from leaking important or private object information due to using the mini-program. The application platform's testing personnel can run the aforementioned application client on a terminal device and then obtain the mini-program through the application client. After obtaining the mini-program, the terminal device can send it as business data to the business server 100. The business server 100 can perform anomaly detection on the mini-program, determine the detection result, and inform the user of the weighted risk probability of the information type of the object information that the mini-program needs to obtain, thereby enabling the testing personnel to determine the risk level of the mini-program. The weighted risk probability is determined based on the risk probability of the information type corresponding to the object information and the risk weight of the event type corresponding to the object information; where the event type refers to the type of the event method executed by the mini program for the object information.

[0084] After obtaining the mini-program, business server 100 can perform anomaly detection on the application to be tested and determine the detection result. Please refer to [link to relevant documentation] for the detailed implementation process. Figure 2 , Figure 2 This is a schematic diagram illustrating an application scenario for an application anomaly detection method provided in this application embodiment. For ease of understanding, the example described above will still be the applet to be detected. Figure 2 As shown, terminal device 200 (which can be the above-mentioned) Figure 1 Any terminal device, for example, terminal device 10a), has software management application 300 integrated and installed. Object A is associated with terminal device 200. Assume object A is a tester responsible for testing whether the mini-program accessing the target app complies with security regulations, for example, mini-program 301. In the interactive interface of mini-program 301, interactive components that can obtain object information will appear, such as... Figure 2As shown, the interactive interface 302 of the mini-program 301 includes interactive components 303, 304, and 305. Interactive component 303 is purely display-oriented, used only to display the descriptive text "Privacy Policy Display." Interactive components 304 and 305, in addition to displaying the descriptive text, also carry event-triggered attributes. That is, object A can trigger interactive component 304 to indicate agreement to the privacy policy display, or trigger interactive component 305 to indicate rejection of the privacy policy display. When object A triggers interactive component 304 or 305, the mini-program 301 can obtain object A's selection information regarding the privacy policy display. When the mini-program 301 contains one or more interactive interfaces, each interface may have interactive components with event-triggered attributes. When an object triggers an interactive component with event-triggered attributes, the mini-program can obtain object information and execute the event methods associated with that interactive component. These event methods may contain anomalies, such as uploading sensitive object information to the cloud, causing leakage of object information. If object A were to manually perform anomaly detection on mini-program 301, it would need to manually open each interactive interface to check and determine whether mini-program 301 is abnormal, which would inevitably take a considerable amount of time. Therefore, object A can upload mini-program 301 to software management application 300, and then run software management application 300 through terminal device 200 to send data to business server 400 (e.g., the aforementioned...). Figure 1 The business server 100 (shown) initiates an anomaly detection request for the mini-program 301. Then, the business server 400 can perform anomaly detection on the mini-program 301 and determine the detection result of the mini-program 301, that is, determine the weighted risk probability of the information type of the object information obtained by the mini-program 301, so that object A can determine the risk of the mini-program 301.

[0085] like Figure 2As shown, the terminal device 200 sends the mini-program 301 to the business server 400. It should be noted that sending the mini-program 301 to the business server 400 can be done by sending the source code data package of the mini-program 301 to the business server 400, whereby the business server 400 performs anomaly detection on the mini-program 301. The business server 400 first constructs a target node structure tree 401 for the mini-program 301. This target node structure tree 401 corresponds to the interactive interface of the mini-program 301, and is constructed based on the interactive components within the interactive interface. Assuming the interactive interface of mini-program 301 only contains interactive interface 301, then the target node structure tree 401 can contain nodes 4011, 4012, and 4013. Node 4011 contains interactive component 303 and its corresponding extended description text A; node 4012 contains interactive component 304 and its corresponding extended description text B; and node 4013 contains interactive component 305 and its corresponding extended description text C. The extended description texts contained in the target node structure tree 401 are determined based on the interactive components contained in each node and the node structure relationships within the target node structure 401. The node structure relationships in the target node structure tree 401 are determined based on the structural relationships of the interactive components in interactive interface 302. Figure 2 As can be seen, interaction component 303 contains interaction components 304 and 305; therefore, node 4011 is the parent node of nodes 4012 and 4013. In simple terms, the business server 400 first determines the description text corresponding to each interaction component, that is, the text attribute value corresponding to that interaction component. For example, the description text of interaction component 304 is "agree." Then, the business server 400 can expand the description text of the interaction component based on its neighboring interaction components (referring to the interaction components contained in nodes that have a parent-child relationship with the node of that interaction component), thus obtaining expanded description text. For example, the description text of its neighboring interaction components can be added to the description text of this interaction component. The expansion of the description text mainly aims to better supplement the contextual semantics, thereby improving the accuracy of subsequent detection.

[0086] like Figure 2As shown, after obtaining the target node structure tree 401, the business server 400 can extract the extended description text contained in the nodes with event triggering attributes, forming the target description short text 402. As mentioned above, nodes 4012 containing interactive components 304 and 4013 containing interactive components 305 have event triggering attributes; therefore, the target description short text 402 is composed of extended description text B and extended description text C. Then, the business server 400 performs word segmentation on the target description short text 402, assuming it obtains target description word segments 4031, 4032, and 4033. The business server 400 can then perform similarity matching between each target description word and the word segments in the detection information dictionary 404, obtaining the detection information type 4051 corresponding to target description word 4031, the detection information type 4052 corresponding to target description word 4032, and the detection information type 4053 corresponding to target description word 4033. The detection information dictionary 404 contains multiple word segments and their corresponding information types. The business server 400 retrieves the word segment with the highest similarity to the target description word from the detection information dictionary 404, and then determines the information type of that word as the detection information type corresponding to the target description word. Subsequently, the business server 400 can determine the weighted risk probability corresponding to each target detection word based on the event type of the event trigger attribute corresponding to the target detection word and the detection information type corresponding to that target detection word, thus obtaining the detection result for the mini-program 301. It is understandable that event trigger attributes have different event types, such as upload information type, retrieve information type, etc. Upload information type means that object information needs to be uploaded to the cloud or other servers, while retrieve information type means retrieving object information. The possibility of information leakage during the upload process is higher than that during the retrieval process. Therefore, the same detection information type corresponds to different event types, resulting in different levels of risk.

[0087] Optionally, if the terminal device stores a detection information dictionary, anomaly detection can also be performed on the terminal device. Since generating the detection information dictionary involves a significant amount of offline computation, the detection information dictionary on the terminal device can be generated by the business server 400 and then sent to the terminal device for storage.

[0088] It is understood that the methods provided in this application embodiment can be executed by computer devices, including but not limited to terminal devices or servers. The business server 100 in this application embodiment can be a computer device, and the terminal devices in the terminal device cluster can also be computer devices; this is not limited here. The aforementioned server can be an independent physical server, a server cluster composed of multiple physical servers, or a distributed system. It can also be a cloud server providing basic cloud computing services such as cloud services, cloud security, data security, application security, privacy protection, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The aforementioned terminal devices include but are not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, and vehicle terminals, but are not limited to these. This application embodiment can be applied to various scenarios, including but not limited to cloud technology, cloud security, application security, data security, mini-program security, blockchain, artificial intelligence, smart transportation, and assisted driving.

[0089] It is understood that, in the specific embodiments of this application, the data related to the application to be tested, when applied to specific products or technologies, requires user permission or consent, and the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0090] Further, please see Figure 3 , Figure 3 This is a flowchart illustrating an application anomaly detection method provided in an embodiment of this application. The application anomaly detection method can be executed by a computer device, wherein the computer device can be the one described above. Figure 1 The business server 100 shown can also be the one described above. Figure 1 Any terminal device in the terminal device cluster shown, such as terminal device 10c. The following description will use the example of this application anomaly detection method being executed by a computer device. This application anomaly detection method may include at least the following steps S101-S104:

[0091] Step S101: Construct a target node structure tree for the application to be detected.

[0092] Specifically, the target node structure tree contains one or more nodes, and each node contains an interactive component and its corresponding extended description text. The extended description text in the target node structure tree is determined by the interactive components contained in each node and the node structural relationships within the target node structure tree.

[0093] Specifically, the application to be tested can include mini-programs, mobile applications, etc. During operation, the application to be tested can contain one or more interactive interfaces, which can be composed of one or more interactive components, such as those mentioned above. Figure 2 The interactive interface 301 is shown. Interactive components are the basic building blocks of an interactive interface. An interactive component can display a partial view on a terminal device; therefore, one or more interactive components can constitute an interactive interface. Common interactive components include view container components, basic content components, form components, navigation components, media components, map components, and canvas components. Each interactive component has attributes. By setting the attribute values ​​corresponding to the attributes of an interactive component, its presentation style can be changed. Different types of interactive components will have some common attributes, such as component text attributes, component class name attributes, component style attributes, component color attributes, etc. The text attribute values ​​corresponding to the component text attributes of an interactive component are generally displayed in the interactive interface. Through the displayed text attribute values, the object can understand the function and purpose of the interactive component; therefore, the text attribute values ​​of an interactive component can also be called the descriptive text of the interactive component. For example, if the descriptive text of button component A is "Agree to upload phone number," then the object knows that after clicking button component A, its phone number will be uploaded to the cloud.

[0094] Therefore, during operation, the application under test can obtain object information through interactive components of its user interface. However, in the process of obtaining this information, the application may engage in sensitive behaviors. Specifically, the application under test refers to any behavior involving the collection of sensitive data such as personal information and geographic location information. When an application under test exhibits sensitive behaviors, the user faces privacy and security risks when using it. To determine whether an application under test complies with security regulations, anomaly detection can be performed.

[0095] Specifically, computer devices can construct a target node structure tree for the application under test using reverse engineering methods. This allows them to obtain the extended description text corresponding to the interactive components of the mini-program, and then perform anomaly detection on the application. Reverse engineering refers to obtaining the application's assembly code through decompilation and other methods to analyze the code flow. When constructing the target node structure tree, the computer device can first obtain the source code data package corresponding to the application under test, then perform reverse engineering on it to determine the interactive interface contained in the application, the interactive components contained in the interactive interface, and the structural relationships between the interactive components. This generates an initial node structure tree, where each node in the initial node structure tree corresponds to an interactive component. The structural relationships between nodes depend on the structural relationships between interactive components. For example, if interactive component A contains interactive components B and C, then node A corresponding to interactive component A is the parent node of node B corresponding to interactive component B and node C corresponding to interactive component C, and nodes B and C are parallel nodes. It should be noted that when the application under test contains multiple interactive interfaces, the computer device can generate multiple initial node structure trees, meaning one initial node structure tree corresponds to one interactive interface. Alternatively, it can generate a single target empty node as the root node of the initial node structure tree, and then use the root nodes of the node structure trees corresponding to multiple interactive interfaces as child nodes of this target empty node, thus obtaining a single initial node structure tree. For ease of understanding, the following explanation will use the example of the computer device generating an initial node structure tree for the application under test. After obtaining the initial node structure tree, the computer device can reverse-engineer the descriptive text corresponding to each interactive component. Then, based on the node structure relationship in the initial node structure tree, it can expand the descriptive text corresponding to each interactive component, thus obtaining the expanded descriptive text corresponding to each interactive component. This expanded descriptive text is then written into the node containing that interactive component, resulting in the target node structure tree. It is understandable that the node structure relationship in the initial node structure tree is the same as that in the target node structure tree.

[0096] Specifically, the descriptive text corresponding to the interactive components is expanded based on the node structure relationship. That is, the descriptive text corresponding to the interactive components contained in the adjacent nodes of the node is supplemented to make its contextual semantics richer and facilitate subsequent detection.

[0097] Step S102: Perform word segmentation on the short text describing the target in the target node structure tree to obtain the target description word segmentation.

[0098] Specifically, the target description short text refers to the extended description text contained in nodes with event-triggered attributes in the target node structure tree. Interactive components can have event-triggered attributes; in this case, the node containing the interactive component can be considered to have event-triggered attributes. When an interactive component has an event-triggered attribute, the object's behavior towards that interactive component (behaviors that require object triggering, such as clicks or swipes) will be responded to by the computer device, and the application under test will execute the method associated with that interactive component. It can be understood that the application under test can only obtain object information when an object triggers an interactive component with an event-triggered attribute. Therefore, the extended description text corresponding to interactive components with event-triggered attributes can effectively describe the type of object information that the application under test needs to obtain. Therefore, the computer device can obtain the extended description text contained in all nodes with event-triggered attributes from the target node structure tree and use it as the target description short text.

[0099] Specifically, if the target description short text contains one or more target description phrases, a feasible implementation process for segmenting the target description short text in the target node structure tree to obtain target description word segments is as follows: traverse one or more target description phrases to obtain the j-th target description phrase; j is a positive integer; j is less than or equal to the number of one or more target description phrases; determine the language type corresponding to the j-th target description phrase as the target language type; call the word segmentation tool corresponding to the target language type to segment the target description phrase, obtaining the short sentence target description word segment corresponding to the j-th target description phrase; use the short sentence target description word segment corresponding to each target description phrase as the target description word segment. The speech type can include Chinese, English, etc. Different word segmentation tools can be used for target description phrases of different language types. For example, if the language type of the target description phrase is Chinese, a Chinese word segmentation tool can be used; if the language type of the target description phrase is English, camelCase word segmentation can be used. Of course, other word segmentation methods can also be used to segment the target description phrase, and this application does not impose any restrictions here.

[0100] Step S103: Perform similarity matching between the target description segment and the segment in the detection information dictionary to determine the detection information type of the target description segment.

[0101] Specifically, a feasible implementation process for determining the detection information type of the target description segment by performing similarity matching between the target description segment and the segment in the detection information dictionary is as follows: The language type of the target description segment is taken as the target language type; the segment in the detection information dictionary whose language type matches the target language type is taken as the target search segment; the segment with the highest similarity to the target description segment is obtained from the target search segment and taken as the target matching segment; the information type corresponding to the target matching segment is obtained from the detection information dictionary and taken as the detection information type of the target description segment. The similarity matching can be implemented using fuzzy matching. For ease of understanding, let's assume the target description segment is "telephone" and its language type is Chinese. Therefore, the computer device can use segments in the detection information dictionary that are also in Chinese as target search segments. Let's assume the target search segments are "telephone number", "name", and "date of birth". Then, the computer device can perform fuzzy matching on the target description segment and the target search segment to obtain the segment with the highest similarity to "telephone", namely "telephone number", as the target matching segment. Let's assume that the information type of "telephone number" in the detection information dictionary is "basic information", then the detection information type of the target description segment "telephone number" is "basic information".

[0102] Step S104: Determine the detection result for the application to be detected based on the event type of the event triggering attribute and the detection information type.

[0103] Specifically, there are many event types corresponding to the event triggering attribute, such as information retrieval and information upload. Information upload means uploading object information to the cloud or other servers, while information retrieval means retrieving object information. The possibility of information leakage during upload is higher than during retrieval; that is, different event types correspond to different levels of risk. Therefore, different risk weights can be set for different event types based on their respective risk levels. Similarly, information types can include basic data, educational and work information, property information, etc. The risk of object information leakage also varies for different information types. Therefore, different risk probabilities can be set for different information types. Thus, based on the event type of the event triggering attribute and the detection information type, a feasible implementation process for determining the detection results for the application to be detected is as follows: Obtain the risk weight corresponding to the event type of the event triggering attribute; obtain the risk probability corresponding to the detection information type; weight the risk probabilities according to the risk weights to obtain a weighted risk probability; generate the detection results for the application to be detected based on the weighted risk probability. The detection result is actually the analysis result of the information type of the object information collected by the application under test, that is, the weighted risk probability. The higher the weighted risk probability, the more serious the abnormal problem of the application under test.

[0104] Using the method provided in this application embodiment, a target node structure tree of the application to be detected is first constructed. Each node in the target node structure tree contains an interactive component and its corresponding extended description text. The extended description text in the target node structure tree is determined based on the interactive components contained in each node and the node structural relationships in the target node structure tree. Subsequently, the target description short text in the target node structure tree is segmented to obtain target description segments. The target description segments are then matched with the segments in the detection information dictionary to determine the detection information type of the target description segments. Finally, the detection result for the application to be detected can be determined based on the event type of the event trigger attribute and the detection information type. Here, the target description short text refers to the extended description text contained in the nodes with event trigger attributes in the target node structure tree. Using the method provided in this application embodiment, for the application to be detected, a short text describing the target can be obtained by constructing a target node structure tree. Then, semantic analysis is performed on the short text describing the target based on the detection information dictionary, thereby obtaining the detection result for the application to be detected. Based on the detection result, it can be determined whether the mini-program has any abnormalities. The detection process for the application to be detected does not require manual intervention, which can reduce the cost and time consumption of abnormal detection of the application to be detected, and reduce the probability of missed detection and false detection.

[0105] Further, please see Figure 4 , Figure 4 This is a flowchart illustrating a method for constructing a target node structure tree according to an embodiment of this application. The construction method is as described above. Figure 3 One feasible implementation of step S101 in the corresponding embodiment can be executed by a computer device, wherein the computer device can be the one described above. Figure 1 The business server 100 shown can also be the one described above. Figure 1 Any terminal device in the terminal device cluster shown, such as terminal device 10c. The following description will use the example of this construction method being executed by a computer device. This construction method may include at least the following steps S201-S205:

[0106] Step S201: Obtain the source code data package corresponding to the application to be detected, and obtain the layout file of the interactive component from the source code data package.

[0107] For details, please refer to the following: Figure 5 , Figure 5 This is a schematic diagram illustrating the process of obtaining an interactive component layout file according to an embodiment of this application. For example... Figure 5 As shown, a feasible implementation of obtaining the source code data package corresponding to the application to be tested and extracting the layout file of the interactive components from the source code data package includes the following steps:

[0108] Step S2011: Obtain the source code data package corresponding to the application to be tested.

[0109] Step S2012: Perform format detection on the source code data packet and obtain the format detection result.

[0110] Specifically, if the source code data package is a compressed and compiled code package, the computer device cannot directly search for the files contained therein. Therefore, the computer device needs to first perform a format check on the source code data package to determine whether the source code data package has been compressed and compiled.

[0111] Step S2013: If the format detection result is a compressed compilation result, then the source code data package is decompiled to obtain the decompiled source code data package, and the interactive component layout file is searched from the decompiled source code data package.

[0112] Specifically, if the format detection result is a compressed compilation result, it means that the source code data package is a compressed and compiled code package. Therefore, the computer device needs to decompile the source proxy data package first to obtain the decompiled source code data package before it can normally search for the files contained therein. Decompilation can be performed using tools like AppUnpacker (a small program decompiler) or decompression software; the specific implementation depends on the type of application being tested. Furthermore, if the source code data package is not only compressed and compiled but also obfuscated, it can be restored using a corresponding deobfuscation tool during the decompilation process.

[0113] Step S2014: If the format detection result is not a compressed compilation result, then search for the interactive component layout file in the source code data package.

[0114] Step S202: Perform tree parsing processing on the interactive component layout file to obtain the initial node structure tree.

[0115] Specifically, the initial node structure tree contains one or more nodes, and each node contains an interactive component. The node structure relationship of the initial node structure tree is determined based on the structural relationship between interactive components in the interactive component layout file.

[0116] Specifically, the interactive component layout file contains all the interactive components corresponding to the application to be tested, as well as the structural relationships between them. If such a file is in XML (Extensible Markup Language) format, XML is a markup language used to mark up electronic documents to give them structure. Therefore, the interactive component layout file can well represent the structural relationships between interactive components. Computer devices can use XML parsing tools to parse the interactive component layout file into a tree structure, thereby obtaining an initial node structure tree. At this time, each interactive component will be mapped to a node in the initial node structure tree. There are parent-child relationships between interactive components and between interactive components and the layout framework; therefore, there are parent-child relationships between nodes.

[0117] Step S203: Extract the text attribute values ​​for each interactive component to obtain the description text corresponding to each interactive component.

[0118] Specifically, as described in step S101 above, each interactive component can have multiple attribute values. The computer device can extract the text attribute values ​​of each interactive component, filtering out attribute values ​​that are irrelevant to the component's text attributes during the extraction process, thus obtaining the description text corresponding to each interactive component. Irrelevant attribute values ​​include, but are not limited to, the attribute values ​​corresponding to the component class name, component style, component color, and component bound data variables.

[0119] Step S204: Expand the description text corresponding to each interactive component according to the node structure relationship in the initial node structure tree to obtain the expanded description text corresponding to each interactive component.

[0120] Specifically, interactive components and their corresponding descriptive text can form a similar structure.<n,s> The binary tuple is defined as follows: n represents the interactive component or its corresponding node, and s represents its corresponding descriptive text. Computer devices can expand the binary tuple based on the parent-child node relationships in the node structure to obtain an expanded binary tuple.<n,q> , where q is the extended description text corresponding to n.

[0121] Specifically, assuming n is a node, s can be expanded according to the parent-child relationship of n using the following rules: the parent node possesses the explanatory short text information of all its child nodes; for nodes that do not have explanatory short text information themselves, the node possesses the explanatory short text information of its parent node. In other words, a feasible implementation process for expanding the description text corresponding to each interactive component based on the node structure relationship in the initial node structure tree to obtain the expanded description text corresponding to each interactive component is as follows: traverse the initial node structure tree, expand the description text corresponding to each interactive component according to the child node relationship of the traversed nodes to obtain the transitional description text corresponding to each interactive component; if there are no nodes without explanatory descriptions in the initial node structure tree, then the transitional description text corresponding to each interactive component is used as the expanded description text corresponding to each interactive component; nodes without explanatory descriptions refer to nodes whose associated transitional description text does not belong to the explanatory type; if there are nodes without explanatory descriptions in the initial node structure tree, then the transitional description text corresponding to the interactive components contained in the nodes without explanatory descriptions is supplemented according to the parent node relationship of the nodes without explanatory descriptions to obtain the expanded description text corresponding to each interactive component. In this context, a node without explanatory description refers to a node whose interactive component's transition description text does not contain explanatory text. Explanatory text carries short explanatory text information; for example, if the description text is "Privacy Policy Display," its corresponding explanatory description text is "Privacy Policy." The object can obtain the displayed text as a privacy policy through this explanatory description text.

[0122] Specifically, a feasible implementation of the above-mentioned traversal of the initial node structure tree and expansion processing of the description text corresponding to each interactive component based on the child node relationships of the traversed nodes to obtain the transition description text corresponding to each interactive component is as follows: Traverse the initial node structure tree to obtain the k-th node; k is a positive integer less than or equal to M, where M is the number of one or more nodes; if the child node relationship of the k-th node indicates that the k-th node has no child nodes, then the description text corresponding to the interactive component contained in the k-th node is used as the transition description text corresponding to the interactive component contained in the k-th node; if the child node relationship of the k-th node indicates that the k-th node has child nodes, then the child node corresponding to the k-th node is used as the target child node, and the description text corresponding to the interactive component contained in the target child node is added to the description text corresponding to the interactive component contained in the k-th node to obtain the transition description text corresponding to the interactive component contained in the k-th node.

[0123] For ease of understanding, assume that after extracting text from the attributes of each node in the initial node structure tree, a mapping table between nodes and their descriptive text is obtained. A usable structure of this mapping table is shown in Table 1:

[0124] Table 1

[0125]

[0126] Where <node1, node2> indicates that in the initial node structure tree, node1 is the parent node of node2. The computer device can expand the mapping relationship table shown in Table 1 based on the parent-child node relationships in the initial node structure tree to obtain a transitional mapping relationship table, as shown in Table 2.

[0127] Table 2

[0128]

[0129] Specifically, if there are nodes without explanatory descriptions in the initial node structure tree, a feasible implementation for supplementing the transitional description text corresponding to the interactive components contained in the nodes without explanatory descriptions, based on the parent node relationship of the nodes without explanatory descriptions, to obtain the extended description text corresponding to each interactive component, is as follows: If there are nodes without explanatory descriptions in the initial node structure tree, obtain the parent node relationship of the nodes without explanatory descriptions; if the parent node relationship of the nodes without explanatory descriptions indicates that the nodes without explanatory descriptions have parent nodes, then supplement the target explanatory description text into the transitional description text corresponding to the interactive components contained in the nodes without explanatory descriptions; the target explanatory description text refers to the text of the explanatory type in the transitional description text corresponding to the interactive components contained in the parent node; both the supplemented transitional description text and the transitional description text corresponding to the interactive components contained in the explanatory description nodes are used as extended description text; the explanatory description nodes refer to the nodes in the initial node structure tree other than the nodes without explanatory descriptions.

[0130] For easier understanding, please refer to Table 2. As shown in Table 2, the transition description texts corresponding to the interactive components contained in nodes 2 and 3 do not carry explanatory short text information. Therefore, nodes 2 and 3 are nodes without explanatory descriptions. In this case, the target explanatory description text contained in their parent nodes can be added to their corresponding transition description texts, resulting in the extended mapping relationship table, as shown in Table 3.

[0131] Table 3

[0132]

[0133]

[0134] Step S205: Add the extended description text corresponding to each interactive component to the node to which each interactive component belongs, to obtain the target node structure tree.

[0135] Using the method provided in the embodiments of this application, the descriptive text associated with each node is supplemented into the descriptive text of each node as context according to the node structure relationship of the target node structure tree, as shown in Table 3 above. The resulting extended descriptive text is more interpretable and fully understandable than the original descriptive text corresponding to the node.

[0136] Further, please see Figure 6 , Figure 6 This is a flowchart illustrating a method for generating a detection information dictionary according to an embodiment of this application. The generation method involves constructing the aforementioned... Figure 3 One feasible implementation method of the detection information dictionary described in the corresponding embodiment can be executed by a computer device, wherein the computer device can be the one described above. Figure 1 The business server 100 shown can also be the one described above. Figure 1 Any terminal device in the terminal device cluster shown, such as terminal device 10c. The following description will use the example of this generation method being executed by a computer device. This generation method may include at least the following steps S301-S305:

[0137] Step S301: Obtain at least two sample applications and construct the sample node structure tree for each sample application.

[0138] Specifically, a sample node structure tree contains one or more sample nodes, and each sample node contains a sample interaction component and the corresponding extended description text for that interaction component. The extended description text in the sample node structure tree is determined based on the sample interaction components contained in each sample node and the structural relationships between the sample nodes in the structure tree.

[0139] Specifically, when constructing the detection information dictionary, a large number of sample applications can be obtained first to form a sample application set. Then, for each sample application in this set, a corresponding sample node structure tree can be constructed. The process of constructing the sample node structure tree can be referred to the above. Figure 4 The construction process of the target node structure tree described in the corresponding embodiment will not be repeated here.

[0140] Step S302: Perform word segmentation and extraction processing on the sample extended description text contained in the structure tree of at least two sample nodes to obtain sample word segments.

[0141] Specifically, a feasible implementation process for extracting sample extended description text from at least two sample node structure trees to obtain sample word segments is as follows: Perform word segmentation on the sample extended description text from at least two sample node structure trees to obtain one or more word segments; filter invalid word segments from the one or more word segments to obtain valid word segments; and perform deduplication on the valid word segments to obtain the sample word segments. Invalid word segments can refer to text word segments without explanatory descriptive information, i.e., word segments that do not belong to the explanatory type. Understandably, when the number of sample applications is large enough, the probability of duplicate word segments is high; therefore, it is necessary to perform deduplication on the valid word segments to determine the uniqueness of valid words and reduce the workload in subsequent steps.

[0142] Step S303: Perform clustering processing on the sample word segmentation to obtain sample word segmentation clusters.

[0143] Specifically, the purpose of clustering sample word segments is to add sample word segments with the same information type into the same sample word segment cluster. In other words, the sample word segments in a sample word segment cluster have the same information type.

[0144] Step S304: The sample word segmentation clusters are labeled to determine the information type corresponding to the sample word segmentation clusters.

[0145] Specifically, the purpose of labeling sample word segmentation clusters is to record which information type each cluster belongs to. Specifically, the information type can be referenced from the user information types defined in GB / T 35273-2020 Information Security Technology - Personal Information Security Specification.

[0146] Step S305: Add the information type corresponding to each sample word segment and the sample word cluster to which each sample word segment belongs to the initial dictionary to obtain the detection information dictionary.

[0147] Specifically, the computer device adds each sample word segment and the information type corresponding to the sample word segmentation cluster to which the sample word segment belongs to the initial dictionary, thus obtaining the detection information dictionary.

[0148] Using the method provided in this application, a detection information dictionary can be built offline. When performing anomaly detection on the application to be detected online, the detection information dictionary can be used directly, saving detection time.

[0149] Please see Figure 7 , Figure 7This is a schematic diagram of the structure of an application anomaly detection device provided in an embodiment of this application. The application anomaly detection device can be a computer program (including program code) running on a computer device; for example, the application anomaly detection device is application software. This device can be used to execute corresponding steps in the application anomaly detection method provided in the embodiments of this application. Figure 7 As shown, the application anomaly detection device 1 may include: a construction module 11, a word segmentation module 12, a matching module 13, and a result determination module 14.

[0150] Module 11 is used to construct a target node structure tree for the application to be tested; the target node structure tree contains one or more nodes; a node contains an interactive component and an extended description text corresponding to the interactive component;

[0151] The word segmentation module 12 is used to segment the target description short text in the target node structure tree to obtain target description words; the target description short text refers to the extended description text contained in the node with event triggering attribute in the target node structure tree;

[0152] The matching module 13 is used to perform similarity matching between the target description segment and the segment in the detection information dictionary to determine the detection information type of the target description segment;

[0153] The result determination module 14 is used to determine the detection result for the application to be detected based on the event type of the event triggering attribute and the detection information type.

[0154] The specific implementation methods of the construction module 11, word segmentation module 12, matching module 13, and result determination module 14 can be found in the above description. Figure 3 The descriptions of steps S101-S104 in the corresponding embodiments will not be repeated here.

[0155] The construction module 11 includes: an acquisition unit 111, a parsing unit 112, an extraction unit 113, an extension unit 114, and an addition unit 115.

[0156] The acquisition unit 111 is used to acquire the source code data package corresponding to the application to be detected, and to obtain the layout file of the interactive component from the source code data package;

[0157] The parsing unit 112 is used to perform tree parsing processing on the interactive component layout file to obtain an initial node structure tree; the initial node structure tree contains one or more nodes; a node contains an interactive component; the node structure relationship of the initial node structure tree is determined based on the structure relationship between interactive components in the interactive component layout file.

[0158] Extraction unit 113 is used to extract text attribute values ​​for each interactive component to obtain the description text corresponding to each interactive component;

[0159] Extension unit 114 is used to extend the description text corresponding to each interactive component according to the node structure relationship in the initial node structure tree to obtain the extended description text corresponding to each interactive component.

[0160] Add unit 115 to add the extended description text corresponding to each interactive component into the node to which each interactive component belongs, so as to obtain the target node structure tree.

[0161] The specific implementation methods of the acquisition unit 111, parsing unit 112, extraction unit 113, expansion unit 114, and addition unit 115 can be found in the above description. Figure 4 The descriptions of steps S201-S205 in the corresponding embodiments will not be repeated here.

[0162] The acquisition unit 111 includes: a first acquisition subunit 1111, a format detection subunit 1112, and a second acquisition subunit 1113.

[0163] The first acquisition subunit 1111 is used to acquire the source code data packet corresponding to the application to be detected;

[0164] The format detection subunit 1112 is used to perform format detection on the source code data packet and obtain the format detection result;

[0165] The second acquisition subunit 1113 is used to decompile the source code data packet if the format detection result is a compressed compilation result, and to obtain the decompiled source code data packet, and to search for the interactive component layout file in the decompiled source code data packet.

[0166] The second acquisition subunit 1113 is also used to search for the interactive component layout file in the source code data package if the format detection result is not a compressed compilation result.

[0167] The specific implementation methods of the first acquisition subunit 1111, the format detection subunit 1112, and the second acquisition subunit 1113 can be found in the above description. Figure 5 The descriptions of steps S2011-S2012 in the corresponding embodiments will not be repeated here.

[0168] The extension unit 114 includes: a traversal extension subunit 1141, a text determination subunit 1142, and a supplementary extension subunit 1143.

[0169] Traverse the extended subunit 1141, which is used to traverse the initial node structure tree and expand the description text corresponding to each interactive component according to the child node relationship of the traversed node to obtain the transition description text corresponding to each interactive component.

[0170] The text determination subunit 1142 is used to take the transition description text corresponding to each interactive component as the extended description text corresponding to each interactive component if there is no node without explanatory description in the initial node structure tree; a node without explanatory description refers to a node whose associated transition description text does not belong to the explanatory type.

[0171] The supplementary extension subunit 1143 is used to supplement the transition description text corresponding to the interactive components contained in the unexplained description node according to the parent node relationship of the unexplained description node if there is an unexplained description node in the initial node structure tree, so as to obtain the extended description text corresponding to each interactive component.

[0172] Specifically, the traversal of the extended sub-unit is used to traverse the initial node structure tree to obtain the k-th node; k is a positive integer less than or equal to M, where M is the number of one or more nodes; if the child node relationship of the k-th node indicates that the k-th node has no child nodes, then the description text corresponding to the interactive component contained in the k-th node is used as the transition description text corresponding to the interactive component contained in the k-th node; if the child node relationship of the k-th node indicates that the k-th node has child nodes, then the child node corresponding to the k-th node is used as the target child node, and the description text corresponding to the interactive component contained in the target child node is added to the description text corresponding to the interactive component contained in the k-th node to obtain the transition description text corresponding to the interactive component contained in the k-th node.

[0173] Specifically, the supplementary extension sub-unit is used to: if there are nodes without explanatory descriptions in the initial node structure tree, obtain the parent node relationship of the nodes without explanatory descriptions; if the parent node relationship of the nodes without explanatory descriptions indicates that the nodes without explanatory descriptions have parent nodes, then supplement the target explanatory description text into the transition description text corresponding to the interactive components contained in the nodes without explanatory descriptions; the target explanatory description text refers to the text of the explanatory type in the transition description text corresponding to the interactive components contained in the parent node; both the supplemented transition description text and the transition description text corresponding to the interactive components contained in the explanatory description nodes are used as extended description text; the explanatory description nodes refer to the nodes in the initial node structure tree other than the nodes without explanatory descriptions.

[0174] The specific implementation methods of the traversal extension subunit 1141, the text determination subunit 1142, and the supplementary extension subunit 1143 can be found in the above description. Figure 4 The description of step S204 in the corresponding embodiment will not be repeated here.

[0175] The target description short text contains one or more target description short sentences;

[0176] The word segmentation module 12 includes: a short sentence traversal unit 121, a language type determination unit 122, a segmentation unit 123, and a word segmentation determination unit 124.

[0177] Short phrase traversal unit 121 is used to traverse one or more target description short phrases and obtain the j-th target description short phrase; j is a positive integer; j is less than or equal to the number of one or more target description short phrases;

[0178] Language type determination unit 122 is used to determine the language type corresponding to the j-th target description sentence, and use it as the target language type;

[0179] The segmentation unit 123 is used to call the word segmentation tool corresponding to the target language type to segment the target description short sentences and obtain the short sentence target description word segmentation corresponding to the j-th target description short sentence;

[0180] The word segmentation determination unit 124 is used to segment the short target description words corresponding to each target description short sentence as target description words.

[0181] The specific implementation methods of the short sentence traversal unit 121, language type determination unit 122, segmentation unit 123, and word segmentation determination unit 124 can be found in the above description. Figure 3 The description of step S102 in the corresponding embodiment will not be repeated here.

[0182] The result determination module 14 includes: a weight acquisition unit 141, a probability acquisition unit 142, a weighting unit 143, and a detection result generation unit 144.

[0183] Weight acquisition unit 141 is used to acquire the risk weight corresponding to the event type of the event triggering attribute;

[0184] The probability acquisition unit 142 is used to acquire the risk probability corresponding to the detection information type;

[0185] Weighting unit 143 is used to weight the risk probability according to the risk weight to obtain the weighted risk probability;

[0186] The detection result generation unit 144 is used to generate detection results for the application to be detected based on the weighted risk probability.

[0187] The specific implementation methods of the weight acquisition unit 141, probability acquisition unit 142, weighting unit 143, and detection result generation unit 144 can be found in the above description. Figure 3The description of step S104 in the corresponding embodiment will not be repeated here.

[0188] The matching module 13 includes: a target determination unit 131, a target matching unit 132, and an information type determination unit 133.

[0189] Target determination unit 131 is used to determine the language type of the target description segmentation as the target language type;

[0190] The target determination unit 131 is also used to use the word segmentation in the detection information dictionary whose language type is the target language type as the target search word segmentation;

[0191] The target matching unit 132 is used to obtain the segmentation with the highest similarity to the target description segmentation from the target search segmentation, and use it as the target matching segmentation.

[0192] The information type determination unit 133 is used to obtain the information type corresponding to the target matching word from the detection information dictionary, and use it as the detection information type of the target description word.

[0193] The specific implementation methods of the target determination unit 131, the target matching unit 132, and the information type determination unit 133 can be found in the above description. Figure 3 The description of step S103 in the corresponding embodiment will not be repeated here.

[0194] The aforementioned application anomaly detection device 1 further includes: a sample construction module 15, a sample word segmentation module 16, a clustering module 17, an annotation module 18, and a dictionary addition module 19.

[0195] The sample construction module 15 is used to obtain at least two sample applications and construct a sample node structure tree for each sample application; a sample node structure tree contains one or more sample nodes; a sample node contains a sample interaction component and a sample extended description text corresponding to the sample interaction component;

[0196] The sample word segmentation module 16 is used to perform word segmentation and extraction processing on the sample extended description text contained in the structure tree of at least two sample nodes to obtain sample words;

[0197] Clustering module 17 is used to perform clustering processing on sample word segments to obtain sample word segmentation clusters;

[0198] The annotation module 18 is used to annotate the sample word segmentation clusters and determine the information type corresponding to the sample word segmentation clusters;

[0199] The dictionary addition module 19 is used to add the information type corresponding to each sample word segment and the sample word cluster to which each sample word segment belongs to the initial dictionary, so as to obtain the detection information dictionary.

[0200] The specific implementation methods of the sample construction module 15, sample word segmentation module 16, clustering module 17, annotation module 18, and dictionary addition module 19 can be found in the above. Figure 6 The descriptions of steps S301-S305 in the corresponding embodiments will not be repeated here.

[0201] The sample word segmentation module 16 includes: word segmentation unit 161, word segmentation filtering unit 162, and word segmentation deduplication unit 163.

[0202] The word segmentation unit 161 is used to perform word segmentation on the sample extended description text contained in the structure tree of at least two sample nodes to obtain one or more words;

[0203] The word segmentation filtering unit 162 is used to filter invalid words from one or more word segments to obtain valid word segments;

[0204] The word segmentation deduplication unit 163 is used to deduplicatize valid word segments to obtain sample word segments.

[0205] The specific implementation methods of the word segmentation unit 161, the word segmentation filtering unit 162, and the word segmentation deduplication unit 163 can be found in the above description. Figure 3 The description of step S302 in the corresponding embodiment will not be repeated here.

[0206] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 8 As shown above, Figure 8 The application anomaly detection device 1 in the corresponding embodiment can be applied to a computer device 1000, which may include a processor 1001, a network interface 1004, and a memory 1005. Furthermore, the computer device 1000 may also include a user interface 1003 and at least one communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as at least one disk storage device. Optionally, the memory 1005 may also be at least one storage device located remotely from the processor 1001. Figure 8As shown, the memory 1005, which is a computer-readable storage medium, may include an operating system, a network communication module, a user interface module, and a device control application.

[0207] In such Figure 8 In the computer device 1000 shown, the network interface 1004 provides network communication elements; the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the device control application stored in the memory 1005 to achieve:

[0208] Construct a target node structure tree for the application to be tested; the target node structure tree contains one or more nodes; each node contains an interactive component and an extended description text corresponding to the interactive component.

[0209] The target description short text in the target node structure tree is segmented into words to obtain target description words; the target description short text refers to the extended description text contained in the nodes with event triggering attributes in the target node structure tree;

[0210] The similarity of the target description segmentation words with the segmentation words in the detection information dictionary is used to determine the detection information type of the target description segmentation words;

[0211] Based on the event type of the event triggering attribute and the detection information type, determine the detection result for the application to be detected.

[0212] It should be understood that the computer device 1000 described in the embodiments of this application can execute the foregoing text. Figure 3 Figure 4 Figure 5 , Figure 6 The description of the anomaly detection method for this application in any of the corresponding embodiments will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated.

[0213] Furthermore, it should be noted that this application embodiment also provides a computer-readable storage medium, which stores a computer program executed by the aforementioned application anomaly detection device 1. The computer program includes program instructions, and when the processor executes the program instructions, it can execute the aforementioned... Figure 3 , Figure 4 , Figure 5 , Figure 6 The description of the above-described application anomaly detection method in any of the corresponding embodiments is already provided, and therefore will not be repeated here. Furthermore, the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer-readable storage medium embodiments related to this application, please refer to the description of the method embodiments of this application.

[0214] The aforementioned computer-readable storage medium can be the application anomaly detection device provided in any of the foregoing embodiments or the internal storage unit of the aforementioned computer device, such as the hard disk or memory of the computer device. The computer-readable storage medium can also be an external storage device of the computer device, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., provided on the computer device. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices of the computer device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0215] Furthermore, it should be noted that this application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned... Figure 3 , Figure 4 , Figure 5 , Figure 6 The method provided in any of the corresponding embodiments.

[0216] The terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the term "comprising," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules not listed, or may optionally include other step units inherent to these processes, methods, apparatuses, products, or devices.

[0217] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the foregoing description as a network element. Whether these network elements are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can implement the described network elements using different methods for each specific application, but such implementation should not be considered beyond the scope of this application.

[0218] The above-disclosed embodiments are merely preferred embodiments of this application and should not be construed as limiting the scope of this application. Therefore, any equivalent variations made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. An application anomaly detection method, characterized in that, include: Construct a target node structure tree for the application to be detected; wherein, the target node structure tree contains one or more nodes; a node contains an interactive component and extended description text corresponding to the interactive component; The target description short text in the target node structure tree is segmented into words to obtain target description words; the target description short text refers to the extended description text contained in the nodes with event triggering attributes in the target node structure tree; The target description segment is matched with the segment in the detection information dictionary by similarity to determine the detection information type of the target description segment; Based on the event type of the event triggering attribute and the detection information type, the detection result for the application to be detected is determined.

2. The method according to claim 1, characterized in that, The construction of the target node structure tree for the application to be detected includes: Obtain the source code data package corresponding to the application to be tested, and obtain the layout file of the interactive components from the source code data package; The interactive component layout file is parsed in a tree structure to obtain an initial node structure tree; the initial node structure tree contains one or more nodes; each node contains one interactive component; the node structure relationship of the initial node structure tree is determined based on the structural relationship between interactive components in the interactive component layout file. Extract the text attribute values ​​for each interactive component to obtain the description text corresponding to each interactive component; Based on the node structure relationship in the initial node structure tree, the description text corresponding to each interactive component is expanded to obtain the expanded description text corresponding to each interactive component. The extended description text corresponding to each interactive component is added to the node to which each interactive component belongs, thus obtaining the target node structure tree.

3. The method according to claim 2, characterized in that, The step of obtaining the source code data package corresponding to the application to be detected, and obtaining the interactive component layout file from the source code data package, includes: Obtain the source code data package corresponding to the application to be tested; The source code data packet is subjected to format detection to obtain the format detection result; If the format detection result is a compressed compilation result, the source code data packet is decompiled to obtain a decompiled source code data packet, and the interactive component layout file is searched from the decompiled source code data packet. If the format detection result is not the compressed compilation result, then the interactive component layout file is searched from the source code data package.

4. The method according to claim 2, characterized in that, The step of expanding the description text corresponding to each interactive component based on the node structure relationship in the initial node structure tree to obtain the expanded description text corresponding to each interactive component includes: Traverse the initial node structure tree, and expand the description text corresponding to each interactive component according to the child node relationship of the traversed node to obtain the transition description text corresponding to each interactive component; If there are no nodes without explanatory descriptions in the initial node structure tree, then the transition description text corresponding to each interactive component is used as the extended description text corresponding to each interactive component; the node without explanatory descriptions refers to a node whose associated transition description text does not belong to the explanatory type; If the initial node structure tree contains a node without explanatory description, then the transition description text corresponding to the interactive component contained in the node without explanatory description is supplemented according to the parent node relationship of the node without explanatory description, so as to obtain the extended description text corresponding to each interactive component.

5. The method according to claim 4, characterized in that, The process involves traversing the initial node structure tree and expanding the description text corresponding to each interactive component based on the child node relationships of the traversed nodes to obtain the transition description text corresponding to each interactive component, including: Traverse the initial node structure tree to obtain the k-th node; k is a positive integer less than or equal to M, and M is the number of the one or more nodes; If the child node relationship of the kth node indicates that the kth node has no child nodes, then the description text corresponding to the interactive component contained in the kth node is used as the transition description text corresponding to the interactive component contained in the kth node. If the child node relationship of the kth node indicates that the kth node has child nodes, then the child node corresponding to the kth node is taken as the target child node, and the description text corresponding to the interactive component contained in the target child node is added to the description text corresponding to the interactive component contained in the kth node to obtain the transition description text corresponding to the interactive component contained in the kth node.

6. The method according to claim 4, characterized in that, If the initial node structure tree contains a node without explanatory description, then the transitional description text corresponding to the interactive components contained in the node without explanatory description is supplemented according to the parent node relationship of the node without explanatory description, to obtain the extended description text corresponding to each interactive component, including: If the initial node structure tree contains a node without an explanatory description, then the parent node relationship of the node without an explanatory description is obtained; If the parent node relationship of the unexplainable description node indicates that the unexplainable description node has a parent node, then the target explanatory description text is added to the transition description text corresponding to the interactive component contained in the unexplainable description node; the target explanatory description text refers to the text belonging to the explanatory type in the transition description text corresponding to the interactive component contained in the parent node. The supplemented transition description text and the transition description text corresponding to the interactive components contained in the explanatory description node are both used as extended description text; the explanatory description node refers to the node in the initial node structure tree other than the node without explanatory description.

7. The method according to claim 1, characterized in that, The target description short text contains one or more target description sentences; The step of segmenting the short text describing the target description in the target node structure tree to obtain target description segmentation includes: Iterate through the one or more target description phrases to obtain the j-th target description phrase; j is a positive integer; j is less than or equal to the number of the one or more target description phrases. Determine the language type corresponding to the j-th target description phrase, and use it as the target language type; The target description phrase is segmented using a word segmentation tool corresponding to the target language type to obtain the word segmentation of the j-th target description phrase. Each short phrase corresponding to a target description is segmented into short phrases and used as target description segments.

8. The method according to claim 1, characterized in that, The step of determining the detection result for the application to be detected based on the event type of the event triggering attribute and the detection information type includes: Obtain the risk weight corresponding to the event type of the event triggering attribute; Obtain the risk probability corresponding to the detection information type; The risk probabilities are weighted according to the risk weights to obtain the weighted risk probabilities; Detection results for the application to be detected are generated based on the weighted risk probability.

9. The method according to claim 1, characterized in that, The step of performing similarity matching between the target description segment and the segment in the detection information dictionary to determine the detection information type of the target description segment includes: The language type of the target description segmentation is taken as the target language type; The word segments in the detection information dictionary that are of the target language type are used as the target search word segments; The word segment with the highest similarity to the target description word segment is obtained from the target search word segmentation and used as the target matching word segmentation; The information type corresponding to the target matching word is obtained from the detection information dictionary and used as the detection information type of the target description word.

10. The method according to claim 1, characterized in that, Also includes: Obtain at least two sample applications and construct a sample node structure tree for each sample application; wherein, a sample node structure tree contains one or more sample nodes; A sample node contains a sample interaction component and the sample extended description text corresponding to the sample interaction component; The extended description text of samples contained in the structure tree of at least two sample nodes is processed by word segmentation and extraction to obtain sample word segments; The sample word segments are clustered to obtain sample word segmentation clusters; The sample word segmentation clusters are labeled to determine the information type corresponding to each sample word segmentation cluster; Each sample word segment and the information type corresponding to the sample word cluster to which each sample word segment belongs are added to the initial dictionary to obtain the detection information dictionary.

11. The method according to claim 10, characterized in that, The step of performing word segmentation and extraction on the sample extended description text contained in at least two sample node structure trees to obtain sample word segmentation includes: Perform word segmentation on the sample extended description text contained in the structure tree of at least two sample nodes to obtain one or more word segments; Filter out invalid word segments from the one or more word segments to obtain valid word segments; The effective word segments are deduplicated to obtain sample word segments.

12. An application anomaly detection device, characterized in that, include: A building module is used to construct a target node structure tree for the application to be detected; wherein, the target node structure tree contains one or more nodes; a node contains an interactive component and extended description text corresponding to the interactive component; The word segmentation module is used to segment the target description short text in the target node structure tree to obtain target description words; the target description short text refers to the extended description text contained in the node with event triggering attribute in the target node structure tree; The matching module is used to perform similarity matching between the target description segment and the segment in the detection information dictionary to determine the detection information type of the target description segment; The result determination module is used to determine the detection result for the application to be detected based on the event type of the event triggering attribute and the detection information type.

13. A computer device, characterized in that, include: Processor, memory, and network interface; The processor is connected to the memory and the network interface, wherein the network interface is used to provide data communication functions, the memory is used to store program code, and the processor is used to call the program code to execute the method according to any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and to execute the method according to any one of claims 1-11.

15. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they can perform the method described in any one of claims 1-11.

Images