Apparatus and method for determining location spoofing applications

Abstract

The present disclosure provides an apparatus and method for determining a location-spoofing application, the method comprising: generating a digital representation of the application name of the application used to generate the user's geographic location signal using a variable derived from a list of application names related to multiple other applications capable of generating a user's geographic location signal; and determining a prediction as to whether the application is a location-spoofing application based on the size of the digital representation of the generated application name.

Description

Technical Field

[0001] The present invention generally relates to an apparatus and method for determining location spoofing applications. Background Art

[0002] Global Positioning System (GPS) spoofing is a major issue for ride-hailing organizations and service providers, as drivers are able to falsify their GPS information to obtain better assignments or fake ride completions, and causes both passengers and drivers to lose trust in ride-hailing organizations.

[0003] To falsify their GPO information, drivers often use apps developed by third-party developers for this specific purpose. Therefore, it becomes imperative to identify or label such apps and identify location-spoofing apps to address the above-mentioned issues. Summary of the Invention

[0004] According to a first aspect, the present disclosure provides an apparatus for determining a location-spoofing application, the apparatus comprising: at least one processor; and at least one memory comprising computer program code: the at least one memory and the computer program code being configured to utilize the at least one processor so that the apparatus at least: generates a digital representation of the application name of the application used to generate the user's geographic location signal using a variable derived from a list of application names associated with a plurality of other applications capable of generating the user's geographic location signal; and determines a prediction as to whether the application is a location-spoofing application based on the size of the generated digital representation of the application name.

[0005] According to a second aspect, the present disclosure provides a method for determining a location-fraud application, the method comprising: generating, by a prediction module of a location-fraud application determination system, a digital representation of the application name of the application used to generate a user's geographic location signal, using a variable derived by the prediction module from a list of application names related to multiple other applications capable of generating a user's geographic location signal; and determining, by the prediction module, a prediction as to whether the application is a location-fraud application based on the size of the generated digital representation of the application name.

[0006] Additional benefits and advantages of the disclosed embodiments will become apparent from the description and drawings. Benefits and / or advantages may be achieved individually through various embodiments and features of the description and drawings, and not all of these embodiments and features need be provided in order to achieve one or more such benefits and / or advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The embodiments and implementations are provided by way of example only and will be better understood and readily apparent to those skilled in the art from the following written description read in conjunction with the accompanying drawings, in which:

[0008] Figure 1 A block diagram illustrating a system including a location spoofing application prediction apparatus for determining a location spoofing application according to an embodiment of the present disclosure is shown.

[0009] Figure 2 A block diagram 200 is shown illustrating a method for determining location spoofing applications according to an embodiment of the present disclosure.

[0010] Figure 3 Shown is a diagram showing the Figure 1 Flowchart 300 of a method for spoofing a location in the system 100 .

[0011] Figure 4 A block diagram illustrating the architecture of a neural network according to an embodiment of the present disclosure is shown.

[0012] Figure 5 A block diagram illustrating the architecture of a bidirectional LSTM layer according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0013] Terminology Description

[0014] User - A user can be any suitable type of entity, including a person using an application for generating a geolocation signal, a rider, pillion rider, driver, or passenger. A user registered with the remote assistance server will be referred to as a registered user. A user not registered with the remote assistance server will be referred to as an unregistered user. The term user will be used to refer collectively to both registered and unregistered users.

[0015] Application - An application (or app) is a computer program designed to be executed by a processor of a computer or mobile device to perform a specific task (i.e., in various embodiments of the present disclosure, to generate a geographic location signal of the user of the computer or mobile device). If the application is a location spoofing application, the application may refer to a new application or an application with an unknown geographic location signal validity that has yet to be determined and predicted. In various embodiments below, the term "location spoofing application" may be used interchangeably with the term "GPS spoofing application." The terms "application" and "package" will be used interchangeably throughout this disclosure.

[0016] Application Name - An application name is associated with an application and can be used by a processor of a computer or neural network or a user to distinguish the application from another application. In various embodiments, the application name corresponds to a sequence of two or more characters. For simplicity, English application names formed using the 26 English letters (AZ), 10 numbers (0-9) and special characters (non-alphabetic or numeric characters, such as blank characters, next-line characters, and punctuation marks) are used to illustrate various embodiments in the present disclosure, however, it should be understood that application names can additionally or alternatively be formed using letters or characters in languages ​​other than English.

[0017] Character combination - A character combination is a combination of two or more consecutive characters that form an application name. For example, the word "map" has three characters "m", "a", and "p" and three character combinations "ma", "ap", and "map". In the various embodiments below, a character combination of a character in an application name refers to a character combination of that character and one or more characters before and / or after that character in the application name. For example, the character combination of the character "a" in the application name "GPSmap" may include "GPSma", "PSma", "Sma", "ma", and "ap".

[0018] Prediction - A prediction refers to a determination and classification result regarding the likelihood that an application is a location spoofing application. According to various embodiments, the prediction regarding whether an application is a location spoofing application is determined and classified based on the magnitude of the numerical representation of the application name. For example, if the magnitude of the numerical representation of the application name is close to 1, the application may be classified and predicted as a location spoofing application; if the magnitude is close to 0, the application may be classified and predicted as another application.

[0019] Digital representation - A digital representation is a number, a sequence of numbers, a matrix, or a combination thereof, generated and processed by a processor of a computer or neural network to identify / represent an application name (or a character or a combination of characters) and to distinguish an application name from another application name (or another character or another combination of characters). An example of a digital representation is a 16-dimensional vector. In various embodiments below, the digital representation of the application name can be scaled from a size of 0 to 1, and this size of the digital representation of the application name can correspond to a prediction as to whether the application associated with the application name is a location fraud application. In one embodiment, an application associated with a size of the digital representation of its application name that is closer to 1 or 0 is determined / predicted to be or not a location fraud application, respectively. In addition, a sigmoid function is applied to the digital representation to normalize its size to between 0 and 1.

[0020] The digital representation of the application name is determined based on the digital representation of each character and / or character combination of the application name, for example, by merging the digital representations of the characters and / or character combinations that form the application name into one digital representation by mathematical operators such as addition and multiplication. In one embodiment, each character (e.g., English letters, numbers, and special characters) has a preset digital representation stored in a database accessible to a computer or neural network, and when identifying each character that forms the application name and its corresponding preset digital representation, a variable trained or derived using a list of known applications is applied to the preset digital representation to generate a digital representation of the character. In one example, the preset digital representation of the character is a vector (e.g., vectors of the same or different dimensions, or other types of vectors) that is preconfigured by a processor for general applications, and the variable is a matrix (e.g., a kernel matrix) that is configured to be applied to the preset representation to generate a 16-dimensional vector representation of the character for the purpose of determining the location fraud application.

[0021] The (preset) numerical representation of a character can be derived from a list of known applications and their application names. If the magnitude of the (preset) numerical representation of a character appears in the application name of an application, it can indicate the weight of the character, thereby affecting the subsequent determination of whether the application is a location spoofing application.

[0022] In another embodiment, the digital representation of the character combination is determined based on the digital representations of the characters forming the character combination, for example, by combining the digital representations of the characters forming the character combination into a single digital representation via mathematical operators such as addition and multiplication. Similarly, if the magnitude of the digital representation of the character combination (e.g., ranging from 0 to 1) appears in the application name of the application, it can indicate a weight for the character combination, thereby influencing a subsequent determination of whether the application is a location spoofing application.

[0023] Variable - A variable refers to a number, sequence of numbers, matrix, or combination thereof, used in a model or algorithm to process and generate a character, combination of characters, and / or digital representation of an application name. The same variable or different variables can be used in a layered model or neural network consisting of more than one processing layer. Examples of variables include convolution filters / matrices. In various embodiments below, an application variable can refer to an input sent to a neural network (input layer), which processes the input through a series of algorithms or layers, and generates an output by the neural network (output layer), and in various embodiments below, input and output refer to the application name and the digital representation of the application name.

[0024] For example, through a neural network, a variable is derived from a list of application names corresponding to a list of known applications (e.g., location spoofing applications that have been disallowed (prohibited) from being used to generate a user's geolocation signal and a known location spoofing application that is allowed to be used by fewer than a preconfigured number of users (e.g., fewer than 5,000 users) to generate a geolocation signal). This is based on the assumption that an application that uses more than a preconfigured number of users (e.g., more than 5,000 users) is a popular application and is unlikely to be used to spoof a location. In another embodiment, the list of known applications may also include applications that are known to be legal and are not location spoofing applications (hereinafter referred to as "known legal applications" in this disclosure). The variable is modified and optimized so that when the variable is used to generate a digital representation of the application name of a known application (with a known predicted result), the resulting size of the digital representation of the application name corresponds to the known predicted result, i.e., the result determined or predicted to be a location spoofing application (e.g., the size of the digital representation is close to 1). In various embodiments, such modification and optimization of the variables may be referred to as neural network training.

[0025] Additionally or alternatively, variables are modified and optimized based solely on a list of application names corresponding to a list of known location spoofing applications that were used by at least one user to generate geolocation signals within a specific time period (e.g., within the past year, the last three months, etc.).

[0026] In one embodiment, a new list of known applications with known predictions made by the neural network is extracted and the variables are further modified and optimized using the new list at regular intervals (e.g., every month). By optimizing more variables with more training data (known applications) and at a higher frequency, the variables can be used to make new and better predictions.

[0027] Database - The database stores data related to users (drivers) and applications, including user accounts and details obtained from users' mobile devices and computers, transaction records, application names, application identifiers, application data, application types and details, data usage, application usage records, and the number of users of the applications. Unless otherwise specified, applications stored in the database are assigned identifiers and may be referred to as known applications because at least a portion of the data or details, along with the application's identifier, can be used to identify the application and distinguish it from other applications. The database may store a master list of known applications. Examples include a master list of applications that have been banned, a master list of applications that are allowed to be used by fewer than a pre-configured number of users, and a master list of applications that are known to be legitimate and not location spoofing applications. In one embodiment, such a master list of applications will be used to flag one or more applications, and those flagged applications will form a list of known applications used to optimize variables, models, and neural networks.

[0028] Example Implementations

[0029] When steps and / or features are referred to in any one or more of the figures with the same reference number, for the purposes of this description, those steps and / or features have the same function or operation unless otherwise intended.

[0030] It should be noted that the discussion contained in the "Background" section and the discussion above concerning prior art arrangements relate to discussions using devices that form part of the public knowledge. This should not be construed as a representation by the inventors or patent applicants that these devices in any way form part of the common general knowledge in the art.

[0031] Some portions of the following description are presented, either explicitly or implicitly, in terms of algorithms and functional or symbolic representations of operations on data within a computer memory. These algorithmic descriptions and functional or symbolic representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, considered to be a self-consistent sequence of steps leading to a desired result. These steps are those requiring physical manipulations of physical quantities, such as electrical, magnetic, or optical signals capable of being stored, transferred, combined, compared, and otherwise manipulated.

[0032] Unless otherwise specifically noted, and as will become apparent from the following, it should be understood that throughout this specification, discussions utilizing terms such as "receive," "calculate," "determine," "update," "generate," "initialize," "output," "receive," and "retrieve," "identify," "distribute," and "authenticate" refer to actions and processes of computer systems or similar electronic devices that manipulate and convert data represented as physical quantities within the computer system into other data similarly represented as physical quantities within the computer system or other information storage, transmission, or display devices.

[0033] This specification also discloses an apparatus for performing the operations of the method. Such an apparatus may be specially constructed for the desired purpose, or may comprise a computer or other device selectively activated or reconfigured by a computer program stored in the computer. The algorithms and displays presented herein are not inherently related to any specific computer or other apparatus. Various machines may be used with the program according to the teachings herein. Alternatively, it may be appropriate to construct a more specialized apparatus to perform the required method steps. The structure of the computer will become apparent from the following description.

[0034] In addition, this specification also implicitly discloses a computer program, and it will be apparent to those skilled in the art that the various steps of the methods described herein can be implemented via computer code. The computer program is not intended to be limited to any particular programming language and its implementation. It should be understood that the teachings of the present disclosure contained herein can be implemented using a variety of programming languages ​​and their encodings. Furthermore, the computer program is not intended to be limited to any particular control flow. There are many other variations of the computer program that can use different control flows without departing from the spirit or scope of the present invention.

[0035] In addition, one or more steps of the computer program can be executed in parallel, rather than sequentially. Such a computer program can be stored on any computer-readable medium. Computer-readable media can include storage devices, such as magnetic or optical disks, memory chips, or other storage devices suitable for interfacing with a computer. Computer-readable media can also include hard-wired media, such as those exemplified in the Internet system, or wireless media, such as those exemplified in the GSM mobile phone system. When the computer program is loaded and executed on such a computer, an apparatus is effectively generated that implements the steps of the preferred method.

[0036] As mentioned previously, a solution needs to be developed to identify location-spoofing apps. This identification of location-spoofing apps can: (i) prevent drivers from using such apps; and (ii) help operations teams determine whether suspicious apps exist on drivers’ phones.

[0037] Currently, this process is accomplished through a combination of rules and manual review of the package names on drivers' phones by officials (e.g., quality assurance / fraud investigation officers). For example, any app with "fake" in its name might be placed on a ban list, or an official might stumble upon an app with a mish-mash of names and add that package name to the ban list. While GPS spoofing apps often have clear patterns in their names, this process is both tedious and time-consuming because there are millions of apps on drivers' phones and the name patterns of GPS spoofing apps can change over time.

[0038] This disclosure provides a solution that continuously trains a machine learning model that classifies each app on a driver's phone as either a GPS spoofing app or not. The advantages of using this solution are: (i) it can learn patterns from the entire dataset and make predictions at a scale and speed that would be impossible for a human; and (ii) it is an evolving system that learns and optimizes over time, making it difficult for drivers to evade detection and identification.

[0039] Figure 1A block diagram illustrating a system 100 including a location spoofing application prediction apparatus 108 for determining location spoofing applications according to an embodiment of the present disclosure is shown.

[0040] The system 100 includes a requester device 102 , a location spoofing application prediction module (means) 108 , a remote assistance server 104 , remote assistance hosts 106 a - 106 n , and a database 112 .

[0041] The requester device 102 communicates with the location spoofing application prediction module 108 and / or the remote assistance server 104 via connections 101 and 103, respectively. Connections 101 and 103 may be wireless (e.g., via NFC communication, Bluetooth, etc.) or over a network (e.g., the Internet). Connections 101 and 103 may also be connections over a network (e.g., the Internet). In one arrangement, the location spoofing application prediction module 108 and the requester device 102 are combined, and connection 101 may be an interconnected bus.

[0042] The location spoofing application prediction module 108 further communicates with the remote assistance server 104 via a connection 105. The connection 105 may be through a network (e.g., a local area network, a wide area network, the Internet, etc.). In one arrangement, the location spoofing application prediction module 108 and the remote assistance server 104 are combined, and the connection 105 may be an interconnected bus.

[0043] The remote assistance server 104 in turn communicates with the remote assistance hosts 106a-106n via respective connections 107a-107n. The connections 107a-107n may be a network (eg, the Internet).

[0044] The remote assistance hosts 106a-106n are servers. The term host is used herein to distinguish the remote assistance hosts 106a-106n from the remote assistance server 104. The remote assistance hosts 106a-106n are collectively referred to herein as the remote assistance hosts 106, and remote assistance host 106 refers to one of the remote assistance hosts 106. In an example, the remote assistance host 106 can be one of a computer, a mobile device, a geolocation device, a computing device in a watch, or a similar wearable device, etc., used and managed by the driver. The remote assistance host 106 can also be a vehicle telematics system, a driver monitoring system, or a system that stores information related to the driver or other operations. The remote assistance host 106 is configured to send a signal (e.g., a geolocation signal) to the requester device 102, the location fraud application prediction module 108, and / or the database 112 based on the type and signal of the host 106.

[0045] The remote assistance server 104 is a central server that manages resources and application data communications to / from each remote assistance host and decides which remote assistance host 104 manages resources and transmits / receives application data to / from which remote assistance host 104 via connections 107a-107n. Connections 107a-107n are collectively referred to herein as connections 107, and connection 107 refers to one of the connections 107. Connections 107 can be wireless (e.g., via NFC communication, Bluetooth, etc.) or over a network (e.g., the Internet).

[0046] The term "server" as used herein may refer to a single computing device or multiple interconnected computing devices that operate together to perform a specific function. That is, a server may be contained within a single hardware unit or distributed among several or more different hardware units.

[0047] In the illustrative embodiment, each of the devices 102 and 106, the modules 108, and the server 104 provides an interface to enable communication with other connected devices 102 and 106, the modules 108, and / or the server 104. Such communication is facilitated by an application programming interface ("API"). Such an API can be part of a user interface, which can include a graphical user interface (GUI), a web-based interface, a programming interface (e.g., an application programming interface (API) and / or a set of remote procedure calls (RPCs) corresponding to interface elements), a messaging interface (wherein interface elements correspond to messages of a communication protocol), and / or a suitable combination thereof.

[0048] The remote assistance server 104 is associated with an entity (e.g., a company or organization or an arbitration of services). In one arrangement, the remote assistance server 140 is owned and operated by the entity that operates the server 108. In this arrangement, the remote assistance server 140 can be implemented as part of the module 108 (e.g., a computer program module, a computing device, etc.).

[0049] The remote assistance server 104 is also configured to manage the registration of users. A registered user (driver) has a remote access account (see discussion above) which includes the user's details. The registration step is called enrolment.

[0050] It is not necessary to have a remote assistance account at the remote assistance server 104 to access the functions of the remote assistance server 104. However, there are functions available to registered users. For example, only registered users may be able to get paid as drivers for a ride-hailing service.

[0051] The user's enrollment process is performed by the user through one of the host devices 106. In one arrangement, the user downloads an application (which includes an API for interacting with the remote assistance server 104). In another arrangement, the user accesses a website (which includes an API for interacting with the remote assistance server 104) through the host 106. The user is then able to interact with the remote assistance server 104 via the host 106.

[0052] For example, the registered details include the user's name, the user's address, emergency contacts, driver's license and other traffic accident information, etc. Once registered, the user will have a remote assistance account with all details stored in, for example, database 112 or a separate database (not shown) within server 104.

[0053] Requester device 102 is associated with an entity (e.g., a company or organization) or subject (e.g., a requester) that is requesting the identification of a location fraud application and that manages (e.g., establishes, operates) resources related to a driver or user of host 106. The requester may be a quality assurance / fraud investigation officer who is assisting in ensuring that drivers adhere to appropriate behavior. Requester device 102 may be a computing device, such as a desktop computer, an interactive voice response (IVR) system, a smartphone, a laptop computer, a personal digital assistant (PDA), a mobile computer, a tablet computer, etc. In one exemplary arrangement, requester device 102 is a computing device in a watch or similar wearable device and is equipped with a wireless communication interface.

[0054] Operation of the Location Fraud Application Prediction Module 108

[0055] Location spoofing application prediction module 108, including neural network (or training module) 110, is configured to identify location spoofing applications. Module 108 can be a standalone device or combined with requester device 102, database 112, and / or remote assistance server 104 to form a single device. Module 108 includes at least one processor (not shown) and at least one memory (not shown), the memory including computer program code configured to utilize the at least one processor to cause module 108 to use neural network 110 to generate a digital representation of the application name of the application that generated the user's geolocation signal using variables derived from a list of application names associated with a plurality of other applications capable of generating the user's geolocation signal. Location spoofing application prediction module 108 is further configured to determine a prediction of whether the application is a location spoofing application based on the magnitude of the digital representation of the application name generated by neural network 110. This operation can be initiated upon receiving a request from requester device 102.

[0056] In one embodiment, the database 112 is configured to store data related to users (drivers) and applications, including user accounts and details, transaction records, application data, application types and details, data usage, application usage records, and the number of users of an application obtained from the user's mobile device and computer. The database 112 may store a master list of applications that have been blocked and a master list of applications that are allowed to be used by fewer than a pre-configured number of users.

[0057] In one embodiment, the application names of applications used by all users (drivers) during the time period used to generate the geolocation signal (e.g., in the past year) are extracted / received from the host computer 106. The location fraud application prediction module 108 can be configured to compare the extracted / received application names with a master list of known location fraud applications stored in the database 112 and determine whether any of the extracted / received application names matches one of the application names of the known applications in the master list. If any of the extracted / received application names matches one of the known applications in the master list, the extracted / received application name will be marked (e.g., marked as 1) and included in the application name list for use in optimizing variables and training the neural network 110.

[0058] The detailed operation of the neural network 110 and how to derive and optimize variables, that is, how to train the neural network 110, will be discussed in Figure 4 . Note that the variables used by the neural network 110 are modified and optimized using the new list of application names, such that the neural network 110 is able to generate a numerical representation of each application name in the list and determine that each application name in the new list is a location spoofing application based on the magnitude of the numerical representation (i.e., a magnitude close to 1). Thus, the location spoofing application prediction module 108 is configured to apply such optimized variables to generate a numerical representation of the application name of a new / unknown application and to determine a prediction as to whether the application is a location spoofing application based on the magnitude of the generated numerical representation.

[0059] In one embodiment, the location spoofing application prediction module 108 is configured to re-compare the extracted / received application names with the master list of known applications stored in the database 112 at each fixed time interval (e.g., each month), re-label and re-extract a new application list, and optimize the variables and the neural network 110 based on the new application list, so that the location spoofing application prediction module 108 can make new and better predictions.

[0060] Figure 2A block diagram illustrating a method for determining a location-spoofing application according to an embodiment of the present disclosure is shown. In step 200, a step of generating a digital representation of the application name of an application used to generate a user's geolocation signal is performed using a variable derived from a list of application names associated with a plurality of other applications capable of generating a user's geolocation signal. In step 204, a step of determining a prediction as to whether the application is a location-spoofing application is performed based on the size of the digital representation of the application name generated in step 200.

[0061] Figure 3 Shown is a diagram showing the Figure 1 Flowchart 300 of a method for location spoofing applications in the system 100 of FIG. In step 302, a step of extracting all application names used by all drivers within a time period is performed. In step 304, a first step of marking an application whose application name matches one of the applications in the master list of applications banned for spoofing GPS as 1 is performed. Furthermore, a second step of marking an application whose application name matches one of the applications in the master list of applications allowed to simulate locations that are not used by more than 5,000 drivers as 1 is performed. A third step of marking the remaining applications extracted in step 302 as 0 is performed. In step 306, a step of training a long short-term memory-based neural network is performed based on the labels. Furthermore, in step 306, a variable for generating a digital representation of the application name and determining whether a prediction of an application is associated with the application name is derived.

[0062] In step 308, each application is classified as a GPS spoofing application or not a GPS spoofing application. This step can be performed by generating a digital representation of the application name of each new / unknown application and application not marked as 1 using the derived variable, and determining a prediction of whether each new / unknown application and application not marked as 1 is a GPS spoofing application or not a GPS spoofing application based on the magnitude of the digital representation.

[0063] In step 310, the step of including the GPS spoofing application identified and predicted in step 308 in a ban list or a master list of applications that are banned for being used to spoof GPS is performed. In step 312, for example, after classifying and identifying the location spoofing application, it is determined whether a fixed interval has passed. If so, steps 304-310 are performed again.

[0064] Figure 4A block diagram illustrating the architecture of a neural network 400 according to an embodiment of the present disclosure is shown. The neural network 400 is trained to determine whether an application is a location spoofing application. The neural network 400 includes an input layer 402, an output layer 410, and three processing layers, wherein the three processing layers include a character-level embedding layer 404, a bidirectional long short-term memory (LSTM) layer 406, and a sigmoid layer 408 between the input layer 402 and the output layer 410. The following details how the neural network processes the application name of the application input from the input layer 402 through a series of processing layers to produce an output from the output layer 410, which predicts whether the application is a location spoofing application.

[0065] In this example, the application name in input layer 402 includes five characters w1-w5. In one embodiment, in input layer 402, a neural network is configured to identify a preset digital representation 402a-402e for each character input w1-w5. The preset digital representations 402a-402e are then input into character-level embedding layer 404 to generate digital representations for characters w1-w5.

[0066] The neural network 400 is then configured to input the digital representation of each character into the bidirectional LSTM layer 406. In this layer 406, for each character, a digital representation of the character and the character combination of one or more characters of the application name before and / or after the character is generated. For example, when generating the digital representation of character w3, digital representations of the character combination of characters w3 and w4 and characters w2 and w3 are generated in the bidirectional LSTM layer 403 respectively. Alternatively or additionally, when generating the digital representation of character w3, digital representations of the character combination of characters w3, w4 and w5 and characters w1, w2 and w3 are generated in the bidirectional LSTM layer 403 respectively. In this embodiment, the multiple digital representations generated in association with a character can be merged or the digital representations of the character can be stacked to form merged digital representations 406a-406e.

[0067] The neural network is further configured to input all numerical representations associated with the character combination generated in the bidirectional LSTM layer 406 and merge them through the sigmoid layer 408, so that a numerical representation of the application name is generated and falls within a predetermined range of numerical representations from 0 to 1. The neural network is then configured to output the numerical representation of the application name through the output layer 410 to determine a prediction as to whether the application associated with the application name is a location fraud application based on the magnitude of the numerical representation.

[0068] Note that before predicting or determining whether a new / unknown application is a location fraud application, a list of known application names (with known prediction results), such as a list of known location fraud application names, is used to optimize / train the neural network 400 (with corresponding variables applied in the character-level embedding layer 404 and the bidirectional LSTM layer 406), so that when each known application name from the known application list is input to the neural network 400 through the character-level embedding layer 404, the bidirectional LSTM layer 406 and the sigmoid layer 408 and the application of variables, the network neural network 400 is able to generate a numerically represented result size of each known application name and a prediction corresponding to its known result (e.g., close to 0 or 1) in the output layer 410. In various embodiments, the neural network 400 is configured to apply such variables derived / optimized from a list of known location counterfeiting applications to process the digital representation inputs 402a-402e and 404a-404e to generate digital representation outputs 404a-404e and 406a-406e in the character-level embedding layer 404 and the bidirectional LSTM layer 406, respectively.

[0069] In one example, the input to the input layer 402 is the software package name "com.grab". The software package name is passed through the character-level embedding layer 404. In the character-level embedding layer 404, the software package name is decomposed and each distinct character that forms the software package name is identified (i.e., "c", "o", "m", ".", "g", "r", "a", "b"). For example, a 16-dimensional vector is used for the numerical representation of the characters. After passing through the character-level embedding layer 404, each character in the software package name can be represented as a 16-dimensional vector as follows:

[0070] c-[.3.2.1.1....]

[0071] o-[.1.2.1.1....] ...

[0073] b-[.4,.5,.7....]

[0074] After the characters of the software package name are converted into vector representations in the character-level embedding layer 404 , the output of the character-level embedding layer 404 is then input into the bidirectional LSTM layer 406 .

[0075] Figure 5A block diagram 500 is shown illustrating the architecture of a bidirectional LSTM layer 406 according to an embodiment of the present disclosure. In this embodiment, the architecture of the LSTM layer 406 includes a forget gate, collectively represented by blocks 5506a, 506b, 506c, an input gate, collectively represented by blocks 507a, 507b, and an output gate, collectively represented by blocks 509a, 509b. In this embodiment, the processing of the LSTM layer 406 at the t-th position / character is shown, which takes as part of the input the output of the character embedding layer 404 at the t-th position / character, where t can be any number from 1 to the number of characters in the application name. For example, for a package name "com.grab" consisting of 8 characters, t can be any number between 1 and 8.

[0076] In the forward LSTM of the bidirectional LSTM layer 406, the processing of the LSTM layer 406 is performed in the forward direction, i.e., with increasing values ​​of t. That is, after the processing at the t-th position / character is completed, the processing at the (t+1)-th position (if any) will be performed. For example, for "com.grab", the embedding of c will be passed first, then o, and so on.

[0077] In the forward LSTM of the bidirectional LSTM layer 406, the following equation applies:

[0078] f t =σ(W f ·[h t-1 , x t ]+ b f) Equation (1)

[0079] i t =σ(W i ·[h t-1 ,x t ]+b i ) Equation (2)

[0080]

[0081]

[0082] o t =σ(W o ·[h t-1 ,x t ]+b o ) Equation (5)

[0083] h t =o t ×tanh(C t ) Equation (6)

[0084] Among them, x t is the input of the character-level embedding at the t-th position;

[0085] h t is the hidden state (output) of the LSTM layer at position t;

[0086] C t is the cell state (output) of the LSTM layer at position t;

[0087] h t-1 is the hidden state of the LSTM layer at the (t-1)th position;

[0088] C t-1 is the cell state of the LSTM layer at the (t-1)th position;

[0089] W t 、W i 、W c and W o are the convolution weights (variables) of the forget gate, input gate, estimated unit state, and output gate; and

[0090] σ and tanh are bidirectional LSTM sublayers, in which the sigmoid activation function and the tanh activation function are applied respectively. The sigmoid functions 506b, 5067b, and 509b compress the values ​​between 0 and 1, while the tanh activation functions 508b and 510b compress the values ​​to always be between -1 and 1.

[0091] The hidden state h at the (t-1)th position / character t-1 502 (input x t-1 The previous output (not shown) and the output from the t-th position / character x t The current input of the character-level embedding 404 at 504 is concatenated to the t-th position / character [h t-1 , x t ] is an input array or vector (hereinafter referred to as input vector 505) at the position . For example, for the package name "com.grab", when t = 7, the hidden state at the 6th position (the output of the LSTM processing of the character "r") and the current input at the 7th position (the output of the character-level embedding 404 of the character "a") are combined.

[0092] The input vector 505 is then sent to the forget gate. The forget gate performs the multiplication of the input vector 505 by applying a first variable, for example, the convolution weight W f506a and sigmoid function σ, 506b, to determine which data / information and to what extent the data / information should be discarded or retained, to generate a value between 0 and 1. A sigmoid output value close to 0 indicates forgetting, and a sigmoid output value close to 1 indicates retention. At block 506c, the sigmoid output is called a forget vector and will be sent for unit state processing.

[0093] The input vector 505 is also sent to the input gate. The input gate determines which values ​​are important and will be updated. In the input gate, the second variable, for example, the convolution weight W i 507a and sigmoid function σ 507b are applied to the input vector 505 to generate a value between 0 and 1. A value close to 0 indicates no importance, and a value close to 1 indicates importance. The third variable, for example, the convolution weight W c 508a and a tanh activation function σ 508b are also applied to the input vector to compress the values ​​between -1 and 1. By multiplying the sigmoid output from block 507b by the tanh output from block 508b, the sigmoid output will determine what information is important to retain from the tanh output and, at block 508d, forms the output of the input gate for further cell state processing.

[0094] Regarding the cell state, at block 506c, the (t-1)th position C is processed by multiplying the forget vector t-1 The cell state at (input x t-1 The previous output of the cell (not shown). This will result in forgetting / retaining certain values ​​in the cell state. Subsequently, at block 508d, the cell state is further processed by adding the outputs of the input gates and updating the cell state to a new cell state C t The new cell state generated at the t-th position / character is output to the next LSTM layer at the (t+1)-th position / character (i.e., the character after the character at the t-th position) to generate a new cell state C t+1 and the new hidden state h t+1 .

[0095] Note that the input vector 505 includes the t-th position / character x t The current input x of the character-level embedding 404 at 504 t and the (t-1)th position h t-1 The previous hidden state 502 at the input vector 505 is also passed to the output gate to determine the next hidden state h t What should be. In the output gate, the fourth variable, for example, the convolution weight W o509a and the sigmoid function σ 509b are applied to the input to generate a value between 0 and 1. The tanh activation function 510b is then applied to the new cell state generated at box 508d. By multiplying the sigmoid output from box 509b by the tanh output from box 510b, the sigmoid output will determine the next hidden state h t Which / what information should be carried. Generate a new hidden state h t , and then sent to the next LSTM process of the (t+1)th position / character (i.e., the character after the character at the tth position) to generate a new cell state C t+1 and the new hidden state h t+1 .

[0096] In the reverse LSTM of the bidirectional LSTM layer 406, the processing of the LSTM layer 406 is performed in the reverse direction, that is, with decreasing t values. That is, after the processing at the t-th position / character is completed, the processing at the (t-1)-th position (if any) will be performed.

[0097] In the reverse LSTM of the bidirectional LSTM layer 406, the same equation is applied by replacing "t-1" with "t+1". The hidden state h at the (t+1)th position / character is converted to t before being processed through the forget gate, input gate, and output gate. t+1 (Enter x t+1 previous output) and the character x from position t t The current input of the character-level embedding 404 at 504 is concatenated to the t-th position / character [h t+1 , x t ] in the input array at position . Similarly, the cell state C at position (t+1) is processed by multiplying the forget vector output from the forget gate and adding it to the output of the input gate. t+1 (Enter x t+1 ) to update the cell state to the new cell state C t The new cell state generated at the t-th position / character is output to the next LSTM layer at the (t-1)-th position / character (i.e., the character before the character at the t-th position) to generate a new cell state C t-1 and the new hidden state h t-1 .

[0098] In various embodiments, the hidden state, i.e., the output of the LSTM layer 406, is a digital representation of the character combination, e.g., a vector, which can be used as the output of the bidirectional LTSM layer 406 to the next layer (e.g., the sigmoid layer 408 of the neural network 400) for determining the prediction. In the case where the hidden state generated at the same t-th position of the forward and reverse direction LSTMs can be different, such hidden states at the same t-th position can be merged or concatenated to generate a single hidden state at the t-th position of the bidirectional LTSM layer 406 before outputting the bidirectional LTSM layer 406 to the next layer to determine the prediction.

[0099] In the sigmoid layer 408 of the neural network 400, the output of the bidirectional LSTM layer 406 is transformed using the following equation:

[0100]

[0101] Wherein, e is the Euler number, w is a 16-dimensional weight vector, and h is the output (hidden state) of the previous layer (e.g., LSTM layer 406).

[0102] The sigmoid layer 408 allows the output h from the LSTM layer 406 to be converted into a value between 0 and 1, which can then be used for classification and prediction. In one embodiment, an output value of the sigmoid layer 408 greater than 0.5 will be determined / predicted as a location spoofing application.

[0103] In various embodiments, when the application name (e.g., a known location counterfeiting application) of a known application (with a known predicted result or actual / known output value of the sigmoid layer 408) is input to the neural network 400, the variables (e.g., convolution weights W) in the forget gate, input gate, estimated unit state, and output gate of the bidirectional LSTM layer 406 are respectively applied. t 、W i 、W c and W o ) and the weight vector w in the sigmoid layer 408 are optimized and modified to generate sigmoid values ​​that match the actual / known sigmoid values, thereby determining predictions that match known predictions for known applications (e.g., location spoofing applications). This variable optimization process is repeated and applied to all other known applications in the database.

[0104] As time goes by, the neural network 400 is continuously optimized with more training data. In one embodiment, the neural network is configured to retrieve a new list of known location fraud application names (with known prediction results) from the database at each fixed time interval (e.g., every month), optimize the variables and the neural network 110 based on the new application list, so that the location fraud application prediction module 108 can make new and better predictions.

[0105] The foregoing describes only some embodiments of the present disclosure, and modifications and / or changes may be made thereto without departing from the scope and spirit of the invention, the embodiments being illustrative rather than restrictive.

Claims

1. A device for determining a location-spoofing application, the device comprising: at least one processor; as well as at least one memory comprising computer program code: The at least one memory and the computer program code are configured to, with the at least one processor, cause the apparatus to at least: generating a digital representation of the characters of an application name of an application used to generate a geolocation signal of the user using a variable derived from a list of application names associated with a plurality of other applications capable of generating a geolocation signal of the user, wherein the digital representation of the application name is generated based on the digital representation of the characters of the application name; as well as Based on the size of the generated digital representation of the application name, a prediction is determined as to whether the application is a location spoofing application.

2. The device according to claim 1, wherein The at least one memory and the computer program code are further configured to, with the at least one processor, at each fixed time interval: extracting the list of application names related to the plurality of other applications stored in a database; modifying said variable; generating a digital representation of each of the list of application names associated with the plurality of other applications using the modified variable; as well as It is determined that each of the application name lists is a location falsifying application based on a size of the digital representation of each of the application name lists.

3. The device according to claim 1, wherein The at least one memory and the computer program code are further configured to, with the at least one processor,: Using the variable derived from the list of application names related to the multiple other applications, a digital representation of a character combination of the character and one or more characters of the application name before and / or after the character is generated; and wherein, the digital representation of the application name is further generated based on the digital representation of the character combination.

4. The device according to claim 3, wherein When processing the one or more characters, the at least one memory and the computer program code are configured to, with the at least one processor,: identifying a predetermined numeric representation of the one or more characters; as well as The variables derived from the list of application names associated with the plurality of other applications are applied to the preset digital representations of the one or more characters to generate digital representations of the one or more characters.

5. The device according to any one of claims 1 to 4, wherein The at least one memory and the computer program code are configured to, with the at least one processor,: A plurality of application names corresponding to a plurality of applications used by one or more users during a time period for generating a geographic location signal is received, wherein the plurality of applications includes the application and the plurality of other applications.

6. The device according to claim 5, wherein The at least one memory and the computer program code are configured to, with the at least one processor,: comparing each of the received plurality of application names with a list of application names stored in a database, wherein the list of application names corresponds to a list of location spoofing applications, and each of the application names in the list of location spoofing applications is either not allowed to be used to generate a geographic location signal of a user or is allowed to be used to generate a geographic location signal of a number of users less than a preconfigured number of users; determining whether one of the received plurality of application names matches one of the application name list corresponding to the location spoofing application list; and In response to the determination, the application name list associated with the plurality of other applications is generated to include the received one of the plurality of application names.

7. A method for determining a location-spoofing application, the method comprising: generating, by a prediction module of a location spoofing application determination system, a digital representation of a character of an application name of an application used to generate a geolocation signal of the user using variables derived by the prediction module from a list of application names associated with a plurality of other applications capable of generating a geolocation signal of the user, wherein the digital representation of the application name is generated based on the digital representation of the character of the application name; and A prediction as to whether the application is a location spoofing application is determined by the prediction module based on the size of the generated digital representation of the application name.

8. The method according to claim 7, further comprising, at each fixed time interval: extracting, by the prediction module, the list of application names associated with the plurality of other applications stored in a database of the location fraud application determination system in communication with the prediction module; Modifying the variables through the prediction module; generating, by the prediction module, a digital representation of each of the list of application names associated with the plurality of other applications using the modified variable; as well as By the prediction module, it is determined that each of the application names in the application name list is a location fraud application based on the size of the digital representation of each of the application name lists.

9. The method according to claim 7, further comprising: Through the prediction module, a digital representation of a character combination of the character and one or more characters of the application name before and / or after the character is generated using the variable derived from the list of application names related to the multiple other applications; and wherein, the digital representation of the application name is further generated based on the digital representation of the character combination.

10. The method according to claim 9, further comprising: identifying, by the prediction module, a preset numeric representation of the one or more characters that is preconfigured by the prediction module and stored in a database of the location fraud application determination system in communication with the prediction module; The variables derived from the list of application names related to the plurality of other applications are applied, by the prediction module, to the preset digital representations of the one or more characters to generate digital representations of the one or more characters.

11. The method according to any one of claims 7 to 10, further comprising: A plurality of application names corresponding to a plurality of applications used by one or more users during a time period for generating a geographic location signal are received by the prediction module, wherein the plurality of applications includes the application and the plurality of other applications.

12. The method according to claim 11, further comprising: comparing, by the prediction module, each of the received plurality of application names with a list of application names, wherein the list of application names corresponds to a list of location spoofing applications stored in a database of the location spoofing application determination system in communication with the prediction module, and each of the application names in the list of location spoofing applications is either not allowed to be used to generate a geographic location signal of a user or is allowed to be used to generate a geographic location signal of a number of users less than a preconfigured number of users; determining, by the prediction module, whether one of the received plurality of application names matches one of the application name list corresponding to the location spoofing application list; and In response to the determination, the prediction module generates, by the prediction module, the application name list related to the plurality of other applications to include one of the received plurality of application names.

Images