A mobile application classification method based on dynamic and static combined multi-dimensional APK features

Abstract

The present invention relates to the technical field of APP classification and analysis, and discloses a mobile application classification method based on dynamic and static combined multi-dimensional APK features. First, APP features are constructed, and APP information is collected based on mainstream mobile phone application stores, small Internet distribution platforms, and APP dissemination pages. Specifically, the business classification of APP is identified through the functions provided by APP or the information content presented, and communication information is collected to form an initial test data set; then, analysis is performed based on APP source code to obtain APP static source code features, dynamic traffic and page feature data, specifically including name, traffic and content information; rule matching models and matching mechanisms are established, specifically by constructing a timed scanning program, and identification and judgment are performed through preset classification rule matching models. The present invention has a high recognition accuracy rate for APPs with significant technical features or content features, and reduces the participation of manual review.

Description

Technical Field

[0001] The present invention relates to the technical field of APP classification analysis, and specifically to a mobile application classification method based on dynamic and static combined multi-dimensional APK features. Background Art

[0002] In the field of APK (Android application package file) classification analysis technology, significant progress has been made in recent years. Specifically, it includes the following aspects:

[0003] 1. APK classification method based on machine learning and deep learning: (1) Input the App name into the Internet search engine and process the results to obtain the App document; (2) Extract the keyword distribution features based on the vector space model, and use shallow learning technology to train a base classifier on this basis; (3) Train word vectors based on word2vec, and use convolutional neural network to train another base classifier on this basis; (4) Design a collaborative learning framework, use unlabeled samples to collaboratively train the two base classifiers, and fuse the training results to obtain the final App classifier. Only use the App name to achieve personalized classification of Apps; only a small number of labeled samples are needed to establish a classification model with high accuracy; the designed collaborative learning framework takes into account the performance imbalance of different base classifiers and can reduce the impact of noise data in unlabeled samples.

[0004] Based on the APP user review classification method: obtain APP user review data and clean and mark it; establish the SVTEO model and the NBTEO model; the SVTEO model includes: extracting the Encoder structure part in the Transformer model to obtain the Trasformer-Encoder-Only layer, connecting the pooling layer after the Trasformer-Encoder-Only layer, and connecting the linear layer and the support vector layer in parallel after the pooling layer to obtain the SVTEO model; the NBTEO model includes: extracting the Encoder structure part in the Transformer model to obtain the Trasformer-Encoder-Only layer, -The Encoder-Only layer is connected to the pooling layer, and the pooling layer is connected to the linear layer and the Naive Bayes layer in parallel to obtain the NBTEO model; the Trasformer-Encoder-Only layer includes: an Embedding layer and a six-layer Encoder layer; according to the label data, the linear layers of the SVTEO model and the NBTEO model are subjected to machine learning, deep learning homogeneity learning, and SVTEO model and NBTEO model heterogeneity and parameter fine-tuning processing, and the processed SVTEO model and NBTEO model are combined into a user comment demand classification model; the APP user comment data to be classified is input into the user comment demand classification model for classification and labeling processing to obtain the classification labels of the APP user comment data.

[0005] For example, in the application with application number "CN201810073847.0", the method for automatically dividing APP into categories based on keywords includes the following steps: A. Establishing a classification system and setting a corresponding keyword database, establishing several groups of keyword databases according to the classification categories, and storing the several groups of keyword databases in the storage module; B. APP collects the uploaded information content through the collection module and transmits the information content to the server; C. The server matches the received information content with several groups of keyword databases respectively through the matching and identification module; D. If the information content is successfully matched with one group of keyword databases or multiple groups of keyword databases, the server will feedback the classification category corresponding to the successfully matched keyword database to the APP, and the APP will classify the information content into the corresponding classification category through the execution module. If the information content fails to match with several groups of keyword databases, the server will feedback the unsuccessful matching information to the APP, and the APP will classify the information content separately through the execution module.

[0006] Existing APP classification technology uses few dimensions, mainly relying on a few static source code features such as name, LOGO, keywords, etc. for analysis. However, the classification representation ability of such static features is relatively weak, and it is not possible to fully and accurately identify the actual business classification of the APP. In particular, it is difficult to accurately identify APPs that are counterfeit or provide illegal content through limited static source code feature dimensions.

[0007] In view of the above problems, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is needed. Summary of the invention

[0008] The purpose of the present invention is to provide a mobile application classification method based on dynamic and static combined multi-dimensional APK features. The present invention extracts APP source code features (including APP name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permission, service declaration, SDK, static library), traffic (including main service domain name, IP, path, header information, request content), page content (page display content, snapshot) and other dynamic and static multi-dimensional features of APP, extracts common technical features or content feature combinations for APP classification and identification scenarios such as communication, designs APP feature extraction methods combining dynamic and static features, and constructs a two-level specific type APP classification and identification model including rule matching model and scoring and sorting model, thereby realizing effective classification and identification of mobile applications in massive APP data.

[0009] The present invention is achieved in that:

[0010] The present invention provides a mobile application classification method based on dynamic and static combined multi-dimensional APK features, which is specifically performed in the following steps:

[0011] S1: Construct APP features, collect APP information based on mainstream mobile application stores, small Internet distribution platforms, and APP dissemination pages, identify APP business categories through the functions provided by APP or the information content presented, collect communication information, and form an initial test data set;

[0012] S2: Analyze the APP source code to obtain the static source code features, dynamic traffic and page feature data of the APP, including name, traffic and content information; the name includes LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, static library, and the traffic includes domain name, IP, path, header information, request content; the content specifically includes page display content and snapshot information.

[0013] The APP source code analysis is specifically to parse the APK package file, build information extraction function according to Android design specifications and output requirements, and obtain the name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information;

[0014] By running analysis and building an automated control program, the app is automatically installed and run in the Android device environment, and the communication traffic and page presentation content information of the app are extracted. When analyzing the characteristics of the communication category, the specific characteristic data in terms of functions, permissions, layout, and content data are included, and the rule matching rule data set and the scoring and sorting rule set are built;

[0015] Features of different dimensions are configured according to the business or technical characteristics of the APP. The features of specific APPs include keywords; the features of communication APPs include address book, friends, and sending, and they have specific SDKs and static libraries for data transmission and data encryption.

[0016] S3: Establish a rule matching model and matching mechanism. Specifically, by building a timed scanning program, the formatted and stored data is extracted in the form of objects, and the preset classification rule matching models are used for identification and analysis. If there is any hit, a classification label is added and the scoring and sorting model enters the waiting state. Obtain various static source code features, dynamic traffic features, and dynamic content features of the APP, and perform data cleaning, data formatting, and storage on the entire data.

[0017] The static source code features include name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information;

[0018] Dynamic traffic features include domain name, IP, path, header information, and request content information; dynamic content features include page display content, page snapshots, and page layout file information.

[0019] S4: Establish a scoring and sorting model and a screening mechanism model, build a timed scanning program for apps that have business classification labels and are in a pending review state, scan these apps, and filter them according to rules;

[0020] S5: A large number of APPs are matched with APP rules through the rule matching model, and branch screening is performed through the screening mechanism model. The output results form a classification of the APPs.

[0021] Further, in step S4, the specific rules are to perform keyword feature matching on APK name, localization configuration, traffic domain name, IP, path, header information, and request content, and to perform data set feature matching on LOGO, package name, signature HASH, and signature OWNER, and calculate scores for each dimension of APK. The scores are calculated based on the matching degree and weight of the features.

[0022] Score and dimension: For each APK, two scores A and B are summarized. The score of the APK name and localized configuration content attributes is represented by A, and the score of the package name, signature, LOGO and other dimensions is represented by B. The number of hit dimensions is recorded at the same time. A1 represents the number of hit dimensions in A, and B1 represents the number of hit dimensions in B.

[0023] Determine the APK that meets the classification requirements. If B1 is greater than 1, that is, the APK matches the feature rules in multiple dimensions such as package name, signature, and logo, then it is determined to be the expected identification classification APK;

[0024] In step S5, if B1 is equal to 1 and A1 is greater than 1, manual review is performed; because the APK name and localization configuration match multiple dimensional rules, further review is required to determine the classification. Feature rule extraction and merging: Extract feature rules from the APKs that were judged as corresponding categories in the previous step, so that they can be used for future rule updates and improvements, and merge the extracted feature rules into the rule set of step S4 to enrich the feature rules.

[0025] Furthermore, the present invention provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a main controller, the method described in any one of the above is implemented.

[0026] Furthermore, the core principle of the present invention is to build a two-layer classification and recognition model through the basic static source code features, dynamic traffic features, and dynamic content features of the APP to achieve classification and accurate judgment of the APP. The core process includes:

[0027] 1. Extract features of specific types of APPs, including static source code features (including name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, static library), dynamic traffic features (domain name, IP, path, header information, request content), content features (page display content, snapshot) and other 18 types;

[0028] 2. Build a rule matching model, based on the APP features extracted in the previous step as the identification and matching features of specific categories, and detect and mark business categories in massive APP data;

[0029] 3. Build a scoring and ranking model to further identify and judge the APPs found in the previous step. According to the multi-dimensional combination rules of static source code features, dynamic traffic features, and dynamic content features, formulate scoring standards, set output thresholds, and output accurate classification data;

[0030] 4. Optimize and supplement features, manually review the data marked by the system, output the final data, and supplement this part of the feature data into steps S3-S4.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] 1. In the scenario of massive APP analysis, the present invention can quickly identify APPs of various preset categories.

[0033] 2. It has a higher recognition accuracy rate for apps with significant technical or content features, reducing the involvement of manual review. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It is understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0035] Figure 1 is a flow chart of the overall method of the present invention;

[0036] Figure 2 It is the APP classification execution flow chart of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0038] See also Figure 1-2, a mobile application classification method based on dynamic and static combined multi-dimensional APK features, specifically performed in the following steps:

[0039] S1: Construct APP features, collect APP information based on mainstream mobile application stores, small Internet distribution platforms, and APP dissemination pages, identify APP business categories through the functions provided by APP or the information content presented, collect communication information, and form an initial test data set;

[0040] S2: Analyze the APP source code to obtain the static source code features, dynamic traffic and page feature data of the APP, including name, traffic and content information; the name includes LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, static library, and the traffic includes domain name, IP, path, header information, request content; the content specifically includes page display content and snapshot information.

[0041] The APP source code analysis is specifically to parse the APK package file, build information extraction function according to Android design specifications and output requirements, and obtain the name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information;

[0042] By running analysis and building an automated control program, the app is automatically installed and run in the Android device environment, and the communication traffic and page presentation content information of the app are extracted. When analyzing the characteristics of the communication category, the specific characteristic data in terms of functions, permissions, layout, and content data are included, and the rule matching rule data set and the scoring and sorting rule set are built;

[0043] Features of different dimensions are configured according to the business or technical characteristics of the APP. The features of specific APPs include keywords; the features of communication APPs include address book, friends, and sending, and they have specific SDKs and static libraries for data transmission and data encryption.

[0044] S3: Establish a rule matching model and matching mechanism. Specifically, by building a timed scanning program, the formatted and stored data is extracted in the form of objects, and the preset classification rule matching models are used for identification and analysis. If there is any hit, a classification label is added and the scoring and sorting model enters the waiting state. Obtain various static source code features, dynamic traffic features, and dynamic content features of the APP, and perform data cleaning, data formatting, and storage on the entire data.

[0045] The static source code features include name, LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information;

[0046] Dynamic traffic features include domain name, IP, path, header information, and request content information; dynamic content features include page display content, page snapshot, and page layout file information. The feature dimensions are shown in Table 1;

[0047] Table 1 Static source code feature dimension table

[0048] Dimensions Match Type name Exact matching, fuzzy matching LOGO Exact matching, fuzzy matching Package Name Exact matching, fuzzy matching sign Exact Match Permissions Exact Match Service Statement Exact Match SDK Exact Match Static Libraries Exact Match Localization Configuration Exact matching, fuzzy matching Communication traffic domain name Exact matching, fuzzy matching Communication traffic content Exact matching, fuzzy matching

[0049] S4: Establish a scoring and sorting model and a screening mechanism model, build a timed scanning program for apps that have business classification labels and are in a pending review state, scan these apps, and filter them according to rules;

[0050] S5: A large number of APPs are matched with APP rules through the rule matching model, and branch screening is performed through the screening mechanism model. The output results form a classification of the APPs.

[0051] Further, in step S4, the specific rules are to match the keyword features of APK name, localization configuration, traffic domain name, IP, path, header information, and request content, and match the data set features of LOGO, package name, signature HASH, and signature OWNER, and calculate the score for each dimension of APK. The score is calculated based on the matching degree and weight of the features. The weight design is based on the technical characteristics and content characteristics of APK, where the weight of technical characteristics is higher than that of content characteristics. The technical characteristics determine the weight value according to the correlation of feature attributes. The weight reference example is shown in Table 2;

[0052] Table 2 Weight reference examples

[0053]

[0054]

[0055] Score and dimension: For each APK, two scores A and B are summarized. The score of the APK name and localized configuration content attributes is represented by A, and the score of the package name, signature, LOGO and other dimensions is represented by B. The number of hit dimensions is recorded at the same time. A1 represents the number of hit dimensions in A, and B1 represents the number of hit dimensions in B.

[0056] To determine the APK that meets the classification requirements, if B1 is greater than 1, that is, the APK matches the feature rules in multiple dimensions such as package name, signature, and logo, then it is determined to be the expected identification classification APK; the criteria for calculating the score are shown in Table 3;

[0057] Table 3: Standards for calculating the score

[0058]

[0059] In step S5, if B1 is equal to 1 and A1 is greater than 1, manual review is performed; because the APK name and localization configuration match multiple dimensional rules, further review is required to determine the classification. Feature rule extraction and merging: Extract feature rules from the APKs that were judged as corresponding categories in the previous step, so that they can be used for future rule updates and improvements, and merge the extracted feature rules into the rule set of step S4 to enrich the feature rules.

[0060] In this embodiment, the present invention provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a main controller, the method described in any one of the above is implemented.

[0061] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention has various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A mobile application classification method based on dynamic and static combined multi-dimensional APK features, characterized by: Please follow the steps below: S1: Construct APP features, collect APP information based on mainstream mobile application stores, small Internet distribution platforms, and APP dissemination pages, identify APP business categories through the functions provided by APP or the information content presented, collect communication information, and form an initial test data set; S2: Analyze the APP source code to obtain the static source code features, dynamic traffic and page feature data of the APP, including name, traffic and content information; S3: Establish a rule matching model and matching mechanism, specifically by building a timed scanning program, extracting the formatted and stored data in the form of objects, and identifying and judging them through the preset classification rule matching models. If there is any hit, a classification label is added and the scoring and sorting model enters a waiting state; S4: Establish a scoring and sorting model and a screening mechanism model, build a timed scanning program for apps that have business classification labels and are in a pending review state, scan these apps, and filter them according to rules; S5: A large number of APPs are matched with APP rules through the rule matching model, and branch screening is performed through the screening mechanism model. The output results form a classification of the APPs.

2. According to claim 1, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is characterized in that: In step S2, the name includes LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, static library, and the traffic includes domain name, IP, path, header information, and request content; the content specifically includes page display content and snapshot information.

3. According to claim 1, a mobile application classification method based on dynamic and static combined multi-dimensional APK features is characterized in that: In step S2, the APP source code is analyzed by parsing the APK package file, building an information extraction function according to Android design specifications and output requirements, and obtaining the LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information; By running analysis and building an automated control program, we can automatically install and run the APP in the Android device environment, and extract the APP's communication traffic and page presentation content information.

4. The mobile application classification method based on dynamic and static combined multi-dimensional APK features according to claim 1 is characterized in that: In step S1, when analyzing the characteristics of the communication class, specifically including the characteristic data in terms of functions, permissions, layout, and content data, a rule matching rule data set and a scoring and sorting rule set are constructed; Features of different dimensions are configured according to the business or technical characteristics of the APP. The features of specific APPs include keywords; the features of communication APPs include address book, friends, and sending, and they have specific SDKs and static libraries for data transmission and data encryption.

5. The mobile application classification method based on dynamic and static combined multi-dimensional APK features according to claim 1 is characterized in that: In step S2, various static source code features, dynamic traffic features, and dynamic content features of the APP are obtained, and data cleaning, data formatting, and storage are performed on the entire data; The static source code features include LOGO, package name, signature HASH, signature OWNER, localization configuration, layout file, permissions, service declaration, SDK, and static library information; Dynamic traffic features include domain name, IP, path, header information, and request content information; dynamic content features include page display content, page snapshot, and page layout file information.

6. The mobile application classification method based on dynamic and static combined multi-dimensional APK features according to claim 1 is characterized in that: In step S4, the specific rules are to perform keyword feature matching on APK name, localization configuration, traffic domain name, IP, path, header information, and request content, and to perform data set feature matching on LOGO, package name, signature HASH, and signature OWNER, and calculate scores for each dimension of APK. The scores are calculated based on the matching degree and weight of the features.

7. The mobile application classification method based on dynamic and static combined multi-dimensional APK features according to claim 6 is characterized in that: Score and dimension: For each APK, two scores A and B are summarized. The score of the APK name and localized configuration content attributes is represented by A, and the score of the package name, signature, and LOGO dimension is represented by B. The number of dimensions hit is recorded at the same time. A1 represents the number of dimensions hit in A, and B1 represents the number of dimensions hit in B. Determine the APK that meets the classification requirements. If B1 is greater than 1, that is, the APK matches the feature rules in multiple dimensions such as package name, signature, and logo, then it is determined to be the expected identification classification APK; In step S5, if B1 is equal to 1 and A1 is greater than 1, manual review processing is performed.

8. The mobile application classification method based on dynamic and static combined multi-dimensional APK features according to claim 7 is characterized by the following features: Rule extraction and merging: Extract feature rules from the APKs that are judged as corresponding APKs in the previous step, so that they can be used for updating and improving the rules in the future, and merge the extracted feature rules into the rule set of step S4.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the main controller, the method according to any one of claims 1 to 8 is implemented.

Images