Same-origin application identification method, device, computer equipment and storage medium

Abstract

The present application relates to a method, apparatus, computer equipment and storage medium for identifying homologous applications based on multi-dimensional features, including: obtaining static features of non-operating states, dynamic features of operating states and descriptive information features of each application; performing similarity calculations on the static features, dynamic features and descriptive information features of each application to obtain static similarity, dynamic similarity and descriptive similarity; identifying multiple target applications with the same or similar features based on the static similarity, dynamic similarity and descriptive similarity, and classifying the multiple target applications based on the same or similar features to obtain homology results; constructing an association network map of homologous applications based on the homology results, and determining a cluster of closely related homologous applications based on the association network map. The above can efficiently and accurately identify homologous applications.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, apparatus, computer device and storage medium for identifying homologous applications based on multi-dimensional features. Background Art

[0002] In recent years, the rapid development of technology fields such as content distribution network CDN technology, proxy technology, and cloud computing has made application frauds have the characteristics of low production costs, fast update speed, low acceptance threshold, and high concealment. The identification technology of fraudulent applications generally uses a single-dimensional matching of the same application name to identify the same-source applications, which has the problem of low accuracy in identifying the same-source applications. Especially in dealing with massive and diverse network data environments, single-dimensional matching can no longer accurately identify the same-source applications. Summary of the invention

[0003] Based on this, it is necessary to provide a method, device, computer equipment and storage medium for identifying homologous applications based on multi-dimensional features to address the above technical problems, which can efficiently and accurately identify homologous applications.

[0004] A method for identifying homologous applications based on multi-dimensional features, comprising: obtaining static features of non-operating states, dynamic features of operating states, and descriptive information features of each application; performing similarity calculation on the static features of non-operating states of each application to obtain static similarity, performing similarity calculation on the dynamic features of operating states of each application to obtain dynamic similarity, and performing similarity calculation on the descriptive information features of each application to obtain descriptive similarity; identifying multiple target applications with identical or similar features based on the static similarity, dynamic similarity, and descriptive similarity, and classifying the multiple target applications based on the identical or similar features to obtain homology results, the homology results comprising multiple combinations, each combination comprising multiple target applications with identical or similar features; constructing an association network map of homologous applications based on the homology results, and determining a closely associated homologous application cluster based on the association network map.

[0005] In one of the embodiments, the static features of the non-running state are determined based on one or more file information in the static resource files, source code files, and calling SDK data files corresponding to the APK file; and / or, the dynamic features of the running state are determined based on the background server information of the application and / or the information of the third-party service provider used by the application; and / or, the descriptive information features are determined based on one or more of the application's name, file size, package name, certificate, signature, version, developer information, release time, and functional description.

[0006] In one of the embodiments, similarity calculation is performed on static features of each application in a non-running state, including: performing code similarity analysis on static resource files, source code files, and calling SDK data files of each application; when the code similarity of any one or more of the static resource files, source code files, and calling SDK data files of any two or more applications is greater than a first similarity threshold, determining a static similarity that indicates that any two or more applications have the same or similar features.

[0007] In one of the embodiments, similarity calculation is performed on the dynamic features of the running status of each application, including: clustering and comparing the server IP in the background server information of each application, and / or clustering and comparing the server domain name in the background server information of each application; when the similarity determined by the clustering comparison result of any two or more applications is greater than a second similarity threshold, a first dynamic similarity is obtained, and the first dynamic similarity is used to indicate that any two or more applications share a server; the third-party service provider information of each application is analyzed for overlap; if the third-party service provider information of any two or more applications overlaps, a second dynamic similarity is obtained, and the second dynamic similarity is used to indicate that any two or more applications share a service; wherein the first dynamic similarity and the second dynamic similarity can both indicate that any two or more applications have the same or similar features.

[0008] In one of the embodiments, similarity calculation is performed on the descriptive information features of each application, including: calculating text similarity of the name and package name of each application; when the text similarity of any two or more applications is greater than a third similarity threshold, comparing the signatures and certificates of any two or more applications; if the comparison results of the signatures and / or certificates are the same, determining the descriptive similarity used to indicate that any two or more applications have the same or similar features.

[0009] In one embodiment, multiple combinations of homology results include a first combination, a second combination, and a third combination; in the first combination, any one of the static features, dynamic features, and descriptive features of each target application is the same or similar; in the second combination, any two of the static features, dynamic features, and descriptive features of each target application are the same or similar; in the third combination, three of the static features, dynamic features, and descriptive features of each target application are the same or similar.

[0010] In one of the embodiments, an association network map of homologous applications is constructed based on homology results, and closely related homologous application clusters are determined based on the association network map, including: constructing an association network map of homologous applications based on a first combination, a second combination, and a third combination; and identifying closely related homologous application clusters based on the association network map and using a community discovery algorithm.

[0011] A homology application identification device based on multi-dimensional features, comprising: an acquisition module, used to acquire static features of non-operational states, dynamic features of operation states and descriptive information features of each application; a calculation module, used to perform similarity calculation on the static features of non-operational states of each application to obtain static similarity, perform similarity calculation on the dynamic features of operation states of each application to obtain dynamic similarity, and perform similarity calculation on the descriptive information features of each application to obtain descriptive similarity; a classification module, used to identify multiple target applications with identical or similar features based on static similarity, dynamic similarity and descriptive similarity, and classify the multiple target applications based on the identical or similar features to obtain homology results, wherein the homology results include multiple combinations, each combination including multiple target applications with identical or similar features; an identification module, used to construct an association network map of homology applications based on the homology results, and determine a closely associated homology application cluster based on the association network map.

[0012] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of any of the above-mentioned embodiments are implemented.

[0013] A computer-readable storage medium stores a computer program, which implements the steps of any of the above-mentioned method embodiments when the computer program is executed by a processor.

[0014] The above-mentioned method, device, computer equipment and storage medium for identifying homologous applications based on multi-dimensional features obtain the static features of the non-operating state, the dynamic features of the operating state and the descriptive information features of each application; perform similarity calculation on the static features of the non-operating state of each application to obtain static similarity, and perform similarity calculation on the dynamic features of the operating state of each application to obtain dynamic similarity, and perform similarity calculation on the descriptive information features of each application to obtain descriptive similarity; identify multiple target applications with the same or similar features based on the static similarity, dynamic similarity and descriptive similarity, and classify the multiple target applications based on the same or similar features to obtain homology results, the homology results including multiple combinations, each combination including multiple target applications with the same or similar features; construct an association network map of homologous applications based on the homology results, and determine a closely related homologous application cluster based on the association network map.

[0015] Therefore, it is possible to analyze the similarities of applications from three dimensions: static features of the non-running state, dynamic features of the running state, and descriptive information features, and then use the association network map to determine the clusters of closely related homologous applications, and finally accurately identify each homologous application. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 An application environment diagram of a method for identifying homologous applications based on multi-dimensional features in one embodiment;

[0017] Figure 2 A flowchart of a method for identifying homologous applications based on multi-dimensional features in one embodiment;

[0018] Figure 3 A schematic diagram of an association network map of homologous applications built based on various applications in one embodiment;

[0019] Figure 4 An initial schematic diagram of the association network map of homologous applications built for multiple applications in an example;

[0020] Figure 5 for Figure 4 A diagram of the community behind the same source application built by multiple applications in the example;

[0021] Figure 6 A flowchart of a method for identifying homologous applications based on multi-dimensional features in an application scenario;

[0022] Figure 7 is a schematic diagram of an interactive visualization interface in one embodiment;

[0023] Figure 8 It is a structural block diagram of a device for identifying homologous applications based on multi-dimensional features in one embodiment;

[0024] Fig. 9 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0026] This application provides a method for identifying homologous applications based on multi-dimensional features, which is applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The server 104 obtains the static features of the non-operating state of each application installed in each terminal 102, the dynamic features of the operating state, and the descriptive information features of each application, and performs similarity calculation on the static features of the non-operating state of each application to obtain static similarity, and performs similarity calculation on the dynamic features of the operating state of each application to obtain dynamic similarity, and performs similarity calculation on the descriptive information features of each application to obtain descriptive similarity, and identifies multiple target applications with the same or similar features according to the static similarity, dynamic similarity, and descriptive similarity, and classifies the multiple target applications based on the same or similar features to obtain homology results, the homology results include multiple combinations, each combination includes multiple target applications with the same or similar features, and constructs an association network map of homology applications according to the homology results, and determines a closely related homology application cluster according to the association network map. The terminal 102 may be, but is not limited to, various personal computers, laptop computers, smart phones, tablet computers, and portable wearable devices, and the server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0027] In one embodiment, Figure 2 As shown in the figure, a method for identifying homologous applications based on multi-dimensional features is provided. Figure 1 Taking the server 104 in the example as an example, the following steps are included:

[0028] S202, acquiring static features of a non-operating state, dynamic features of an operating state, and descriptive information features of each application program.

[0029] In this embodiment, after obtaining the static features of the non-operating state, the dynamic features of the operating state, and the descriptive information features of each application, an autoencoder or a Transformer model can be used to perform feature representation learning to enhance the expressive power of the features. Then, the static features of the non-operating state, the dynamic features of the operating state, and the descriptive information features of each application after feature representation learning are used to perform the subsequent steps S204-S208.

[0030] In one embodiment, the static features of the non-running state are determined based on one or more file information in the static resource files, source code files, and calling SDK data files corresponding to the APK file; and / or, the dynamic features of the running state are determined based on the background server information of the application and / or the third-party service provider information used by the application; and / or, the descriptive information features are determined based on one or more of the application's name, file size, package name, certificate, signature, version, developer information, release time, and functional description.

[0031] Specifically, the following data of each application is collected, and the collected data is cleaned, deduplicated, and standardized to lay the foundation for subsequent analysis. The collected data includes:

[0032] (a) Application metadata: application name, installation package MD5 (message digest algorithm), file size, signature, certificate, package name, version, developer information, release time, function description, etc.

[0033] (b) Dynamic feature data of the application: information such as the server IP address, domain name, distribution source, download URL (uniform resource locator), IO data, and third-party services used by the application.

[0034] (c) Reverse feature data of the application: static resource files, source code files and calling SDK data corresponding to the APK (Android application package) file of the application are obtained through static analysis technology.

[0035] Based on the above collected data, the static characteristics of the non-operating state, the dynamic characteristics of the operating state and the descriptive information characteristics of each application program can be determined.

[0036] S204, performing similarity calculation on the static features of the non-operating state of each application to obtain static similarity, performing similarity calculation on the dynamic features of the operating state of each application to obtain dynamic similarity, and performing similarity calculation on the descriptive information features of each application to obtain descriptive similarity.

[0037] In one embodiment, similarity calculation is performed on static features of non-running states of each application, including: performing code similarity analysis on static resource files, source code files, and calling SDK data files of each application; when the code similarity of any one or more of the static resource files, source code files, and calling SDK data files of any two or more applications is greater than a first similarity threshold, determining a static similarity for indicating that any two or more applications have the same or similar features.

[0038] In this embodiment, for the similarity calculation of the static features of the applications: the code similarity analysis is performed on the static resource files, source code files and calling SDK data files of each application respectively. If the code similarity of any two static resource files, source code files and calling SDK data files of any two applications reaches the first similarity threshold, it can be directly determined that the two applications have the same or similar features. The static similarity used to indicate that any two or more applications have the same or similar features can be a pre-set similarity. The specific value of the pre-set similarity can be set according to specific business needs, and its purpose is to identify that the static features of two or more applications are the same or similar. When any of the above code similarities reaches the first similarity threshold, the pre-set similarity is used as the static similarity of the two applications, and then the existence of the two applications with the same or similar features is determined by identifying the similarity.

[0039] Specifically, extract static resource files and source code files such as the res folder, assets folder, lib folder, META-INF folder corresponding to the APK file, build a feature library, compare static code features, and find multiple applications with the same or similar APK static code features.

[0040] In one embodiment, similarity calculation is performed on the dynamic features of the running status of each application, including: clustering and comparing the server IP in the background server information of each application, and / or clustering and comparing the server domain name in the background server information of each application; when the similarity determined by the clustering comparison result of any two or more applications is greater than a second similarity threshold, a first dynamic similarity is obtained, and the first dynamic similarity is used to indicate that any two or more applications share a server; the third-party service provider information of each application is analyzed for overlap; if the third-party service provider information of any two or more applications overlaps, a second dynamic similarity is obtained, and the second dynamic similarity is used to indicate that any two or more applications share a service; wherein the first dynamic similarity and the second dynamic similarity can both indicate that any two or more applications have the same or similar features.

[0041] In this embodiment, for the similarity calculation of the dynamic features of the application: the server IP in the background server information of each application is clustered and compared, and / or the server domain name in the background server information of each application is clustered and compared. The similarity is obtained by clustering comparison, and when the similarity of any clustering comparison is greater than the second similarity threshold, the first dynamic similarity is determined. The third-party service provider information of each application is analyzed for overlap, and the overlap analysis determines whether two or more applications call the same third-party service. If so, the second dynamic similarity is obtained. The first dynamic similarity and the second dynamic similarity can be pre-set similarities, and the similarities set for the two can be the same or different. The specific value can be set according to specific business needs, and the purpose is to separately identify two or more applications sharing servers and common services.

[0042] Specifically, the similarity calculation of servers of multiple applications: cluster and compare server IP and domain names to find application groups that share servers. The similarity calculation of third-party services of multiple applications: analyze the overlapping sets of third-party service calls, determine the similarity, and identify application clusters that share services.

[0043] In one embodiment, similarity calculation is performed on the descriptive information features of each application, including: calculating text similarity of the name and package name of each application; when the text similarity of any two or more applications is greater than a third similarity threshold, comparing the signatures and certificates of any two or more applications; if the comparison results of the signatures and / or certificates are the same, determining the descriptive similarity used to indicate that any two or more applications have the same or similar features.

[0044] In this embodiment, for the descriptive similarity calculation of the applications: first, the text similarity of the names and package names of the two applications is calculated. When the text similarity is greater than a third similarity threshold, the signatures and / or certificates of the two applications are compared. When the signatures and / or certificates of the two applications are the same, it is determined that the two applications have the same or similar features.

[0045] The first similarity threshold, the second similarity threshold and the third similarity threshold may be the same or different, and the "first", "second" and "third" here are only used to distinguish the three similarities and do not have a time sequence characteristic.

[0046] Specifically, Doris Java UDF is used for the vectorization engine. By encapsulating and integrating the Text-Similarity text similarity calculation tool, the package names and name and other feature attributes of the two applications are compared to identify applications with high naming pattern similarity. Then, the similarity of the two applications is further verified through signatures or certificates.

[0047] Therefore, through the above embodiments, the static similarity, dynamic similarity and descriptive similarity between various application programs can be determined.

[0048] S206, identifying multiple target applications with the same or similar features based on static similarity, dynamic similarity and descriptive similarity, and classifying the multiple target applications based on the same or similar features to obtain homology results, the homology results including multiple combinations, each combination including multiple target applications with one or more same or similar features.

[0049] In one embodiment, steps S204-S206 may also include: constructing a homology recognition model based on machine learning, calculating the similarity of the static features of the non-running state, the dynamic features of the running state, and the descriptive information features of each application through the homology recognition model, and identifying multiple target applications with the same or similar features based on static similarity, dynamic similarity, and descriptive similarity.

[0050] Specifically, we build homology recognition models based on machine learning, such as support vector machines (SVM), random forests, and deep neural networks (DNN). The training set for the homology recognition model includes known homology and non-homologous APP samples. Through reverse engineering, code similarity analysis, signature comparison, text similarity comparison and other multi-feature fusion methods and model training precipitation, we can identify target applications with the same or similar features.

[0051] In one embodiment, multiple combinations of homology results include a first combination, a second combination, and a third combination; in the first combination, any one of the static features, dynamic features, and descriptive features of each target application is the same or similar; in the second combination, any two of the static features, dynamic features, and descriptive features of each target application are the same or similar; in the third combination, three of the static features, dynamic features, and descriptive features of each target application are the same or similar.

[0052] Specifically, the applications are classified and the homology results output include the following:

[0053] 1. Nodes with the same server IP / domain name and similar application package names are grouped together;

[0054] 2. Nodes with the same third-party services and similar application package names are grouped together;

[0055] 3. Nodes with the same application name, similar application file size, and similar application package name are grouped together;

[0056] 4. The nodes with the same static code features in the APK package file of the application are grouped together;

[0057] 5. Nodes with the same certificate, server, and packaged service ID of the application are grouped together;

[0058] 6. Nodes with the same application package name and application certificate are grouped together;

[0059] 7. Nodes with the same application certificate and application name are grouped together;

[0060] 8. Nodes with the same application package name and application name are grouped together.

[0061] S208, constructing an association network map of homologous applications based on the homology results, and determining a cluster of closely associated homologous applications based on the association network map.

[0062] In one embodiment, an association network map of homologous applications is constructed based on homology results, and closely related homologous application clusters are determined based on the association network map, including: constructing an association network map of homologous applications based on a first combination, a second combination, and a third combination; and identifying closely related homologous application clusters based on the association network map and using a community discovery algorithm.

[0063] Specifically, a network graph of homologous applications is constructed based on each group of nodes in the above homology results, and a community discovery algorithm is applied to identify closely related homologous application clusters. The community discovery algorithm applied may be the Louvain algorithm. For example:

[0064]

[0065] Among them, combined Figure 3 As shown, nodes represent applications. i represents the sum of the weights of all edges associated with node i, k j represents the sum of the weights of all edges associated with node j, and node i represents Figure 3 For any application shown in the figure, node j represents Figure 3 Any application except node i in A i,j represents the weight of the edge connecting node i and node j, m is the sum of the weights of all edges, C i represents the community divided by node i, C j represents the community divided by node j. The δ function is a step function, which is used to determine whether nodes i and j belong to the same community. Q represents the modularity gain. The meaning of modularity gain is to reflect the quality of community division. The higher the value, the more reasonable the community division.

[0066] At the beginning of the algorithm, each node is an independent community. For example, suppose the initial association network graph has 6 application (APP) nodes, such as Figure 4 As shown: First, each node is considered as a separate community and its assignment to another community is calculated to check whether the modularity is maximized. Only an increase in modularity will lead to a community shift.

[0067] For example, combined with Figure 4 As shown, APP1 is assigned to neighboring communities to obtain modularity gains, where the modularity gain of APP1->APP2 is the largest and positive:

[0068] APP1——>APP2:Q12=5-(10*7) / 30=2.667;

[0069] APP1——>APP3:Q13=4-(10*13) / 30=-0.333;

[0070] APP1——>APP6:Q16=1-(10*9) / 30=-2;

[0071] like Figure 4As shown, taking APP1->APP2 as an example, 5 is the weight between the two APPs, 10 is the sum of the weights of all edges connected to APP1, 7 is the sum of the weights of all edges connected to APP2, and 30 is the sum of the weights of the entire association network graph. Similarly, all other nodes can be checked to maximize the modularity gain of the neighboring community, and finally the nodes of each application are merged. For the combination process of homologous APP construction, if the modularity gain is less than 0, the aggregation operation is stopped and the iteration stops. For example, the community of the finally combined homologous applications is as follows Figure 5 shown.

[0072] Therefore, a homologous application identification method based on multi-dimensional features is used to identify the homology and correlation of applications, and to explore the hidden relationship network of multiple applications, such as shared server IP addresses, domain names, third-party services, etc., to further lock the traces of cybercrime activities, and discover a series of fraud-related applications that appear to be independent but are actually developed or maintained by the same criminal gang. These applications may appear with different names and icons, but they share the same fraudulent purpose and operating methods behind them. Through a homologous application identification method based on multi-dimensional features of this application, the ability to identify, track, prevent and block the homology of cybercrime applications is improved to ensure the health and safety of the network environment.

[0073] In an application scenario, such as Figure 6 As shown, a method for identifying homologous applications based on multi-dimensional features includes the following steps:

[0074] 1. Data collection and preprocessing

[0075] The following APP (application) data is collected, and the data is cleaned, deduplicated, and standardized to lay the foundation for subsequent analysis.

[0076] (a) APP metadata: APP name, installation package MD5, file size, signature, certificate, package name, version, developer information, release time, function description, etc.

[0077] (b) APP dynamic feature data: information such as the server IP address, domain name, distribution source, download URL, IO data, and third-party services used by the APP.

[0078] (c) APP reverse feature data: static resource files, source code files and calling SDK data corresponding to the APK file are obtained through static analysis technology.

[0079] 2. Pattern recognition and feature library extraction

[0080] Based on big data technology, feature vectors of APP are extracted, including but not limited to static features (such as code similarity, resource file comparison), dynamic features (runtime behavior patterns), and similarity calculations (Levenshtein distance, Jaccord distance). Transformer models or autoencoders are used for feature representation learning to enhance the expressiveness of features:

[0081] (a) Server similarity: Cluster and compare server IP and domain names to find out the APP groups that share the server.

[0082] (b) Third-party service similarity: Analyze the overlapping sets of third-party service calls, and identify app clusters that share services.

[0083] (c) Text similarity: Doris Java UDF is used for the vectorization engine. By encapsulating and integrating TextSimilarity, it compares feature attributes such as package names and app names to identify apps with naming patterns or high similarity.

[0084] (d) Similar APP static code features: Extract static resource files and source code files such as the res folder, assets folder, lib folder, and META-INF folder corresponding to the APK file, build a feature library, compare static code features, and find APPs with the same APK static code features.

[0085] 3. Homology recognition model and association analysis

[0086] Build homology recognition models based on machine learning, such as support vector machines (SVM), random forests, and deep neural networks (DNN). The training set includes known homology and non-homology APP samples. Through reverse engineering, code similarity analysis, signature comparison, text similarity comparison and other multi-feature fusion methods and model training precipitation, identify APPs with the same or similar features. Classify APPs and output homology results.

[0087] (1) Nodes with the same server IP / domain name and similar APP package names are grouped together;

[0088] (2) Nodes with the same third-party services and similar APP package names are grouped together;

[0089] (3) Nodes with the same APP name, similar APP file size, and similar APP package name are grouped together;

[0090] (4) Nodes with the same APK static code features are grouped together;

[0091] (5) Nodes with the same certificate, server, and packaged service ID are grouped together;

[0092] (6) Nodes with the same package name and certificate are grouped together;

[0093] (7) Nodes with the same certificate and APP name are grouped together;

[0094] (8) Nodes with the same package name and APP name are grouped together.

[0095] 4. Based on the above nodes, a homologous APP association network map is constructed, and a community discovery algorithm (such as the Louvain algorithm) is applied to identify closely related homologous APP clusters, and the results of application homology identification analysis are output.

[0096] Finally, if Figure 7 As shown, the application homology identification analysis results are displayed through an interactive visual interface.

[0097] The present invention provides a method for identifying homologous applications based on multi-dimensional features, which has the following beneficial effects:

[0098] 1. Efficient and accurate recognition capabilities

[0099] Through deep learning, natural language processing, image recognition and other advanced technologies, we can quickly and accurately analyze massive APP data and improve recognition accuracy.

[0100] 2. Comprehensive coverage

[0101] It is not limited to a single dimension, but a comprehensive analysis of multiple sources and multiple angles (such as IP address, domain name, package name, APK file size, signature, APP name, third-party services, APK static code features, etc.) to ensure wide coverage.

[0102] 3. Dynamic tracking and blocking

[0103] Real-time monitoring of changes in network behavior patterns, combined with time series analysis, provides early warning of possible cybercrime activities, and blocks newly discovered homologous apps.

[0104] 4. Deep Correlation Analysis

[0105] By building a network map, we can provide precise targets for identifying illegal apps.

[0106] 5. Operability

[0107] Provides an easy-to-use visualization and trend analysis interface so that non-technical users can quickly understand the analysis results and assist in decision-making.

[0108] It should be understood that, although the steps in the flowchart are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0109] The present application also provides a device for identifying homologous applications based on multi-dimensional features. Figure 8 As shown, a device for identifying homologous applications based on multi-dimensional features includes an acquisition module 802 , a calculation module 804 , a classification module 806 and an identification module 808 . The acquisition module 802 is used to obtain the static features of the non-operating state, the dynamic features of the operating state and the descriptive information features of each application; the calculation module 804 is used to perform similarity calculation on the static features of the non-operating state of each application to obtain static similarity, and to perform similarity calculation on the dynamic features of the operating state of each application to obtain dynamic similarity, and to perform similarity calculation on the descriptive information features of each application to obtain descriptive similarity; the classification module 806 is used to identify multiple target applications with the same or similar features based on the static similarity, dynamic similarity and descriptive similarity, and classify the multiple target applications based on the same or similar features to obtain homology results, the homology results including multiple combinations, each combination including multiple target applications with the same or similar features; the identification module 808 is used to construct an association network map of homologous applications based on the homology results, and determine a closely related homologous application cluster based on the association network map.

[0110] In one of the embodiments, the static features of the non-running state are determined based on one or more file information in the static resource files, source code files, and calling SDK data files corresponding to the APK file; and / or, the dynamic features of the running state are determined based on the background server information of the application and / or the information of the third-party service provider used by the application; and / or, the descriptive information features are determined based on one or more of the application's name, file size, package name, certificate, signature, version, developer information, release time, and functional description.

[0111] In one of the embodiments, similarity calculation is performed on static features of each application in a non-running state, including: performing code similarity analysis on static resource files, source code files, and calling SDK data files of each application; when the code similarity of any one or more of the static resource files, source code files, and calling SDK data files of any two or more applications is greater than a first similarity threshold, determining a static similarity that indicates that any two or more applications have the same or similar features.

[0112] In one of the embodiments, similarity calculation is performed on the dynamic features of the running status of each application, including: clustering and comparing the server IP in the background server information of each application, and / or clustering and comparing the server domain name in the background server information of each application; when the similarity determined by the clustering comparison result of any two or more applications is greater than a second similarity threshold, a first dynamic similarity is obtained, and the first dynamic similarity is used to indicate that any two or more applications share a server; the third-party service provider information of each application is analyzed for overlap; if the third-party service provider information of any two or more applications overlaps, a second dynamic similarity is obtained, and the second dynamic similarity is used to indicate that any two or more applications share a service; wherein the first dynamic similarity and the second dynamic similarity can both indicate that any two or more applications have the same or similar features.

[0113] In one of the embodiments, similarity calculation is performed on the descriptive information features of each application, including: calculating text similarity of the name and package name of each application; when the text similarity of any two or more applications is greater than a third similarity threshold, comparing the signatures and certificates of any two or more applications; if the comparison results of the signatures and / or certificates are the same, determining the descriptive similarity used to indicate that any two or more applications have the same or similar features.

[0114] In one embodiment, multiple combinations of homology results include a first combination, a second combination, and a third combination; in the first combination, any one of the static features, dynamic features, and descriptive features of each target application is the same or similar; in the second combination, any two of the static features, dynamic features, and descriptive features of each target application are the same or similar; in the third combination, three of the static features, dynamic features, and descriptive features of each target application are the same or similar.

[0115] In one of the embodiments, an association network map of homologous applications is constructed based on homology results, and closely related homologous application clusters are determined based on the association network map, including: constructing an association network map of homologous applications based on a first combination, a second combination, and a third combination; and identifying closely related homologous application clusters based on the association network map and using a community discovery algorithm.

[0116] For the specific definition of a homologous application identification device based on multi-dimensional features, please refer to the definition of a homologous application identification method based on multi-dimensional features above, which will not be repeated here. Each module in the above-mentioned homologous application identification device based on multi-dimensional features can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of the above modules.

[0117] In one embodiment, a computer device is provided, which may be Figure 1 The server shown in FIG. 1 may have an internal structure as shown in FIG. Fig. 9 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store feature data of multiple applications. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for identifying homologous applications based on multi-dimensional features is implemented.

[0118] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: obtaining static features of a non-operating state, dynamic features of an operating state, and descriptive information features of each application; performing similarity calculations on the static features of the non-operating state of each application to obtain static similarity, performing similarity calculations on the dynamic features of the operating state of each application to obtain dynamic similarity, and performing similarity calculations on the descriptive information features of each application to obtain descriptive similarity; identifying multiple target applications having identical or similar features based on the static similarity, dynamic similarity, and descriptive similarity, and classifying the multiple target applications based on the identical or similar features to obtain homology results, wherein the homology results include multiple combinations, each combination including multiple target applications having identical or similar features; constructing an association network map of homologous applications based on the homology results, and determining a closely associated homologous application cluster based on the association network map.

[0119] In one of the embodiments, the static features of the non-running state are determined based on one or more file information in the static resource files, source code files, and calling SDK data files corresponding to the APK file; and / or, the dynamic features of the running state are determined based on the background server information of the application and / or the information of the third-party service provider used by the application; and / or, the descriptive information features are determined based on one or more of the application's name, file size, package name, certificate, signature, version, developer information, release time, and functional description.

[0120] In one of the embodiments, when the processor executes a computer program to implement the above-mentioned step of calculating the similarity of the static features of the non-running state of each application, the following steps are specifically implemented: performing code similarity analysis on the static resource files, source code files and calling SDK data files of each application; when the code similarity of any one or more of the static resource files, source code files and calling SDK data files of any two or more applications is greater than a first similarity threshold, determining the static similarity used to indicate that any two or more applications have the same or similar features.

[0121] In one of the embodiments, when the processor executes a computer program to implement the above-mentioned step of calculating the similarity of the dynamic characteristics of the running status of each application, the following steps are specifically implemented: clustering and comparing the server IP in the background server information of each application, and / or clustering and comparing the server domain name in the background server information of each application; when the similarity determined by the clustering comparison result of any two or more applications is greater than a second similarity threshold, a first dynamic similarity is obtained, and the first dynamic similarity is used to indicate that any two or more applications share a server; the third-party service provider information of each application is analyzed for overlap; if the third-party service provider information of any two or more applications overlaps, a second dynamic similarity is obtained, and the second dynamic similarity is used to indicate that any two or more applications share a service; wherein the first dynamic similarity and the second dynamic similarity can both indicate that any two or more applications have the same or similar characteristics.

[0122] In one of the embodiments, when the processor executes a computer program to implement the above-mentioned step of calculating the similarity of the descriptive information features of each application, the following steps are specifically implemented: calculating the text similarity of the name and package name of each application; when the text similarity of any two or more applications is greater than a third similarity threshold, comparing the signatures and certificates of any two or more applications; if the comparison results of the signatures and / or certificates are the same, determining the descriptive similarity used to indicate that any two or more applications have the same or similar features.

[0123] In one embodiment, multiple combinations of homology results include a first combination, a second combination, and a third combination; in the first combination, any one of the static features, dynamic features, and descriptive features of each target application is the same or similar; in the second combination, any two of the static features, dynamic features, and descriptive features of each target application are the same or similar; in the third combination, three of the static features, dynamic features, and descriptive features of each target application are the same or similar.

[0124] In one of the embodiments, when a processor executes a computer program to implement the above-mentioned steps of constructing an association network map of homologous applications based on the homology results and determining closely related homologous application clusters based on the association network map, the following steps are specifically implemented: constructing an association network map of homologous applications based on the first combination, the second combination, and the third combination; identifying closely related homologous application clusters based on the association network map and using a community discovery algorithm.

[0125] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: obtaining static features of a non-operating state, dynamic features of an operating state, and descriptive information features of each application; performing similarity calculations on the static features of the non-operating state of each application to obtain static similarity, performing similarity calculations on the dynamic features of the operating state of each application to obtain dynamic similarity, and performing similarity calculations on the descriptive information features of each application to obtain descriptive similarity; identifying multiple target applications with identical or similar features based on the static similarity, dynamic similarity, and descriptive similarity, and classifying the multiple target applications based on the identical or similar features to obtain homology results, the homology results including multiple combinations, each combination including multiple target applications with identical or similar features; constructing an association network map of homologous applications based on the homology results, and determining a closely associated homologous application cluster based on the association network map.

[0126] In one of the embodiments, the static features of the non-running state are determined based on one or more file information in the static resource files, source code files, and calling SDK data files corresponding to the APK file; and / or, the dynamic features of the running state are determined based on the background server information of the application and / or the information of the third-party service provider used by the application; and / or, the descriptive information features are determined based on one or more of the application's name, file size, package name, certificate, signature, version, developer information, release time, and functional description.

[0127] In one of the embodiments, when the computer program is executed by the processor to implement the above-mentioned step of calculating the similarity of the static features of the non-running state of each application, the following steps are specifically implemented: performing code similarity analysis on the static resource files, source code files and calling SDK data files of each application; when the code similarity of any one or more of the static resource files, source code files and calling SDK data files of any two or more applications is greater than a first similarity threshold, determining the static similarity used to indicate that any two or more applications have the same or similar features.

[0128] In one of the embodiments, when the computer program is executed by the processor to implement the above-mentioned step of calculating the similarity of the dynamic characteristics of the running status of each application, the following steps are specifically implemented: clustering and comparing the server IP in the background server information of each application, and / or clustering and comparing the server domain name in the background server information of each application; when the similarity determined by the clustering comparison result of any two or more applications is greater than the second similarity threshold, a first dynamic similarity is obtained, and the first dynamic similarity is used to indicate that any two or more applications share a server; the third-party service provider information of each application is analyzed for overlap; if the third-party service provider information of any two or more applications overlaps, a second dynamic similarity is obtained, and the second dynamic similarity is used to indicate that any two or more applications share a service; wherein the first dynamic similarity and the second dynamic similarity can both indicate that any two or more applications have the same or similar characteristics.

[0129] In one of the embodiments, when the computer program is executed by the processor to implement the above-mentioned step of calculating the similarity of the descriptive information features of each application, the following steps are specifically implemented: calculating the text similarity of the name and package name of each application; when the text similarity of any two or more applications is greater than a third similarity threshold, comparing the signatures and certificates of any two or more applications; if the comparison results of the signatures and / or certificates are the same, determining the descriptive similarity used to indicate that any two or more applications have the same or similar features.

[0130] In one embodiment, multiple combinations of homology results include a first combination, a second combination, and a third combination; in the first combination, any one of the static features, dynamic features, and descriptive features of each target application is the same or similar; in the second combination, any two of the static features, dynamic features, and descriptive features of each target application are the same or similar; in the third combination, three of the static features, dynamic features, and descriptive features of each target application are the same or similar.

[0131] In one embodiment, when a computer program is executed by a processor to implement the above-mentioned steps of constructing an association network map of homologous applications based on homology results and determining closely related homologous application clusters based on the association network map, the following steps are specifically implemented: constructing an association network map of homologous applications based on the first combination, the second combination, and the third combination; identifying closely related homologous application clusters based on the association network map and using a community discovery algorithm.

[0132] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0133] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0134] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for identifying homologous applications based on multi-dimensional features, characterized in that: The method comprises: Obtaining static features of the non-running state, dynamic features of the running state, and descriptive information features of each application, wherein the static features of the non-running state are determined based on one or more file information of the static resource file, source code file, and calling SDK data file corresponding to the APK file, the dynamic features of the running state are determined based on the background server information of the application and the third-party service provider information used by the application, and the descriptive information features are determined based on one or more of the name, file size, package name, certificate, signature, version, developer information, release time, and functional description of the application; Performing similarity calculation on static features of non-operating states of each application to obtain static similarity, performing similarity calculation on dynamic features of operating states of each application to obtain dynamic similarity, and performing similarity calculation on descriptive information features of each application to obtain descriptive similarity; Identifying multiple target applications with the same or similar features according to the static similarity, the dynamic similarity, and the descriptive similarity, and classifying the multiple target applications based on the same or similar features to obtain homology results, wherein the homology results include multiple combinations, each of which includes multiple target applications with one or more same or similar features; Constructing an association network map of homologous applications according to the homology results, and determining a cluster of closely associated homologous applications according to the association network map; The similarity calculation of the dynamic features of the running status of each application includes: clustering and comparing the server IP in the background server information of each application, and clustering and comparing the server domain name in the background server information of each application; when the similarity determined by any clustering comparison result of any two or more applications is greater than a second similarity threshold, a first dynamic similarity is obtained, and the first dynamic similarity is used to indicate that the any two or more applications share a server; Performing overlap analysis on the third-party service provider information of each application; if the third-party service provider information of any two or more applications overlaps, a second dynamic similarity is obtained, and the second dynamic similarity is used to indicate that the any two or more applications share services; wherein the first dynamic similarity and the second dynamic similarity both indicate that the any two or more applications have the same or similar features; The similarity calculation of the descriptive information features of each application includes: calculating the text similarity of the name and package name of each application; when the text similarity of any two or more applications is greater than a third similarity threshold, comparing the signatures and certificates of the any two or more applications; if the comparison results of the signatures and / or certificates are the same, determining the descriptive similarity used to indicate that the any two or more applications have the same or similar features; Among them, the multiple combinations of the homology results include a first combination, a second combination and a third combination; any one of the static features, dynamic features and descriptive features of each target application in the first combination is the same or similar; any two of the static features, dynamic features and descriptive features of each target application in the second combination are the same or similar; three of the static features, dynamic features and descriptive features of each target application in the third combination are the same or similar; the construction of an association network map of homology applications based on the homology results, and the determination of a closely related homology application cluster based on the association network map include: Building an association network graph of homologous applications based on the first combination, the second combination, and the third combination; According to the association network graph, a community discovery algorithm is used to identify closely related homologous application clusters, wherein the community discovery algorithm is: The nodes represent the applications in each combination in the association network graph, k i represents the sum of the weights of all edges associated with node i in the associated network graph, k j represents the sum of the weights of all edges in the association network graph pointing to node j, node i represents an application in any combination in the association network graph, node j represents any application except node i, A i,j represents the weight of the edge connecting node i and node j, n is the sum of all weights in the association network graph, C i represents the community divided by node i, C j represents the community divided by node j. The δ function is a step function used to determine whether nodes i and j belong to the same community. Q represents modularity gain. The modularity gain is used to reflect the quality of community division. The higher the value, the more reasonable the community division. The divided community is the homologous application cluster.

2. The method according to claim 1, characterized in that The similarity calculation of the static features of the non-operating state of each application program includes: Perform code similarity analysis on the static resource files, source code files, and SDK data files of each application; When the code similarity of any one or more of the static resource files, source code files and calling SDK data files of any two or more applications is greater than a first similarity threshold, a static similarity is determined to indicate that the any two or more applications have the same or similar features.

3. A device for identifying homologous applications based on multi-dimensional features, characterized in that: The device comprises: An acquisition module, used to acquire static features of a non-operating state, dynamic features of an operating state, and descriptive information features of each application program, wherein the static features of the non-operating state are determined based on one or more file information of a static resource file, a source code file, and a calling SDK data file corresponding to the APK file, the dynamic features of the operating state are determined based on the background server information of the application program and the information of a third-party service provider used by the application program, and the descriptive information features are determined based on one or more of the name, file size, package name, certificate, signature, version, developer information, release time, and functional description of the application program; A calculation module, used to perform similarity calculation on static features of non-operating states of each application program to obtain static similarity, perform similarity calculation on dynamic features of operating states of each application program to obtain dynamic similarity, and perform similarity calculation on descriptive information features of each application program to obtain descriptive similarity; a classification module, configured to identify a plurality of target applications having the same or similar features according to the static similarity, the dynamic similarity, and the descriptive similarity, and classify the plurality of target applications based on the same or similar features to obtain homology results, wherein the homology results include a plurality of combinations, each of which includes a plurality of target applications having one or more same or similar features; An identification module, configured to construct an association network map of homologous applications according to the homology results, and determine a cluster of closely associated homologous applications according to the association network map; The similarity calculation of the dynamic features of the running status of each application includes: clustering and comparing the server IP in the background server information of each application, and clustering and comparing the server domain name in the background server information of each application; when the similarity determined by any clustering comparison result of any two or more applications is greater than a second similarity threshold, a first dynamic similarity is obtained, and the first dynamic similarity is used to indicate that the any two or more applications share a server; Performing overlap analysis on the third-party service provider information of each application; if the third-party service provider information of any two or more applications overlaps, a second dynamic similarity is obtained, and the second dynamic similarity is used to indicate that the any two or more applications share services; wherein the first dynamic similarity and the second dynamic similarity both indicate that the any two or more applications have the same or similar features; The similarity calculation of the descriptive information features of each application includes: calculating the text similarity of the name and package name of each application; when the text similarity of any two or more applications is greater than a third similarity threshold, comparing the signatures and certificates of the any two or more applications; if the comparison results of the signatures and / or certificates are the same, determining the descriptive similarity for indicating that the any two or more applications have the same or similar features; Among them, the multiple combinations of the homology results include a first combination, a second combination and a third combination; any one of the static features, dynamic features and descriptive features of each target application in the first combination is the same or similar; any two of the static features, dynamic features and descriptive features of each target application in the second combination are the same or similar; three of the static features, dynamic features and descriptive features of each target application in the third combination are the same or similar; the construction of an association network map of homology applications based on the homology results, and the determination of a closely related homology application cluster based on the association network map include: Building an association network graph of homologous applications based on the first combination, the second combination, and the third combination; According to the association network graph, a community discovery algorithm is used to identify closely related homologous application clusters, wherein the community discovery algorithm is: The nodes represent the applications in each combination in the association network graph, k i represents the sum of the weights of all edges associated with node i in the associated network graph, k j represents the sum of the weights of all edges in the association network graph pointing to node j, node i represents an application in any combination in the association network graph, node j represents any application except node i, A i,j represents the weight of the edge connecting node i and node j, n is the sum of all weights in the association network graph, C i represents the community divided by node i, C j represents the community divided by node j. The δ function is a step function used to determine whether nodes i and j belong to the same community. Q represents modularity gain. The modularity gain is used to reflect the quality of community division. The higher the value, the more reasonable the community division. The divided community is the homologous application cluster.

4. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 2 are implemented.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.

Images