Method, product and device for identifying bad application classification based on traffic time sequence characteristics

Abstract

The application relates to the field of application identification technology, in particular to a bad application classification identification method, product and equipment based on traffic time sequence characteristics. The method comprises the following steps: obtaining an application to be identified and a seed application set containing category labels; obtaining traffic time sequence data of the application to be identified and each application in the seed application set, and respectively determining the similarity between the application to be identified and each application in the seed application set according to the traffic time sequence data; determining a target category corresponding to the application to be identified from the category labels according to the similarity between the application to be identified and each application in the seed application set and the category labels of each application in the seed application set; and judging whether the application to be identified belongs to the target category to obtain a classification identification result of the application to be identified. The application can improve the efficiency and accuracy of identifying bad applications.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of application recognition technology, and in particular to a bad application classification and recognition method based on traffic timing characteristics, a product and equipment. BACKGROUND

[0002] Under the background of rapid development of information communication technology, telecommunications fraud has become one of the criminal forms that has the greatest impact on society. Criminals design different applications according to different groups of people in order to evade the review mechanism, and even make one application for one person, that is, release a separate application file for each fraud target, which increases the difficulty of investigation. Criminals disguise a new application by changing the application name and appearance, the core function and logic of which do not change, commonly known as "skin" application. This way has very low cost, but will greatly increase the difficulty of identification and the workload of review.

[0003] The related art mainly uses a rule matching algorithm to identify bad applications. A seed set is collected by collecting application files or manually tagging, and rules are extracted from the applications in the set to determine the category of the application to be identified by rule matching. The rule matching method includes but is not limited to:

[0004] (1) File name and package name matching: Check if the name and package name of the application file match the name and package name in the seed set.

[0005] (2) File structure and resource file comparison: Analyze whether the file structure and resource files (such as layout files, icons, pictures, etc.) inside the application match the applications in the seed set.

[0006] (3) Signature and certificate comparison: Check if the signature and certificate information of the application match the applications in the seed set.

[0007] (4) Permission and function comparison: Analyze whether the permission declaration and function list of the application match the applications in the seed set.

[0008] (5) Resource file hash value comparison: Calculate whether the hash value of the resource file (such as pictures, layout files, etc.) matches the applications in the seed set.

[0009] (6) Metadata analysis: Check if the metadata (such as version number, author information, description, etc.) of the application file matches the applications in the seed set.

[0010] However, the rule matching method cannot cope with frequently updated "skin" applications. The appearance elements of "skin" applications, such as UI design, color scheme, icon, etc., can be arbitrarily changed, and the file name, package name, signature, certificate, metadata, etc. can also be updated. If the rule matching method is used, new applications need to be analyzed constantly, and rules need to be extracted and added to the rule library, which is very inefficient. When the rules are extracted and added to the rule library, new "skin" applications may be born, and the old rules have become invalid. SUMMARY

[0011] In order to solve the problem of low efficiency of identifying bad applications in the prior art, the present application provides a bad application classification identification method, product and equipment based on traffic time sequence characteristics.

[0012] In a first aspect, the present application provides a bad application classification identification method based on traffic time sequence characteristics, which adopts the following technical scheme:

[0013] A bad application classification identification method based on traffic time sequence characteristics, comprising:

[0014] Obtaining a to-be-identified application and a seed application set containing category labels;

[0015] Obtaining traffic time sequence data of each application in the to-be-identified application and the seed application set, and determining the similarity of the to-be-identified application and each application in the seed application set according to the traffic time sequence data;

[0016] According to the similarity of the to-be-identified application and each application in the seed application set, and the category label of each application in the seed application set, determining the target category corresponding to the to-be-identified application from the category label;

[0017] Judging whether the to-be-identified application belongs to the target category, and obtaining the classification identification result of the to-be-identified application.

[0018] By adopting the technical scheme, the application to be identified and the seed application set containing the category label are obtained, the category label in the seed application set provides a standard for classification identification, so that the classification process has a basis, and the traceability and accuracy of the classification result are ensured, the flow time sequence data contains dynamic characteristics of application behavior, these characteristics are key to distinguishing different application types (especially bad applications), the time sequence change of the application behavior can be captured, the data of the application to be identified and the seed application set are obtained, the comprehensiveness and consistency of analysis are ensured, and classification errors caused by data differences are reduced, by comparing the flow time sequence data, the similarity between the application to be identified and the seed application can be quantified, the complex network behavior is converted into comparable numerical values, classification decisions are made by using the similarity and the category label, the classification efficiency is improved while the accuracy is ensured, and waste of computing resources is reduced. The application improves the efficiency and accuracy of identifying bad applications.

[0019] In a preferred example, the application can be further configured to: the similarity of the application to be identified and each application in the seed application set is determined according to the flow time sequence data, comprising:

[0020] The flow time sequence data of the first target application is smoothed by using a sliding window to obtain target time sequence data, the first target application is any application in the seed application set and the application to be identified;

[0021] A flow time sequence curve is generated according to the target time sequence data;

[0022] The minimum distance between the flow time sequence curve of the application to be identified and the flow time sequence curve of the second target application is calculated, and the minimum distance is taken as the similarity between the application to be identified and the second target application, the second target application is any application in the seed application set.

[0023] By adopting the technical scheme, the flow time sequence data is smoothed by using a sliding window, the data is smoothed and random noise is removed, the time sequence data after smoothing is converted into a flow time sequence curve, which helps to more intuitively observe the change trend and mode of the data, the minimum distance between two flow time sequence curves is calculated, the similarity between the application to be identified and the seed application is quantified, and the classification decision is more objective and accurate.

[0024] In a preferred example, the application can be further configured to: the minimum distance between the flow time sequence curve of the application to be identified and the flow time sequence curve of the second target application is calculated, comprising:

[0025] A distance matrix of the flow time sequence curve of the application to be identified and the flow time sequence curve of the second target application is constructed, and an element in the distance matrix represents the distance between two points;

[0026] constructing a cumulative distance matrix based on the distance matrix by using a dynamic time warping algorithm, any element in the cumulative distance matrix representing a minimum cumulative distance from a starting point of the matrix to a corresponding point of the element;

[0027] reading an element value corresponding to an ending point of the matrix from the cumulative distance matrix to obtain a minimum distance between the traffic time series curve of the to-be-identified application and the traffic time series curve of the second target application.

[0028] By using the above technical solution, the dynamic time warping algorithm allows time stretching and offset between data points, can better process time series data that is not aligned or inconsistent in speed on the time axis, thereby improving the matching accuracy, the cumulative distance matrix considers the cumulative distances of all possible paths from the starting point to the current point, and selects the minimum one as the cumulative distance of the current point, which helps to avoid local optimal solution, and the element value corresponding to the ending point of the cumulative distance matrix is the minimum distance between the two traffic time series curves, which helps to quantify the similarity between the to-be-identified application and the seed application.

[0029] In a preferred example, the application can be further configured to: determining the target category corresponding to the to-be-identified application from the category labels according to the similarity of the to-be-identified application to each application in the seed application set and the category labels of each application in the seed application set, comprising:

[0030] dividing the seed application set into multiple groups according to the category labels, the category labels of the applications in each group being the same;

[0031] calculating the average of the similarity of the to-be-identified application to each application in each group according to the similarity of the to-be-identified application to each application in the seed application set;

[0032] determining a target group with the minimum average from the multiple groups, and taking the category label of the target group as the target category.

[0033] By using the above technical solution, the seed application set is grouped according to the category labels, and the average of the similarity of the to-be-identified application to each application in each group is calculated, which can smooth the noise or abnormal value influence of individual applications in the group, making the similarity evaluation more robust, reducing the misjudgment caused by individual application differences, and selecting the target group with the minimum average as the category attribution of the to-be-identified application. This method is based on the global optimization idea and considers the relationship between the to-be-identified application and the entire seed application set, so that the category of the to-be-identified application can be more accurately determined.

[0034] In a preferred example, the application can be further configured to: judging whether the to-be-identified application belongs to the target category to obtain a classification recognition result of the to-be-identified application, comprising:

[0035] Compare the average value corresponding to the target category with a preset threshold;

[0036] If the average value corresponding to the target category is not less than the preset threshold, then the classification and identification result is that the application to be identified does not belong to the target category and the application to be identified is a normal application.

[0037] If the average value corresponding to the target category is less than the preset threshold, then the classification and identification result is that the application to be identified is a bad application and belongs to the target category.

[0038] By adopting the above technical solution and using preset thresholds, clear boundary conditions for classification and recognition results are given, which helps to obtain more accurate classification and recognition results.

[0039] In a preferred embodiment, this application can be further configured as follows: obtaining the traffic time-series data of the application to be identified and each application in the seed application set includes:

[0040] Obtain runtime data of the application to be identified and each application in the seed application set;

[0041] The running data of the first target application is preprocessed to obtain target running data, wherein the first target application is either the application to be identified or any application in the seed application set;

[0042] The packet size at each time point is determined from the target running data. The packet sizes are arranged in the order of their corresponding time points to obtain traffic time-series data in array form, where each element in the array represents the packet size at a time point.

[0043] By adopting the above technical solution, the preprocessing of the running data can ensure data quality. The size of the data packets at each time point is determined from the target running data, and the traffic time series data is arranged in array form according to the time sequence, so that the data has continuity and comparability in the time dimension, which helps to capture the network behavior characteristics of the application more accurately.

[0044] In a preferred embodiment, this application can be further configured such that: the preprocessing of the runtime data of the first target application to obtain target runtime data includes:

[0045] Remove irrelevant protocol packets from the runtime data of the first target application to obtain the original traffic data. The irrelevant protocol packets are protocol data packets other than TCP.

[0046] The target running data is obtained by removing useless data packets from the original traffic data. The useless data packets include: corrupted packets, timeout packets, reset packets, handshake packets, and handshake packets.

[0047] By adopting the above technical solution, irrelevant protocol packets and useless data packets are removed, significantly reducing the amount of data that needs to be processed. This not only reduces the computational cost and storage requirements of data processing, but also improves the efficiency and performance of data analysis.

[0048] Secondly, this application provides a computer program product, which adopts the following technical solution:

[0049] A computer program product includes a computer program that, when executed by a processor, implements the bad application classification and identification method based on traffic timing characteristics as described in any of the first aspects.

[0050] Thirdly, this application provides an electronic device that adopts the following technical solution:

[0051] One or more processors;

[0052] Memory;

[0053] At least one application, wherein the at least one application is stored in memory and configured to be executed by at least one processor, the at least one application being configured to: perform a bad application classification and identification method based on traffic timing characteristics as described in any of the first aspects.

[0054] Fourthly, this application provides a computer-readable storage medium, which adopts the following technical solution:

[0055] A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform a method for classifying and identifying bad applications based on traffic timing characteristics as described in any of the first aspects.

[0056] In summary, this application includes the following beneficial technical effects:

[0057] This application acquires the application to be identified and a seed application set containing category labels. The category labels in the seed application set provide a standard for classification and identification, making the classification process based on evidence and ensuring the traceability and accuracy of the classification results. Traffic time-series data contains dynamic characteristics of application behavior, which are key to distinguishing different application types (especially malicious applications). It can capture the time-series changes in application behavior. Acquiring data from both the application to be identified and the seed application set ensures the comprehensiveness and consistency of the analysis, helping to reduce classification errors caused by data differences. By comparing traffic time-series data, the similarity between the application to be identified and the seed applications can be quantified, helping to transform complex network behavior into comparable values. Using similarity and category labels for classification decisions can improve classification efficiency while ensuring accuracy, reducing the waste of computing resources, and improving the efficiency and accuracy of identifying malicious applications. Attached Figure Description

[0058] Figure 1 This is a flowchart illustrating a method for classifying and identifying malicious applications based on traffic time-series characteristics, as provided in an embodiment of this application.

[0059] Figure 2 This is a schematic diagram of the registration interface of an application provided in an embodiment of this application;

[0060] Figure 3 This is a schematic diagram of the traffic packet information of the Pcap file provided in the embodiments of this application;

[0061] Figure 4 This is a schematic diagram of the traffic timing curve provided in the embodiments of this application;

[0062] Figure 5 This is a comparative schematic diagram of the traffic timing curves of two applications in the same series provided in the embodiments of this application;

[0063] Figure 6 This is a comparative schematic diagram of the traffic timing curves of two non-corresponding applications provided in the embodiments of this application;

[0064] Figure 7 This is a schematic diagram illustrating the principle of the DTW algorithm provided in this embodiment of the application.

[0065] Figure 8 This is a schematic diagram of path selection provided in an embodiment of this application;

[0066] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0067] The following is in conjunction with the appendix Figure 1 -Appendix Figure 9This application will be described in further detail.

[0068] This specific embodiment is merely an explanation of this application and is not intended to limit it. After reading this specification, those skilled in the art can make modifications to this embodiment without contributing any inventive step, but such modifications are protected by patent law as long as they fall within the scope of the claims of this application.

[0069] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0070] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0071] It should be noted that, in the optional embodiments of this application, the data related to object information, when applied to specific products or technologies, requires the permission or consent of the object. Furthermore, the collection, use, and processing of this data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. In other words, if the embodiments of this application involve data related to an object, it must be obtained with the object's authorization and consent, the authorization and consent of relevant departments, and in accordance with the relevant laws, regulations, and standards of the country and region. If the embodiments involve personal information, the acquisition of all personal information requires the individual's consent. If sensitive information is involved, the separate consent of the information subject is required. The embodiments also need to be implemented with the object's authorization and consent.

[0072] To improve the efficiency and accuracy of identifying "reskinned" apps, we can look for features that are difficult for "reskinned" apps to change, or features that are extremely costly to change. For the same series of "reskinned" apps, even if the UI design, color scheme, icons, and other appearance elements can change, they usually use the same set of backend interfaces. This is because changing the backend interface is tantamount to designing and developing a completely new application system, which is very costly. In this case, it's equivalent to developing a completely new application, no longer considered a "reskinned" app. The application's interface format, call parameters, and call order are designed during the development phase. Apps in the same series call the same interfaces; the only difference is the data contained in the interfaces. Therefore, the amount of data transmitted by each interface will not change significantly. The size of the data volume and the call order of the interfaces will be reflected in the timing of traffic transmission. Therefore, if we can extract the application's traffic timing features as classification features, then for the same series of "reskinned" apps, we only need to analyze and extract the traffic timing features once to apply to all apps in the series, without frequently updating the rule base. This improves the efficiency and accuracy of classifying and identifying "reskinned" apps.

[0073] This application provides a method for classifying and identifying problematic applications based on traffic time-series characteristics, such as... Figure 1 As shown, the method provided in this application embodiment is executed by an electronic device, which can be a server or a terminal device. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smartphone, tablet, laptop, desktop computer, etc., but is not limited to these. The terminal device and the server can be directly or indirectly connected via wired or wireless communication. This application embodiment does not impose any limitations on this connection. The method includes steps S101-S104, wherein:

[0074] S101. Obtain the application to be identified and a set of seed applications containing category labels.

[0075] Specifically, a sample set of malicious applications can be obtained. Each application in the sample set is pre-labeled with a category label by manual means. The sample set is divided into a set of applications to be identified and a seed set Q at a ratio of 3:1. For each application in the set of applications to be identified, the malicious application classification and identification method based on traffic time-series characteristics provided in this application is used, and the seed set Q is used to identify whether the application is a malicious application and, if so, which category it belongs to. Then, the identification results of the set of applications to be identified are compared with the pre-set category labels to complete the verification.

[0076] In this system, the application to be identified is any application in the set of applications to be identified. Each application in the set is classified and identified to obtain the classification result for each application. The size of the seed application set is |Q| = q, representing the number of applications in the seed application set. Malicious applications are "reskinned" applications that disguise themselves as new applications by changing their application names and appearances.

[0077] S102. Obtain the traffic time-series data of the application to be identified and each application in the seed application set, and determine the similarity between the application to be identified and each application in the seed application set based on the traffic time-series data.

[0078] For any given application, the operational steps are specific, with each step corresponding to a particular interface of a remote service. Changing the appearance of a malicious application to disguise it as a new one is a common tactic to evade censorship, but criminals don't modify the application's backend code. This is partly because users and censors are unaware of changes to the backend code, thus offering no benefit to the purpose of disguising the application as new; and partly due to cost considerations. Modifying the appearance only requires changing the text and resource files, which is extremely low-cost, while modifying the backend code requires altering the logic and database, essentially developing a completely new system program—a much more difficult and costly endeavor.

[0079] For applications within the same series, the interface format is defined during the application development phase. Applications within the same series share the same interfaces; the differences lie in the data contained within them. Even after changes to the user interface, the order of interface calls remains unchanged when using the same set of backend interfaces, and the overall amount of data transmitted by the interfaces does not vary significantly.

[0080] Specifically, for any application in the application to be identified and the seed application set, the application is set to run in a sandbox environment. This allows the generation of a Pcap file. Traffic timing data for the application is extracted from the Pcap file. This traffic timing data includes the packet size at each time point. The packet sizes are then arranged in ascending order according to their corresponding time points, resulting in an array of time-series traffic data. Each element in the array represents the packet size at a given time point. By running each application, the electronic device can obtain the traffic timing data for each application in both the application to be identified and the seed application set.

[0081] The runtime of each application can be manually set based on actual experience; optionally, the runtime is 30 minutes.

[0082] Figure 2The diagram below shows the registration interface of the application provided in this application embodiment. The interface includes four operation steps: enter mobile phone number, click to get verification code, enter password, and set password. These four operation steps correspond to four interfaces of remote service. The data packets generated by the four interfaces are arranged in order of time as 526, 385, 284, 385, 369, 385, 1411, and 385.

[0083] See Figure 3 This illustration shows a schematic diagram of traffic packet information in a Pcap file provided in an embodiment of this application. It can be seen that the traffic packet information within the Pcap file is ordered over time, and the traffic packet information includes: time, source, communication protocol type, data packet size, etc.

[0084] Furthermore, for any application in the application to be identified and the seed application set, a traffic time-series curve is generated based on the traffic time-series data of that application, thereby obtaining the traffic time-series curve of each application in the application to be identified and the seed application set. Figure 4 A schematic diagram of the traffic timing curve provided in an embodiment of this application is shown.

[0085] See Figure 5 It shows a comparative diagram of the traffic time-series curves of two applications in the same series, demonstrating the similarity between the traffic time-series curves of applications within the same series. See also Figure 6 The diagram shows a comparison of the traffic timing curves of two applications from different series. It can be seen that the traffic timing curves of the two applications from different series are quite different and have low similarity.

[0086] Then, the minimum distance between the traffic time-series curve of the application to be identified and the traffic time-series curve of each application in the seed application set is calculated as the similarity between the two applications, thus obtaining the similarity between the application to be identified and each application in the seed application set.

[0087] S103. Based on the similarity between the application to be identified and each application in the seed application set, and the category label of each application in the seed application set, determine the target category corresponding to the application to be identified from the category labels.

[0088] Specifically, the seed application set is divided into multiple groups according to category labels, with applications in each group having the same category label. Based on the similarity between the application to be identified and each application in the seed application set, the average similarity between the application to be identified and each application in each group is calculated. The group with the smallest average similarity among the multiple groups is selected as the target group, and the category label of the target group is taken as the target category.

[0089] S104. Determine whether the application to be identified belongs to the target category, and obtain the classification and identification result of the application to be identified.

[0090] Specifically, the average value corresponding to the target category is compared with a preset threshold. If the average value corresponding to the target category is not less than the preset threshold, the classification result is that the application to be identified does not belong to the target category. If the average value corresponding to the target category is less than the preset threshold, the classification result is that the application to be identified is a bad application and belongs to the target category.

[0091] This application's embodiments acquire the application to be identified and a seed application set containing category labels. The category labels in the seed application set provide a standard for classification, making the classification process data-driven and ensuring the traceability and accuracy of the classification results. Traffic time-series data contains dynamic characteristics of application behavior, which are key to distinguishing different application types (especially malicious applications). It can capture the time-series changes in application behavior. Simultaneously acquiring data from both the application to be identified and the seed application set ensures the comprehensiveness and consistency of the analysis, helping to reduce classification errors caused by data differences. By comparing traffic time-series data, the similarity between the application to be identified and the seed applications can be quantified, helping to transform complex network behavior into comparable numerical values. Using similarity and category labels for classification decisions can improve classification efficiency while ensuring accuracy and reducing the waste of computing resources. This application improves the efficiency and accuracy of identifying malicious applications.

[0092] One possible implementation of this application embodiment involves obtaining traffic time-series data for the application to be identified and each application in the seed application set, including:

[0093] Obtain runtime data for each application in the application to be identified and the seed application set;

[0094] The runtime data of the first target application is preprocessed to obtain target runtime data, wherein the first target application is any application in the application to be identified and the seed application set;

[0095] The packet size at each time point is determined from the target running data. The packet sizes are then arranged in chronological order according to the corresponding time points to obtain traffic time series data in array form, where each element in the array represents the packet size at a time point.

[0096] For the first target application, its runtime data is the generated Pcap file data. Preprocessing the runtime data of the first target application includes sequentially executing steps to remove irrelevant protocol packets and steps to remove useless data packets. Preprocessing can be achieved using network analysis tools such as Wireshark or Tshark.

[0097] Furthermore, the traffic time-series data of the first target application can be represented by an array. The length of the array is the number of data packets in the traffic time-series data, and each element in the array represents the size of the data packet, thereby obtaining the traffic time-series data of each application in the application to be identified and the seed application set.

[0098] The embodiments of this application preprocess the running data to ensure data quality. The size of the data packets at each time point is determined from the target running data, and the traffic time series data is arranged in array form according to the time sequence, so that the data has continuity and comparability in the time dimension, which helps to capture the network behavior characteristics of the application more accurately.

[0099] One possible implementation of this application embodiment involves preprocessing the runtime data of the first target application to obtain target runtime data, including:

[0100] Remove irrelevant protocol packets from the runtime data of the first target application to obtain the raw traffic data. Irrelevant protocol packets are protocol data packets other than TCP.

[0101] Remove useless data packets from the raw traffic data to obtain the target running data. Useless data packets include: corrupted packets, timeout packets, reset packets, handshake packets, and handshake packets.

[0102] An application may use different transport protocols depending on the usage scenario during runtime; for example, UDP might be used during voice and video calls. However, data generated by the application using protocols other than TCP has little value for subsequent algorithms. Therefore, data packets using protocols other than TCP can be considered irrelevant and removed using network analysis tools. For the runtime data of the first target application, the data after removing irrelevant protocol packets will be used as the raw traffic data.

[0103] During network transmission, issues such as poor communication line quality, poor client network quality, and weak network signal can lead to packet corruption, connection timeouts, and connection resets. These corrupted packets can interfere with subsequent algorithms and need to be removed. In the TCP protocol, there is a three-way handshake when establishing a connection and a four-way handshake when terminating it. The packet size transmitted during these processes is fixed and has little value for subsequent algorithms, so it also needs to be removed from the TCP stream data. For the runtime data of the primary target application, network analysis tools are used to remove useless packets from the raw traffic data, thus obtaining the target runtime data, which contains a series of packet sizes.

[0104] This application embodiment significantly reduces the amount of data that needs to be processed by removing irrelevant protocol packets and useless data packets. This not only reduces the computational cost and storage requirements of data processing, but also improves the efficiency and performance of data analysis.

[0105] One possible implementation of this application embodiment involves determining the similarity between the application to be identified and each application in the seed application set based on traffic time-series data, including:

[0106] The traffic time series data of the first target application is smoothed using a sliding window to obtain the target time series data. The first target application is any application in the application to be identified and the seed application set.

[0107] Generate traffic flow time-series curves based on target time-series data;

[0108] Calculate the minimum distance between the traffic time-series curve of the application to be identified and the traffic time-series curve of the second target application. Use the minimum distance as the similarity between the application to be identified and the second target application. The second target application is any application in the seed application set.

[0109] In this embodiment, a sliding window aggregation algorithm is performed on the traffic time-series data of the application to be identified and each application to obtain the traffic time-series curve of each application.

[0110] Taking the first target application as an example, the traffic time-series data of the first target application is recorded as an array sequence. The sliding window aggregation algorithm is performed on the sequence, including the following steps:

[0111] (1) Initialize the sliding window.

[0112] Define the sliding window size, denoted as w, which represents the number of time points contained within the sliding window. Define the step size, denoted as s, which represents the number of time points the sliding window slides in each step.

[0113] (2) Data segmentation.

[0114] The sequence array is divided into segments according to the sliding window size w and the step size s. The initial window position starts from the first element of the traffic time series data, containing the first w elements. Then the window moves to the right, sliding s positions to the right each time, until the entire traffic time series data is covered.

[0115] (3) Summation within a sliding window.

[0116] Summing is performed on the time point data within each sliding window to calculate the sum of all elements within the window. Let the starting position of the i-th sliding window be is; then the formula for calculating the sum of the i-th sliding window is:

[0117]

[0118] Repeat the above summation process until all windows have been calculated.

[0119] (4) Result generation.

[0120] The summation results of each window are stored sequentially to generate new time series data. This new time series data reflects the local sums of the original data, providing a smoother aggregation result. The length of the new time series is denoted as |S|:

[0121]

[0122] (5) Calculation optimization.

[0123] During the sliding window process, incremental calculation is achieved by using the summation result of the previous window, adding the newly entered element and subtracting the left element, thus reducing the amount of redundant calculation.

[0124] The target time series data obtained by smoothing the traffic time series data of the first target application using a sliding window can be represented by an array. Then, a traffic time series curve is generated based on the target time series data. The traffic time series curve contains a series of points, each point representing an element in the target time series data.

[0125] The sliding window aggregation algorithm plays a role in traffic time series data processing and analysis, including:

[0126] (1) Smoothing data fluctuations: Sliding window aggregation can smooth out fluctuations and noise in the original data by summing or averaging adjacent data points, providing clearer trends and patterns. This is especially important when analyzing time series data with high volatility.

[0127] (2) Real-time computation: Sliding window aggregation can perform real-time computation, making it particularly suitable for streaming data processing. When a new data point arrives, only the value within the window needs to be updated, without recalculating the entire sequence. This incremental computation method is suitable for high-frequency, continuous data stream processing.

[0128] (3) Reduce computational complexity: By setting the window size and step size, the amount of data to be processed can be effectively reduced, thus lowering computational complexity. Especially for large-scale traffic time-series data, sliding window aggregation can significantly improve computational efficiency and adapt to the needs of limited computing resources.

[0129] (4) Flexibility: Sliding window aggregation can adjust the window size and step size according to specific needs to balance computational accuracy and efficiency. Different window size and step size settings can capture trends and changes at different granularities, making the aggregation method more flexible and adaptable.

[0130] (5) Providing local features: Sliding window aggregation can extract local features from time series data, which helps to identify short-term trends, periodic patterns, and outliers. This is of great significance for the construction of time series analysis and prediction models, and can provide valuable features for subsequent in-depth analysis.

[0131] (6) Data compression: Sliding window aggregation reduces the dimensionality and compresses data by aggregating multiple data points into one data point, which helps to reduce data storage space.

[0132] (7) Improve data robustness: Sliding window aggregation can enhance data robustness and resist the impact of individual outliers or erroneous data points. Through aggregation operations, the impact of individual outliers is averaged or weakened, thereby improving the overall data quality.

[0133] This application embodiment utilizes a sliding window to smooth traffic time-series data, which can smooth the data and remove random noise. The smoothed time-series data is transformed into traffic time-series curves, which helps to more intuitively observe the changing trends and patterns of the data. Calculating the minimum distance between two traffic time-series curves can quantify the similarity between the application to be identified and the seed application, making the classification decision more objective and accurate.

[0134] One possible implementation of this application embodiment involves calculating the minimum distance between the traffic time-series curve of the application to be identified and the traffic time-series curve of the second target application, including:

[0135] Construct a distance matrix between the traffic time-series curve of the application to be identified and the traffic time-series curve of the second target application. The elements in the distance matrix represent the distance between two points.

[0136] The Dynamic Time Warping (DTW) algorithm is used to construct a cumulative distance matrix based on the distance matrix. Each element in the cumulative distance matrix represents the minimum cumulative distance from the starting point of the matrix to the point corresponding to that element.

[0137] Read the element value corresponding to the endpoint of the cumulative distance matrix to obtain the minimum distance between the traffic time series curve of the application to be identified and the traffic time series curve of the second target application.

[0138] Specifically, the traffic time-series curve of the application to be identified is represented as Sp, and the traffic time-series curve of the second target application is represented as Sq. Sp and Sq are aligned to construct a distance matrix X, which has a size of n×m, where n is the number of elements in Sp and m is the number of elements in Sq. The matrix element x(i,j) represents the distance between the i-th point in Sp and the j-th point in Sq, and the element corresponding to the i-th point in Sp is Sp. i The element corresponding to the j-th point in Sq has a value of Sq.j The distance between the two points is d(Sp). i ,Sq j Generally, Euclidean distance is used, i.e.

[0139] like Figure 7 As shown, this diagram illustrates the principle of the DTW algorithm provided in this application embodiment. Finding the distance between two flow time series curves can be reduced to finding a path that passes through several grid points in this grid, minimizing the sum of the distances between the points along the path. The grid points traversed by the path are the points where the two sequences are aligned for calculation. This path is represented by W, and the k-th element of W is defined as w. k =(i,j) k The mapping between sequences Sp and Sq is defined, resulting in the following equation:

[0140] W = w1, w2, ..., w k ,...w K max(m,n)≤K≤m+n-1

[0141] This path was not chosen arbitrarily; it needs to meet the following constraints:

[0142] (1) Boundary conditions: w1 = (1,1) and w K = (m, n). The generation speed of any two flow time series curves may vary, but the order in which each behavior occurs will not change. Therefore, the selected path must start from the lower left corner and end at the upper right corner.

[0143] (2) Continuity. If w k-1 =(a ′ ,b ′ ), then for the next point w on the path k =(a,b) needs to satisfy (aa) ′ )≤1 and (bb ′ The value ≤ 1. This means it's impossible to cross a certain point to match; it can only align with its adjacent points. This ensures that every coordinate in Sp and Sq appears in W.

[0144] (3) Monotonicity. If w k-1 =(a ′ ,b ′ ), then for the next point w on the path k =(a,b) needs to satisfy (aa) ′ )≥0 and (bb ′ )≥0. This restricts the points on W to be monotonically increasing over time.

[0145] See Figure 8The diagram illustrates the path selection provided in this embodiment. Combining continuity and monotonicity constraints, each cell has only three possible paths. For example, if the path has already passed cell (i,j), the next cell to pass can only be one of the following three cases: (i+1,j), (i,j+1), or (i+1,j+1).

[0146] There are many paths that satisfy the above constraints, among which the shortest path is the one that minimizes the following regularization cost:

[0147]

[0148] This shortest path is equivalent to extending and shortening two traffic time series curves to obtain the shortest distance between the two traffic time series, which is the most similar mapping relationship. This shortest distance is also the final distance metric between the two traffic time series curves.

[0149] Define an accumulated distance. Starting from the point (0,0), match the two curve sequences Sp and Sq. At each point, the distances calculated for all previous points are accumulated. After reaching the endpoint (m,n), this accumulated distance is the final total distance, d = d(i,j) = d(Sp). i ,Sq j )+min{d(i-1,j-1),d(i-1,j),d(i,j-1)}, which is the minimum distance (similarity) between the flow time series curves Sp and Sq.

[0150] The dynamic time warping algorithm in this application allows for time scaling and offset between data points, which can better handle time-series data that are misaligned or have inconsistent speeds on the time axis, thereby improving the accuracy of matching. The construction of the cumulative distance matrix considers the cumulative distance of all possible paths from the starting point to the current point, and selects the smallest one as the cumulative distance of the current point, which helps to avoid local optima. The element value corresponding to the endpoint of the cumulative distance matrix is ​​the minimum distance between the two traffic time-series curves, which helps to quantify the similarity between the application to be identified and the seed application.

[0151] One possible implementation of this application embodiment involves determining the target category corresponding to the application to be identified from the category tags based on the similarity between the application to be identified and each application in the seed application set, and the category tags of each application in the seed application set, including:

[0152] The seed application set is divided into multiple groups according to category labels, and the applications in each group have the same category label;

[0153] Based on the similarity between the application to be identified and each application in the seed application set, calculate the average similarity between the application to be identified and each application in each group;

[0154] Identify the target group with the smallest average value from multiple groups, and use the category label of the target group as the target category.

[0155] In this embodiment, the size of the seed application set is |Q| = q, representing the number of applications in the seed application set. After obtaining the similarity between the application to be identified and each application in the seed application set, the obtained similarity scores are represented as an array d = [d1, d2, ..., d...]. q The seed application set is represented as Q = {q1, q2, ..., q}, (q = |Q|). q The category labels of the seed application set are represented as a category set T = {t1, t2, ..., t}. z}, where z is the number of categories, and q is the number of applications in the seed application set. i Category t i ∈T.

[0156] For each category t∈T, calculate the average distance (average similarity) between the application to be identified and all applications belonging to category t in the seed set Q. Let Q... t Let Q be the set of all points of class t, representing a group. t ={q i ∈Q∣t i =t}, calculate the application to Q to be identified t Average distance:

[0157]

[0158] Find the group with the smallest average distance and denote it as the target group. The average distance of the target group is denoted as . The category corresponding to the target group is target category t. min :

[0159]

[0160] This application embodiment groups the seed application set according to category labels and calculates the average similarity between the application to be identified and each application in each group. This can smooth out the influence of noise or outliers that may be brought by individual applications within the group, making the similarity assessment more robust and reducing misjudgments caused by differences in individual applications. The target group with the smallest average is selected as the category to which the application to be identified belongs. This method is based on the idea of ​​global optimization and considers the relationship between the application to be identified and the entire seed application set, thereby enabling a more accurate determination of its category.

[0161] One possible implementation of this application embodiment is to determine whether the application to be identified belongs to the target category and obtain the classification and identification result of the application to be identified, including:

[0162] Compare the average value corresponding to the target category with a preset threshold;

[0163] If the average value corresponding to the target category is not less than the preset threshold, the classification result is that the application to be identified does not belong to the target category and the application to be identified is a normal application.

[0164] If the average value corresponding to the target category is less than the preset threshold, the classification result is that the application to be identified is a bad application and belongs to the target category.

[0165] The preset threshold can be set manually according to actual needs, and this embodiment does not impose specific limitations.

[0166] This application provides clear boundary conditions for classification and recognition results by referencing preset thresholds, which helps to obtain more accurate classification and recognition results.

[0167] For example, based on the sample set in Table 1, the distribution of the number of seed applications and the number of applications to be identified in each category is shown in Table 1 below:

[0168]

[0169] The application classification and identification method based on traffic time-series characteristics provided in this application was used to classify and identify each application to be identified in Table 1. The results (number of correctly identified applications by the DTW algorithm and accuracy of the DTW algorithm) are shown in Table 2. Table 2 also includes the classification and identification results of the traditional rule matching algorithm. Comparing the two methods, it can be seen that in the nine categories, the algorithm provided in this application is weaker than the traditional rule matching algorithm in classifying and identifying fraudulent investment and financial management applications, but better in classifying and identifying the remaining eight categories, which proves the effectiveness of the algorithm in this application.

[0170]

[0171]

[0172] This application provides a computer program product, including a computer program that, when executed by a processor, implements the content shown in the aforementioned embodiment of the method for classifying and identifying malicious applications based on traffic timing characteristics.

[0173] This application provides an electronic device, such as... Figure 9 As shown, Figure 9The illustrated electronic device 900 includes a processor 901 and a memory 903. The processor 901 and the memory 903 are connected, for example, via a bus 902. Optionally, the electronic device 900 may also include a transceiver 904. It should be noted that in practical applications, the transceiver 904 is not limited to one type, and the structure of this electronic device 900 does not constitute a limitation on the embodiments of this application.

[0174] Processor 901 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 901 may also be a combination that implements computational functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0175] Bus 902 may include a pathway for transmitting information between the aforementioned components. Bus 902 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. Bus 902 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The symbol is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0176] The memory 903 may be a ROM (Read Only Memory) or other type of static storage device capable of storing static information and instructions, RAM (Random Access Memory) or other type of dynamic storage device capable of storing information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), CD-ROM (Compact Disc Read Only Memory) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0177] The memory 903 stores the application code that executes the scheme of this application, and its execution is controlled by the processor 901. The processor 901 executes the application code stored in the memory 903 to implement the content shown in the aforementioned embodiment of the malicious application classification and identification method based on traffic timing characteristics.

[0178] Figure 9 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0179] This application provides a computer-readable storage medium storing a computer program that, when run on a computer, enables the computer to execute the content shown in the aforementioned embodiment of the method for classifying and identifying malicious applications based on traffic timing characteristics.

[0180] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0181] The above are only some embodiments of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for identifying a bad application based on traffic timing characteristics, characterized in that, The application comprises the following steps: Obtaining a to-be-identified application and a seed application set containing category labels; Obtaining traffic time series data of each application in the to-be-identified application and the seed application set, and determining the similarity between the to-be-identified application and each application in the seed application set according to the traffic time series data; Determining the target category corresponding to the to-be-identified application from the category labels according to the similarity between the to-be-identified application and each application in the seed application set and the category labels of each application in the seed application set; Determining whether the to-be-identified application belongs to the target category to obtain a classification recognition result of the to-be-identified application; The step of obtaining traffic time series data of each application in the to-be-identified application and the seed application set comprises the following steps: Obtaining running data of each application in the to-be-identified application and the seed application set; Preprocessing the running data of a first target application to obtain target running data, wherein the first target application is any application in the to-be-identified application and the seed application set; Determining the packet size of each time point from the target running data, and arranging the packet sizes according to the time sequence of the corresponding time points to obtain traffic time series data in the form of an array, wherein one element in the array represents the packet size of one time point; The step of determining the similarity between the to-be-identified application and each application in the seed application set according to the traffic time series data comprises the following steps: Smoothing the traffic time series data of a first target application by using a sliding window to obtain target time series data, wherein the first target application is any application in the to-be-identified application and the seed application set; Generating a traffic time series curve according to the target time series data; Calculating the minimum distance between the traffic time series curve of the to-be-identified application and the traffic time series curve of a second target application, and taking the minimum distance as the similarity between the to-be-identified application and the second target application, wherein the second target application is any application in the seed application set; The step of calculating the minimum distance between the traffic time series curve of the to-be-identified application and the traffic time series curve of a second target application comprises the following steps: Constructing a distance matrix of the traffic time series curve of the to-be-identified application and the traffic time series curve of the second target application, wherein an element in the distance matrix represents the distance between two points; Constructing a cumulative distance matrix based on the distance matrix by using a dynamic time warping algorithm, wherein any element in the cumulative distance matrix represents the minimum cumulative distance from the starting point of the matrix to the corresponding point of the element; Reading the element value corresponding to the end point of the matrix from the cumulative distance matrix to obtain the minimum distance between the traffic time series curve of the to-be-identified application and the traffic time series curve of the second target application. 2.The method of claim 1, wherein, The step of determining the target category corresponding to the to-be-identified application from the category labels according to the similarity between the to-be-identified application and each application in the seed application set and the category labels of each application in the seed application set comprises the following steps: Dividing the seed application set into multiple groups according to the category labels, and the category labels of the applications in each group are the same. According to the similarity between the to-be-identified application and each application in the seed application set, an average value of the similarity between the to-be-identified application and each application in each group is calculated; A target group with a minimum average value is determined from the multiple groups, and a class label of the target group is taken as a target class. 3.The method of claim 2, wherein, The judgment of whether the to-be-identified application belongs to the target class includes: The average value corresponding to the target class is compared with a preset threshold value; If the average value corresponding to the target class is not less than the preset threshold value, the classification recognition result is that the to-be-identified application does not belong to the target class, and the to-be-identified application is a normal application; If the average value corresponding to the target class is less than the preset threshold value, the classification recognition result is that the to-be-identified application is a bad application and belongs to the target class. 4.The method of claim 1, wherein, The preprocessing of the running data of the first target application to obtain target running data includes: Irrelevant protocol packets are removed from the running data of the first target application to obtain original traffic data, the irrelevant protocol packets being protocol data packets other than TCP protocol packets; Useless data packets are removed from the original traffic data to obtain target running data, the useless data packets including damaged packets, timeout packets, reset packets, handshake packets and waving packets.

5. A computer program product, characterised in that, The computer program is executed by a processor to implement the steps of the bad application classification and recognition method based on traffic timing characteristics in any one of claims 1-4.

6. An electronic device, comprising: The computer program is executed by a processor to implement the steps of the bad application classification and recognition method based on traffic timing characteristics in any one of claims 1-4. The computer program is executed by a processor to implement the steps of the bad application classification and recognition method based on traffic timing characteristics in any one of claims 1-4. ​ ​ 7. A computer-readable storage medium having stored thereon a computer program, characterized in that, ​

Images