Malicious application detection method and device, terminal and storage medium

Abstract

The invention provides a malicious application detection method and device, a terminal and a storage medium, and belongs to the technical field of computers. And the terminal determines a connection relationship between the first node representing the application program and other nodes in the application program map according to the application permission and the interface calling behavior of the to-be-detected application program. Furthermore, the terminal can convert a malicious application program detection problem into a node classification problem. And the terminal fuses the embedded vectors of the plurality of neighbor nodes of the first node to obtain an embedded vector capable of reflecting the application permission characteristics or the interface calling behavior characteristics of the application program. And the terminal classifies the first node according to the embedded vector with higher expression capability, so that whether the application program is a malicious application program or not can be accurately determined according to the classification result. By adopting the method, the application permission characteristics and the interface calling behavior characteristics of the application program are considered, and the detection accuracy of the malicious application program is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, terminal and storage medium for detecting malicious applications. Background Art

[0002] With the development of computer technology, various types of terminals such as mobile phones, desktop computers, laptops and tablet computers have gradually become an indispensable part of people's daily lives. Malicious applications on terminals will pose a threat to the privacy and property security of users. Therefore, in order to ensure the privacy and property security of users, how to detect whether an application is a malicious application after it is installed on the terminal is a technical problem that needs to be solved.

[0003] In the related art, for an application to be detected, a terminal can detect whether the application is a malicious application by analyzing the API (Application Programming Interface) called by the application. For example, the terminal obtains an API list, and the API list includes APIs that are called more times or with a higher frequency by malicious applications. Then the terminal analyzes the APIs called by the application according to the API list. If multiple APIs frequently called by the application are all in the API list, the application can be considered to be a malicious application.

[0004] However, there are certain limitations in using the above method to detect malicious applications based only on the called APIs. For example, the API list may include some APIs that are called by both malicious applications and non-malicious applications. If the API called by a non-malicious application is present in the API list, the non-malicious application will be misreported as a malicious application. Therefore, the accuracy of detecting malicious applications using the above method is low. Summary of the invention

[0005] The embodiments of the present application provide a malicious application detection method, device, terminal and storage medium, which can improve the accuracy of malicious application detection. The technical solution is as follows:

[0006] According to one aspect of an embodiment of the present application, a method for detecting malicious applications is provided, the method comprising:

[0007] When the target application is installed, a first node is added to the application graph, the first node is used to represent the target application, the nodes in the application graph represent the application, the application permission and the interface call behavior respectively, and the edges in the application graph represent that the application has the application permission and the application has executed the interface call behavior respectively;

[0008] Determine a plurality of target neighbor nodes of the first node, wherein the target neighbor nodes are used to indicate that the target application has the application authority represented by the target neighbor nodes, or that the target application has executed the interface call behavior represented by the target neighbor nodes;

[0009] fusing the embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, where the embedding vector of the first node is used to represent at least one of an application permission feature and an interface call behavior feature of the target application program;

[0010] Based on the embedding vector of the first node, the first node is classified to obtain a classification result of the first node, and the classification result is used to indicate whether the target application is a malicious application.

[0011] According to another aspect of an embodiment of the present application, a malicious application detection device is provided, the device comprising:

[0012] An adding module, used for adding a first node in an application graph when the target application is installed, the first node being used to represent the target application, the nodes in the application graph respectively representing an application, an application permission and an interface calling behavior, and the edges in the application graph respectively representing that the application has the application permission and that the application has executed the interface calling behavior;

[0013] A determination module, used to determine a plurality of target neighbor nodes of the first node, wherein the target neighbor nodes are used to indicate that the target application has the application authority represented by the target neighbor node, or that the target application has executed the interface call behavior represented by the target neighbor node;

[0014] a fusion module, configured to fuse the embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, wherein the embedding vector of the first node is used to represent at least one of an application permission feature and an interface call behavior feature of the target application program;

[0015] A classification module is used to classify the first node based on the embedding vector of the first node to obtain a classification result of the first node, wherein the classification result is used to indicate whether the target application is a malicious application.

[0016] In some embodiments, the fusion module comprises:

[0017] An acquisition unit, configured to acquire, for any target neighbor node, an initial embedding vector of the target neighbor node, wherein the initial embedding vector is used to represent an application permission feature or an interface call behavior feature;

[0018] a transformation unit, configured to transform an initial embedding vector of the target neighbor node based on a transformation parameter value of the target neighbor node to obtain an embedding vector of the target neighbor node, wherein the transformation parameter value is related to a type of the target neighbor node, and the embedding vector of the target neighbor node is used to represent an association feature between the first node and the target neighbor node;

[0019] A fusion unit is used to fuse the embedding vectors of the multiple target neighbor nodes to obtain the embedding vector of the first node.

[0020] In some embodiments, the transformation unit is used to obtain a first transformation parameter value when the type of the target neighbor node is a first type, and the node of the first type is a node representing application permissions; when the type of the target neighbor node is a second type, obtain a second transformation parameter value, and the node of the second type is a node representing interface call behavior; based on the first transformation parameter value or the second transformation parameter value, the initial embedding vector of the target neighbor node is transformed by a first transformation function to obtain the embedding vector of the target neighbor node, and the first transformation function is used to transform the vector.

[0021] In some embodiments, the apparatus further comprises:

[0022] An acquisition module, used for acquiring multiple candidate transformation functions and a weight of each candidate transformation function;

[0023] a transformation module, configured to transform an initial embedding vector of a first sample node through each candidate transformation function based on a transformation parameter value of the first sample node to obtain an embedding vector output by each candidate transformation function, wherein the first sample node is a node of the first type or a node of the second type in the application graph, and the transformation parameter value is related to the type of the first sample node;

[0024] A weighted summation module, configured to perform weighted summation on the embedding vectors output by each candidate transformation function based on the weight of each candidate transformation function, so as to obtain the embedding vector of the first sample node;

[0025] A weight adjustment module, configured to adjust the weight of each candidate transformation function based on the embedding vector of the first sample node until the embedding vector of the first sample node satisfies a condition for ending the adjustment;

[0026] The function determination module is used to determine the candidate transformation function with the highest weight as the first transformation function.

[0027] In some embodiments, the apparatus further comprises:

[0028] A feature extraction module, used to extract features of at least one of the application permissions and the interface call behavior executed by the target application program, to obtain an original feature vector of the first node;

[0029] The transformation module is used to transform the original feature vector of the first node through a second transformation function based on a preset transformation parameter value to obtain an initial embedding vector of the first node, and the second transformation function is used to transform the vector;

[0030] The fusion module is used to fuse the initial embedding vector of the first node and the embedding vector of the first node to obtain an updated embedding vector of the first node.

[0031] In some embodiments, the acquisition module is used to acquire multiple candidate transformation functions and a weight of each candidate transformation function;

[0032] The transformation module is used to transform the original feature vector of the second sample node through each candidate transformation function based on the preset transformation parameter value to obtain the embedding vector output by each candidate transformation function, and the second sample node is a node representing an application in the application graph;

[0033] The weighted summation module is used to perform weighted summation on the embedding vectors output by each candidate transformation function based on the weight of each candidate transformation function to obtain an initial embedding vector of the second sample node;

[0034] The weight adjustment module is used to adjust the weight of each candidate transformation function based on the initial embedding vector of the second sample node until the initial embedding vector of the second sample node meets the condition for ending the adjustment;

[0035] The function determination module is used to determine the candidate transformation function with the highest weight as the second transformation function.

[0036] In some embodiments, the fusion unit is used to fuse the embedding vectors of the multiple target neighbor nodes through a fusion function to obtain the embedding vector of the first node, and the fusion function is used to fuse the vectors.

[0037] In some embodiments, the acquisition module is used to acquire multiple candidate fusion functions and the weight of each candidate fusion function;

[0038] The transformation module is used to fuse the embedding vectors of multiple third sample nodes through each candidate fusion function to obtain the embedding vector output by each candidate fusion function, wherein the third sample node is a node representing application permissions or a node representing interface call behavior in the application graph;

[0039] The weighted summation module is used to perform weighted summation on the embedding vectors output by each candidate fusion function based on the weight of each candidate fusion function to obtain the embedding vector of the fourth sample node, wherein the fourth sample node is a node representing an application in the application graph, and the third sample node is a neighbor node of the fourth sample node;

[0040] The weight adjustment module is used to adjust the weight of each candidate fusion function based on the embedding vector of the fourth sample node until the embedding vector of the fourth sample node meets the condition for ending the adjustment;

[0041] The function determination module is used to determine the candidate fusion function with the highest weight as the fusion function.

[0042] In some embodiments, the adding module is used to determine at least one second node and at least one third node in the application map based on the application permissions of the target application and the interface calling behavior performed by the target application, wherein the second node is a node representing the application permissions and the third node is a node representing the interface calling behavior; in the application map, the first node is connected to the at least one second node and the at least one third node respectively;

[0043] The determination module is used to determine the at least one second node and the at least one third node as multiple target neighbor nodes of the first node in the application map.

[0044] According to another aspect of an embodiment of the present application, a terminal is provided, comprising a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the malicious application detection method as described in the above aspect.

[0045] According to another aspect of an embodiment of the present application, a chip is provided, which includes a programmable logic circuit and / or program instructions. When the chip runs on a terminal, it is used to implement the malicious application detection method described in the above aspect.

[0046] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein the storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the malicious application detection method as described in the above aspects.

[0047] According to another aspect of an embodiment of the present application, a computer program product is provided. The computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the malicious application detection method described in the above aspect.

[0048] The embodiment of the present application provides a malicious application detection solution, because the application permissions or interface call behaviors of malicious applications are somewhat different from those of non-malicious applications. Therefore, the terminal can determine the connection relationship between the first node representing the application and other nodes in the application map based on the application permissions and interface call behaviors of the application to be detected. Furthermore, the terminal can convert the problem of malicious application detection into a node classification problem. The terminal fuses the embedding vectors of multiple neighboring nodes of the first node according to the connection relationship between the nodes indicated by the application map, and obtains an embedding vector that can reflect the application permission characteristics or interface call behavior characteristics of the application. The terminal classifies the first node according to the embedding vector with stronger expressive power, and can more accurately determine the classification result, and determine whether the application is a malicious application based on the classification result. The above method takes into account the application permission characteristics and interface call behavior characteristics of the application, and improves the accuracy of malicious application detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0050] Figure 1 It is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0051] Figure 2 is a flow chart of a malicious application detection method provided by an embodiment of the present application;

[0052] Figure 3 is a flow chart of another malicious application detection method provided by an embodiment of the present application;

[0053] Figure 4 It is a schematic diagram of a graph neural network model provided in an embodiment of the present application;

[0054] Figure 5 is a schematic diagram of a fusion module provided in an embodiment of the present application;

[0055] Figure 6 is a schematic diagram of a malicious application detection effect provided by an embodiment of the present application;

[0056] Figure 7 It is a schematic diagram of a detection time provided in an embodiment of the present application;

[0057] Figure 8 It is a structural schematic diagram of a malicious application detection device provided in an embodiment of the present application;

[0058] Fig. 9 is a schematic diagram of the structure of another malicious application detection device provided in an embodiment of the present application;

[0059] Fig.10 It is a structural block diagram of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0060] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0061] In this article, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of the associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0062] It should be noted that the information (including but not limited to user's device information, user's personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the application permissions of the application and the interface calling behavior of the application involved in this application are all obtained with full authorization.

[0063] Figure 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application. Figure 1 , the implementation environment includes a terminal 101 and a server 102. The terminal 101 can be directly or indirectly connected to the server 102 through wired or wireless communication.

[0064] Optionally, the terminal 101 can be a mobile phone, a desktop computer, a laptop computer, a tablet computer, a smart watch and other types of terminals. Optionally, the terminal has an application installed and running. In order to ensure the privacy and property security of the user, the terminal 101 can detect the application permissions of the application and the interface call behavior executed by the application after the application is installed to detect whether the application is a malicious application. Optionally, the terminal 101 has a security application installed. The application can be used to detect malicious applications, and the application is associated with the server 102, and the server 102 provides background services.

[0065] Optionally, the server 102 is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. In some embodiments, the server 102 undertakes the main computing work, and the terminal 101 undertakes the secondary computing work; or, the server 102 undertakes the secondary computing work, and the terminal 101 undertakes the main computing work; or, the server 102 and the terminal 101 use a distributed computing architecture for collaborative computing.

[0066] Figure 2 is a flowchart of a malicious application detection method provided by an embodiment of the present application. The method is executed by a terminal, see Figure 2 , the method comprising:

[0067] 201. When the target application is installed, the terminal adds a first node in the application graph, where the first node is used to represent the target application. The nodes in the application graph respectively represent applications, application permissions, and interface call behaviors. The edges in the application graph respectively represent that the application has application permissions and that the application has executed interface call behaviors.

[0068] In the embodiment of the present application, the application graph is a knowledge graph. The application graph includes nodes representing applications (APP, Application), nodes representing application permissions (permission), and nodes representing interface call behaviors (intent). The edge (APP-permission) between the node representing the application and the node representing the application permission is used to indicate that the application has the application permission, and the edge (APP-intent) between the node representing the application and the node representing the interface call behavior is used to indicate that the application has executed the interface call behavior.

[0069] Among them, the nodes representing applications in the application graph can be divided into existing nodes and newly added nodes. Existing nodes are nodes added to the application graph during the construction of the application graph. The connection relationship between existing nodes and other nodes has been determined. New nodes are nodes newly added to the application graph. Existing nodes include nodes representing malicious applications and nodes representing non-malicious applications. Since there are differences in the application permissions and interface call behaviors of malicious applications and non-malicious applications, there are also differences in the connection relationship between the node representing malicious applications and other nodes and the connection relationship between the node representing non-malicious applications and other nodes.

[0070] After the terminal successfully installs the target application, the terminal adds a node representing the target application in the application map. For ease of description, the newly added node is called the first node. The terminal can determine whether the target application is a malicious application by analyzing the connection relationship between the first node and other nodes.

[0071] 202. The terminal determines multiple target neighbor nodes of the first node, where the target neighbor nodes are used to indicate that the target application has the application authority represented by the target neighbor nodes, or that the target application has executed the interface calling behavior represented by the target neighbor nodes.

[0072] In an embodiment of the present application, the terminal detects the target application and obtains at least one application permission and at least one interface call behavior of the target application. The terminal determines the nodes representing the above application permissions and the nodes representing the above interface call behaviors in the application map as multiple target neighbor nodes of the first node. Among them, since the first node can be directly connected to the target neighbor node, the target neighbor node can also be called the first-order neighbor node of the first node.

[0073] 203. The terminal fuses the embedding vectors of multiple target neighbor nodes to obtain an embedding vector of a first node, where the embedding vector of the first node is used to represent at least one of an application permission feature and an interface call behavior feature of the target application program.

[0074] In the embodiment of the present application, the terminal can process the application graph through the graph neural network to obtain the embedding vectors of the nodes in the application graph. Among them, the embedding vector of the node representing the application permission can represent the application permission characteristics; the embedding vector of the node representing the interface call behavior can represent the interface call behavior characteristics; the embedding vector of the node representing the application can represent the application permission characteristics and interface call behavior characteristics of the application.

[0075] Therefore, the embedding vector of the target neighbor node of the first node is used to represent the application permission feature or the interface call behavior feature. The terminal fuses the embedding vectors of multiple target neighbor nodes to obtain the embedding vector of the first node. The embedding vector of the first node can represent at least one of the application permission feature and the interface call behavior feature of the target application.

[0076] 204. The terminal classifies the first node based on the embedding vector of the first node to obtain a classification result of the first node, where the classification result is used to indicate whether the target application is a malicious application.

[0077] In an embodiment of the present application, since the application permission characteristics or interface call behavior characteristics of malicious applications and non-malicious applications are different, the terminal can classify the first node according to the embedding vector of the first node to determine whether the target application represented by the first node is a malicious application. When the application permission characteristics of the target application represented by the embedding vector of the first node are similar to the application permission characteristics of the malicious application, or the interface call behavior characteristics of the target application represented by the embedding vector of the first node are similar to the interface call behavior characteristics of the malicious application, the target application can be considered to be a malicious application. The terminal can delete, uninstall or add the malicious application to the mobile phone blacklist to prevent the malicious application from performing repackaging attacks, privilege escalation attacks or other attack behaviors, thereby protecting the privacy and property safety of users.

[0078] The embodiment of the present application provides a method for detecting malicious applications, because the application permissions or interface call behaviors of malicious applications are somewhat different from those of non-malicious applications. Therefore, the terminal can determine the connection relationship between the first node representing the application and other nodes in the application map based on the application permissions and interface call behaviors of the application to be detected. Furthermore, the terminal can convert the problem of malicious application detection into a node classification problem. The terminal fuses the embedding vectors of multiple neighboring nodes of the first node according to the connection relationship between the nodes indicated by the application map, and obtains an embedding vector that can reflect the application permission characteristics or interface call behavior characteristics of the application. The terminal classifies the first node according to the embedding vector with stronger expression ability, and can determine the classification result more accurately, and determine whether the application is a malicious application based on the classification result. The above method takes into account the application permission characteristics and interface call behavior characteristics of the application, and improves the accuracy of malicious application detection.

[0079] Figure 3 is a flowchart of another malicious application detection method provided by an embodiment of the present application. The method is executed by a terminal, see Figure 3 , the method comprising:

[0080] 301. When the target application is installed, the terminal adds a first node in the application graph, where the first node is used to represent the target application. The nodes in the application graph respectively represent the application, application permissions, and interface call behaviors. The edges in the application graph respectively represent that the application has application permissions and that the application has executed an interface call behavior.

[0081] In the embodiment of the present application, the application graph is a knowledge graph. The application graph includes nodes representing applications, nodes representing application permissions, and nodes representing interface call behaviors. The edge between the node representing the application and the node representing the application permissions is used to indicate that the application has the application permissions, and the edge between the node representing the application and the node representing the interface call behavior is used to indicate that the application has executed the interface call behavior.

[0082] Among them, the nodes representing applications in the application graph can be divided into existing nodes and newly added nodes. Existing nodes are nodes added to the application graph during the process of building the application graph. The connection relationship between existing nodes and other nodes has been determined. New nodes are nodes newly added to the application graph. Since existing nodes are original nodes in the application graph and newly added nodes are nodes that were not originally in the application graph, existing nodes can also be called in-graph nodes, and newly added nodes can also be called out-of-graph (OOG) nodes. Existing nodes in the application graph include nodes representing malicious applications and nodes representing non-malicious applications. Since there are differences in the application permissions and interface call behaviors of malicious applications and non-malicious applications, there are also differences in the connection relationship between nodes representing malicious applications and other nodes and the connection relationship between nodes representing non-malicious applications and other nodes.

[0083] After the terminal successfully installs the target application, the terminal adds a node representing the target application in the application map. For ease of description, the newly added node is called the first node. The first node is an OOG node representing the application. The terminal can determine whether the target application is a malicious application by analyzing the connection relationship between the first node and other nodes.

[0084] 302. The terminal determines multiple target neighbor nodes of the first node, where the target neighbor nodes are used to indicate that the target application has the application authority represented by the target neighbor node, or that the target application has executed the interface calling behavior represented by the target neighbor node.

[0085] In an embodiment of the present application, the terminal detects the target application and obtains at least one application permission and at least one interface call behavior of the target application. The terminal determines the nodes representing the above application permissions and the nodes representing the above interface call behaviors in the application map as multiple target neighbor nodes of the first node. Among them, since the first node can be directly connected to the target neighbor node, the target neighbor node can also be called the first-order neighbor node of the first node.

[0086] For example, when the terminal detects that the target application has storage permission, pop-up permission and application installation permission, the terminal determines the node representing storage permission, the node representing pop-up permission and the node representing application installation permission in the application graph as the target neighbor node of the first node.

[0087] In some embodiments, the terminal is able to connect the first node and the first-order neighbor node of the first node. The terminal determines at least one second node and at least one third node in the application map based on the application permissions of the target application and the interface call behavior performed by the target application. The second node is a node representing the above-mentioned application permissions, and the third node is a node representing the above-mentioned interface call behavior. In the application map, the terminal connects the first node with at least one second node and at least one third node respectively. Then, the terminal can determine at least one second node and at least one third node as multiple target neighbor nodes of the first node in the application map. By using at least one first-order neighbor node of the first node as the target neighbor node, there is no need to consider the second-order neighbor nodes and multi-order neighbor nodes of the first node. Furthermore, in the process of analyzing the connection relationship between the first node and the neighbor node and determining whether the target application is a malicious application, the number of sampled neighbor nodes can be reduced, the amount of calculation can be reduced, and the detection efficiency can be improved.

[0088] 303. For any target neighbor node, the terminal obtains an initial embedding vector of the target neighbor node, where the initial embedding vector is used to represent application permission features or interface call behavior features.

[0089] In an embodiment of the present application, after the terminal determines multiple target neighbor nodes of the first node, the terminal obtains the initial embedding vector of each target neighbor node. In the application graph, the initial embedding vector of the node can be an embedding vector obtained by processing the application graph through graph learning models such as GCN (Graph Convolutional Networks), GAT (Graph Attention Networks) and TransE (Translating Embedding, an embedding vector generation model), or it can be an embedding vector obtained by extracting features from the application graph. The embodiment of the present application does not limit this. Since the target neighbor node is a node representing application permissions or a node representing interface call behavior, the initial embedding vector of the target neighbor node obtained by the above method can represent application permission features or interface call behavior features.

[0090] 304. The terminal transforms the initial embedding vector of the target neighbor node based on the transformation parameter value of the target neighbor node to obtain the embedding vector of the target neighbor node. The transformation parameter value is related to the type of the target neighbor node. The embedding vector of the target neighbor node is used to represent the association feature between the first node and the target neighbor node.

[0091] In an embodiment of the present application, since the target neighbor node is a node representing application permissions or a node representing an interface call behavior, the terminal can determine the type of edge between the target neighbor node and the first node according to the type of the target neighbor node. In the case where the target neighbor node is a node representing application permissions, the edge between the target neighbor node and the first node indicates that the target application has the application permissions; in the case where the target neighbor node is a node representing an interface call behavior, the edge between the target neighbor node and the first node indicates that the target application has executed the interface call behavior. Therefore, the terminal can determine the transformation parameter value of the target neighbor node according to the type of the target neighbor node, or according to the type of the edge between the target neighbor node and the first node. The terminal transforms the initial embedding vector of the target neighbor node according to the transformation parameter value, so that the transformed embedding vector can represent the association feature between the first node and the target neighbor node. Among them, the association feature means that the target application represented by the first node has the application permissions represented by the target neighbor node, or executes the interface call behavior represented by the target neighbor node.

[0092] In some embodiments, the terminal can transform the initial embedding vector of the target neighbor node through a transformation function. When the type of the target neighbor node is the first type, the terminal obtains a first transformation parameter value. Among them, the node of the first type is a node representing application permissions. When the type of the target neighbor node is the second type, the terminal obtains a second transformation parameter value. Among them, the node of the second type is a node representing an interface call behavior. The terminal transforms the initial embedding vector of the target neighbor node through the first transformation function based on the first transformation parameter value or the second transformation parameter value, and can obtain the embedding vector of the target neighbor node. The embedding vector of the target neighbor node has the same dimension as the initial embedding vector. Among them, the first transformation function is used to transform the vector. The first transformation function includes multiple parameters. The terminal can determine two different sets of parameter values ​​for the above multiple parameters according to the type of the target neighbor node. Furthermore, in the process of transforming the initial embedding vector of the target neighbor node through the first transformation function, the terminal can select a set of parameter values ​​corresponding to the type of the above node for transformation.

[0093] Optionally, the above-mentioned vector transformation process can be implemented by a graph neural network model. The graph neural network model is used to transform the input vector. The graph neural network model includes a first transformation module, and the first transformation module provides a first transformation function. The terminal inputs the initial embedding vector of the target neighbor node into the first transformation module, and performs vector transformation through the first transformation function provided by the first transformation module to obtain the embedding vector of the target neighbor node. Among them, the first transformation module can provide different first transformation functions through different network layers. For example, the first transformation module may include at least one network layer of a linear layer, a one-dimensional convolution layer, a direct connection layer, and a gating layer. The vector can be linearly transformed through a linear layer; the vector can be nonlinearly transformed through a one-dimensional convolution layer; the vector can be identically transformed through a direct connection layer, and the vector can also be linearly transformed through a gating layer. Therefore, by performing vector transformation through any network layer in the first transformation module, the effect of using the corresponding first transformation function to transform the vector can be achieved.

[0094] It should be noted that the above embodiment is described by taking the graph neural network model including a first transformation module and performing a vector transformation on the initial embedding vector of the target neighbor node as an example. In some embodiments, the graph neural network model may include multiple first transformation modules connected in series. The terminal may input the embedding vector output by the first first transformation module into the second first transformation module, and continue to transform the embedding vector through the transformation function provided by the second first transformation module until the embedding vector output by the last first transformation module is obtained. Among them, the dimension of the embedding vector input to the first transformation module is the same as the dimension of the embedding vector output by the last first transformation module, that is, the dimension of the embedding vector is not changed by transforming the embedding vector through the first transformation module. By designing a model structure of a multi-layer first transformation module, the graph neural network model can include both a basic single-layer graph neural network structure and a richer graph learning model. Among them, the single-layer graph neural network structure means that when the graph neural network model includes N first transformation modules, the network layers of the first N-1 first transformation modules are all directly connected layers, and the network layer of the last first transformation module is a linear layer, a one-dimensional convolutional layer or a gated layer. That is, a single-layer graph neural network structure means that the input vector is first subjected to N-1 identity transformations, and then a linear transformation or a nonlinear transformation is performed on the transformed vector, where N is a positive integer. The above-mentioned richer graph learning model means that when the graph neural network model includes N first transformation modules, the input vector is subjected to at least two linear transformations or nonlinear transformations, thereby realizing vector transformation through a rich graph learning model.

[0095] 305. The terminal fuses the embedding vectors of multiple target neighbor nodes to obtain an embedding vector of a first node, where the embedding vector of the first node is used to represent at least one of an application permission feature and an interface call behavior feature of the target application program.

[0096] In an embodiment of the present application, the terminal transforms the initial embedding vector of each target neighbor node through the above steps 303-304. After obtaining the embedding vector of each target neighbor node, the terminal fuses the embedding vector of each target neighbor node in multiple target neighbor nodes to obtain the embedding vector of the first node. Among them, since the embedding vector of the target neighbor node can represent the association characteristics between the first node and the target neighbor node (the target application has the application permissions represented by the target neighbor node, or the target application executes the interface call behavior represented by the target neighbor node). Therefore, the fused embedding vector of the first node can represent at least one of the application permission characteristics and interface call behavior characteristics of the target application.

[0097] In some embodiments, the terminal can fuse the embedding vectors of multiple target neighbor nodes through a fusion function to obtain the embedding vector of the first node. The fusion function is used to fuse the vectors. The fusion function includes a sum function, an average function, a maximum function and a GAT attention mechanism function. For example, when the fusion function is a sum function, the terminal adds the elements of the embedding vectors of multiple target neighbor nodes in the corresponding dimension in each dimension by taking the sum function to obtain the elements of the embedding vector of the first node in each dimension. When the fusion function is an average function, the terminal averages the elements of the embedding vectors of multiple target neighbor nodes in the corresponding dimension by taking the average function to obtain the elements of the embedding vector of the first node in each dimension. When the fusion function is a maximum function, in each dimension, the terminal uses the element with the largest value of the embedding vectors of multiple target neighbor nodes in the corresponding dimension as the element of the embedding vector of the first node in the dimension. When the fusion function is an attention mechanism function, the terminal adds the embedding vectors of multiple target neighbor nodes by taking the sum function according to the weight of each target neighbor node to obtain the embedding vector of the first node. The weight of the target neighbor node may be a weight preset by the terminal or a weight input by a user, which is not limited in this embodiment of the present application.

[0098] Optionally, the above-mentioned process of vector fusion through a fusion function can also be implemented through a graph neural network model. Accordingly, the graph neural network model is also used to fuse multiple input vectors. The graph neural network model also includes a fusion module, which provides at least one of the above-mentioned multiple fusion functions. The terminal inputs the embedding vectors of multiple target neighbor nodes into the fusion module, performs vector fusion through any fusion function provided by the fusion module, and obtains the embedding vector of the first node.

[0099] In some embodiments, the terminal is capable of updating the embedding vector of the first node. The terminal extracts features of at least one of the application permissions and the interface call behavior executed by the target application to obtain the original feature vector of the first node. The terminal transforms the original feature vector of the first node through the second transformation function based on the preset transformation parameter value to obtain the initial embedding vector of the first node. Among them, the second transformation function is used to transform the vector, and the second transformation function includes multiple parameters. The preset parameter value can be a set of parameter values ​​preset by the terminal for the above multiple parameters, or a set of parameter values ​​input by the user, which is not limited in the embodiment of the present application. The terminal fuses the initial embedding vector of the first node and the embedding vector of the first node obtained in step 305 to obtain the updated embedding vector of the first node. By updating the embedding vector of the first node according to the original feature vector of the first node, the updated embedding vector can be more expressive and can better express the application permission characteristics or interface call behavior characteristics of the target application.

[0100] Optionally, the above-mentioned process of transforming the original feature vector of the first node can also be implemented through a graph neural network model. The graph neural network model also includes a second transformation module, and the second transformation module provides a second transformation function. The terminal inputs the original feature vector of the first node into the second transformation module, and performs vector transformation through the second transformation function provided by the second transformation module to obtain the initial embedding vector of the first node. Among them, the second transformation module can provide different second transformation functions through different network layers. For example, the second transformation module can also include at least one network layer selected from a linear layer, a one-dimensional convolutional layer, a direct connection layer, and a gated layer. Among them, the vector transformation effect of the above-mentioned network layer is the same as the vector transformation effect of the corresponding network layer in the first transformation module, which will not be repeated here. Furthermore, by performing vector transformation through any network layer in the second transformation module, the effect of vector transformation using the corresponding second transformation function can be achieved.

[0101] It should be noted that the above embodiment is described by taking the example that the graph neural network model includes a second transformation module and performs a vector transformation on the original feature vector of the first node. In some embodiments, the graph neural network model may include multiple second transformation modules connected in series, and the embodiments of the present application do not limit this.

[0102] 306. The terminal classifies the first node based on the embedding vector of the first node to obtain a classification result of the first node, where the classification result is used to indicate whether the target application is a malicious application.

[0103] In an embodiment of the present application, since the application permission characteristics or interface call behavior characteristics of malicious applications and non-malicious applications are different, the terminal can classify the first node through a linear classifier according to the embedding vector of the first node to obtain a classification result of the first node. The terminal can determine whether the target application represented by the first node is a malicious application based on the classification result. When the application permission characteristics of the target application represented by the embedding vector of the first node are similar to the application permission characteristics of the malicious application, or the interface call behavior characteristics of the target application represented by the embedding vector of the first node are similar to the interface call behavior characteristics of the malicious application, the target application can be considered to be a malicious application. Therefore, the terminal can delete, uninstall or add the malicious application to the mobile phone blacklist to prevent the malicious application from performing repackaging attacks, privilege escalation attacks or other attack behaviors, thereby protecting the privacy and property safety of users.

[0104] In order to more clearly illustrate the process of generating the embedding vector of the first node through the graph neural network model, the following is combined with Figure 4 The schematic diagram of the graph neural network model shown in Figure 1 illustrates the above process. Figure 4 As shown, the graph neural network model includes three first transformation modules connected in series, a second transformation module and a fusion module. When the terminal obtains the original feature vector of the first node, the terminal can input the original feature vector of the first node into the second transformation module, and input the initial embedding vectors of multiple target neighbor nodes of the first node into the first transformation module. Then, the terminal transforms the input initial embedding vector through the first transformation function provided by the first transformation module to obtain the embedding vector of each target neighbor node; and transforms the input original feature vector through the second transformation function provided by the second transformation module to obtain the initial embedding vector of the first node. Among them, the above-mentioned process of vector transformation through the first transformation module and through the second transformation module can be processed in parallel to improve the processing speed of the graph neural network model. Then, the terminal fuses the embedding vectors of multiple neighbor nodes through the fusion module to obtain the embedding vector of the first node. Then, the terminal adds the initial embedding vector of the first node output by the second transformation module and the embedding vector of the first node output by the fusion module to obtain the updated embedding vector of the first node. It should be noted that in some embodiments, the terminal does not need to obtain the original feature vector of the first node, and the terminal can determine the embedding vector output by the fusion module as the embedding vector of the first node.

[0105] In the above-mentioned graph neural network model, the first transformation module provides multiple candidate transformation functions. In the process of training the graph neural network model, the terminal can select any one of the multiple candidate transformation functions as the first transformation function provided by the first transformation module. Similarly, the second transformation module also provides multiple candidate transformation functions, and the fusion module also provides multiple candidate fusion functions. The following describes the process of the terminal determining the first transformation function, the second transformation function and the fusion function in the process of training the graph neural network model.

[0106] (1) The terminal determines the transformation function provided by the first transformation module. The terminal obtains multiple candidate transformation functions and the weight of each candidate transformation function. The weight of the candidate transformation function may be a weight preset by the terminal or a weight input by the user, which is not limited in the embodiment of the present application. The weight of each candidate transformation function may be the same or different. The terminal transforms the initial embedding vector of the first sample node through each candidate transformation function based on the transformation parameter value of the first sample node to obtain the embedding vector output by each candidate transformation function. The first sample node is a node of the first type or a node of the second type in the application graph. The transformation parameter value is related to the type of the first sample node. The terminal performs weighted summation on the embedding vector output by each candidate transformation function based on the weight of each candidate transformation function to obtain the embedding vector of the first sample node. The terminal adjusts the weight of each candidate transformation function based on the embedding vector of the first sample node until the embedding vector of the first sample node meets the condition for ending the adjustment. The condition for ending the adjustment may be that the application permission feature or the interface call behavior feature of the first sample node can be determined based on the embedding vector of the first sample node. The terminal determines the candidate transformation function with the highest weight as the first transformation function.

[0107] (2) The terminal determines the transformation function provided by the second transformation module. The terminal obtains multiple candidate transformation functions and the weight of each candidate transformation function. Based on the preset transformation parameter value in the above step 305, the terminal transforms the original feature vector of the second sample node through each candidate transformation function to obtain the embedding vector output by each candidate transformation function. Among them, the second sample node is a node representing an application in the application graph. Based on the weight of each candidate transformation function, the terminal performs weighted summation on the embedding vector output by each candidate transformation function to obtain the initial embedding vector of the second sample node. Based on the initial embedding vector of the second sample node, the terminal adjusts the weight of each candidate transformation function until the initial embedding vector of the second sample node meets the condition for ending the adjustment. Among them, the condition for ending the adjustment can be that according to the initial embedding vector of the second sample node, the application permission characteristics or interface call behavior characteristics of the application corresponding to the second sample node can be determined. The terminal determines the candidate transformation function with the highest weight as the second transformation function.

[0108] (3) The terminal determines the fusion function provided by the fusion module. The terminal obtains multiple candidate fusion functions and the weight of each candidate fusion function. The terminal fuses the embedding vectors of multiple third sample nodes through each candidate fusion function to obtain the embedding vector output by each candidate fusion function. The third sample node is a node representing application permissions or a node representing interface call behavior in the application graph. The terminal performs weighted summation on the embedding vectors output by each candidate fusion function according to the weight of each candidate fusion function to obtain the embedding vector of the fourth sample node. The fourth sample node is a node representing an application in the application graph, and the third sample node is a neighbor node of the fourth sample node. The terminal adjusts the weight of each candidate fusion function based on the embedding vector of the fourth sample node until the embedding vector of the fourth sample node meets the condition for ending the adjustment. The condition for ending the adjustment may be that the embedding vector of the fourth sample node can represent the application permission characteristics or interface call behavior characteristics of the above-mentioned application. The terminal determines the candidate fusion function with the highest weight as the fusion function.

[0109] For example, Figure 5 is a schematic diagram of a fusion module. Figure 5 As shown, the fusion module provides 4 fusion functions. The terminal performs weighted summation on the embedding vectors output by each candidate fusion function according to the weight of each candidate fusion function. Then, based on the result of the weighted summation, the terminal adjusts the weight of each fusion function until the condition for ending the adjustment is met. Then, the terminal determines the fusion function 3 with the largest weight as the fusion function provided by the fusion module.

[0110] In some embodiments, the terminal can determine the weight of the candidate function through preset structural parameters. For any module in the above-mentioned graph neural network model, the terminal can preset a structural parameter for each candidate function provided by the module. Then, the terminal processes the structural parameter through the Softmax (normalized exponential) function to obtain the weight of each candidate function. The terminal performs weighted summation on the output of each candidate function according to the weight of each candidate function, obtains the output of the module, and completes the continuity relaxation calculation.

[0111] In some embodiments, the terminal combines multiple candidate transformation functions provided by the first transformation module, multiple candidate transformation functions provided by the second transformation module, and multiple candidate fusion functions provided by the fusion module to form a search space for the entire graph neural network model. Among them, the search space includes a combination of multiple candidate transformation functions and fusion functions. For example, the first transformation module provides candidate transformation function 1 and candidate transformation function 2; the second transformation module provides candidate transformation function 3 and candidate transformation function 4; the fusion module provides fusion function 1, fusion function 2, fusion function 3 and fusion function 4. The entire search space includes 2*2*4=16 possible combinations: candidate transformation function 1-candidate transformation function 3-fusion function 1, candidate transformation function 1-candidate transformation function 3-fusion function 2, candidate transformation function 1-candidate transformation function 4-fusion function 1, candidate transformation function 1-candidate transformation function 4-fusion function 2... and other 16 combinations. Then, the terminal can perform the above-mentioned continuity relaxation calculation in the search space according to the determined weights of each transformation function and the weight of the fusion function.

[0112] In some embodiments, after the terminal completes the continuity relaxation calculation, the terminal can obtain continuous structural parameters. Then, the terminal iteratively updates the structural parameters and the model parameters of the graph neural network model through the back propagation algorithm based on the results of the continuity relaxation calculation to achieve tuning of the structural parameters and the model parameters. When the result of the continuity relaxation calculation meets the conditions for ending the tuning, the terminal calculates the obtained structural parameters through the Softmax function to obtain the weight of each candidate function. Among them, the condition for ending the tuning can be that the output result of the graph neural network model converges. Then, according to the weight of each candidate function, the terminal uses the candidate function with the largest weight in each module as the function provided by each module to obtain the function provided by each module in the graph neural network model. Among them, in the process of iteratively updating the structural parameters of the terminal, the terminal can approximate the optimization of the structural parameters, avoid the large amount of calculation caused by the second-order derivative, and improve the calculation speed and the training efficiency of the graph neural network model.

[0113] It should be noted that the above steps (1)-(3) are described by taking the terminal training the graph neural network model as an example. In some embodiments, the graph neural network model can also be trained by the server, and the embodiments of the present application do not limit this.

[0114] Figure 6 A schematic diagram of the detection effect of a malicious application. Figure 6As shown, compared with other baseline models (GAT, GraphSAGE, MEAN and ConvL), the malicious application detection solution (S2E) provided by the embodiment of the present application has a stable and significant improvement in effect. When using different data sets (ACM, IMDB and MobAPP) and different encoders (RGCN, GAT, TransE), the solution provided by the embodiment of the present application has a high accuracy (Accuracy) and a high F1 (Macro-F1) evaluation index (an indicator for measuring the accuracy of a binary classification model), and has a stable and excellent effect.

[0115] Figure 7 is a schematic diagram of detection time. Figure 7 As shown, in terms of detection time, compared with other baseline models, the solution (S2E) provided in the embodiment of the present application can obtain detection results with higher accuracy while consuming less detection time. Especially in the graph MobAPP constructed using APP and related information, the solution provided in the embodiment of the present application achieved better results than the baseline model, reflecting that the graph neural network model provided in the embodiment of the present application can be better applied in the scenario of malicious application detection.

[0116] The embodiment of the present application provides a method for detecting malicious applications, because the application permissions or interface call behaviors of malicious applications are somewhat different from those of non-malicious applications. Therefore, the terminal can determine the connection relationship between the first node representing the application and other nodes in the application map based on the application permissions and interface call behaviors of the application to be detected. Furthermore, the terminal can convert the problem of malicious application detection into a node classification problem. The terminal fuses the embedding vectors of multiple neighboring nodes of the first node according to the connection relationship between the nodes indicated by the application map, and obtains an embedding vector that can reflect the application permission characteristics or interface call behavior characteristics of the application. The terminal classifies the first node according to the embedding vector with stronger expression ability, and can determine the classification result more accurately, and determine whether the application is a malicious application based on the classification result. The above method takes into account the application permission characteristics and interface call behavior characteristics of the application, and improves the accuracy of malicious application detection.

[0117] All the above optional technical solutions can be arbitrarily combined to form optional embodiments of the present application, which will not be described one by one here.

[0118] The following are device embodiments of the present application, which can be used to execute the method embodiments of the present application. For details not disclosed in the device embodiments of the present application, please refer to the method embodiments of the present application.

[0119] Figure 8is a schematic diagram of the structure of a malicious application detection device provided in an embodiment of the present application. Figure 8 The device includes: an adding module 801, a determining module 802, a fusion module 803 and a classification module 804.

[0120] An adding module 801 is used to add a first node in the application map when the target application is installed, the first node is used to represent the target application, the nodes in the application map respectively represent the application, the application permission and the interface call behavior, and the edges in the application map respectively represent that the application has the application permission and the application has executed the interface call behavior;

[0121] A determination module 802 is used to determine a plurality of target neighbor nodes of the first node, where the target neighbor nodes are used to indicate that the target application has the application authority represented by the target neighbor node, or that the target application has executed the interface call behavior represented by the target neighbor node;

[0122] A fusion module 803 is used to fuse the embedding vectors of multiple target neighbor nodes to obtain an embedding vector of a first node, where the embedding vector of the first node is used to represent at least one of an application permission feature and an interface call behavior feature of the target application program;

[0123] The classification module 804 is used to classify the first node based on the embedding vector of the first node to obtain a classification result of the first node, and the classification result is used to indicate whether the target application is a malicious application.

[0124] In some embodiments, Fig. 9 is a schematic diagram of the structure of another malicious application detection device provided in an embodiment of the present application, see Fig. 9 , the fusion module 803 includes:

[0125] The acquisition unit 8031 ​​is used to acquire, for any target neighbor node, an initial embedding vector of the target neighbor node, where the initial embedding vector is used to represent application permission features or interface call behavior features;

[0126] A transformation unit 8032 is used to transform the initial embedding vector of the target neighbor node based on the transformation parameter value of the target neighbor node to obtain the embedding vector of the target neighbor node, where the transformation parameter value is related to the type of the target neighbor node, and the embedding vector of the target neighbor node is used to represent the association feature between the first node and the target neighbor node;

[0127] The fusion unit 8033 is used to fuse the embedding vectors of multiple target neighbor nodes to obtain the embedding vector of the first node.

[0128] In some embodiments, the transformation unit 8032 is used to obtain a first transformation parameter value when the type of the target neighbor node is a first type, and the node of the first type is a node representing application permissions; when the type of the target neighbor node is a second type, obtain a second transformation parameter value, and the node of the second type is a node representing interface call behavior; based on the first transformation parameter value or the second transformation parameter value, the initial embedding vector of the target neighbor node is transformed by a first transformation function to obtain the embedding vector of the target neighbor node, and the first transformation function is used to transform the vector.

[0129] In some embodiments, the apparatus further comprises:

[0130] An acquisition module 805 is used to acquire multiple candidate transformation functions and the weight of each candidate transformation function;

[0131] a transformation module 806, configured to transform the initial embedding vector of the first sample node through each candidate transformation function based on the transformation parameter value of the first sample node to obtain the embedding vector output by each candidate transformation function, wherein the first sample node is a node of the first type or a node of the second type in the application graph, and the transformation parameter value is related to the type of the first sample node;

[0132] A weighted summation module 807 is used to perform weighted summation on the embedding vectors output by each candidate transformation function based on the weight of each candidate transformation function to obtain the embedding vector of the first sample node;

[0133] A weight adjustment module 808, configured to adjust the weight of each candidate transformation function based on the embedding vector of the first sample node until the embedding vector of the first sample node satisfies a condition for ending the adjustment;

[0134] The function determination module 809 is configured to determine the candidate transformation function with the highest weight as the first transformation function.

[0135] In some embodiments, the apparatus further comprises:

[0136] A feature extraction module 810 is used to extract features of at least one of the application permissions and the interface call behaviors executed by the target application program to obtain an original feature vector of the first node;

[0137] A transformation module 806, configured to transform the original feature vector of the first node by a second transformation function based on a preset transformation parameter value to obtain an initial embedding vector of the first node, wherein the second transformation function is used to transform the vector;

[0138] The fusion module 803 is used to fuse the initial embedding vector of the first node and the embedding vector of the first node to obtain an updated embedding vector of the first node.

[0139] In some embodiments, the acquisition module 805 is used to acquire multiple candidate transformation functions and the weight of each candidate transformation function;

[0140] A transformation module 806, configured to transform the original feature vector of the second sample node through each candidate transformation function based on a preset transformation parameter value to obtain an embedding vector output by each candidate transformation function, wherein the second sample node is a node representing an application in the application graph;

[0141] A weighted summation module 807 is used to perform weighted summation on the embedding vector output by each candidate transformation function based on the weight of each candidate transformation function to obtain an initial embedding vector of the second sample node;

[0142] A weight adjustment module 808, configured to adjust the weight of each candidate transformation function based on the initial embedding vector of the second sample node until the initial embedding vector of the second sample node satisfies a condition for ending the adjustment;

[0143] The function determination module 809 is configured to determine the candidate transformation function with the highest weight as the second transformation function.

[0144] In some embodiments, the fusion unit 8033 is used to fuse the embedding vectors of multiple target neighbor nodes through a fusion function to obtain the embedding vector of the first node, and the fusion function is used to fuse the vectors.

[0145] In some embodiments, the acquisition module 805 is used to acquire multiple candidate fusion functions and the weight of each candidate fusion function;

[0146] A transformation module 806 is used to fuse the embedding vectors of multiple third sample nodes through each candidate fusion function to obtain the embedding vector output by each candidate fusion function, where the third sample node is a node representing application permissions or a node representing interface call behavior in the application graph;

[0147] A weighted summation module 807 is used to perform weighted summation on the embedding vectors output by each candidate fusion function based on the weight of each candidate fusion function to obtain the embedding vector of the fourth sample node, where the fourth sample node is a node representing an application in the application graph, and the third sample node is a neighbor node of the fourth sample node;

[0148] A weight adjustment module 808, configured to adjust the weight of each candidate fusion function based on the embedding vector of the fourth sample node until the embedding vector of the fourth sample node satisfies a condition for ending the adjustment;

[0149] The function determination module 809 is used to determine the candidate fusion function with the highest weight as the fusion function.

[0150] In some embodiments, the adding module 801 is used to determine at least one second node and at least one third node in the application map based on the application permissions of the target application and the interface call behavior performed by the target application, the second node is a node representing the application permissions, and the third node is a node representing the interface call behavior; in the application map, the first node is connected to the at least one second node and the at least one third node respectively;

[0151] The determination module 802 is used to determine at least one second node and at least one third node as multiple target neighbor nodes of the first node in the application graph.

[0152] The embodiment of the present application provides a malicious application detection device. Since the application permissions or interface call behaviors of malicious applications are somewhat different from those of non-malicious applications. Therefore, the terminal can determine the connection relationship between the first node representing the application and other nodes in the application map according to the application permissions and interface call behaviors of the application to be detected. Furthermore, the terminal can convert the problem of malicious application detection into a node classification problem. The terminal fuses the embedding vectors of multiple neighboring nodes of the first node according to the connection relationship between the nodes indicated by the application map, and obtains an embedding vector that can reflect the application permission characteristics or interface call behavior characteristics of the application. The terminal classifies the first node according to the embedding vector with stronger expression ability, and can more accurately determine the classification result, and determine whether the application is a malicious application according to the classification result. The above method takes into account the application permission characteristics and interface call behavior characteristics of the application, and improves the accuracy of malicious application detection.

[0153] It should be noted that the malicious application detection device provided in the above embodiment, when implementing its functions, only uses the division of the above functional modules as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the terminal is divided into different functional modules to complete all or part of the functions described above. In addition, the malicious application detection device provided in the above embodiment and the malicious application detection method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0154] An embodiment of the present application provides a terminal, which includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the malicious application detection method provided in the above-mentioned various method embodiments.

[0155] Fig.101000 is a block diagram of a terminal provided in an embodiment of the present application. In some embodiments, the terminal 1000 is a terminal such as a smart phone, a tablet computer, a wearable device, etc. that can access a wireless local area network as a wireless station. The terminal 1000 in the present application includes at least one or more of the following components: a processor 1010, a memory 1020, and at least two wireless links 1030.

[0156] In some embodiments, the processor 1010 includes one or more processing cores. The processor 1010 uses various interfaces and lines to connect various parts of the entire terminal 1000, and executes various functions and processes data of the terminal 1000 by running or executing program codes stored in the memory 1020, and calling data stored in the memory 1020. In some embodiments, the processor 1010 is implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 1010 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), a neural network processor (NPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the NPU is used to implement artificial intelligence (AI) functions; and the modem is used to process wireless communications. It is understandable that the above-mentioned modem may not be integrated into the processor 1010, but may be implemented by a separate chip.

[0157] In some embodiments, the processor 1010 is used to control the working conditions of at least two wireless links 1030. Accordingly, the processor 1010 is a processor integrated with a wireless fidelity (Wireless Fidelity, Wi-Fi) chip. The Wi-Fi chip is a chip with dual Wi-Fi processing capabilities. For example, the Wi-Fi chip is a dual-band dual concurrent (Dual Band Dual Concurrent, DBDC) chip, or a dual-band synchronous (Dual Band Simultaneous, DBS) chip, etc.

[0158] In some embodiments, the memory 1020 includes a random access memory (RAM), and in some embodiments, the memory 1020 includes a read-only memory (ROM). In some embodiments, the memory 1020 includes a non-transitory computer-readable storage medium. The memory 1020 can be used to store program codes. The memory 1020 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, instructions for implementing the following various method embodiments, etc.; the data storage area may store data created according to the use of the terminal 1000.

[0159] In some embodiments, the memory 1020 stores reception schemes for receiving beacon frames of different wireless links 1030, as well as identifiers of access nodes connected to different wireless links 1030, identifiers of wireless links 1030, and the like.

[0160] The at least two wireless links 1030 are used to connect different access points (APs) to receive downlink data sent by the APs, wherein the different access points are access points in the same router or access points in different routers.

[0161] In some embodiments, the terminal 1000 also includes a display screen. The display screen is a display component for displaying a user interface. In some embodiments, the display screen is a display screen with a touch function, through which the user can use any suitable object such as a finger or a touch pen to perform touch operations on the display screen. In some embodiments, the display screen is generally arranged on the front panel of the terminal 1000. In some embodiments, the display screen is designed to be a full screen, a curved screen, a special-shaped screen, a double-sided screen or a folding screen. In some embodiments, the display screen is also designed to be a combination of a full screen and a curved screen, a combination of a special-shaped screen and a curved screen, etc., which is not limited in this embodiment.

[0162] In addition, those skilled in the art will appreciate that the structure of the terminal 1000 shown in the above drawings does not limit the terminal 1000, and the terminal 1000 includes more or fewer components than shown in the drawings, or combines certain components, or arranges components differently. For example, the terminal 1000 also includes components such as a microphone, a speaker, an input unit, a sensor, an audio circuit, a module, a power supply, and a Bluetooth module, which will not be described in detail here.

[0163] The present application also provides a computer-readable storage medium, which stores at least one program code, and the at least one program code is loaded and executed by the processor to implement the malicious application detection method shown in the above embodiments.

[0164] The present application also provides a chip, which includes a programmable logic circuit and / or program instructions. When the chip runs on a terminal, it is used to implement the malicious application detection method shown in the above embodiments.

[0165] The present application also provides a computer program product, which stores at least one program code, and the at least one program code is used to be executed by a processor to implement the malicious application detection method shown in the above embodiments.

[0166] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0167] Those skilled in the art will appreciate that all or part of the steps in the malicious application detection method of the above embodiment can be completed by hardware, or by a program to instruct the relevant hardware to complete the steps, and the program can be stored in a computer-readable storage medium, and the storage medium mentioned above can be a read-only memory, a disk or an optical disk, etc. The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting malicious applications, characterized in that: Applied to a terminal, the method comprises: When the target application is installed, a first node is added to the application graph, the first node is used to represent the target application, the nodes in the application graph represent the application, the application permission and the interface call behavior respectively, and the edges in the application graph represent that the application has the application permission and the application has executed the interface call behavior respectively; Determine a plurality of target neighbor nodes of the first node, wherein the target neighbor nodes are used to indicate that the target application has the application authority represented by the target neighbor nodes, or that the target application has executed the interface call behavior represented by the target neighbor nodes; fusing the embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, where the embedding vector of the first node is used to represent at least one of an application permission feature and an interface call behavior feature of the target application program; Based on the embedding vector of the first node, the first node is classified to obtain a classification result of the first node, and the classification result is used to indicate whether the target application is a malicious application.

2. The method according to claim 1, characterized in that The fusing the embedding vectors of the plurality of target neighbor nodes to obtain the embedding vector of the first node includes: For any target neighbor node, obtaining an initial embedding vector of the target neighbor node, where the initial embedding vector is used to represent application permission features or interface call behavior features; Based on the transformation parameter value of the target neighbor node, transform the initial embedding vector of the target neighbor node to obtain the embedding vector of the target neighbor node, wherein the transformation parameter value is related to the type of the target neighbor node, and the embedding vector of the target neighbor node is used to represent the association feature between the first node and the target neighbor node; The embedding vectors of the multiple target neighbor nodes are fused to obtain the embedding vector of the first node.

3. The method according to claim 2, characterized in that The step of transforming the initial embedding vector of the target neighbor node based on the transformation parameter value of the target neighbor node to obtain the embedding vector of the target neighbor node includes: In a case where the type of the target neighbor node is a first type, obtaining a first transformation parameter value, wherein the first type of node is a node representing application authority; In the case where the type of the target neighbor node is a second type, obtaining a second transformation parameter value, wherein the second type of node is a node representing an interface call behavior; Based on the first transformation parameter value or the second transformation parameter value, the initial embedding vector of the target neighbor node is transformed by a first transformation function to obtain the embedding vector of the target neighbor node, and the first transformation function is used to transform the vector.

4. The method according to claim 3, characterized in that The method further comprises: Obtaining multiple candidate transformation functions and a weight of each candidate transformation function; Based on a transformation parameter value of a first sample node, transforming an initial embedding vector of the first sample node through each candidate transformation function to obtain an embedding vector output by each candidate transformation function, wherein the first sample node is a node of the first type or a node of the second type in the application graph, and the transformation parameter value is related to the type of the first sample node; Based on the weight of each candidate transformation function, weighted sum is performed on the embedding vectors output by each candidate transformation function to obtain the embedding vector of the first sample node; Based on the embedding vector of the first sample node, adjusting the weight of each candidate transformation function until the embedding vector of the first sample node satisfies a condition for ending the adjustment; The candidate transformation function with the highest weight is determined as the first transformation function.

5. The method according to claim 2, characterized in that: The method further comprises: Extracting features of at least one of the application permissions and the interface calling behaviors executed by the target application to obtain an original feature vector of the first node; Based on a preset transformation parameter value, transforming the original feature vector of the first node by a second transformation function to obtain an initial embedding vector of the first node, wherein the second transformation function is used to transform the vector; An initial embedding vector of the first node and an embedding vector of the first node are fused to obtain an updated embedding vector of the first node.

6. The method according to claim 5, characterized in that The method further comprises: Obtaining multiple candidate transformation functions and a weight of each candidate transformation function; Based on the preset transformation parameter value, transforming the original feature vector of the second sample node by each candidate transformation function to obtain an embedding vector output by each candidate transformation function, wherein the second sample node is a node representing an application in the application graph; Based on the weight of each candidate transformation function, weighted sum is performed on the embedding vectors output by each candidate transformation function to obtain an initial embedding vector of the second sample node; Based on the initial embedding vector of the second sample node, adjusting the weight of each candidate transformation function until the initial embedding vector of the second sample node meets a condition for ending the adjustment; The candidate transformation function with the highest weight is determined as the second transformation function.

7. The method according to claim 2, characterized in that The fusing the embedding vectors of the plurality of target neighbor nodes to obtain the embedding vector of the first node includes: The embedding vectors of the multiple target neighbor nodes are fused through a fusion function to obtain the embedding vector of the first node, and the fusion function is used to fuse the vectors.

8. The method according to claim 7, characterized in that The method further comprises: Obtain multiple candidate fusion functions and the weight of each candidate fusion function; By means of each candidate fusion function, the embedding vectors of a plurality of third sample nodes are fused to obtain an embedding vector output by each candidate fusion function, wherein the third sample node is a node representing application permissions or a node representing interface call behavior in the application graph; Based on the weight of each candidate fusion function, weighted sum is performed on the embedding vectors output by each candidate fusion function to obtain the embedding vector of the fourth sample node, where the fourth sample node is a node representing an application in the application graph, and the third sample node is a neighbor node of the fourth sample node; Based on the embedding vector of the fourth sample node, adjusting the weight of each candidate fusion function until the embedding vector of the fourth sample node meets a condition for ending the adjustment; The candidate fusion function with the highest weight is determined as the fusion function.

9. The method according to claim 1, characterized in that: The adding of the first node in the application graph includes: Based on the application permissions of the target application and the interface calling behavior executed by the target application, determining at least one second node and at least one third node in the application graph, wherein the second node is a node representing the application permissions, and the third node is a node representing the interface calling behavior; In the application graph, connecting the first node to the at least one second node and the at least one third node respectively; The determining a plurality of target neighbor nodes of the first node includes: In the application map, the at least one second node and the at least one third node are determined as multiple target neighbor nodes of the first node.

10. A malicious application detection device, characterized in that: The device comprises: An adding module, used for adding a first node in an application graph when the target application is installed, the first node being used to represent the target application, the nodes in the application graph respectively representing an application, an application permission and an interface calling behavior, and the edges in the application graph respectively representing that the application has the application permission and that the application has executed the interface calling behavior; A determination module, used to determine a plurality of target neighbor nodes of the first node, wherein the target neighbor nodes are used to indicate that the target application has the application authority represented by the target neighbor node, or that the target application has executed the interface call behavior represented by the target neighbor node; a fusion module, configured to fuse the embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, wherein the embedding vector of the first node is used to represent at least one of an application permission feature and an interface call behavior feature of the target application program; A classification module is used to classify the first node based on the embedding vector of the first node to obtain a classification result of the first node, wherein the classification result is used to indicate whether the target application is a malicious application.

11. A terminal, characterized in that: The terminal includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the malicious application detection method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the malicious application detection method as described in any one of claims 1 to 9.

13. A chip, characterized in that: The chip includes a programmable logic circuit and / or program instructions, and when the chip runs on the terminal, it is used to implement the malicious application detection method as described in any one of claims 1 to 9.

14. A computer program product comprising a computer program, characterized in that The computer program product stores at least one program code, and the at least one program code is used to be executed by a processor to implement the malicious application detection method according to any one of claims 1 to 9.

Images