Malicious application detection method, device, terminal and storage medium

Abstract

The application provides a malicious application detection method and device, a terminal and a storage medium, and belongs to the technical field of computers. The terminal determines the connection relationship between the first node representing the application program and other nodes in the application program graph according to the application permission and interface calling behavior of the application program to be detected. Further, the terminal can convert the problem of malicious application detection into a node classification problem. The terminal fuses the embedding vectors of the plurality of neighbor nodes of the first node to obtain an embedding vector capable of reflecting the application permission feature or the interface calling behavior feature of the application program. The terminal classifies the first node according to the embedding vector with stronger expression capability, and can accurately determine whether the application program is a malicious application program according to the classification result. The above method takes into account the application permission feature and the interface calling behavior feature of the application program, and improves the accuracy of malicious application program detection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, terminal, and storage medium for detecting malicious applications. Background Art

[0002] With the advancement of computer technology, various types of devices, such as mobile phones, desktop computers, laptops, and tablets, have become an integral part of people's daily lives. However, malicious applications on these devices pose a threat to users' privacy and property security. Therefore, to ensure the privacy and property security of users, detecting whether an application is malicious after it has been installed on a device is a technical problem that needs to be addressed.

[0003] In related technologies, for an application to be detected, a terminal can detect whether the application is malicious by analyzing the APIs (Application Programming Interfaces) called by the application. For example, the terminal obtains an API list that includes APIs that are frequently called by malicious applications. The terminal then analyzes the APIs called by the application based on the API list. If multiple APIs frequently called by the application are included in the API list, the application can be considered malicious.

[0004] However, the above method, which detects malicious applications based solely on the APIs they call, has certain limitations. For example, the API list may include APIs that are called by both malicious and non-malicious applications. If an API called by a non-malicious application is also on the API list, the non-malicious application may be mistakenly reported as malicious. Therefore, the accuracy of detecting malicious applications using the above method is low. Summary of the Invention

[0005] The embodiments of the present application provide a method, device, terminal, and storage medium for detecting malicious applications, which can improve the accuracy of malicious application detection. The technical solution is as follows:

[0006] According to one aspect of an embodiment of the present application, a method for detecting malicious applications is provided, the method comprising:

[0007] When the target application is installed, a first node is added to the application graph, where the first node represents the target application. The nodes in the application graph represent the application, application permissions, and interface call behaviors, respectively. The edges in the application graph represent that the application has application permissions and that the application has executed an interface call behavior, respectively.

[0008] determine a plurality of target neighbor nodes of the first node, the target neighbor nodes being used to indicate that the target application program has an application permission represented by the target neighbor nodes or that the target application program performs an interface calling behavior represented by the target neighbor nodes;

[0009] fuse embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, the embedding vector of the first node being used to represent at least one of an application permission feature and an interface calling behavior feature of the target application program;

[0010] classify the first node based on the embedding vector of the first node to obtain a classification result of the first node, the classification result being used to indicate whether the target application program is a malicious application program.

[0011] According to another aspect of the embodiments of the present application, a malicious application program detection device is provided, and the device comprises:

[0012] add a first node in an application program graph in a case where a target application program is installed, the first node being used to represent the target application program, nodes in the application program graph representing application programs, application permissions and interface calling behaviors respectively, and edges in the application program graph representing that an application program has an application permission and that an application program performs an interface calling behavior;

[0013] determine a plurality of target neighbor nodes of the first node, the target neighbor nodes being used to indicate that the target application program has an application permission represented by the target neighbor nodes or that the target application program performs an interface calling behavior represented by the target neighbor nodes;

[0014] fuse embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, the embedding vector of the first node being used to represent at least one of an application permission feature and an interface calling behavior feature of the target application program;

[0015] classify the first node based on the embedding vector of the first node to obtain a classification result of the first node, the classification result being used to indicate whether the target application program is a malicious application program.

[0016] In some embodiments, the fusion module comprises:

[0017] The acquisition unit is configured to acquire, for any target neighbor node, an initial embedding vector of the target neighbor node, the initial embedding vector being used to represent an application permission feature or an interface call behavior feature.

[0018] The transformation unit is configured to transform the initial embedding vector of the target neighbor node based on a transformation parameter value of the target neighbor node to obtain an embedding vector of the target neighbor node, the transformation parameter value being related to a type of the target neighbor node, and the embedding vector of the target neighbor node being used to represent an association feature between the first node and the target neighbor node.

[0019] The fusion unit is configured to fuse the embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node.

[0020] In some embodiments, the transformation unit is configured to acquire a first transformation parameter value in a case where the type of the target neighbor node is a first type, the node of the first type being a node representing an application permission; acquire a second transformation parameter value in a case where the type of the target neighbor node is a second type, the node of the second type being a node representing an interface call behavior; and transform the initial embedding vector of the target neighbor node by a first transformation function based on the first transformation parameter value or the second transformation parameter value to obtain the embedding vector of the target neighbor node, the first transformation function being used to transform a vector.

[0021] In some embodiments, the apparatus further includes:

[0022] The acquisition module is configured to acquire a plurality of candidate transformation functions and a weight of each candidate transformation function.

[0023] The transformation module is configured to transform the initial embedding vector of the first sample node by the each candidate transformation function based on a transformation parameter value of the first sample node to obtain an embedding vector output by each candidate transformation function, the first sample node being a node of a first type or a node of a second type in the application graph, and the transformation parameter value being related to a type of the first sample node.

[0024] The weighted summation module is configured to perform weighted summation on the embedding vectors output by the each candidate transformation function based on the weight of the each candidate transformation function to obtain the embedding vector of the first sample node.

[0025] The weight adjustment module is configured to adjust the weight of the each candidate transformation function based on the embedding vector of the first sample node until the embedding vector of the first sample node satisfies an end adjustment condition.

[0026] The function determining module is configured to determine the candidate transformation function with the highest weight as the first transformation function.

[0027] In some embodiments, the apparatus further includes:

[0028] The feature extraction module is configured to extract features of at least one of application permissions and interface call behaviors performed by the target application program, to obtain an original feature vector of the first node.

[0029] The transformation module is configured to transform the original feature vector of the first node by a second transformation function based on a preset transformation parameter value, to obtain an initial embedding vector of the first node, the second transformation function being configured to transform vectors.

[0030] The fusion module is configured to fuse the initial embedding vector of the first node and the embedding vector of the first node, to obtain an updated embedding vector of the first node.

[0031] In some embodiments, the obtaining module is configured to obtain a plurality of candidate transformation functions and a weight of each candidate transformation function.

[0032] The transformation module is configured to transform an original feature vector of a second sample node by each candidate transformation function based on the preset transformation parameter value, to obtain an embedding vector output by each candidate transformation function, the second sample node being a node representing an application program in the application program graph.

[0033] The weighted summation module is configured to perform weighted summation on the embedding vectors output by each candidate transformation function based on the weight of each candidate transformation function, to obtain an initial embedding vector of the second sample node.

[0034] The weight adjusting module is configured to adjust the weight of each candidate transformation function based on the initial embedding vector of the second sample node, until the initial embedding vector of the second sample node meets a condition for ending adjustment.

[0035] The function determining module is configured to determine the candidate transformation function with the highest weight as the second transformation function.

[0036] In some embodiments, the fusion unit is configured to fuse embedding vectors of the plurality of target neighbor nodes by a fusion function, to obtain the embedding vector of the first node, the fusion function being configured to fuse vectors.

[0037] In some embodiments, the obtaining module is configured to obtain a plurality of candidate fusion functions and a weight of each candidate fusion function.

[0038] The transformation module is configured to fuse embedding vectors of a plurality of third sample nodes by using each candidate fusion function, to obtain an embedding vector output by each candidate fusion function, the third sample nodes being nodes representing application permissions or nodes representing interface calling behaviors in the application graph.

[0039] The weighted summation module is configured to perform weighted summation on the embedding vectors output by each candidate fusion function based on the weight of each candidate fusion function, to obtain an embedding vector of a fourth sample node, the fourth sample node being a node representing an application program in the application graph, and the third sample nodes being neighbor nodes of the fourth sample node.

[0040] The weight adjustment module is configured to adjust the weight of each candidate fusion function based on the embedding vector of the fourth sample node until the embedding vector of the fourth sample node meets an end adjustment condition.

[0041] The function determination module is configured to determine the candidate fusion function with the highest weight as the fusion function.

[0042] In some embodiments, the adding module is configured to determine at least one second node and at least one third node in the application graph based on the application permissions of the target application program and the interface calling behaviors performed by the target application program, the second nodes being nodes representing the application permissions, and the third nodes being nodes representing the interface calling behaviors; and connect the first node with the at least one second node and the at least one third node in the application graph.

[0043] The determination module is configured to determine the at least one second node and the at least one third node as a plurality of target neighbor nodes of the first node in the application graph.

[0044] According to another aspect of the embodiments of the present application, a terminal is provided, which includes a processor and a memory; the memory stores at least one program code, which is used to be executed by the processor to implement the malicious application program detection method according to the above aspect.

[0045] According to another aspect of the embodiments of the present application, a chip is provided, which includes a programmable logic circuit and / or program instructions, and when the chip is running on a terminal, is used to implement the malicious application program detection method according to the above aspect.

[0046] According to another aspect of the embodiments of the present application, a computer readable storage medium is provided, the storage medium storing at least one program code, the at least one program code being used to be executed by a processor to implement the malicious application detection method according to the above aspect.

[0047] According to another aspect of the embodiments of the present application, a computer program product is provided, the computer program product storing at least one program code, the at least one program code being used to be executed by a processor to implement the malicious application detection method according to the above aspect.

[0048] The embodiments of the present application provide a malicious application detection scheme. Since the application permission or interface calling behavior of a malicious application is different from that of a non-malicious application, a terminal can determine the connection relationship between a first node representing the application and other nodes in an application graph according to the application permission and the interface calling behavior of the application to be detected. Then, the terminal can convert the problem of malicious application detection into a node classification problem. The terminal fuses the embedding vectors of a plurality of neighbor nodes of the first node according to the connection relationship between the nodes indicated by the application graph, and obtains an embedding vector reflecting the application permission feature or the interface calling behavior feature of the application. The terminal classifies the first node according to the embedding vector with stronger expression capability, can more accurately determine the classification result, and determines whether the application is a malicious application according to the classification result. The above method takes into account the application permission feature and the interface calling behavior feature of the application, and improves the accuracy of malicious application detection. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0050] Figure 1 is a schematic diagram of an implementation environment provided by the embodiments of the present application;

[0051] Figure 2 is a flowchart of a malicious application detection method provided by the embodiments of the present application;

[0052] Figure 3 is a flowchart of another malicious application detection method provided by the embodiments of the present application;

[0053] Figure 4 is a schematic diagram of a graph neural network model provided by the embodiments of the present application;

[0054] Figure 5 is a schematic diagram of a fusion module provided by an embodiment of the present application;

[0055] Figure 6 is a schematic diagram of a malicious application detection effect provided by an embodiment of the present application;

[0056] Figure 7 is a schematic diagram of a detection time provided by an embodiment of the present application;

[0057] Figure 8 is a structural schematic diagram of a malicious application detection device provided by an embodiment of the present application;

[0058] Figure 9 is a structural schematic diagram of another malicious application detection device provided by an embodiment of the present application;

[0059] Figure 10 is a structural block diagram of a terminal provided by an embodiment of the present application. DETAILED DESCRIPTION

[0060] To make the purpose, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the drawings.

[0061] In this document, "at least one" refers to one or more, and "multiple" refers to two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. The character " / " generally represents an "or" relationship between the associated objects before and after it.

[0062] It should be noted that the information (including but not limited to user's device information, user's personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in the present application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions. For example, the application permissions and application interface calling behaviors of the application involved in the present application are obtained under sufficient authorization.

[0063] Figure 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application. Referring to Figure 1 , the implementation environment includes a terminal 101 and a server 102. The terminal 101 can be directly or indirectly connected with the server 102 through wired or wireless communication mode.

[0064] Optionally, the terminal 101 can be a mobile phone, a desktop computer, a notebook computer, a tablet computer, a smart watch, or the like. Optionally, the terminal is installed with and runs an application program. In order to ensure the privacy and property safety of a user, the terminal 101 can detect the application permission of the application program and the interface calling behavior performed by the application program after the installation of the application program is completed, so as to detect whether the application program is a malicious application program. Optionally, the terminal 101 is installed with a security application program. The application program can be used to detect a malicious application program, and the application program is associated with the server 102 and provided with a background service by the server 102.

[0065] Optionally, the server 102 is a stand-alone physical server, or can be a server cluster or a distributed system composed of multiple physical servers, or can be a cloud server providing basic cloud computing services such as cloud service, cloud database, cloud computing, cloud function, cloud storage, network service, cloud communication, middleware service, domain name service, security service, CDN (Content Delivery Network), and big data and artificial intelligence platform. In some embodiments, the server 102 undertakes the main computing work, and the terminal 101 undertakes the secondary computing work; or the server 102 undertakes the secondary computing work, and the terminal 101 undertakes the main computing work; or the server 102 and the terminal 101 cooperatively compute in a distributed computing architecture.

[0066] Figure 2 is a flowchart of a malicious application program detection method provided by an embodiment of the present application. The method is executed by a terminal, and the method comprises the following steps. Figure 2

[0067] 201. In a case where a target application program is installed, the terminal adds a first node to an application program graph, the first node being used to represent the target application program, the nodes in the application program graph representing application programs, application permissions, and interface calling behaviors respectively, and the edges in the application program graph representing that an application program has an application permission and the application program has performed an interface calling behavior.

[0068] In the embodiment of the present application, the application program graph is a knowledge graph. The application program graph comprises nodes representing application programs (APP, Application), nodes representing application permissions (permission), and nodes representing interface calling behaviors (intent). An edge between a node representing an application program and a node representing an application permission (APP-permission) is used to represent that the application program has the application permission, and an edge between a node representing an application program and a node representing an interface calling behavior (APP-intent) is used to represent that the application program has performed the interface calling behavior. ​

[0069] The nodes representing the application programs in the application program graph can be divided into existing nodes and new nodes. The existing nodes are nodes added to the application program graph during the construction of the application program graph. The connection relationship between the existing nodes and other nodes is determined. The new nodes are nodes newly added to the application program graph. The existing nodes include nodes representing malicious application programs and nodes representing non-malicious application programs. Since the application permissions and the interface calling behaviors of the malicious application programs and the non-malicious application programs are different, the connection relationship between the nodes representing the malicious application programs and other nodes and the connection relationship between the nodes representing the non-malicious application programs and other nodes are also different.

[0070] After the terminal successfully installs the target application program, the terminal adds a node representing the target application program in the application program graph. For ease of description, the added node is referred to as a first node. The terminal can determine whether the target application program is a malicious application program by analyzing the connection relationship between the first node and other nodes.

[0071] 202. The terminal determines a plurality of target neighbor nodes of the first node, and the target neighbor nodes are used to indicate that the target application program has the application permissions represented by the target neighbor nodes or that the target application program performs the interface calling behaviors represented by the target neighbor nodes.

[0072] In the embodiments of the present application, the terminal detects the target application program to obtain at least one application permission and at least one interface calling behavior performed by the target application program. The terminal determines the nodes representing the application permissions and the nodes representing the interface calling behaviors in the application program graph as the plurality of target neighbor nodes of the first node. Since the first node can be directly connected with the target neighbor nodes, the target neighbor nodes can also be referred to as the first-order neighbor nodes of the first node.

[0073] 203. The terminal fuses the embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, and the embedding vector of the first node is used to represent at least one of the application permission features and the interface calling behavior features of the target application program.

[0074] In the embodiments of the present application, the terminal can process the application program graph through the graph neural network to obtain the embedding vectors of the nodes in the application program graph. The embedding vectors of the nodes representing the application permissions can represent the application permission features. The embedding vectors of the nodes representing the interface calling behaviors can represent the interface calling behavior features. The embedding vectors of the nodes representing the application programs can represent the application permission features and the interface calling behavior features of the application programs.

[0075] Therefore, the embedding vector of the target neighbor node of the first node is used to represent the application permission feature or the interface calling behavior feature. The terminal fuses embedding vectors of multiple target neighbor nodes to obtain an embedding vector of the first node. The embedding vector of the first node can represent at least one of the application permission feature and the interface calling behavior feature of the target application program.

[0076] 204. The terminal classifies the first node based on the embedding vector of the first node to obtain a classification result of the first node. The classification result is used to indicate whether the target application program is a malicious application program.

[0077] In the embodiments of the present application, because the application permission feature or the interface calling behavior feature of the malicious application program is different from that of the non-malicious application program, the terminal can classify the first node according to the embedding vector of the first node to determine whether the target application program represented by the first node is a malicious application program. In the case that the application permission feature of the target application program represented by the embedding vector of the first node is similar to the application permission feature of the malicious application program, or the interface calling behavior feature of the target application program represented by the embedding vector of the first node is similar to the interface calling behavior feature of the malicious application program, the target application program can be considered as a malicious application program. The terminal can delete, uninstall or add the malicious application program to a mobile phone blacklist to avoid the malicious application program from performing a repackaging attack, a privilege escalation attack or other attack behaviors, thereby protecting the privacy and property safety of the user.

[0078] The embodiments of the present application provide a malicious application program detection method. Because the application permission or the interface calling behavior of the malicious application program is different from that of the non-malicious application program, the terminal can determine the connection relationship between a first node representing the application program and other nodes in an application program graph according to the application permission and the interface calling behavior of the application program to be detected. Further, the terminal can convert the problem of detecting the malicious application program into a node classification problem. The terminal fuses embedding vectors of multiple neighbor nodes of the first node according to the connection relationship between the nodes indicated by the application program graph to obtain an embedding vector that can reflect the application permission feature or the interface calling behavior feature of the application program. The terminal classifies the first node according to the embedding vector with stronger expression capability, can more accurately determine the classification result, and determines whether the application program is a malicious application program according to the classification result. By using the above method, the application permission feature and the interface calling behavior feature of the application program are considered, and the accuracy of the malicious application program detection is improved.

[0079] Figure 3 is a flowchart of another malicious application program detection method provided by the embodiments of the present application. The method is performed by a terminal, and the method is shown in Figure 3 , and the method comprises the following steps.

[0080] 301、in the case of the target application being installed, the terminal adds a first node in an application graph, the first node is used to represent the target application, the nodes in the application graph represent applications, application permissions and interface calling behaviors respectively, and the edges in the application graph represent that the applications have the application permissions and the applications execute the interface calling behaviors.

[0081] In the embodiments of the present application, the application graph is a knowledge graph. The application graph includes nodes representing applications, nodes representing application permissions and nodes representing interface calling behaviors. The edges between the nodes representing applications and the nodes representing application permissions are used to represent that the applications have the application permissions, and the edges between the nodes representing applications and the nodes representing interface calling behaviors are used to represent that the applications execute the interface calling behaviors.

[0082] The nodes representing applications in the application graph can be divided into existing nodes and new nodes. The existing nodes are the nodes added to the application graph in the process of constructing the application graph. The connection relationship between the existing nodes and other nodes is determined. The new nodes are the nodes newly added to the application graph. Since the existing nodes are the original nodes in the application graph and the new nodes are the nodes that do not originally exist in the application graph, the existing nodes can also be called In-Graph nodes and the new nodes can also be called Out-Of-Graph (OOG) nodes. The existing nodes in the application graph include nodes representing malicious applications and nodes representing non-malicious applications. Since the application permissions and the executed interface calling behaviors of the malicious applications and the non-malicious applications are different, the connection relationship between the nodes representing malicious applications and other nodes is different from the connection relationship between the nodes representing non-malicious applications and other nodes.

[0083] After the terminal successfully installs the target application, the terminal adds a node representing the target application in the application graph, which is called the first node for convenience of description. The first node is an OOG node representing an application. The terminal can determine whether the target application is a malicious application by analyzing the connection relationship between the first node and other nodes.

[0084] 302、the terminal determines a plurality of target neighbor nodes of the first node, the target neighbor nodes are used to indicate that the target application has the application permissions represented by the target neighbor nodes or the target application executes the interface calling behaviors represented by the target neighbor nodes.

[0085] In the embodiments of the present application, the terminal detects a target application program, and obtains at least one application permission of the target application program and at least one interface calling behavior performed by the target application program. The terminal determines, as a plurality of target neighbor nodes of the first node, nodes representing the application permissions and nodes representing the interface calling behaviors in the application graph. Since the first node can be directly connected with the target neighbor nodes, the target neighbor nodes can also be referred to as first-order neighbor nodes of the first node.

[0086] For example, in a case where the terminal detects that the target application program has a storage permission, a pop-up window permission and an application installation permission, the terminal determines, as the target neighbor nodes of the first node, nodes representing the storage permission, the pop-up window permission and the application installation permission in the application graph.

[0087] In some embodiments, the terminal can connect the first node and the first-order neighbor nodes of the first node. The terminal determines, based on the application permissions of the target application program and the interface calling behaviors performed by the target application program, at least one second node and at least one third node in the application graph. The second node is a node representing the application permissions, and the third node is a node representing the interface calling behaviors. The terminal connects, in the application graph, the first node with the at least one second node and the at least one third node, respectively. Further, the terminal can determine, in the application graph, the at least one second node and the at least one third node as a plurality of target neighbor nodes of the first node. By taking at least one first-order neighbor node of the first node as a target neighbor node, the second-order neighbor nodes and the multi-order neighbor nodes of the first node do not need to be considered. Further, in the process of analyzing the connection relationship between the first node and the neighbor nodes to determine whether the target application program is a malicious application program, the number of sampled neighbor nodes can be reduced, the calculation amount can be reduced, and the detection efficiency can be improved.

[0088] 303. For any target neighbor node, the terminal obtains an initial embedding vector of the target neighbor node, and the initial embedding vector is used to represent an application permission feature or an interface calling behavior feature.

[0089] In the embodiment of the present application, after the terminal determines the plurality of target neighbor nodes of the first node, the terminal obtains an initial embedding vector of each target neighbor node. In the application graph, the initial embedding vector of a node can be an embedding vector obtained by processing the application graph through a graph learning model such as a GCN (Graph Convolutional Networks), a GAT (Graph Attention Networks), and a TransE (Translating Embedding), or can be an embedding vector obtained by feature extraction on the application graph, and the present application does not limit this. Since the target neighbor node is a node representing an application permission or a node representing an interface calling behavior, the initial embedding vector of the target neighbor node obtained by the above method can represent an application permission feature or an interface calling behavior feature.

[0090] 304. The terminal transforms the initial embedding vector of the target neighbor node based on the transformation parameter value of the target neighbor node to obtain an embedding vector of the target neighbor node, the transformation parameter value being related to the type of the target neighbor node, and the embedding vector of the target neighbor node being used to represent the association feature between the first node and the target neighbor node.

[0091] In the embodiment of the present application, since the target neighbor node is a node representing an application permission or a node representing an interface calling behavior, the terminal can determine the type of the edge between the target neighbor node and the first node according to the type of the target neighbor node. In the case where the target neighbor node is a node representing an application permission, the edge between the target neighbor node and the first node represents that the target application program has the application permission; in the case where the target neighbor node is a node representing an interface calling behavior, the edge between the target neighbor node and the first node represents that the target application program performs the interface calling behavior. Therefore, the terminal can determine the transformation parameter value of the target neighbor node according to the type of the target neighbor node or according to the type of the edge between the target neighbor node and the first node. The terminal transforms the initial embedding vector of the target neighbor node according to the transformation parameter value, so that the embedding vector after transformation can represent the association feature between the first node and the target neighbor node. The association feature refers to that the target application program represented by the first node has the application permission represented by the target neighbor node, or performs the interface calling behavior represented by the target neighbor node.

[0092] In some embodiments, the terminal is capable of transforming the initial embedding vector of the target neighbor node by a transformation function. In a case where the type of the target neighbor node is a first type, the terminal obtains a first transformation parameter value. The node of the first type is a node representing application permission. In a case where the type of the target neighbor node is a second type, the terminal obtains a second transformation parameter value. The node of the second type is a node representing interface calling behavior. The terminal transforms the initial embedding vector of the target neighbor node by a first transformation function based on the first transformation parameter value or the second transformation parameter value, and obtains an embedding vector of the target neighbor node. The embedding vector of the target neighbor node has the same dimension as the initial embedding vector. The first transformation function is used for transforming vectors. The first transformation function includes a plurality of parameters. The terminal is capable of determining two different sets of parameter values for the plurality of parameters according to the type of the target neighbor node. Further, in the process of transforming the initial embedding vector of the target neighbor node by the first transformation function, the terminal is capable of selecting a set of parameter values corresponding to the type of the node for transformation.

[0093] Optionally, the process of vector transformation can be implemented by a graph neural network model. The graph neural network model is used for transforming input vectors. The graph neural network model includes a first transformation module, and the first transformation module is provided with a first transformation function. The terminal inputs the initial embedding vector of the target neighbor node to the first transformation module, and performs vector transformation by the first transformation function provided by the first transformation module to obtain the embedding vector of the target neighbor node. The first transformation module can provide different first transformation functions by different network layers. For example, the first transformation module can include at least one of a linear layer, a one-dimensional convolution layer, a direct connection layer, and a gating layer. The linear layer can be used for linear transformation of vectors; the one-dimensional convolution layer can be used for nonlinear transformation of vectors; the direct connection layer can be used for identity transformation of vectors; and the gating layer can also be used for linear transformation of vectors. Therefore, vector transformation by any network layer in the first transformation module can achieve the effect of vector transformation by the corresponding first transformation function.

[0094] It should be noted that the above embodiments are described by taking an example in which the graph neural network model includes one first transformation module and the initial embedding vector of the target neighbor node is transformed once by the vector transformation. In some embodiments, the graph neural network model can include a plurality of first transformation modules connected in series. The terminal can input the embedding vector output by the first first transformation module to the second first transformation module, continue to transform the embedding vector by the transformation function provided by the second first transformation module, and obtain the embedding vector output by the last first transformation module. The dimension of the embedding vector input to the first transformation module is the same as the dimension of the embedding vector output by the last first transformation module, that is, the dimension of the embedding vector is not changed by the transformation of the first transformation module. By designing a model structure with multiple first transformation modules, the graph neural network model can include a basic single-layer graph neural network structure and a more rich graph learning model. The single-layer graph neural network structure refers to a case where, when the graph neural network model includes N first transformation modules, the network layers of the first N-1 first transformation modules are all direct connection layers, and the network layer of the last first transformation module is a linear layer, a one-dimensional convolution layer or a gating layer. That is, the single-layer graph neural network structure refers to that the input vector is transformed N-1 times by identity transformation, and then the vector after transformation is transformed once by linear transformation or nonlinear transformation, where N is a positive integer. The more rich graph learning model refers to a case where, when the graph neural network model includes N first transformation modules, the input vector is transformed at least twice by linear transformation or nonlinear transformation, so as to realize vector transformation by the rich graph learning model.

[0095] 305. The terminal fuses the embedding vectors of the plurality of target neighbor nodes to obtain the embedding vector of the first node, and the embedding vector of the first node is used to represent at least one of the application permission feature and the interface call behavior feature of the target application.

[0096] In the embodiments of the present application, after the terminal transforms the initial embedding vector of each target neighbor node by the above steps 303-304 to obtain the embedding vector of each target neighbor node, the terminal fuses the embedding vectors of each target neighbor node in the plurality of target neighbor nodes to obtain the embedding vector of the first node. Since the embedding vector of the target neighbor node can represent the association feature between the first node and the target neighbor node (the target application has the application permission represented by the target neighbor node, or the target application performs the interface call behavior represented by the target neighbor node), the embedding vector of the first node obtained by fusion can represent at least one of the application permission feature and the interface call behavior feature of the target application.

[0097] In some embodiments, the terminal is capable of fusing the embedding vectors of the plurality of target neighbor nodes by a fusion function to obtain the embedding vector of the first node. The fusion function is used to fuse the vectors. The fusion function includes a sum function, an average function, a maximum function, and an attention mechanism function of GAT. For example, when the fusion function is the sum function, the terminal obtains the element of each dimension of the embedding vector of the first node by summing the elements of the corresponding dimension of the embedding vectors of the plurality of target neighbor nodes in each dimension by the sum function. When the fusion function is the average function, the terminal obtains the element of each dimension of the embedding vector of the first node by averaging the elements of the corresponding dimension of the embedding vectors of the plurality of target neighbor nodes by the average function. When the fusion function is the maximum function, in each dimension, the terminal obtains the element of the embedding vector of the first node in the dimension as the element with the maximum value in the corresponding dimension of the embedding vectors of the plurality of target neighbor nodes. When the fusion function is the attention mechanism function, the terminal obtains the embedding vector of the first node by summing the embedding vectors of the plurality of target neighbor nodes by the sum function according to the weight of each target neighbor node. The weight of the target neighbor node can be a preset weight of the terminal or a user input weight, which is not limited in the embodiments of the present application.

[0098] Optionally, the above vector fusion process by the fusion function can also be implemented by a graph neural network model. Correspondingly, the graph neural network model is also used to fuse the plurality of input vectors. The graph neural network model further includes a fusion module, and the fusion module is provided with at least one of the above plurality of fusion functions. The terminal inputs the embedding vectors of the plurality of target neighbor nodes to the fusion module, and fuses the vectors by any fusion function provided by the fusion module to obtain the embedding vector of the first node.

[0099] In some embodiments, the terminal can update the embedding vector of the first node. The terminal extracts features of at least one of the application permissions and the interface call behaviors performed by the target application program, to obtain an original feature vector of the first node. The terminal transforms the original feature vector of the first node based on a preset transformation parameter value, by using a second transformation function, to obtain an initial embedding vector of the first node. The second transformation function is used to transform vectors, and the second transformation function includes a plurality of parameters. The preset parameter value can be a set of parameter values preset by the terminal for the plurality of parameters, or a set of parameter values input by a user, and the embodiments of the present application do not limit this. The terminal fuses the initial embedding vector of the first node and the embedding vector of the first node obtained in step 305, to obtain an updated embedding vector of the first node. By updating the embedding vector of the first node according to the original feature vector of the first node, the expression ability of the updated embedding vector can be stronger, and the application permission features or the interface call behavior features of the target application program can be better expressed.

[0100] Optionally, the process of transforming the original feature vector of the first node can also be implemented by using a graph neural network model. The graph neural network model further includes a second transformation module, and the second transformation module is provided with a second transformation function. The terminal inputs the original feature vector of the first node into the second transformation module, and performs vector transformation by using the second transformation function provided by the second transformation module, to obtain the initial embedding vector of the first node. The second transformation module can provide different second transformation functions by using different network layers. For example, the second transformation module can include at least one of a linear layer, a one-dimensional convolution layer, a direct connection layer, and a gate layer. The vector transformation effects of the above network layers are the same as those of the corresponding network layers in the first transformation module, and will not be described herein. Furthermore, by using any network layer in the second transformation module to perform vector transformation, the effect of using the corresponding second transformation function to perform vector transformation can be achieved.

[0101] It should be noted that the above embodiments are described by taking an example in which the graph neural network model includes one second transformation module and performs vector transformation on the original feature vector of the first node once. In some embodiments, the graph neural network model can include a plurality of second transformation modules connected in series, and the embodiments of the present application do not limit this.

[0102] 306、The terminal classifies the first node based on the embedding vector of the first node, to obtain a classification result of the first node. The classification result is used to indicate whether the target application program is a malicious application program.

[0103] In the embodiments of the present application, since the application permission features or the interface calling behavior features of the malicious application and the non-malicious application are different, the terminal can classify the first node according to the embedding vector of the first node through the linear classifier, and obtain the classification result of the first node. The terminal can determine whether the target application represented by the first node is a malicious application according to the classification result. In the case that the application permission features of the target application represented by the embedding vector of the first node are similar to the application permission features of the malicious application, or the interface calling behavior features of the target application represented by the embedding vector of the first node are similar to the interface calling behavior features of the malicious application, the target application can be considered as a malicious application. Therefore, the terminal can delete, uninstall or add the malicious application to the mobile phone blacklist to avoid the malicious application from performing repackaging attack, privilege escalation attack or other attack behaviors, so as to protect the privacy and property safety of the user.

[0104] In order to more clearly illustrate the process of generating the embedding vector of the first node through the graph neural network model, the above process will be described in combination with the schematic diagram of the graph neural network model shown in Figure 4 As shown in Figure 4 The graph neural network model includes three first transformation modules, one second transformation module and one fusion module in series. In the case that the terminal obtains the original feature vector of the first node, the terminal can input the original feature vector of the first node to the second transformation module, and input the initial embedding vectors of the plurality of target neighbor nodes of the first node to the first transformation module. Then, the terminal transforms the input initial embedding vectors through the first transformation function provided by the first transformation module to obtain the embedding vector of each target neighbor node, and transforms the input original feature vector through the second transformation function provided by the second transformation module to obtain the initial embedding vector of the first node. The above vector transformation processes through the first transformation module and the second transformation module can be processed in parallel to improve the processing speed of the graph neural network model. Then, the terminal fuses the embedding vectors of the plurality of neighbor nodes through the fusion module to obtain the embedding vector of the first node. Then, the terminal adds the initial embedding vector of the first node output by the second transformation module and the embedding vector of the first node output by the fusion module to obtain the updated embedding vector of the first node. It should be noted that in some embodiments, the terminal does not need to obtain the original feature vector of the first node, and the terminal can determine the embedding vector output by the fusion module as the embedding vector of the first node.

[0105] In the above graph neural network model, the first transformation module is provided with a plurality of candidate transformation functions. In the process of training the graph neural network model, the terminal can select one of the plurality of candidate transformation functions as the first transformation function provided by the first transformation module. Similarly, the second transformation module is also provided with a plurality of candidate transformation functions, and the fusion module is also provided with a plurality of candidate fusion functions. The process of determining the first transformation function, the second transformation function and the fusion function by the terminal in the process of training the graph neural network model is described below.

[0106] (1) The terminal determines the transformation function provided by the first transformation module. The terminal obtains a plurality of candidate transformation functions and the weight of each candidate transformation function. The weight of the candidate transformation function can be a preset weight of the terminal or a weight input by the user, and the embodiments of the present application do not limit this. The weight of each candidate transformation function can be the same or different. The terminal transforms the initial embedding vector of the first sample node by each candidate transformation function based on the transformation parameter value of the first sample node, to obtain the embedding vector output by each candidate transformation function. The first sample node is a node of the first type or a node of the second type in the application graph. The transformation parameter value is related to the type of the first sample node. The terminal performs weighted summation on the embedding vector output by each candidate transformation function based on the weight of each candidate transformation function, to obtain the embedding vector of the first sample node. The terminal adjusts the weight of each candidate transformation function based on the embedding vector of the first sample node, until the embedding vector of the first sample node satisfies the end adjustment condition. The end adjustment condition can be that the application permission feature or the interface call behavior feature of the first sample node can be determined according to the embedding vector of the first sample node. The terminal determines the candidate transformation function with the highest weight as the first transformation function.

[0107] (2) The terminal determines the transformation function provided by the second transformation module. The terminal obtains a plurality of candidate transformation functions and the weight of each candidate transformation function. The terminal transforms the original feature vector of the second sample node by each candidate transformation function based on the preset transformation parameter value in step 305, to obtain the embedding vector output by each candidate transformation function. The second sample node is a node representing an application program in the application graph. The terminal performs weighted summation on the embedding vector output by each candidate transformation function based on the weight of each candidate transformation function, to obtain the initial embedding vector of the second sample node. The terminal adjusts the weight of each candidate transformation function based on the initial embedding vector of the second sample node, until the initial embedding vector of the second sample node satisfies the end adjustment condition. The end adjustment condition can be that the application permission feature or the interface call behavior feature of the application program corresponding to the second sample node can be determined according to the initial embedding vector of the second sample node. The terminal determines the candidate transformation function with the highest weight as the second transformation function.

[0108] (3) The terminal determines the fusion function provided by the fusion module. The terminal obtains a plurality of candidate fusion functions and a weight of each candidate fusion function. The terminal fuses the embedding vectors of a plurality of third sample nodes through each candidate fusion function to obtain an embedding vector output by each candidate fusion function. The third sample node is a node representing an application permission or a node representing an interface calling behavior in the application graph. The terminal performs weighted summation on the embedding vectors output by each candidate fusion function according to the weight of each candidate fusion function to obtain an embedding vector of a fourth sample node. The fourth sample node is a node representing an application in the application graph, and the third sample node is a neighbor node of the fourth sample node. The terminal adjusts the weight of each candidate fusion function based on the embedding vector of the fourth sample node until the embedding vector of the fourth sample node meets an end adjustment condition. The end adjustment condition can be that the embedding vector of the fourth sample node can represent the application permission feature or the interface calling behavior feature of the application. The terminal determines the candidate fusion function with the highest weight as the fusion function.

[0109] For example, Figure 5 is a schematic diagram of a fusion module. As shown in Figure 5 , the fusion module provides four fusion functions. The terminal performs weighted summation on the embedding vectors output by each candidate fusion function according to the weight of each candidate fusion function. Then, the terminal adjusts the weight of each fusion function based on the result of the weighted summation until the end adjustment condition is met. Then, the terminal determines the fusion function 3 with the highest weight as the fusion function provided by the fusion module.

[0110] In some embodiments, the terminal can determine the weight of the candidate function through a preset structure parameter. For any module in the above-mentioned graph neural network model, the terminal can preset a structure parameter for each candidate function provided by the module. Then, the terminal processes the structure parameter through a Softmax (normalized exponential) function to obtain the weight of each candidate function. The terminal performs weighted summation on the output of each candidate function according to the weight of each candidate function to obtain the output of the module, and completes the continuity relaxation calculation.

[0111] In some embodiments, the terminal combines the plurality of candidate transformation functions provided by the first transformation module, the plurality of candidate transformation functions provided by the second transformation module, and the plurality of candidate fusion functions provided by the fusion module to form a search space of the entire graph neural network model. The search space includes combinations of the plurality of candidate transformation functions and the plurality of candidate fusion functions. For example, the first transformation module provides candidate transformation function 1 and candidate transformation function 2; the second transformation module provides candidate transformation function 3 and candidate transformation function 4; and the fusion module provides fusion function 1, fusion function 2, fusion function 3, and fusion function 4. The entire search space includes 2*2*4=16 possible combinations: candidate transformation function 1-candidate transformation function 3-fusion function 1, candidate transformation function 1-candidate transformation function 3-fusion function 2, candidate transformation function 1-candidate transformation function 4-fusion function 1, candidate transformation function 1-candidate transformation function 4-fusion function 2, and so on. Then, the terminal can perform the continuity relaxation calculation in the search space according to the determined weights of the transformation functions and the weights of the fusion functions.

[0112] In some embodiments, after the terminal completes the continuity relaxation calculation, the terminal can obtain continuous structure parameters. Then, the terminal iteratively updates the structure parameters and the model parameters of the graph neural network model through the back propagation algorithm based on the results of the continuity relaxation calculation, so as to optimize the structure parameters and the model parameters. When the results of the continuity relaxation calculation satisfy the condition for ending the optimization, the terminal calculates the obtained structure parameters through the Softmax function to obtain the weights of each candidate function. The condition for ending the optimization can be that the output results of the graph neural network model converge. Then, the terminal determines the candidate function with the largest weight in each module as the function provided by each module according to the weights of each candidate function, and obtains the functions provided by each module in the graph neural network model. During the process of iteratively updating the structure parameters, the terminal can approximate the optimization of the structure parameters to avoid a large amount of calculation caused by the second-order derivative, and can improve the calculation speed and the training efficiency of the graph neural network model.

[0113] It should be noted that steps (1)-(3) are described by taking the training of the graph neural network model by the terminal as an example, and in some embodiments, the server can also train the graph neural network model, which is not limited by the embodiments of the present application.

[0114] Figure 6 FIG. 1 is a schematic diagram of a malicious application detection effect. As shown in FIG. 1, the malicious application detection effect includes a plurality of candidate functions, and each candidate function is provided by a module in the graph neural network model. Figure 6As shown, compared with other baseline models (GAT, GraphSAGE, MEAN and ConvL), the malicious application detection scheme (S2E) provided in the embodiment of the application has stable and significant effect improvement. In different data sets (ACM, IMDB and MobAPP) and using different encoders (RGCN, GAT and TransE), the scheme provided in the embodiment of the application has higher accuracy and higher Macro-F1 evaluation index (an index for measuring the accuracy of a binary classification model), and has stable and excellent effect.

[0115] Figure 7 It is a schematic diagram for detecting time. As shown in the figure, Figure 7 In terms of detection time, compared with other baseline models, the scheme (S2E) provided in the embodiment of the application can obtain a detection result with higher accuracy while consuming less detection time. Especially in the graph MobAPP constructed using APP and related information, the scheme provided in the embodiment of the application achieves better effect than the baseline model, which shows that the graph neural network model provided in the embodiment of the application can be well applied in the scene of malicious application detection.

[0116] The embodiment of the application provides a malicious application detection method. Since the application permission or interface calling behavior of a malicious application program is different from that of a non-malicious application program, a terminal can determine the connection relationship between a first node representing the application program and other nodes in an application program graph according to the application permission and interface calling behavior of the application program to be detected. Further, the terminal can convert the problem of malicious application program detection into a node classification problem. The terminal fuses the embedding vectors of a plurality of neighbor nodes of the first node according to the connection relationship between the nodes indicated by the application program graph, and obtains an embedding vector that can reflect the application permission feature or interface calling behavior feature of the application program. The terminal classifies the first node according to the embedding vector with stronger expression capability, can more accurately determine the classification result, and determines whether the application program is a malicious application program according to the classification result. By using the above method, the application permission feature and the interface calling behavior feature of the application program are considered, and the accuracy of malicious application program detection is improved.

[0117] All the optional technical solutions described above can be combined to form optional embodiments of the application, which will not be described here.

[0118] The following is an apparatus embodiment of the application, which can be used to execute the method embodiments of the application. For details not disclosed in the apparatus embodiments of the application, please refer to the method embodiments of the application.

[0119] Figure 8is a structural schematic diagram of a malicious application detection device provided by an embodiment of the present application. Referring to Figure 8 The device comprises an adding module 801, a determining module 802, a fusion module 803 and a classification module 804.

[0120] The adding module 801 is configured to add a first node in an application graph in a case where a target application is installed, the first node being used to represent the target application, the nodes in the application graph representing applications, application permissions and interface calling behaviors respectively, and the edges in the application graph representing that the applications have the application permissions and the applications execute the interface calling behaviors;

[0121] The determining module 802 is configured to determine a plurality of target neighbor nodes of the first node, the target neighbor nodes being used to indicate that the target application has the application permissions represented by the target neighbor nodes or the target application executes the interface calling behaviors represented by the target neighbor nodes;

[0122] The fusion module 803 is configured to fuse the embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, the embedding vector of the first node being used to represent at least one of an application permission feature and an interface calling behavior feature of the target application;

[0123] The classification module 804 is configured to classify the first node based on the embedding vector of the first node to obtain a classification result of the first node, the classification result being used to represent whether the target application is a malicious application.

[0124] In some embodiments, Figure 9 is a structural schematic diagram of another malicious application detection device provided by an embodiment of the present application, referring to Figure 9 The fusion module 803 comprises:

[0125] The obtaining unit 8031 is configured to obtain an initial embedding vector of a target neighbor node for any target neighbor node, the initial embedding vector being used to represent an application permission feature or an interface calling behavior feature;

[0126] The transformation unit 8032 is configured to transform the initial embedding vector of the target neighbor node based on a transformation parameter value of the target neighbor node to obtain an embedding vector of the target neighbor node, the transformation parameter value being related to a type of the target neighbor node, and the embedding vector of the target neighbor node being used to represent an association feature between the first node and the target neighbor node;

[0127] The fusion unit 8033 is configured to fuse the embedding vectors of the plurality of target neighbor nodes to obtain the embedding vector of the first node.

[0128] In some embodiments, the transformation unit 8032 is configured to, in a case where the type of the target neighbor node is a first type, obtain a first transformation parameter value, the node of the first type being a node representing an application permission; in a case where the type of the target neighbor node is a second type, obtain a second transformation parameter value, the node of the second type being a node representing an interface calling behavior; and transform, based on the first transformation parameter value or the second transformation parameter value, the initial embedding vector of the target neighbor node by using a first transformation function to obtain the embedding vector of the target neighbor node, the first transformation function being configured to transform a vector.

[0129] In some embodiments, the apparatus further includes:

[0130] The obtaining module 805 is configured to obtain a plurality of candidate transformation functions and a weight of each candidate transformation function.

[0131] The transformation module 806 is configured to transform, based on the transformation parameter value of the first sample node, the initial embedding vector of the first sample node by using each candidate transformation function to obtain an embedding vector output by each candidate transformation function, the first sample node being a node of a first type or a node of a second type in an application graph, the transformation parameter value being related to the type of the first sample node.

[0132] The weighted sum module 807 is configured to perform weighted sum on the embedding vectors output by each candidate transformation function based on the weight of each candidate transformation function to obtain the embedding vector of the first sample node.

[0133] The weight adjustment module 808 is configured to adjust the weight of each candidate transformation function based on the embedding vector of the first sample node until the embedding vector of the first sample node satisfies an end adjustment condition.

[0134] The function determination module 809 is configured to determine the candidate transformation function with the highest weight as the first transformation function.

[0135] In some embodiments, the apparatus further includes:

[0136] The feature extraction module 810 is configured to perform feature extraction on at least one of an application permission possessed by the target application and an interface calling behavior performed by the target application to obtain an original feature vector of the first node.

[0137] The transformation module 806 is configured to transform, based on a preset transformation parameter value, the original feature vector of the first node by using a second transformation function to obtain an initial embedding vector of the first node, the second transformation function being configured to transform a vector.

[0138] The fusion module 803 is configured to fuse the initial embedding vector of the first node and the embedding vector of the first node to obtain an updated embedding vector of the first node.

[0139] In some embodiments, the obtaining module 805 is configured to obtain a plurality of candidate transformation functions and a weight of each candidate transformation function;

[0140] The transformation module 806 is configured to transform the original feature vector of the second sample node by each candidate transformation function based on a preset transformation parameter value, to obtain an embedding vector output by each candidate transformation function, the second sample node being a node representing an application in an application graph;

[0141] The weighted sum module 807 is configured to perform weighted sum on the embedding vector output by each candidate transformation function based on the weight of each candidate transformation function, to obtain an initial embedding vector of the second sample node;

[0142] The weight adjustment module 808 is configured to adjust the weight of each candidate transformation function based on the initial embedding vector of the second sample node, until the initial embedding vector of the second sample node meets an end adjustment condition;

[0143] The function determination module 809 is configured to determine the candidate transformation function with the highest weight as the second transformation function.

[0144] In some embodiments, the fusion unit 8033 is configured to fuse the embedding vectors of the plurality of target neighbor nodes by a fusion function to obtain the embedding vector of the first node, the fusion function being configured to fuse vectors.

[0145] In some embodiments, the obtaining module 805 is configured to obtain a plurality of candidate fusion functions and a weight of each candidate fusion function;

[0146] The transformation module 806 is configured to fuse the embedding vectors of the plurality of third sample nodes by each candidate fusion function to obtain an embedding vector output by each candidate fusion function, the third sample node being a node representing an application permission or a node representing an interface calling behavior in an application graph;

[0147] The weighted sum module 807 is configured to perform weighted sum on the embedding vector output by each candidate fusion function based on the weight of each candidate fusion function, to obtain an embedding vector of a fourth sample node, the fourth sample node being a node representing an application in an application graph, and the third sample node being a neighbor node of the fourth sample node;

[0148] The weight adjustment module 808 is configured to adjust the weight of each candidate fusion function based on the embedding vector of the fourth sample node, until the embedding vector of the fourth sample node meets an end adjustment condition;

[0149] The function determination module 809 is configured to determine the candidate fusion function with the highest weight as the fusion function.

[0150] In some embodiments, the adding module 801 is configured to determine, based on the application permission of the target application program and the interface calling behavior performed by the target application program, at least one second node and at least one third node in the application program graph, the second node being a node representing the application permission, and the third node being a node representing the interface calling behavior; and connect, in the application program graph, the first node with the at least one second node and the at least one third node respectively.

[0151] The determining module 802 is configured to determine, in the application program graph, the at least one second node and the at least one third node as a plurality of target neighbor nodes of the first node.

[0152] The embodiments of the present application provide a malicious application program detection apparatus. Since the application permission or the interface calling behavior of a malicious application program is different from that of a non-malicious application program, a terminal can determine, according to the application permission and the interface calling behavior of an application program to be detected, a connection relationship between a first node representing the application program and other nodes in an application program graph. Then, the terminal can convert a problem of detecting a malicious application program into a node classification problem. The terminal fuses embedding vectors of a plurality of neighbor nodes of the first node according to the connection relationship between the nodes indicated by the application program graph, and obtains an embedding vector that can reflect the application permission feature or the interface calling behavior feature of the application program. The terminal classifies the first node according to the embedding vector with stronger expression capability, can more accurately determine a classification result, and determines whether the application program is a malicious application program according to the classification result. The above method takes into account the application permission feature and the interface calling behavior feature of the application program, and improves the accuracy of malicious application program detection.

[0153] It should be noted that the malicious application program detection apparatus provided in the above embodiments is only used as an example for the division of the above functional modules in the implementation of the functions thereof. In actual application programs, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the terminal is divided into different functional modules to complete all or part of the above described functions. In addition, the malicious application program detection apparatus and the malicious application program detection method provided in the above embodiments belong to the same concept, and the specific implementation process is described in detail in the method embodiments, which will not be described here.

[0154] The embodiments of the present application provide a terminal, which includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the malicious application program detection method provided in each of the above method embodiments.

[0155] Figure 10is a structural block diagram of a terminal provided by an embodiment of the present application. In some embodiments, the terminal 1000 is a terminal capable of accessing a wireless local area network as a wireless station, such as a smartphone, a tablet computer, a wearable device, and the like. The terminal 1000 in the present application includes at least one or more of the following components: a processor 1010, a memory 1020, and at least two wireless links 1030.

[0156] In some embodiments, the processor 1010 includes one or more processing cores. The processor 1010 connects various parts within the entire terminal 1000 by various interfaces and lines, performs various functions of the terminal 1000 and processes data by running or executing program codes stored in the memory 1020 and calling data stored in the memory 1020. In some embodiments, the processor 1010 is implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 1010 can be integrated with a combination of one or more of a central processing unit (CPU), a graphics processor (GPU), a neural-network processing unit (NPU), and a modem. Among them, the CPU is mainly used to process operating systems, user interfaces, and application programs; the GPU is used to render and draw the content required to be displayed on the display screen; the NPU is used to implement artificial intelligence (AI) functions; and the modem is used to process wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 1010, but be implemented by a separate chip.

[0157] In some embodiments, the processor 1010 is used to control the working conditions of the at least two wireless links 1030, and the processor 1010 is a processor integrated with a wireless fidelity (Wi-Fi) chip. The Wi-Fi chip is a chip with dual Wi-Fi processing capability. For example, the Wi-Fi chip is a dual-band dual-concurrent (DBDC) chip, or a dual-band simultaneous (DBS) chip, etc.

[0158] In some embodiments, the memory 1020 includes a Random Access Memory (RAM), and in some embodiments, the memory 1020 includes a Read-Only Memory (ROM). In some embodiments, the memory 1020 includes a non-transitory computer-readable storage medium. The memory 1020 can be used to store program codes. The memory 1020 can include a program storage area and a data storage area, where the program storage area can store instructions for implementing an operating system, instructions for at least one function, instructions for implementing each of the method embodiments described below, and the like; and the data storage area can store data created based on the use of the terminal 1000.

[0159] In some embodiments, the memory 1020 stores a reception scheme of receiving a beacon frame of different wireless links 1030. In addition, the memory 1020 stores an identity of an access node connected by the different wireless links 1030, an identity of the wireless links 1030, and the like.

[0160] The at least two wireless links 1030 are used to connect different access points (APs). The downlink data transmitted by the APs is received. The different access points are access points in the same router or access points in different routers.

[0161] In some embodiments, the terminal 1000 further includes a display screen. The display screen is a display component for displaying a user interface. In some embodiments, the display screen is a display screen with a touch function, through which the user can perform touch operations on the display screen using a finger, a stylus, or any suitable object. In some embodiments, the display screen is usually arranged on the front panel of the terminal 1000. In some embodiments, the display screen is designed to be a full-screen, a curved screen, a special-shaped screen, a double-sided screen, or a folding screen. In some embodiments, the display screen is also designed to be a combination of a full-screen and a curved screen, a combination of a special-shaped screen and a curved screen, and the like, which are not limited in the present embodiment.

[0162] In addition, those skilled in the art can understand that the structure of the terminal 1000 shown in the above-described figures does not constitute a limitation on the terminal 1000, and the terminal 1000 includes more or fewer components than those shown in the figures, or combines certain components, or different component arrangements. For example, the terminal 1000 further includes a microphone, a speaker, an input unit, a sensor, an audio circuit, a module, a power supply, a Bluetooth module, and the like, which are not described herein.

[0163] The application further provides a computer readable storage medium, which stores at least one program code, the at least one program code is loaded and executed by the processor to implement the malicious application detection method shown in each of the above embodiments.

[0164] The application further provides a chip, which comprises programmable logic circuit and / or program instructions, and is used to implement the malicious application detection method shown in each of the above embodiments when the chip is running on a terminal.

[0165] The application further provides a computer program product, which stores at least one program code, the at least one program code is used to be executed by the processor to implement the malicious application detection method shown in each of the above embodiments.

[0166] The above application embodiment serial numbers are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0167] Those skilled in the art can understand that all or part of the steps of the malicious application detection method of the above-mentioned embodiments can be completed by hardware, or by program to instruct related hardware to complete, and the program can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk. The above is only an optional embodiment of the application, and does not limit the application. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the application shall be included in the protection scope of the application.

Claims

1. A method for detecting malicious applications, characterized in that: Applied to a terminal, the method includes: When the target application is installed, a first node is added to the application graph, where the first node represents the target application. The nodes in the application graph represent the application, application permissions, and interface call behaviors, respectively. The edges in the application graph represent that the application has application permissions and that the application has executed an interface call behavior, respectively. Determining a plurality of target neighbor nodes of the first node, where the target neighbor nodes are used to indicate that the target application has the application permission represented by the target neighbor nodes, or that the target application has executed the interface call behavior represented by the target neighbor nodes; For any target neighbor node, obtaining an initial embedding vector of the target neighbor node, where the initial embedding vector is used to represent application permission features or interface call behavior features; transforming an initial embedding vector of the target neighbor node based on a transformation parameter value of the target neighbor node to obtain an embedding vector of the target neighbor node, wherein the transformation parameter value is related to a type of the target neighbor node, and the embedding vector of the target neighbor node is used to represent an association feature between the first node and the target neighbor node; fusing the embedding vectors of the plurality of target neighbor nodes to obtain an embedding vector of the first node, where the embedding vector of the first node is used to represent at least one of an application permission feature and an interface call behavior feature of the target application; Based on the embedding vector of the first node, the first node is classified to obtain a classification result of the first node, where the classification result is used to indicate whether the target application is a malicious application.

2. The method according to claim 1, characterized in that The transforming the initial embedding vector of the target neighbor node based on the transformation parameter value of the target neighbor node to obtain the embedding vector of the target neighbor node includes: In a case where the type of the target neighbor node is a first type, obtaining a first transformation parameter value, where the first type of node is a node representing application authority; In a case where the type of the target neighbor node is a second type, obtaining a second transformation parameter value, where the second type of node is a node representing an interface call behavior; Based on the first transformation parameter value or the second transformation parameter value, the initial embedding vector of the target neighbor node is transformed by a first transformation function to obtain the embedding vector of the target neighbor node, where the first transformation function is used to transform the vector.

3. The method according to claim 2, characterized in that The method further comprises: Obtaining multiple candidate transformation functions and a weight of each candidate transformation function; Based on a transformation parameter value of a first sample node, transforming an initial embedding vector of the first sample node using each candidate transformation function to obtain an embedding vector output by each candidate transformation function, wherein the first sample node is a node of the first type or a node of the second type in the application graph, and the transformation parameter value is related to the type of the first sample node; Based on the weight of each candidate transformation function, performing weighted summation on the embedding vectors output by each candidate transformation function to obtain the embedding vector of the first sample node; Adjusting the weight of each candidate transformation function based on the embedding vector of the first sample node until the embedding vector of the first sample node meets a condition for ending the adjustment; The candidate transformation function with the highest weight is determined as the first transformation function.

4. The method according to claim 1, wherein The method further comprises: Performing feature extraction on at least one of the application permissions and the interface call behavior executed by the target application to obtain an original feature vector of the first node; Based on a preset transformation parameter value, transforming the original feature vector of the first node by a second transformation function to obtain an initial embedding vector of the first node, wherein the second transformation function is used to transform the vector; An initial embedding vector of the first node and the embedding vector of the first node are fused to obtain an updated embedding vector of the first node.

5. The method according to claim 4, characterized in that The method further comprises: Obtaining multiple candidate transformation functions and a weight of each candidate transformation function; Based on the preset transformation parameter value, transforming the original feature vector of the second sample node by each candidate transformation function to obtain an embedding vector output by each candidate transformation function, where the second sample node is a node representing an application in the application graph; Based on the weight of each candidate transformation function, performing weighted summation on the embedding vectors output by each candidate transformation function to obtain an initial embedding vector of the second sample node; Adjusting the weight of each candidate transformation function based on the initial embedding vector of the second sample node until the initial embedding vector of the second sample node meets a condition for ending adjustment; The candidate transformation function with the highest weight is determined as the second transformation function.

6. The method according to claim 1, characterized in that The fusing the embedding vectors of the multiple target neighbor nodes to obtain the embedding vector of the first node includes: The embedding vectors of the multiple target neighbor nodes are fused through a fusion function to obtain the embedding vector of the first node, and the fusion function is used to fuse the vectors.

7. The method according to claim 6, characterized in that The method further comprises: Obtain multiple candidate fusion functions and the weight of each candidate fusion function; fusing the embedding vectors of multiple third sample nodes through each candidate fusion function to obtain an embedding vector output by each candidate fusion function, wherein the third sample node is a node representing application permissions or a node representing interface call behavior in the application graph; Based on the weight of each candidate fusion function, weighted summation is performed on the embedding vectors output by each candidate fusion function to obtain an embedding vector of a fourth sample node, where the fourth sample node is a node representing an application in the application graph, and the third sample node is a neighbor node of the fourth sample node; Adjusting the weight of each candidate fusion function based on the embedding vector of the fourth sample node until the embedding vector of the fourth sample node meets a condition for ending the adjustment; The candidate fusion function with the highest weight is determined as the fusion function.

8. The method according to claim 1, characterized in that Adding the first node to the application graph includes: Determining, based on the application permissions of the target application and the interface call behavior executed by the target application, at least one second node and at least one third node in the application graph, wherein the second node is a node representing the application permissions, and the third node is a node representing the interface call behavior; In the application graph, connecting the first node to the at least one second node and the at least one third node respectively; The determining of a plurality of target neighbor nodes of the first node includes: In the application graph, the at least one second node and the at least one third node are determined as multiple target neighbor nodes of the first node.

9. A malicious application detection device, characterized in that: The device comprises: an adding module configured to add a first node to an application graph when the target application is installed, the first node being used to represent the target application, the nodes in the application graph representing an application, an application permission, and an interface call behavior, respectively, and the edges in the application graph representing that the application has the application permission and that the application has executed an interface call behavior, respectively; a determination module, configured to determine a plurality of target neighbor nodes of the first node, wherein the target neighbor nodes are used to indicate that the target application has the application permission represented by the target neighbor nodes, or that the target application has executed the interface call behavior represented by the target neighbor nodes; A fusion module is configured to obtain, for any target neighbor node, an initial embedding vector of the target neighbor node, the initial embedding vector being used to represent an application permission feature or an interface call behavior feature; transform the initial embedding vector of the target neighbor node based on a transformation parameter value of the target neighbor node to obtain an embedding vector of the target neighbor node, the transformation parameter value being related to the type of the target neighbor node, the embedding vector of the target neighbor node being used to represent an association feature between the first node and the target neighbor node; and fuse the embedding vectors of the multiple target neighbor nodes to obtain an embedding vector of the first node, the embedding vector of the first node being used to represent at least one of an application permission feature and an interface call behavior feature of the target application program; A classification module is used to classify the first node based on the embedding vector of the first node to obtain a classification result of the first node, where the classification result is used to indicate whether the target application is a malicious application.

10. A terminal, characterized in that: The terminal includes a processor and a memory; the memory stores at least one program code, and the at least one program code is used to be executed by the processor to implement the malicious application detection method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The storage medium stores at least one program code, and the at least one program code is used to be executed by a processor to implement the malicious application detection method according to any one of claims 1 to 8.

12. A chip, characterized in that: The chip includes a programmable logic circuit and / or program instructions, and when the programmable logic circuit and / or program instructions run on the chip, they are used to implement the malicious application detection method according to any one of claims 1 to 8.

13. A computer program product comprising a computer program, characterized in that The computer program includes at least one program code, and the at least one program code is used to be executed by a processor to implement the malicious application detection method according to any one of claims 1 to 8.

Images