Illegal behavior determination method, electronic equipment and computer readable storage medium

Abstract

The invention relates to the technical field of electronics, and provides an illegal behavior determination method, electronic equipment and a computer readable storage medium, the method comprises the following steps: obtaining a website access record in a monitoring time period, the monitoring time period being a time period including an occurrence moment of a suspected behavior; and determining whether the suspected behavior is an illegal behavior or not according to the website access record and a preset illegal website list. According to the method, the illegal behavior identification accuracy can be improved.

Description

Technical Field

[0001] The present application relates to the field of electronic technology, and in particular to an illegal behavior determination method, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the rapid development of terminal devices, the types and number of applications installed on terminal devices are also increasing. Many applications will stay active in the background, and then pop up windows at specific times. Among these pop-up behaviors, some are pop-ups that users need to use normally, that is, pop-ups that users expect, such as chat software will pop up chat windows, taxi software will pop up windows with vehicle arrival information, etc. There are also some pop-ups that users do not expect, such as advertising pop-ups. Usually we need to distinguish these pop-ups, intercept pop-ups that users do not expect, and release pop-ups that users expect. At this time, it is necessary to identify pop-ups that users do not expect.

[0003] In traditional technology, people usually identify the displayed content on the interface where the ad pop-up window appears. If it is identified as an ad pop-up window, it can be blocked.

[0004] However, as advertising formats and content become increasingly diverse, the method of determining whether an ad pop-up is displayed by identifying the displayed content of the window will lead to inaccurate identification results and inability to effectively block ad pop-ups, thus affecting user experience. Summary of the invention

[0005] The present application provides a method, device, chip, electronic device, computer-readable storage medium and computer program product for determining illegal behavior, which can improve the accuracy of illegal behavior identification.

[0006] In a first aspect, a method for determining illegal behavior is provided, comprising: obtaining URL access records within a monitoring period, the monitoring period being a period including the time when the suspected behavior occurs; and determining whether the suspected behavior is illegal behavior based on the URL access records and a preset illegal URL list.

[0007] In this implementation, the terminal device determines whether the current suspected behavior is illegal based on the URLs visited before and after the suspected behavior occurs, combined with a preset list of illegal URLs, which can improve the accuracy of illegal behavior identification. Taking advertising pop-ups as an example, this method can accurately determine whether the pop-up behavior is an advertising pop-up by determining whether the URL visited before and after the pop-up behavior is a known advertising URL. Compared with the judgment method of identifying the content displayed by the pop-up window, it can improve the recognition accuracy of advertising pop-up behavior and consume less power. At the same time, the traditional method of identifying the content displayed in the pop-up window to judge the pop-up window is likely to involve user privacy. For example, the content recognition of the chat pop-up window is likely to involve the user's chat content and other private content. The method adopted by this application does not need to identify the pop-up window content, so there is no risk of leaking user privacy, which is safer.

[0008] In one possible implementation, the URL access record includes: an initial display URL record, which is a record of accessing the initial display URL. Obtaining the URL access record during the monitoring period includes: obtaining the initial display URL, which is the URL accessed by the suspected behavior during the pre-display; recording the initial display URL to obtain the initial display URL record.

[0009] The terminal device can judge whether the suspected behavior is illegal according to the initial display URL recorded in the initial display URL record, and can accurately judge the legality of the suspected behavior at the early stage of the suspected behavior display, with strong timeliness.

[0010] In a possible implementation, after recording the initial display URL and obtaining the initial display URL record, the method includes: sending a resource display request carrying the initial display URL to a resource server, wherein the resource display request also carries a user portrait; receiving resources to be displayed returned by the resource server, wherein the resources to be displayed are resources that the resource server responds to the resource display request and is matched according to the user portrait; and displaying the resources to be displayed.

[0011] After obtaining the initial display URL record, the terminal device can obtain the resources to be displayed that match the user portrait by sending a resource display request carrying the user portrait, so that the displayed resources to be displayed are more targeted to the user.

[0012] In a possible implementation, obtaining the initial display URL includes:

[0013] The APP to be displayed obtains the background startup message of the suspected behavior and sends the initial display URL to the intermediate application;

[0014] Record the initial display URL and obtain the initial display URL record, including:

[0015] The intermediate APP responds to the received initial display URL by sending the domain name of the initial display URL to the domain name resolution module;

[0016] The domain name resolution module records the domain name of the initial display website address and obtains the initial display website address record;

[0017] The domain name resolution module also resolves the domain name of the initial display website to obtain an initial Internet Protocol IP address corresponding to the initial display website;

[0018] The domain name resolution module sends the initial IP address to the intermediate APP;

[0019] Send a resource display request with the initial display URL to the resource server, including:

[0020] The middle APP obtains the user portrait;

[0021] The intermediate APP sends a resource display request to the resource server, and the resource display request also carries the initial IP address;

[0022] Receive the resources to be displayed returned by the resource server, including:

[0023] The intermediate APP receives the resources to be displayed returned by the resource server. The resources to be displayed are the resources matched by the resource server based on the user portrait and the initial IP address.

[0024] Display resources to be displayed, including:

[0025] The middle APP fills the display position according to the resources to be displayed and obtains the display result;

[0026] The intermediate APP sends a filled message to the APP to be displayed, indicating that the resource is ready for display;

[0027] The APP to be displayed responds to the filled message and displays the resources to be displayed according to the display result.

[0028] In a possible implementation, the URL access record also includes: an actual display URL record, which is a record of accessing the actual display URL. Obtaining the URL access record within the monitoring period also includes: obtaining the actual display URL accessed by the resource to be displayed; recording the actual display URL to obtain the actual display URL record.

[0029] The terminal device can determine whether the suspected behavior is an illegal behavior based on the actual display URL recorded in the actual display URL record. Since the actual display URL is the URL accessed when the illegal behavior actually displays the content of the resource to be displayed, it can accurately reflect the source of the resource to be displayed, making the identification of illegal behavior more accurate.

[0030] In a possible implementation manner, the method further includes: sending a successful presentation record of successful presentation of the resource to be presented to a record server, so that the record server performs data settlement according to the successful presentation record.

[0031] After the display is successful, a display success record of the successful display of the resources to be displayed is sent to the record server, which can accurately combine the successful display of the resources to be displayed for data settlement, making the result of data settlement more accurate.

[0032] In a possible implementation, obtaining the actual display URL accessed by displaying the resource to be displayed includes:

[0033] The intermediate APP sends a display success record to the domain name resolution module, and the display success record carries the actual display URL;

[0034] Record the actual display URL and obtain the actual display URL record, including:

[0035] The domain name resolution module records the domain name of the actual displayed website address and obtains the actual displayed website address record;

[0036] Sending a successful display record of the resources to be displayed to the recording server, so that the recording server performs data settlement according to the successful display record, including:

[0037] The intermediate APP sends a display success record to the recording server so that the recording server performs data settlement according to the display success record.

[0038] In one possible implementation, the URL access record includes: a browsing URL record, which is a record of browsing URLs that users need to browse, and obtaining the URL access record within the monitoring period also includes: receiving user operations on the display interface of the resources to be displayed; in response to the user operation, recording the browsing URL corresponding to the user operation, and obtaining a browsing URL record.

[0039] When the resources to be displayed are successfully displayed, the user may further browse related content if he is interested. The terminal device can judge whether the suspected behavior is illegal based on the browsing URL records generated by the browsing URLs visited by the actual user, making the basis for judging illegal behavior more comprehensive and sufficient, and improving the accuracy of illegal behavior identification.

[0040] In a possible implementation, the method further includes: sending a selection result record representing the user's execution of the user operation to a recording server, so that the recording server performs data settlement according to the selection result record.

[0041] In this implementation, user operations can also be recorded to obtain selection result records generated by the user operations. Data settlement based on the selection result records can make the data settlement method more accurate and reasonable.

[0042] In a possible implementation, in response to a user operation, recording a browsed URL corresponding to the selection operation, and obtaining a browsed URL record includes:

[0043] The APP to be displayed analyzes the user operation, obtains the operation event, and sends the operation event to the intermediate APP. The operation event indicates the browsed URL;

[0044] The intermediate APP determines the domain name of the browsing website indicated by the user's operation according to the operation event;

[0045] The intermediate APP sends a user selection request to the domain name resolution module, and the user request carries the domain name of the browsed website;

[0046] The domain name resolution module records the domain name of the browsed website and obtains the browsed website record.

[0047] In one possible implementation, the list of illegal URLs includes at least one URL corresponding to an illegal behavior, the URL access record includes at least one URL to be analyzed and a corresponding number of visits, the URL to be analyzed is any one or more of the initial display URL, the actual display URL, and the browsed URL, and whether the suspected behavior is an illegal behavior is determined based on the URL access record and the preset list of illegal URLs, including: if the URL to be analyzed exists in the list of illegal URLs, and the number of visits corresponding to the URL to be analyzed exceeds a preset threshold, then the suspected behavior is determined to be an illegal behavior.

[0048] Since the preset illegal URL list has already screened out URLs that users do not want to be displayed, and the number of visits represents the frequency of visits to the URL to be analyzed during the suspected behavior, in the face of the high frequency of illegal behavior, combining the illegal URL list and the number of visits corresponding to the URL to be analyzed to determine whether the current suspected behavior is illegal behavior can further improve the accuracy of illegal behavior identification.

[0049] In a possible implementation, determining whether a suspected behavior is an illegal behavior based on the website access records and a preset illegal website list includes: an illegal behavior detection module determining whether a suspected behavior is an illegal behavior based on the website access records and the illegal website list.

[0050] In a possible implementation, the monitoring period includes: a sub-period before the time when the suspected behavior occurs and / or a sub-period after the time when the suspected behavior occurs.

[0051] By obtaining the records of visited URLs in the sub-period before or after the time when the suspected behavior occurred, the URL recorded in the URL access record can be locked near the time when the suspected behavior occurred. At this time, the URL visited by the terminal device and the suspected behavior are more closely related, which can improve the accuracy of illegal behavior identification.

[0052] In a possible implementation, the time when the suspected behavior occurs is the time when the resource to be displayed is displayed.

[0053] In a possible implementation, before obtaining the initial display URL, the method further includes: receiving a screen unlocking operation from a user; and unlocking the screen in response to the screen unlocking operation.

[0054] Before obtaining the access URL record, the terminal device can also first determine whether the current screen state is a locked screen state. If it is a locked screen state, it means that the user is most likely not using the terminal device at this time, so the subsequent illegal behavior will not achieve the desired effect, and there is no need to execute the above illegal behavior determination process to avoid invalid identification, thereby saving resources; if it is an unlocked state, the terminal device can execute the above illegal behavior determination process to identify illegal behavior. Optionally, if the terminal device is in a locked screen state, the user can perform a screen unlock operation to unlock the screen, so that the terminal device is in an unlocked state, and then execute the above illegal behavior determination process to identify illegal behavior, so that resources are effectively utilized.

[0055] In a second aspect, an illegal behavior determination device is provided, comprising a unit composed of software and / or hardware, wherein the unit is used to execute any one of the methods in the technical solution of the first aspect.

[0056] In a third aspect, an electronic device is provided, comprising: a processor, a memory and an interface; the processor, the memory and the interface cooperate with each other so that the electronic device executes any one of the methods in the technical solution described in the first aspect.

[0057] In a fourth aspect, an embodiment of the present application provides a chip, comprising a processor; the processor is used to read and execute a computer program stored in a memory to execute any one of the methods in the technical solution described in the first aspect.

[0058] Optionally, the chip also includes a memory, and the memory is connected to the processor via a circuit or wire.

[0059] Further optionally, the chip also includes a communication interface.

[0060] In a fifth aspect, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the processor executes any one of the methods in the technical solution described in the first aspect.

[0061] In a sixth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run on an electronic device, the electronic device executes any one of the methods in the technical solution described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 is a schematic diagram of the structure of a terminal device 100 provided in an embodiment of the present application;

[0063] Figure 2 is a software structure block diagram of the terminal device 100 provided in an embodiment of the present application;

[0064] Figure 3 This is a flowchart of an illegal application management method provided by an embodiment of the present application;

[0065] Figure 4 This is a flowchart of another illegal application management method provided by an embodiment of the present application;

[0066] Figure 5 This is an interactive flow chart of a traditional advertising pop-up behavior provided in an embodiment of the present application;

[0067] Figure 6 is a flowchart of a method for determining illegal behavior provided in an embodiment of the present application;

[0068] Figure 7 This is a flowchart of a method for obtaining a list of illegal websites provided in an embodiment of the present application;

[0069] Figure 8 This is a schematic diagram of an interactive process of another illegal behavior determination method provided in an embodiment of the present application;

[0070] Fig. 9 It is a structural diagram of an illegal behavior determination device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0071] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0072] In the following, the terms "first", "second", and "third" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", and "third" may explicitly or implicitly include one or more of the features.

[0073] The illegal behavior determination method provided in the embodiments of the present application can be applied to terminal devices such as mobile phones, tablet computers, wearable devices, vehicle-mounted devices, augmented reality (AR) / virtual reality (VR) devices, laptop computers, ultra-mobile personal computers (UMPC), netbooks, personal digital assistants (PDA), etc. The embodiments of the present application do not impose any restrictions on the specific types of terminal devices.

[0074] For example, Figure 1 1 is a schematic diagram of the structure of an example of a terminal device 100 provided in an embodiment of the present application. The terminal device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (USB) interface 130, a charging management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, a button 190, a motor 191, an indicator 192, a camera 193, a display screen 194, and a subscriber identification module (SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyroscope sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity light sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, etc.

[0075] It is understood that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0076] The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Different processing units may be independent devices or integrated into one or more processors.

[0077] The controller may be the nerve center and command center of the terminal device 100. The controller may generate an operation control signal according to the instruction operation code and the timing signal to complete the control of fetching and executing instructions.

[0078] The processor 110 may also be provided with a memory for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may store instructions or data that the processor 110 has just used or cyclically used. If the processor 110 needs to use the instruction or data again, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

[0079] In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, an inter-integrated circuit sound (I2S) interface, a pulse code modulation (PCM) interface, a universal asynchronous receiver / transmitter (UART) interface, a mobile industry processor interface (MIPI), a general-purpose input / output (GPIO) interface, a subscriber identity module (SIM) interface, and / or a universal serial bus (USB) interface, etc.

[0080] The I2C interface is a bidirectional synchronous serial bus, including a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 110 may include multiple groups of I2C buses. The processor 110 may be coupled to the touch sensor 180K, the charger, the flash, the camera 193, etc. through different I2C bus interfaces. For example: the processor 110 may be coupled to the touch sensor 180K through the I2C interface, so that the processor 110 communicates with the touch sensor 180K through the I2C bus interface, thereby realizing the touch function of the terminal device 100.

[0081] The I2S interface can be used for audio communication. In some embodiments, the processor 110 can include multiple I2S buses. The processor 110 can be coupled to the audio module 170 via the I2S bus to achieve communication between the processor 110 and the audio module 170. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 via the I2S interface to achieve the function of answering a call through a Bluetooth headset.

[0082] The PCM interface can also be used for audio communication, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 170 and the wireless communication module 160 can be coupled via a PCM bus interface. In some embodiments, the audio module 170 can also transmit audio signals to the wireless communication module 160 via the PCM interface to realize the function of answering calls via a Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.

[0083] The UART interface is a universal serial data bus for asynchronous communication. The bus can be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, the UART interface is generally used to connect the processor 110 and the wireless communication module 160. For example, the processor 110 communicates with the Bluetooth module in the wireless communication module 160 through the UART interface to implement the Bluetooth function. In some embodiments, the audio module 170 can transmit an audio signal to the wireless communication module 160 through the UART interface to implement the function of playing music through a Bluetooth headset.

[0084] The MIPI interface can be used to connect the processor 110 with peripheral devices such as the display screen 194 and the camera 193. The MIPI interface includes a camera serial interface (CSI), a display serial interface (DSI), etc. In some embodiments, the processor 110 and the camera 193 communicate via the CSI interface to implement the shooting function of the terminal device 100. The processor 110 and the display screen 194 communicate via the DSI interface to implement the display function of the terminal device 100.

[0085] The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 110 with the camera 193, the display 194, the wireless communication module 160, the audio module 170, the sensor module 180, etc. The GPIO interface can also be configured as an I2C interface, an I2S interface, a UART interface, a MIPI interface, etc.

[0086] The USB interface 130 is an interface that complies with the USB standard specification, and specifically can be a Mini USB interface, a Micro USB interface, a USB Type C interface, etc. The USB interface 130 can be used to connect a charger to charge the terminal device 100, and can also be used to transmit data between the terminal device 100 and peripheral devices. It can also be used to connect headphones to play audio through the headphones. The interface can also be used to connect other terminal devices, such as AR devices, etc.

[0087] It is understandable that the interface connection relationship between the modules illustrated in the embodiment of the present application is only a schematic illustration and does not constitute a structural limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may also adopt different interface connection methods in the above embodiments, or a combination of multiple interface connection methods.

[0088] The charging management module 140 is used to receive charging input from a charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 140 may receive charging input from a wired charger through the USB interface 130. In some wireless charging embodiments, the charging management module 140 may receive wireless charging input through a wireless charging coil of the terminal device 100. While the charging management module 140 is charging the battery 142, it may also power the terminal device through the power management module 141.

[0089] The power management module 141 is used to connect the battery 142, the charging management module 140 and the processor 110. The power management module 141 receives input from the battery 142 and / or the charging management module 140, and provides power to the processor 110, the internal memory 121, the external memory, the display screen 194, the camera 193, and the wireless communication module 160. The power management module 141 can also be used to monitor parameters such as battery capacity, battery cycle number, battery health status (leakage, impedance), etc. In some other embodiments, the power management module 141 can also be set in the processor 110. In other embodiments, the power management module 141 and the charging management module 140 can also be set in the same device.

[0090] The wireless communication function of the terminal device 100 can be implemented through the antenna 1, the antenna 2, the mobile communication module 150, the wireless communication module 160, the modem processor and the baseband processor.

[0091] Antenna 1 and antenna 2 are used to transmit and receive electromagnetic wave signals. Figure 1 The structures of antenna 1 and antenna 2 in the figure are only an example. Each antenna in the terminal device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve the utilization of the antennas. For example, antenna 1 can be reused as a diversity antenna for a wireless local area network. In some other embodiments, the antenna can be used in combination with a tuning switch.

[0092] The mobile communication module 150 can provide solutions for wireless communications including 2G / 3G / 4G / 5G applied to the terminal device 100. The mobile communication module 150 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 150 can receive electromagnetic waves from the antenna 1, and filter, amplify, and process the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 150 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 1. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the processor 110. In some embodiments, at least some of the functional modules of the mobile communication module 150 can be set in the same device as at least some of the modules of the processor 110.

[0093] The modem processor may include a modulator and a demodulator. Among them, the modulator is used to modulate the low-frequency baseband signal to be sent into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is passed to the application processor. The application processor outputs a sound signal through an audio device (not limited to a speaker 170A, a receiver 170B, etc.), or displays an image or video through a display screen 194. In some embodiments, the modem processor may be an independent device. In other embodiments, the modem processor may be independent of the processor 110 and be arranged in the same device as the mobile communication module 150 or other functional modules.

[0094] The wireless communication module 160 can provide wireless communication solutions including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., which are applied to the terminal device 100. The wireless communication module 160 can be one or more devices integrating at least one communication processing module. The wireless communication module 160 receives electromagnetic waves via the antenna 2, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 110. The wireless communication module 160 can also receive the signal to be sent from the processor 110, modulate the frequency of it, amplify it, and convert it into electromagnetic waves for radiation through the antenna 2.

[0095] In some embodiments, the antenna 1 of the terminal device 100 is coupled to the mobile communication module 150, and the antenna 2 is coupled to the wireless communication module 160, so that the terminal device 100 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), wideband code division multiple access (WCDMA), time-division code division multiple access (TD-CDMA), long term evolution (LTE), BT, GNSS, WLAN, NFC, FM, and / or IR technology. The GNSS may include a global positioning system (GPS), a global navigation satellite system (GLONASS), a BeiDou navigation satellite system (BDS), a quasi-zenith satellite system (QZSS) and / or a satellite based augmentation system (SBAS).

[0096] The terminal device 100 implements the display function through a GPU, a display screen 194, and an application processor. The GPU is a microprocessor for image processing, which connects the display screen 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 110 may include one or more GPUs, which execute program instructions to generate or change display information.

[0097] The display screen 194 is used to display images, videos, etc. The display screen 194 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the terminal device 100 may include 1 or N display screens 194, where N is a positive integer greater than 1.

[0098] The terminal device 100 can realize the shooting function through ISP, camera 193, video codec, GPU, display screen 194 and application processor.

[0099] ISP is used to process the data fed back by camera 193. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to ISP for processing and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on the noise, brightness, and skin color of the image. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, ISP can be set in camera 193.

[0100] The camera 193 is used to capture still images or videos. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then passes the electrical signal to the ISP to be converted into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the terminal device 100 may include 1 or N cameras 193, where N is a positive integer greater than 1.

[0101] The digital signal processor is used to process digital signals, and can process not only digital image signals but also other digital signals. For example, when the terminal device 100 is selecting a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy.

[0102] Video codecs are used to compress or decompress digital videos. The terminal device 100 may support one or more video codecs. Thus, the terminal device 100 may play or record videos in various coding formats, such as Moving Picture Experts Group (MPEG) 1, MPEG2, MPEG3, MPEG4, etc.

[0103] NPU is a neural network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transmission mode between neurons in the human brain, it can quickly process input information and can also continuously self-learn. Through NPU, applications such as intelligent cognition of the terminal device 100 can be realized, such as image recognition, face recognition, voice recognition, text understanding, etc.

[0104] The external memory interface 120 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the terminal device 100. The external memory card communicates with the processor 110 through the external memory interface 120 to implement a data storage function, such as storing music, video and other files in the external memory card.

[0105] The internal memory 121 can be used to store computer executable program codes, which include instructions. The processor 110 executes various functional applications and data processing of the terminal device 100 by running the instructions stored in the internal memory 121. The internal memory 121 may include a program storage area and a data storage area. Among them, the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc. The data storage area can store data created during the use of the terminal device 100 (such as audio data, a phone book, etc.), etc. In addition, the internal memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0106] The terminal device 100 can implement audio functions such as music playing and recording through the audio module 170, the speaker 170A, the receiver 170B, the microphone 170C, the headphone jack 170D, and the application processor.

[0107] The audio module 170 is used to convert digital audio information into analog audio signal output, and is also used to convert analog audio input into digital audio signals. The audio module 170 can also be used to encode and decode audio signals. In some embodiments, the audio module 170 can be arranged in the processor 110, or some functional modules of the audio module 170 can be arranged in the processor 110.

[0108] The speaker 170A, also called a "speaker", is used to convert an audio electrical signal into a sound signal. The terminal device 100 can listen to music or listen to a hands-free call through the speaker 170A.

[0109] The receiver 170B, also called a "handset", is used to convert audio electrical signals into sound signals. When the terminal device 100 receives a call or voice message, the voice can be received by placing the receiver 170B close to the ear.

[0110] Microphone 170C, also called "microphone" or "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can speak by putting their mouth close to the microphone 170C to input the sound signal into the microphone 170C. The terminal device 100 can be provided with at least one microphone 170C. In other embodiments, the terminal device 100 can be provided with two microphones 170C, which can not only collect sound signals but also realize noise reduction function. In other embodiments, the terminal device 100 can also be provided with three, four or more microphones 170C to realize the collection of sound signals, noise reduction, identification of sound sources, realization of directional recording function, etc.

[0111] The earphone interface 170D is used to connect a wired earphone and can be a USB interface 130 or a 3.5 mm open mobile terminal platform (OMTP) standard interface or a cellular telecommunications industry association of the USA (CTIA) standard interface.

[0112] The pressure sensor 180A is used to sense the pressure signal and can convert the pressure signal into an electrical signal. In some embodiments, the pressure sensor 180A can be set on the display screen 194. There are many types of pressure sensors 180A, such as resistive pressure sensors, inductive pressure sensors, capacitive pressure sensors, etc. The capacitive pressure sensor can be a parallel plate including at least two conductive materials. When a force acts on the pressure sensor 180A, the capacitance between the electrodes changes. The terminal device 100 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 194, the terminal device 100 detects the touch operation intensity according to the pressure sensor 180A. The terminal device 100 can also calculate the touch position according to the detection signal of the pressure sensor 180A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities can correspond to different operation instructions. For example: when a touch operation with a touch operation intensity less than the first pressure threshold acts on the short message application icon, an instruction to view the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, an instruction to create a new short message is executed.

[0113] The gyroscope sensor 180B can be used to determine the motion posture of the terminal device 100. In some embodiments, the angular velocity of the terminal device 100 around three axes (i.e., x, y, and z axes) can be determined by the gyroscope sensor 180B. The gyroscope sensor 180B can be used for anti-shake shooting. For example, when the shutter is pressed, the gyroscope sensor 180B detects the angle of the terminal device 100 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the terminal device 100 through reverse movement to achieve anti-shake. The gyroscope sensor 180B can also be used for navigation and somatosensory game scenes.

[0114] The air pressure sensor 180C is used to measure air pressure. In some embodiments, the terminal device 100 calculates the altitude through the air pressure value measured by the air pressure sensor 180C to assist positioning and navigation.

[0115] The magnetic sensor 180D includes a Hall sensor. The terminal device 100 can use the magnetic sensor 180D to detect the opening and closing of the flip leather case. In some embodiments, when the terminal device 100 is a flip phone, the terminal device 100 can detect the opening and closing of the flip cover according to the magnetic sensor 180D. Then, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, the flip cover automatic unlocking and other features are set.

[0116] The acceleration sensor 180E can detect the magnitude of the acceleration of the terminal device 100 in various directions (generally three axes). When the terminal device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the terminal device and applied to applications such as horizontal and vertical screen switching and pedometers.

[0117] The distance sensor 180F is used to measure the distance. The terminal device 100 can measure the distance by infrared or laser. In some embodiments, when shooting a scene, the terminal device 100 can use the distance sensor 180F to measure the distance to achieve fast focusing.

[0118] The proximity light sensor 180G may include, for example, a light emitting diode (LED) and a light detector, such as a photodiode. The light emitting diode may be an infrared light emitting diode. The terminal device 100 emits infrared light outward through the light emitting diode. The terminal device 100 uses a photodiode to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it can be determined that there is an object near the terminal device 100. When insufficient reflected light is detected, the terminal device 100 can determine that there is no object near the terminal device 100. The terminal device 100 can use the proximity light sensor 180G to detect that the user holds the terminal device 100 close to the ear to talk, so as to automatically turn off the screen to save power. The proximity light sensor 180G can also be used in leather case mode, and pocket mode automatically unlocks and locks the screen.

[0119] The ambient light sensor 180L is used to sense the ambient light brightness. The terminal device 100 can adaptively adjust the brightness of the display screen 194 according to the perceived ambient light brightness. The ambient light sensor 180L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 180L can also cooperate with the proximity light sensor 180G to detect whether the terminal device 100 is in a pocket to prevent accidental touch.

[0120] The fingerprint sensor 180H is used to collect fingerprints. The terminal device 100 can use the collected fingerprint characteristics to achieve fingerprint unlocking, access application locks, fingerprint photography, fingerprint call answering, etc.

[0121] The temperature sensor 180J is used to detect temperature. In some embodiments, the terminal device 100 uses the temperature detected by the temperature sensor 180J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 180J exceeds a threshold, the terminal device 100 reduces the performance of the processor located near the temperature sensor 180J to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is lower than another threshold, the terminal device 100 heats the battery 142 to avoid abnormal shutdown of the terminal device 100 due to low temperature. In other embodiments, when the temperature is lower than another threshold, the terminal device 100 performs a boost on the output voltage of the battery 142 to avoid abnormal shutdown caused by low temperature.

[0122] The touch sensor 180K is also called a "touch panel". The touch sensor 180K can be set on the display screen 194, and the touch sensor 180K and the display screen 194 form a touch screen, also called a "touch screen". The touch sensor 180K is used to detect touch operations acting on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to the touch operation can be provided through the display screen 194. In other embodiments, the touch sensor 180K can also be set on the surface of the terminal device 100, which is different from the position of the display screen 194.

[0123] The bone conduction sensor 180M can obtain a vibration signal. In some embodiments, the bone conduction sensor 180M can obtain a vibration signal of a vibrating bone block of the vocal part of the human body. The bone conduction sensor 180M can also contact the human pulse to receive a blood pressure beat signal. In some embodiments, the bone conduction sensor 180M can also be set in an earphone and combined into a bone conduction earphone. The audio module 170 can parse out a voice signal based on the vibration signal of the vibrating bone block of the vocal part obtained by the bone conduction sensor 180M to realize a voice function. The application processor can parse the heart rate information based on the blood pressure beat signal obtained by the bone conduction sensor 180M to realize a heart rate detection function.

[0124] The key 190 includes a power key, a volume key, etc. The key 190 may be a mechanical key or a touch key. The terminal device 100 may receive key input and generate key signal input related to user settings and function control of the terminal device 100.

[0125] Motor 191 can generate vibration prompts. Motor 191 can be used for incoming call vibration prompts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, audio playback, etc.) can correspond to different vibration feedback effects. For touch operations acting on different areas of the display screen 194, motor 191 can also correspond to different vibration feedback effects. Different application scenarios (for example: time reminders, receiving messages, alarm clocks, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.

[0126] Indicator 192 may be an indicator light, which may be used to indicate charging status, power changes, messages, missed calls, notifications, etc.

[0127] The SIM card interface 195 is used to connect a SIM card. The SIM card can be connected to and separated from the terminal device 100 by inserting the SIM card interface 195 or pulling it out from the SIM card interface 195. The terminal device 100 can support 1 or N SIM card interfaces, where N is a positive integer greater than 1. The SIM card interface 195 can support Nano SIM cards, Micro SIM cards, SIM cards, and the like. Multiple cards can be inserted into the same SIM card interface 195 at the same time. The types of the multiple cards can be the same or different. The SIM card interface 195 can also be compatible with different types of SIM cards. The SIM card interface 195 can also be compatible with external memory cards. The terminal device 100 interacts with the network through the SIM card to implement functions such as calls and data communications. In some embodiments, the terminal device 100 uses an eSIM, i.e., an embedded SIM card. The eSIM card can be embedded in the terminal device 100 and cannot be separated from the terminal device 100.

[0128] The software system of the terminal device 100 may adopt a layered architecture, an event-driven architecture, a micro-core architecture, a micro-service architecture, or a cloud architecture. The present application embodiment takes the Android system of the layered architecture as an example to exemplify the software structure of the terminal device 100.

[0129] Figure 2 1 is a software structure diagram of the terminal device 100 of the embodiment of the present application. The layered architecture divides the software into several layers, each layer has a clear role and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the Android system is divided into four layers, from top to bottom, namely, the application layer, the application framework layer, the Android runtime (Android runtime) and the system library, and the kernel layer. The application layer can include a series of application packages.

[0130] like Figure 2 As shown, the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc. The application package may also include applications to be displayed and may also include intermediate applications.

[0131] The application to be displayed is the application to be promoted, such as shopping APP, film and television APP, etc. The intermediate application is a reference package for executing the application to be displayed, such as an advertising promotion application installation package, also called an advertising promotion software development kit (Software Development Kit, SDK).

[0132] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0133] like Figure 2 As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager (Notification), an activity manager (ActivityManagerService, AMS), a package manager (PackageManagerService, PMS), a power consumption manager (iAware), a behavior sequence collector (Behavior Collect Manager) and a control manager (Add ViewManager), etc.

[0134] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0135] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0136] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0137] The phone manager is used to provide communication functions of the terminal device 100, such as management of call status (including connection, disconnection, etc.).

[0138] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0139] The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, the terminal device vibrates, the indicator light flashes, etc.

[0140] The power consumption manager is used to schedule and manage the power consumption of the whole machine to ensure the performance of the whole machine.

[0141] The package manager is used to manage the information of applications installed by the system, and to query the information of each installation package and the information of applications with hidden icons.

[0142] The behavior sequence collector is used to collect the behavior sequences of logical function modules such as WMS, AMS, PMS, Notification and iAware, and report the behavior sequences that need to be reported to the system manager of the application layer.

[0143] The control manager can cache control rules and provide an interface to query control rules.

[0144] Android runtime includes core libraries and virtual machines. Android runtime is responsible for scheduling and management of the Android system.

[0145] The core library consists of two parts: one part is the function that needs to be called by the Java language, and the other part is the Android core library.

[0146] The application layer and the application framework layer run in a virtual machine. The virtual machine executes the Java files of the application layer and the application framework layer as binary files. The virtual machine is used to perform functions such as object life cycle management, stack management, thread management, security and exception management, and garbage collection.

[0147] The system library may include multiple functional modules, such as surface manager, media libraries, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), domain name resolution module (netd).

[0148] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0149] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0150] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0151] A 2D graphics engine is a drawing engine for 2D drawings.

[0152] The domain name resolution module can resolve the domain name of a website into an IP address to access the corresponding web page.

[0153] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0154] For ease of understanding, the following embodiments of the present application will be described in detail with Figure 1 and Figure 2 Taking the terminal device with the shown structure as an example, the illegal behavior determination method provided in the embodiment of the present application is specifically explained in combination with the accompanying drawings and application scenarios.

[0155] With the rapid development of terminal devices, the types and number of applications installed on terminal devices are also increasing. Many applications will stay active in the background, and then pop up windows at specific times. Among these pop-up behaviors, some are pop-ups that users need to use normally, that is, pop-ups that users expect, such as chat software will pop up chat windows, taxi software will pop up windows with vehicle arrival information, etc. There are also some pop-ups that users do not expect, such as advertising pop-ups. Usually we need to distinguish these pop-ups, intercept pop-ups that users do not expect, and release pop-ups that users expect. At this time, it is necessary to identify pop-ups that users do not expect.

[0156] In traditional technology, people usually identify the displayed content on the interface where the ad pop-up window appears. If it is identified as an ad pop-up window, it can be blocked.

[0157] However, as advertising formats and content become increasingly diverse, the method of determining whether an ad pop-up is displayed by identifying the displayed content of the window will lead to inaccurate identification results and inability to effectively block ad pop-ups, thus affecting user experience.

[0158] The illegal behavior determination method provided in the embodiment of the present application can be used alone in any system and software architecture, and can also be applied to Figure 3 and Figure 4 The technical solution for illegal application control shown in Figure 3 and Figure 4 Based on the shown architecture, the applicable scenarios of the illegal behavior determination method provided in the embodiments of the present application are introduced.

[0159] In order to clearly describe the technical solution of the present application, illegal acts, illegal applications and other related concepts are explained here.

[0160] Illegal behavior (also called rogue behavior or abnormal behavior) refers to some behaviors that are not expected by users on terminal devices, such as pop-up advertisements on the interface of third-party applications, pop-up advertisements on the desktop, pop-up advertisements on the lock screen interface, application icons are transparent, application icons are hidden, application lock screen is disabled, third-party applications use system capabilities to achieve self-startup, third-party applications are pulled up again when running (not on the desktop), impersonating system applications, impersonating system contact data providers, setting for barrier-free startup, etc. The above illegal behaviors can be expressed in illegal behavior sequences.

[0161] Applications that exhibit the above illegal behaviors may be called illegal applications (for simplicity, they are all referred to as illegal applications in the following text, and may also be called rogue applications or abnormal applications). Generally, marking illegal applications may be recording the identifier of the illegal application, such as recording the package name of the illegal application.

[0162] Control path: Each control path corresponds to an illegal behavior. The terminal device can implement control over various illegal behaviors by managing multiple control paths. For example, if an illegal behavior needs to be intercepted or released (not intercepted), it can be achieved by defining interception or non-interception for the control path corresponding to the illegal behavior. Optionally, the control path can be represented by a control path identifier. For example, the control path identifiers of multiple control paths can be named using non-repeating positive integers.

[0163] The control rule is used to describe the way to control the behavior of illegal applications, that is, which illegal behaviors of the illegal application need to be intercepted. The control rule can be expressed by the control path set corresponding to the illegal application, and the control path set includes multiple control paths corresponding to the illegal behaviors that need to be intercepted.

[0164] The control information is information generated based on the results of the control rule query. When the logical function module needs to execute an illegal behavior, it first queries the control manager to see whether the control path corresponding to the illegal behavior exists. Regardless of whether it exists, the control information corresponding to the illegal behavior will be generated. The control information may include the identifier of the illegal application corresponding to the illegal behavior (such as the package name), the control path corresponding to the illegal behavior, and the control result obtained by the query. Among them, the control results include interception or non-interception. If it is found, it means that control is required, and the control result is interception. If it is not found, it means that control is not required, and the control result is non-interception.

[0165] Control rule instantiation is the process of generating control rules corresponding to an application, that is, the process of obtaining a control path set consisting of control paths that need to be controlled corresponding to the application. The result of control rule instantiation is a control path set corresponding to the generated application, which includes control paths corresponding to the behaviors that need to be intercepted.

[0166] For ease of understanding, we first introduce the functional deployment of the technical solution of this application. For details, please refer to Figure 3 As shown, the technical solution can be deployed on the cloud side and the terminal side, and the terminal and cloud are combined to achieve the management of illegal applications. Among them, the cloud side is the cloud side server, and the terminal side is the terminal device.

[0167] Among them, the cloud-side server can be set:

[0168] The big data analysis platform, which can also be called a dot database, is an example of the Hiview big data platform. The big data analysis platform can count the interception results, such as the number of successful interceptions and failed interceptions of illegal applications, and analyze the interception results to evaluate the interception success rate.

[0169] Security cloud platform: used to collect statistics on various behavior sequences reported by the end side, generate behavior sequence distribution rules for summarizing, formatting, distributing and filtering behavior sequences, and then send them to the system manager on the end side; it can also generate a preset illegal list based on various behavior sequences reported by multiple terminal devices and the corresponding interception results, or the smart cloud platform can send the black and white lists of illegal applications and combine them with manual corrections to generate the final preset illegal list for storage, and finally send the final preset illegal list to the end side; it can also generate control rules for each illegal application based on various behavior sequences reported by multiple terminal devices and the corresponding interception results, and store them on the security cloud platform. After that, the configuration file containing the control rules can be sent to the system manager on the end side to implement control. The security cloud platform extracts rules based on group data reported by multiple terminal devices, generates rules quickly, takes effect quickly, and has high accuracy.

[0170] Optionally, the security cloud platform can send the generated various rules and lists to the terminal side at an appropriate time, such as sending them regularly every day, or sending them when the terminal device is charging, connected to Wi-Fi, or idle.

[0171] Smart cloud platform: includes decision-making middle platform and machine learning platform. The machine learning platform is used to summarize various illegal behavior sequences reported from the end side, obtain training samples after calibration, and then perform feature calculation on these training samples to train the model, obtain a trained AI model, and use the AI ​​model for inference and prediction to verify the accuracy of the AI ​​model. It should be noted that the machine learning platform can train two types of AI models, one is the AI ​​model applied to cloud testing, called the cloud testing AI model, and the other is applied to the end side, called the end side AI model.

[0172] The above-mentioned cloud test AI model is a group recognition model. The input data may include multiple behavior sequences reported by multiple terminal devices of multiple users. Then, more complete features can be identified during the recognition process, so the recognition result is more accurate. The cloud test AI model can be expressed as a decision-making middle platform of the cloud test, which can be used to determine whether to trigger management based on the input behavior sequence. If the triggering conditions of the trigger management are met (for example, a timed trigger), the input behavior sequence can be feature analyzed to identify risks and obtain risk identification results. The risk identification result can be the package name and corresponding risk level of the identified illegal application. Then the cloud test AI model manages and distributes the risk identification results. The cloud test AI model can identify illegal applications after the cloud test implementation (after the illegal behavior is implemented on the end side) and generate a black and white list of illegal applications. Optionally, the black and white list of illegal applications generated by the smart cloud platform can be transmitted to the security cloud platform and used as a preset illegal list, or it can be used as a preset illegal application list after manual correction.

[0173] The input data of the above-mentioned end-side AI model is the behavior sequence of a single terminal device, and the recognition result obtained is the recognition result corresponding to the behavior sequence of a single terminal device. It should be noted that the smart cloud platform can also send the trained end-side AI model to the end side through the network, which can be sent to multiple terminal devices for local identification of illegal applications by the terminal devices. The smart cloud platform can also correct and optimize the generated end-side AI model based on the continuously reported behavior data to make the end-side AI model more accurate. When the continuously corrected end-side AI model is sent to the end side, the accuracy of the recognition result can be improved, and it can adapt to the evolution of illegal applications, so as to achieve the effect of continuously combating illegal applications.

[0174] In comparison, the cloud-based AI model is trained by combining training samples from multiple terminal devices, so its recognition accuracy is higher than that of the end-side AI model. The end-side AI model can identify illegal behavior sequences locally on the terminal device, which is faster and consumes less power than the cloud-based AI model.

[0175] The above-mentioned big data analysis platform, smart cloud platform, and security cloud platform can be set up on different cloud-side servers respectively, or on the same cloud-side server, which is not limited to this embodiment of the present application.

[0176] The end-side can include multiple end-devices, which can share various rules, lists, and identification results of cloud testing. Taking one of the end-devices as an example, the application layer of the end-device can install a system manager and set up an end-side identification engine. The system manager and end-side identification engine can provide a set of security services for local rapid identification and timely control of illegal applications.

[0177] The terminal recognition engine can be a terminal AI model issued by the smart cloud platform. The system framework layer of the terminal device includes multiple logical function modules, such as AMS, WMS, PMS, Notification and iAware. For the introduction of each logical function module, please refer to the previous article and will not be repeated here.

[0178] The system framework layer is also equipped with a behavior sequence collector (IHnBehaviorCollectManager), which can collect the behavior sequences reported by each logical function module. The collected behavior sequences can include dynamic behavior sequences that characterize dynamic behaviors and static behavior sequences that characterize static features. The behavior sequence collector can also report the collected behavior sequences to the system manager at the application layer, which will be recognized by the AI ​​model on the input side of the system manager.

[0179] After receiving the behavior sequence reported by the system framework layer, the system manager can first aggregate, format, filter and distribute the data according to the behavior sequence distribution rules issued by the security cloud platform, and filter out the behavior sequences that do not need to be identified. The filtered behavior sequences that need to be identified are then formatted according to the needs of data transmission and input into the end-side AI model (that is, the local AI model of the terminal device) for identification. Optionally, formatting the transmitted data is not a necessary step, but a data processing step to achieve smooth data transmission. It can be understood that in the subsequent evolution of the data format, if the entire process can be executed using a normalized data format, then the step of formatting the transmitted data can be omitted.

[0180] The end-side AI model can include a decision-making middle platform, a computing engine base, and a data middle platform.

[0181] The data center of the end-side AI model is used to manage input and output data, such as caching input behavior sequences, storing recognition results, and distributing input and output data.

[0182] The computing engine foundation is used to manage and infer the AI ​​model on the client side. Model inference is also the process of inference prediction, that is, outputting the inference result based on the input behavior sequence.

[0183] The decision-making center in the end-side AI model can be used to determine whether to trigger reasoning based on system events when inputting a behavior sequence. If the triggering conditions for triggering reasoning are met, such as an application popping up more than three times in a short period of time, or a timed trigger, the input behavior sequence can be feature analyzed, that is, the input computing engine is used to perform model reasoning, and then specific risk identification results are obtained based on the reasoning results output by the computing engine. Finally, the decision-making center manages or distributes the risk identification results (for example, sending them to the system manager for management, and reporting to the smart cloud platform).

[0184] The risk identification results of the decision-making platform in the end-side AI model can also be integrated with the preset illegal list downloaded from the security cloud platform in the system manager to output the final risk identification results. The risk identification results can include the package name of the illegal application and the corresponding risk level.

[0185] The system manager can also parse the configuration files of the control rules issued by the security cloud platform to instantiate the control rules, which are then sent to the control manager at the application framework layer to implement control.

[0186] When the logic function module needs to execute an illegal behavior, it can query the control path corresponding to the illegal behavior in the control manager. Among them, the control manager is used to cache the control rules of each illegal application that needs to be controlled, and provide an interface for the logic function module to query. If the control path corresponding to the illegal behavior that needs to be executed exists in the package control list of the control manager, it means that the illegal behavior needs to be controlled, and the logic function module does not execute the subsequent process of the illegal behavior. In terms of pop-up behavior, no pop-up window will appear. If the control path corresponding to the illegal behavior that needs to be executed is not in the package control list of the control manager, it means that the illegal behavior does not need to be controlled, and the logic function module continues to execute the illegal behavior. In terms of pop-up behavior, the pop-up window will continue to appear.

[0187] The system manager can also obtain the list of viruses detected by the virus detection engine. When illegal behavior occurs, it first determines whether the illegal behavior is the behavior of the virus application. If so, it directly executes the control policy corresponding to the virus application. If not, the behavior sequence of the illegal behavior is input into the end-side AI model for identification. Among them, the control policy is used to describe which behaviors of the application are blocked and which are not blocked.

[0188] The illegal application control process described in the embodiment of the present application may include the following processes: triggering the collection of illegal behavior sequences, distributing illegal behavior sequences, triggering and identifying risk levels, and illegal application control.

[0189] 1. Triggering the collection of illegal behavior sequences:

[0190] When the logic function module executes a behavior (action), it will output a behavior sequence representing the behavior to complete the execution of the action. The behavior sequence collector can collect the behavior sequence and cache it.

[0191] Usually, the behavior sequence collector can also store the behavior sequence whitelist issued by the system manager, which includes multiple behavior sequences that need to be monitored. Each behavior sequence in the behavior sequence whitelist can also carry the corresponding package name (pkg) and / or behavior sequence identifier (bid), so the behavior sequence whitelist can be a table (bid list) including behavior sequence identifiers of multiple behavior sequences that need to be monitored.

[0192] Specifically, the behavior sequence collector can compare the behavior sequence reported by the logic function module with the behavior sequence whitelist. If the behavior sequence reported by the logic function module is in the behavior sequence whitelist, it means that the behavior sequence is an illegal behavior sequence that needs to be collected, that is, it is necessary to start monitoring the behavior sequence, then the behavior sequence collector can report the behavior sequence to the system manager. If the behavior sequence reported by the logic function module is not in the behavior sequence whitelist, it means that the behavior sequence is not an illegal behavior sequence at present, or it is an illegal behavior sequence that has not yet been identified. It does not need to be collected temporarily, and no attention is required, that is, there is no need to start monitoring the behavior sequence. The behavior sequence collector can directly discard the behavior sequence and no longer report it, and it will not trigger the monitoring process for illegal behavior sequences. This can avoid reporting invalid behavior sequences and avoid wasting resources.

[0193] Optionally, the above-mentioned behavior sequence whitelist can be a configuration file including illegal behavior sequences that need to be monitored sent by the security cloud platform to the system manager on the terminal side, which is parsed by the system manager and then sent to the behavior sequence collector of the application framework layer for screening; optionally, the behavior sequence whitelist can also be pre-set in the system manager of the terminal device, parsed and then sent to the behavior sequence collector of the application framework layer, and subsequently regularly updated according to the configuration file of illegal behavior sequences that need to be monitored sent by the security cloud platform to ensure the accuracy of illegal behavior sequence reporting. The embodiments of the present application are not limited to this.

[0194] From the perspective of the entire process of application management, taking the execution of pop-up behavior as an example, the control process for illegal applications can specifically include: when the logical function module needs to execute a pop-up behavior, the WMS first queries the control manager to see whether there is a control path corresponding to the behavior sequence of the pop-up behavior.

[0195] If the control path corresponding to the pop-up behavior already exists in the control manager, it means that the pop-up behavior has been controlled, and the behavior sequence corresponding to the pop-up behavior does not need to be reported to the system manager, and there is no need to start monitoring the pop-up behavior, so as to avoid waste of resources caused by invalid monitoring. WMS can directly control according to the queried control rules. At this time, regardless of whether the pop-up behavior is intercepted or not, the control information corresponding to this query will be generated and recorded, and then uploaded to the system manager. Optionally, the control information may include: the package name of the application of the pop-up behavior, the control path and control result of the pop-up behavior (the control result of the pop-up behavior can be controlled, intercepted, or not intercepted or not controlled). Among them, the control path is the control method of the behavior sequence, and each control path can correspond to a behavior sequence. The control path is described in detail below, which will not be repeated here.

[0196] If there is no control path for the pop-up behavior in the control manager, such as when the terminal device is newly turned on or has just been restored to factory settings, it means that the corresponding control rules have not yet been instantiated for the pop-up behavior. In other words, when WMS queries the behavior sequence of the pop-up behavior in the control manager and there is no corresponding control path, WMS will still execute the pop-up behavior as usual. Optionally, the control information of the pop-up behavior can also be recorded by the control manager and then uploaded to the system manager. For example, the control information at this time may include, but is not limited to: the package name of the application of the pop-up behavior, the control path of the pop-up behavior, and the control result (the control result of the pop-up behavior is not controlled or not intercepted).

[0197] It should be noted that the illegal behavior sequence reported by the behavior sequence collector to the system manager indicates that the application that performs the illegal behavior is a suspicious application. The next step is to identify the suspicious application as an illegal application, thereby triggering the illegal application control process; or the system manager can combine the monitored system events, filter out the illegal behavior sequences that do not need to be identified and the behavior sequences required by other recognition engines, and then select the illegal behavior sequences that need to be controlled to identify illegal applications and trigger the illegal application control process.

[0198] 2. Distribute illegal behavior sequences:

[0199] Specifically, the system manager can pre-process the illegal behavior sequences reported by the application management layer according to the behavior sequence distribution rules issued by the security cloud platform, including but not limited to behavior sequence aggregation, formatting, filtering and distribution, to obtain illegal applications to be identified that need to be identified. Among them, filtering illegal behavior sequences can be to screen out behavior sequences that need to be identified and input them into the end-side AI model, and distribute other data that do not need to be identified to their corresponding recognition engines, such as distributing anti-fraud behavior sequences to anti-fraud recognition engines, or distributing virus application behavior sequences to virus application recognition engines.

[0200] A behavior sequence distribution module can also be set up in the system manager. The behavior sequence distribution module can pre-process the illegal dynamic behavior sequences output by the illegal application data analysis module, the system events output by the system event monitoring module, the self-started applications output by the self-started application monitoring module, and the illegal static behavior sequences output by the application feature analysis module, such as behavior sequence aggregation, formatting and filtering, and then distribute the filtered illegal behavior sequences that need to be monitored to the end-side AI model (also known as the end-side decision-making middle platform) and the management database. Optionally, the control information of the above-mentioned different behavior sequences can be reported to the system manager through the control manager, and the system manager's behavior sequence distribution module sends the control information to the management database. Optionally, the behavior sequence distribution module formats the illegal behavior sequences to adapt to the needs of data transmission.

[0201] It should be noted that the above trigger control process can be to add the illegal applications corresponding to the above illegal behavior sequence to the risk control center for control, or to input the illegal behavior sequence into the end-side AI model for direct identification, so as to obtain the risk level corresponding to the illegal behavior sequence, and finally implement different control strategies according to the risk level. For details about the risk control center and control strategy, please refer to the description below, which will not be repeated here.

[0202] 3. Trigger and identify risk levels:

[0203] The terminal device can use the end-side AI model of the application layer to identify the input illegal behavior sequence and obtain the risk level of the illegal application to which the illegal behavior sequence belongs. Exemplarily, the risk level can be divided into level one, level two, level three and level four, or even more levels; it can also be divided into high level (high risk), medium level (medium risk) and low level (low risk). Different risk levels correspond to different management and control strategies. The higher the risk level, the stricter the management and control strategy. In the embodiment of the present application, the number of risk levels is not limited, and the risk level can be divided into a larger number of risk levels according to the sophistication requirements of the management and control.

[0204] Optionally, the end-side AI model may be a trained model issued by the smart cloud platform. The end-side AI model may perform fixed rule recognition and / or AI recognition on the input illegal behavior sequence.

[0205] Optionally, before the end-side AI model performs fixed rule recognition and / or AI recognition, the input illegal behavior sequence may be first identified based on a preset illegal list issued by the security cloud platform:

[0206] Optionally, the preset illegal list may include an illegal blacklist and / or an illegal whitelist. The illegal blacklist may include at least one package name of an illegal application whose risk level has been identified, that is, the illegal blacklist may include at least one package name of an illegal application and the risk level corresponding to each package name. The illegal whitelist may also include at least one package name that has been identified as not an illegal application.

[0207] Specifically, the end-side AI model can first search for the package name corresponding to the illegal behavior sequence in the preset illegal list. If the package name of the illegal behavior sequence exists in the illegal blacklist, there is no need to perform fixed rule recognition or AI recognition. The risk level of the package name corresponding to the illegal behavior sequence in the illegal blacklist can be directly obtained. The risk level is also the risk level of the illegal application to which the illegal behavior sequence belongs.

[0208] If the package name of the illegal behavior sequence exists in the illegal whitelist, it means that the illegal application to which the illegal behavior sequence belongs is actually not illegal, but legal. For example, although pop-ups appear continuously in common chat apps, they are message pop-ups, which are the behavior expected by users. The terminal device can remove the illegal application corresponding to the illegal behavior sequence from the risk control center and no longer monitor the illegal application.

[0209] Optionally, the preset illegal list may also include a virus list. Among them, the virus list may include a virus blacklist and a virus whitelist. The virus blacklist represents a list of applications that are determined to be virus applications, and the virus whitelist represents a list of applications that are determined not to be virus applications. If the package name of the illegal behavior sequence exists in the virus blacklist, it can be directly determined that the package name of the illegal behavior sequence corresponds to the highest risk level, or the risk level specific to the virus application, and the most stringent control policy corresponding to the virus application is executed. If the package name of the illegal behavior sequence exists in the virus whitelist, it can be directly determined that the package name of the illegal behavior sequence does not correspond to the highest risk level, and other control policies other than the most stringent control policy corresponding to the virus application can be executed. Optionally, the above-mentioned virus list may be the result of killing by a virus engine. The virus engine may be a module separated from the end-side AI model, or a module integrated in the end-side AI model specifically for killing viruses. The embodiments of the present application are not limited to this.

[0210] Optionally, if the package name of the illegal behavior sequence does not exist in the above-mentioned preset illegal list, it means that the illegal behavior sequence is a behavior sequence generated by an unrecognized application and needs to be identified. The end-side AI model can be used to perform fixed rule identification and / or AI identification to obtain the identification result.

[0211] First, fixed rule identification is introduced: Usually, the system manager can receive the configuration file including fixed rules issued by the security cloud platform and parse it to obtain the fixed rules, or it can use the fixed rules preset in the system manager, and then judge the input illegal behavior sequence according to the fixed rules. Optionally, if the fixed rules cannot identify the risk level, the illegal behavior sequence can continue to be AI identified to obtain the risk level. Fixed rules may include, but are not limited to, the number of pop-up windows in a fixed time period exceeds the first number threshold for high risk, the number of pop-up windows exceeding the second number threshold and less than the first number threshold for medium risk, and the number of pop-up windows exceeding the third number threshold and less than the second number threshold for low risk, where the first number threshold is greater than the second number threshold, and the second number threshold is greater than the third number threshold.

[0212] Next, we will introduce AI recognition: the function module that performs AI recognition can be the function module of AI recognition in the end-side AI model trained by the smart cloud platform. The function module of AI recognition can perform feature analysis on the input illegal behavior sequence to obtain the recognition result.

[0213] Optionally, the above-mentioned process of determining whether to trigger the identification process and identifying the list according to the preset illegal list can be executed by using separate functional modules, or can be integrated with fixed rule identification and AI identification in the end-side AI model for execution. When integrated in the end-side AI model for execution, the entire identification process can be decoupled from the control process, and only the illegal behavior sequence needs to be input into the end-side AI model, thereby realizing the decoupling of the identification process and facilitating deployment.

[0214] Optionally, the end-side AI model may also use fixed rule recognition to obtain a rule recognition result on the one hand, and use AI recognition to obtain an AI recognition result on the other hand, and then select one of the rule recognition result and the AI ​​recognition result as the final recognition result.

[0215] Optionally, the end-side AI model may first adopt fixed rule recognition. If the rule recognition result can be obtained, the fixed rule recognition is more efficient. If the fixed rule cannot be recognized, the illegal behavior sequence can continue to be AI recognized to improve the recognition rate.

[0216] If the end-side AI model identifies an illegal application, the illegal application and the corresponding risk level are added to the illegal blacklist so that the next time the behavior sequence appears, there is no need to identify it, and the identification result can be obtained directly by querying the illegal blacklist in the preset illegal list.

[0217] Optionally, the end-side AI model may first identify the illegal behavior sequence to obtain a preliminary identification result, and then modify the preliminary identification result according to the virus application list.

[0218] For example, if the package name of the application is not in the virus application list (empty or NA), the final identification result shall be based on the preliminary identification result. That is, if the preliminary identification result is high risk, the final identification result is high risk; if the preliminary identification result is medium risk, the final identification result is medium risk; if the preliminary identification result is low risk, the final identification result is low risk; if the preliminary identification result is not a risky application (that is, an illegal application whitelist), the final identification result is not a risky application. If the virus application list indicates that the application is a virus blacklist (determined to be a virus), and the preliminary identification result of the illegal application is empty, the final identification result is high risk, that is, it is treated as a virus; if the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application is empty, the final identification result is not a virus application. If the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application is empty, the final identification result is not a virus application. If the virus application list indicates that the application is not a virus (whitelist of virus applications), and the preliminary identification result of the illegal application is high risk or medium risk, the final identification result is medium risk.

[0219] Optionally, after the identified illegal application is added to the illegal blacklist, when the illegal behavior of the illegal application occurs, the control rule instantiation can be triggered to obtain the control rule corresponding to the illegal application, and then control is performed according to the control rule.

[0220] Optionally, the end-side AI model can also report illegal behavior sequences to the smart cloud platform at regular intervals, and the smart cloud platform retrains or corrects the end-side AI model based on the illegal behavior sequences reported by the terminal devices, making the end-side AI model more accurate. After the smart cloud platform collects a variety of different illegal behavior sequences (i.e., group data) reported by more terminal devices, it can train the end-side AI model more comprehensively and accurately. The updated end-side AI model can be sent to the end-side at an appropriate time. Usually, management tools such as aiSplitAPK are set up on the smart cloud platform, which can be used to manage the end-side AI model, such as managing the download or update of the end-side AI model. When the smart cloud platform sends the updated end-side AI model to the end-side, even if some illegal behaviors that have not appeared before appear on the current terminal device, and these illegal behaviors have been reported by other terminal devices, then the terminal device that currently accepts the updated end-side AI model does not need to wait until the illegal behavior occurs itself and spends a certain amount of time and resources to identify it by itself, and can accurately identify the illegal application through the new end-side AI model and manage it in time. This approach can achieve end-to-end cloud integration and rapid identification when faced with the situation where illegal applications are generated too quickly, thus playing a long-term role in combating illegal applications.

[0221] In other words, the end-side AI model and the cloud-side AI model can collaborate with each other to form an end-cloud combined AI recognition engine. Next, the end-cloud combined AI recognition engine is described based on functional deployment.

[0222] Among them, the end-side AI model includes a data middle platform, which can obtain the dotting data through the data dotting interface and upload it to the smart cloud platform for model training and data analysis on the smart cloud platform. Among them, the dotting data is the collected illegal behavior sequence, such as illegal dynamic behavior sequence, illegal static behavior sequence and system event. Optionally, the illegal dynamic behavior sequence may include a sequence of behaviors such as pop-up window events, chart hiding and transparency, system application pulling up third-party applications, and third-party application background starting activity; illegal static behavior sequences include but are not limited to: application installation source, whether it is set as a device manager application and other static features corresponding to the sequence; it may also include: user feedback data, such as user processing information after risk control reminders, user cleaning background / uninstalling application information after pop-up windows. Optionally, dotting data access can be in the "point management" system, applying for the corresponding dotting data ID, software version (version) and each dotting field that needs to be dotted, after which the data analysis tool will send the dotting data to the data middle platform through a preset interface. Optionally, the data middle platform can also store the dotting data, support data query, and aging.

[0223] 4. Illegal application control:

[0224] After the risk level is identified, different control strategies can be implemented according to the risk level. In order to implement differentiated control strategies, in the embodiment of the present application, different control path identifiers (path IDs) are defined to represent different control paths, and then control is implemented through the control paths.

[0225] Specifically, a control path identifier is defined for each control path (path ID) to represent it. The control path can be represented by a non-repeating identifier, such as a non-repeating integer, and each control path corresponds to an illegal behavior. Optionally, different illegal behaviors can also include different startup methods or startup paths for behaviors that users do not expect. For example, the lock screen interface pop-up window corresponding to control path 1001; the desktop background pop-up window corresponding to control path 1002; and the pop-up window on the interface of the third-party application corresponding to control path 1003. Although these three control paths all represent pop-up behaviors, the corresponding startup methods are different. In some embodiments, each control path can be represented by a globally unique integer. The control path can support expansion and continuous evolution. For example, when it is necessary to add control of new illegal behaviors, a new control path can be used to uniquely represent the newly added illegal behavior, and the control path that has been used before or has been abandoned will not be reused. If an unused control path needs to be abandoned, this unused control path will no longer be reused for other illegal behaviors, thereby ensuring the uniqueness of the control path. In this way, even if the old and new system versions are used interchangeably between different terminal devices during the system version iteration, the uniqueness of the control path can ensure that the control strategy is compatible with the old and new versions, and there will be no logical confusion. In addition, for abandoned control paths, the corresponding illegal behaviors will no longer be controlled and will be released by default, that is, the illegal behaviors will no longer be intercepted, which can reduce invalid interception behaviors and save system resources.

[0226] Optionally, the evolution of the control path can also be reflected in the subdivision of the control path. For example, the initial control path of the pop-up behavior is 100, and 100 represents the pop-up behavior of all startup methods. But later it was discovered that not all pop-up behaviors can meet usage needs by executing the same control method. Then the pop-up behavior can be subdivided into three types according to the startup method: lock screen interface pop-up, desktop / background pop-up, and third-party application interface pop-up. The three new control path identifiers 1001, 1002, and 1003 are added to represent them one by one, so that differentiated control can be performed for different startup methods of pop-up behaviors, achieving fine-grained control, making the control strategy more accurate, and improving the user experience. The original control path 100 can be discarded and no longer used.

[0227] Next, we will introduce how to implement control strategies for applications with different risk levels based on the control paths.

[0228] Specifically, the terminal device can receive the control rule configuration file issued by the security cloud platform through the system manager. The system manager can parse the control rule configuration file to obtain the control path set corresponding to different risk levels, and then obtain the control path set corresponding to the application program of different risk levels based on the risk level corresponding to the application program, thereby realizing the instantiation of the control rules. The control rules in the above control rule configuration file may include general control rules. Taking the different risk levels including high risk, medium risk and low risk as an example, the general control rules may include: control path set 1 corresponding to low risk, control path set 2 corresponding to medium risk and control path set 3 corresponding to high risk.

[0229] For example, it can be expressed in the following form:

[0230] Low risk (low): [1001, 1002, 1003...], indicating the control paths that low-risk applications need to control (control path set 1);

[0231] Medium risk (middle): [2001, 2002, 2003...], indicating the control paths (control path label set 2) that need to be controlled for medium risk level applications;

[0232] Medium risk (high): [2100001, 2100002, 2100003...], indicating the control paths (control path set 3) that need to be controlled for high-risk applications.

[0233] In some embodiments, common rules can also be divided into fixed common rules (CommonPolicy) corresponding to fixed identification rules and AI common rules (aiCommonPolicy) identified by AI. If the risk level is identified by a fixed rule, it is managed and controlled according to the fixed common rules. If the risk level is identified by AI, it can be managed and controlled according to the AI ​​common rules. Which one is executed can be determined based on the identification source in the identification result. Optionally, the control paths for different risk levels of fixed common rules and AI common rules may be consistent, or there may be certain differences.

[0234] Optionally, in addition to general rules, the above control rules may also include special rules. Special rules may include some control rules for specific applications, such as separate control rules for blacklist applications. Special rules include, but are not limited to, any one or more combinations of package name, risk level, control date, added control path, and removed control path.

[0235] Exemplarily, generating the control policy logic for pkg1 (that is, the process of instantiating the control rules) includes: obtaining the collection of control paths corresponding to the current risk level of the current pkg1 from the general rules issued by the cloud side, then adding the control paths added in the special rules of pkg1 issued by the cloud side, and finally deleting the control paths removed from the special rules of pkg1 issued by the cloud side, to obtain the final set of all paths that need to be controlled corresponding to pkg1. This process is called control rule instantiation, and the final set of all paths that need to be controlled corresponding to pkg1 is the result of instantiating the control rules for pkg1.

[0236] In the above control strategies, since the results obtained by AI recognition have not been manually reviewed and confirmed, the corresponding control strategies may be different from the control strategies corresponding to the applications in the illegal blacklist. The control rules can be configured differently for these two situations. The specific method can be to define differentiated control rules based on different identification sources.

[0237] It should be noted that if the user targets an application that has already generated instantiation results, the user can adjust the control strategy through the risk control center. Specifically, the user can turn on or off the control corresponding to a certain control path on the risk details page corresponding to the application, and the system manager will update the control path set in the instantiation result according to the user operation. For example, when the user changes the notification control from off to on, it means that the user does not want to see the notification, and the system manager will delete the control path corresponding to the notification from the originally instantiated control path set; when the user changes the background pop-up control from on to off, it means that the user allows the background pop-up, and the system manager will add the control path corresponding to the background pop-up to the originally instantiated control path set. After that, the updated new control path set will be sent to the control manager to implement control.

[0238] Optionally, after the control rules are instantiated, the instantiation results can be stored in the system housekeeper. When the system housekeeper discovers the first occurrence of illegal behavior, it can trigger the instantiation results to be sent to the control manager. The control manager can store the instantiation results, that is, store the control rule table, and provide an interface for WMS, iAWare and other logical function modules to query. When the logical function module performs illegal behavior again, it can first query the control rule table in the control manager. If the queried control path exists in the control rule table, it means that the illegal behavior corresponding to the control path needs to be controlled, and the illegal behavior will not continue to be executed, thereby achieving control of the illegal behavior. If the queried control path does not exist in the control rule table, it means that the illegal behavior corresponding to the control path does not need to be controlled, and the illegal behavior will continue to be executed.

[0239] For a comprehensive and systematic introduction to the technical solutions of the embodiments of the present application, please refer to Figure 4 The architecture diagram shown includes:

[0240] S1201. The security cloud platform issues behavior sequence distribution rules to the system manager.

[0241] S1202. The security cloud platform sends control rules for illegal behavior to the system manager.

[0242] S1203. The security cloud platform sends a preset illegal list to the system manager.

[0243] S1204. The smart cloud platform receives the behavior sequence reported by the terminal side and collects the behavior characteristics.

[0244] S1205. The smart cloud platform performs behavioral characteristic analysis based on the data collected based on the behavioral characteristics.

[0245] S1206. The smart cloud platform trains an AI model based on the results of the behavior feature analysis. The AI ​​model may include a device-side AI model and a cloud-side AI model.

[0246] S1207. The smart cloud platform sends the trained end-side AI model to the terminal device. The end-side AI model carries fixed recognition rules. The smart cloud platform can also use the trained cloud-testing AI model to identify the risk level of illegal behavior sequences on the cloud side.

[0247] S1208: The smart cloud platform performs behavioral feature analysis based on the collected behavioral sequences and obtains an initial illegal list, which may include an illegal blacklist and an illegal whitelist, and may also include an initial virus list.

[0248] S1209. The security cloud platform receives the results of manual review and correction of the initial illegal list, and obtains a preset illegal list or an updated preset illegal list.

[0249] S1210. The logic function module queries the illegal behavior sequence in the control manager to obtain the control result corresponding to the illegal behavior sequence.

[0250] S1211A: When the control result is no control, the illegal behavior sequence is reported to the behavior sequence collector. Then, S1212 is executed.

[0251] S1211B. When the control result is control, the illegal behavior corresponding to the illegal behavior sequence will no longer be executed.

[0252] S1212: The behavior sequence collector reports the illegal behavior sequence to the behavior sequence distribution module of the system manager.

[0253] S1213. The behavior sequence distribution module filters illegal behavior sequences and sends the illegal behavior sequences that need to be monitored to the end-side AI model for identification.

[0254] S1214. The end-side AI model identifies the risk level corresponding to the illegal behavior sequence.

[0255] S1215. The system manager obtains the final risk level based on the identified risk level and the preset illegal list.

[0256] S1214 and S1215 can also be that the system manager first queries the preset illegal list. If there is an illegal behavior sequence in the preset illegal list, the subsequent process can be executed according to the corresponding risk level in the preset illegal list; if there is no illegal behavior sequence in the preset illegal list, continue to input the end-side AI model for identification to obtain the risk level.

[0257] S1216. When the illegal behavior sequence is triggered next time, the system manager triggers the instantiation of the control rules according to the risk level and sends the instantiation results to the control manager.

[0258] S1217. When the illegal behavior sequence is triggered again, the control rules in the control manager are queried to obtain the control result, which is used to control the illegal behavior sequence.

[0259] S1218. The control manager collects the control results and reports them to the system manager.

[0260] S1219. The system manager reports the management and control results to the big data analysis platform.

[0261] S1220. The big data analysis platform sends the statistical control results to the security cloud platform for generating new or updated behavior sequence distribution rules, control rules, and preset illegal lists, etc.

[0262] It should be noted that Figure 4 The order of the numbering of the steps in the example is only an example and is not used to limit the order of execution of the steps. Figure 4 The execution of the various steps in the process is interleaved and can be in any order if the steps do not conflict with each other. Figure 4 For a detailed description of each step in the above, please refer to the relevant description in the previous text, which will not be repeated here.

[0263] It should be noted that the timing for sending various data of Cloud Testing to the end side can be when the end side sends it during idle time or at a scheduled time, as long as it does not affect the control of illegal applications on the end side.

[0264] First, the pop-up process of traditional advertising pop-up behavior is explained: Specifically, a mobile APP and an advertising promotion APP are installed on the terminal device. Among them, the mobile APP is an APP that needs to display resources, such as a shopping APP, a film and television APP; the advertising promotion APP can be an APP that pushes resources to the mobile APP, such as an advertising SDK. The advertising promotion APP can interact with the advertising resource retrieval server and the advertising event recording server to obtain resource display records. For details, please refer to Figure 5 As shown:

[0265] S501. The mobile APP pops up an advertisement preview interface at the advertisement display position.

[0266] S502: The mobile APP sends information of a pop-up advertisement preview interface to the advertisement promotion APP.

[0267] S503: The advertising promotion APP obtains the user identity of the terminal device.

[0268] S504: The advertising promotion APP sends an advertising request carrying the user's identity information to an advertising resource search server.

[0269] S505: The advertisement resource retrieval server retrieves advertisement resources according to the advertisement request.

[0270] S506: The advertising resource retrieval server returns the retrieved advertising resources to the advertising promotion APP.

[0271] S507. The advertising promotion APP analyzes the advertising resources and fills the advertising display positions according to the analyzed advertising resources.

[0272] S508. The advertising promotion APP sends display location information to the mobile APP.

[0273] S509. The mobile APP displays advertising content.

[0274] S510. The mobile APP returns display success information to the advertising promotion APP.

[0275] S511. The advertising promotion APP sends a display record request to the advertising event recording server.

[0276] S512: The advertising event recording server records the display record for settlement.

[0277] S513: When the user clicks in the interface of the displayed advertisement content, the mobile APP parses the click event.

[0278] S514. The mobile APP sends the parsed click event to the advertising promotion APP.

[0279] S515. The advertising promotion APP sends a display record request triggered by the user click to the advertising event record server again.

[0280] S516. The advertising event recording server records the display record again for settlement.

[0281] Figure 5 In the process shown, the mobile APP interacts with the advertising resource retrieval server and the advertising event recording server respectively through the advertising promotion APP to complete the advertising pop-up behavior and obtain the advertising display record.

[0282] The illegal behavior determination method provided in the embodiment of the present application can be used for the above Figure 3 and Figure 4 The scenario shown in the figure can also be used in other scenarios, and the present application embodiment does not limit this. Figure 3 and Figure 4 In the scenario, the illegal behavior can be explained by taking the example of an advertisement pop-up window. When a pop-up window behavior appears on the terminal device, the illegal behavior determination method provided in the application embodiment can be used to determine whether the current pop-up window behavior is an illegal advertisement pop-up window behavior based on the URL visited before and after the pop-up window behavior occurs, so that the advertisement pop-up window behavior can be accurately identified. This method can improve the recognition accuracy of advertisement pop-up window behavior and has lower power consumption. At the same time, the traditional method of identifying the content displayed in the pop-up window to judge the pop-up window is prone to involve user privacy. For example, the content recognition of the chat pop-up window is prone to involve the user's chat content and other private content. The method adopted by this application does not need to identify the pop-up window content, so there is no risk of leaking user privacy, which is safer.

[0283] The method for determining illegal behavior provided in the embodiment of the present application can be as follows: Figure 6 As shown, including:

[0284] S601. Obtain website access records within a monitoring period, where the monitoring period is a period including the time when the suspected behavior occurs.

[0285] Specifically, when a suspected behavior occurs on the terminal device, the time when the suspected behavior occurs is used as the time node, and the sub-period before and / or after the time node is obtained according to the preset configuration, and the sub-period is the monitoring period. The URL visited during the monitoring period may be the URL visited by the suspected behavior, and the record of the URL visited during the monitoring period is the URL access record.

[0286] For example, the monitoring period may be five seconds before and five seconds after the time when the suspected behavior occurs, or the monitoring period may be only five seconds after the time when the suspected behavior occurs.

[0287] Taking pop-up behavior as an example, the terminal device can use the time when the pop-up window is successfully displayed as the time when the suspected behavior occurs, and the period within ten seconds from five seconds before and five seconds after the pop-up window is successfully displayed as the monitoring period to obtain the URL access records within these ten seconds.

[0288] Specifically, the terminal device can query a historical website access list within a longer period of time, and obtain the website access records within the monitoring period.

[0289] Optionally, the terminal device may also take the time when the suspected behavior occurs as a time node, and directly start recording the visited URLs within the monitoring period including the time node, thereby obtaining the URL access record within the monitoring period.

[0290] Optionally, the website access record may include the website accessed by the terminal device when executing the suspected behavior, and the number of visits corresponding to the website.

[0291] S602: Determine whether the suspected behavior is an illegal behavior based on the website access record and a preset illegal website list.

[0292] Specifically, the terminal device can receive the illegal website list sent by the cloud side, for example, it can receive the illegal website list sent by the security cloud platform during idle time, or it can receive the illegal website list shared by other terminal devices, or it can read the illegal website list preset by the local device.

[0293] Optionally, the illegal website list may include domain names, IP addresses or other forms of website identifiers of illegal websites. Optionally, the illegal website list may also include a blacklist and / or a whitelist, wherein the blacklist may include websites that are determined not to be visited by the user, and the whitelist may include websites that are determined to be visited by the user.

[0294] The terminal device can query the illegal website list according to the website in the website access record. If the website in the illegal website list that the user does not expect has been visited, the suspected behavior can be determined to be illegal. If the visited website is not the website in the illegal website list that the user does not expect, the suspected behavior can be determined not to be illegal.

[0295] Optionally, if a URL has been visited in the URL access record and the URL is an unexpected URL in the illegal URL list, it can be directly identified as an illegal URL, and the suspected behavior performed by visiting the URL can be identified as an illegal behavior. This method of identification based on the illegal URL list is simple and direct, and has high identification efficiency.

[0296] Optionally, if a URL in the URL access record is accessed more than a certain preset number of times, and the URL is a URL that the user does not expect in the illegal URL list, then the URL can be determined to be an illegal URL, and the suspected behavior performed by accessing the URL is an illegal behavior. Optionally, the preset number threshold can be a natural number such as 5, 8, 10, etc., as long as it can accurately reflect the characteristics of illegal behavior. For example, the illegal URL list includes advertising URL 1, and the URL access record includes advertising URL 1 and the number of times advertising URL 1 is accessed is 10 times, then the terminal device can determine that the suspected behavior performed during the monitoring period of obtaining the URL access record is an illegal advertising pop-up behavior.

[0297] Optionally, if the number of visits is relatively small, for example, the URL is only visited once during the monitoring period, this access record may be caused by other behaviors, not illegal behaviors. In this case, there is no need to directly determine that the suspected behavior is illegal behavior, and it can be re-determined based on the URL access records monitored subsequently.

[0298] If a URL in the URL access record has been visited more than a certain preset number of times, and the URL is an unexpected URL in the list of illegal URLs, the suspected behavior is directly determined to be an illegal behavior. This method of determining the suspected behavior as an illegal behavior by adding the condition that the number of visits exceeds the preset number of times, combined with the high frequency feature of illegal behavior, can avoid the misidentification of low-frequency URLs, thereby improving the recognition accuracy.

[0299] Above Figure 6 In the illustrated embodiment, the terminal device determines whether the current suspected behavior is illegal based on the URLs visited before and after the suspected behavior occurs, combined with a preset list of illegal URLs, which can improve the accuracy of illegal behavior identification. Taking ad pop-ups as an example, this method can accurately determine whether the pop-up behavior is an ad pop-up by determining whether the URL visited before and after the pop-up behavior is a known ad URL. Compared with the judgment method of identifying the content displayed by the pop-up window, it can improve the accuracy of identifying ad pop-up behaviors, and has lower power consumption. At the same time, the traditional method of identifying the content displayed by the pop-up window to judge the pop-up window is likely to involve user privacy. For example, the content identification of the chat pop-up window is likely to involve the user's chat content and other private content. The method adopted by this application does not need to identify the pop-up window content, so there is no risk of leaking user privacy, which is safer.

[0300] Optionally, before obtaining the access URL record, the terminal device can also first determine whether the current screen state is a locked screen state. If it is a locked screen state, it means that the user is most likely not using the terminal device at this time, and the subsequent illegal behavior will not achieve the desired effect, so there is no need to execute the above illegal behavior determination process to avoid invalid identification, thereby saving resources; if it is an unlocked state, the terminal device can execute the above illegal behavior determination process to identify illegal behavior. Optionally, if the terminal device is in a locked screen state, the user can perform a screen unlock operation to unlock the screen, so that the terminal device is unlocked, and then execute the above illegal behavior determination process to identify illegal behavior.

[0301] Optionally, the screen unlocking operation may be inputting an unlocking password, inputting an unlocking fingerprint, or inputting an unlocking face, which is not limited in the embodiments of the present application.

[0302] Optionally, taking the illegal behavior as an advertisement pop-up window as an example, the method for obtaining the above illegal website list can be specifically referred to Figure 7 It should be noted that the Figure 7 The method shown can be executed by a terminal device or by a cloud server, such as a smart cloud platform, to obtain a list of illegal websites. The list of illegal websites can then be stored on a secure cloud platform for download and use by other terminal devices to achieve resource sharing. Here, the terminal device is used as the execution subject for an exemplary description, and the method may include:

[0303] S701. Obtain multiple initial advertisement URLs.

[0304] Specifically, the domain names of multiple advertising servers and resource servers can usually be stored on an advertising aggregation website, and the terminal device can download multiple advertising URLs from the advertising URL aggregation website to obtain multiple initial advertising URLs, or a list of multiple initial advertising URLs.

[0305] S702: Format multiple initial advertisement URLs to obtain a normalized advertisement URL set.

[0306] The embodiment of the present application does not limit the specific form of formatting, and a normalized domain name may be extracted, or a normalized IP address may be extracted.

[0307] S703: Summarize the advertisement URLs in the normalized advertisement URL set to obtain an advertisement URL list.

[0308] S704: Remove duplicate advertisement URLs in the advertisement URL list to obtain a streamlined advertisement URL set.

[0309] The terminal device deletes duplicate URLs in the advertisement URL list, which can reduce the amount of data and thus obtain a streamlined advertisement URL set.

[0310] S705 , deleting the URLs in the advertisement whitelist from the streamlined set of advertisement URLs, and adding the URLs in the advertisement blacklist to obtain a final list of advertisement URLs.

[0311] The advertisement blacklist is a list of URLs that are determined to be advertisements, and the advertisement whitelist is a list of URLs that are determined not to be advertisements.

[0312] Optionally, a possible implementation of step S601 may include:

[0313] When the logic function module of the terminal device is about to execute a suspected behavior, it outputs a suspected behavior sequence corresponding to the suspected behavior. The suspected behavior sequence corresponds to a website to be visited, which can be recorded as the initial display website.

[0314] Taking the suspected behavior as a pop-up behavior as an example, the pop-up window will have a corresponding display position to be displayed. Among them, the display position can be one of the positions such as the entire screen, the notification bar, and the floating window on the interface of other applications. The embodiment of the present application does not limit the display position.

[0315] When the logic function module of the terminal device is to execute the pop-up behavior, the terminal device records the initial display URL to obtain the initial display URL record. The initial display URL record can be used as the above URL access record, or a part of the URL access record.

[0316] Optionally, after the terminal device obtains the above-mentioned initial display website record, it can also continue to obtain the website that is actually visited to complete the suspected behavior, and obtain the actual display website record. The above-mentioned step S601 can also include:

[0317] Among them, when displaying the resources to be displayed, it is necessary to access the actual display URL to obtain the resources to be displayed. The terminal device can obtain the actual display URL accessed to display the resources to be displayed, and record the actual display URL to obtain the actual display URL record. Taking the resources to be displayed as advertising resources as an example, the terminal device can obtain the actual display URL actually accessed when the advertisement pops up by querying the URL corresponding to the advertising resources, and record the actual display URL to obtain the actual display URL record.

[0318] When the logic function module of the terminal device executes the pop-up behavior, the terminal device records the actual displayed URL to obtain the actual displayed URL record. The actual displayed URL record can be used as the above URL access record or a part of the URL access record.

[0319] Optionally, after the display of the resource to be displayed is successful, the terminal device may also send a display success record of the display of the resource to be displayed to the recording server, and after receiving the display success record, the recording server may perform data settlement according to the display success record. Optionally, the data settlement may be a settlement of data such as fees. If the resource to be displayed is an advertising resource, the data settlement may be a settlement of advertising fees.

[0320] Optionally, when the resource to be displayed is successfully displayed, if the user is interested in the content displayed by the resource, he or she may view the resource or click on a link of interest. At this time, the terminal device can receive user input operations on the display interface of the resource to be displayed, such as a click operation on the terminal device screen, or an operation of selecting a control on the display interface by user voice input, or an operation of annotating a control with the user's eyes to select the control. These operations can be collectively referred to as user operations, which can characterize the degree of user interest in the currently displayed content. The embodiments of the present application are not limited.

[0321] It should be noted that when the user performs the above user operation, the terminal device can respond to the user operation and record the URL visited in response to the user operation as the browsed URL. The terminal device can record the browsed URL as a browsed URL record.

[0322] Taking the resource to be displayed as an advertising resource as an example, the terminal device can display the display interface of the advertising pop-up window. If the user is interested in the content of the advertisement, he may click the control therein. In response to the click operation, the terminal device will access the URL corresponding to the control to jump to a new web page to display the content that the user wants to view. At this time, the URL jumped to can be recorded as the browsing URL. The terminal device records the browsing URL to obtain a browsing URL record. The browsing URL record can be used as the above-mentioned URL access record, or a part of the URL access record.

[0323] Optionally, after the resource corresponding to the browsing URL is successfully displayed, the terminal device can also record the user operation, obtain a selection result record representing that the user has performed the user operation, and send the selection result record to the recording server, indicating that the resource to be displayed is successfully displayed. After receiving the selection result record, the recording server can perform data settlement based on the selection result record.

[0324] Optionally, the above-mentioned URL access record may include one or more of the initial display URL record, the actual display URL record and the browsed URL record, and the terminal device may determine whether the suspected behavior is an illegal behavior based on one or more of the initial display URL record, the actual display URL record and the browsed URL record. Specifically, no matter which of the initial display URL record, the actual display URL record and the browsed URL record may be included in the URL access record, the URL in the URL access record may be used as the URL to be analyzed, and the URL access record may also include the number of visits corresponding to the URL to be analyzed.

[0325] Optionally, the initial display URL, the actual display URL, and the browsed URL may be the same or different. For example, if the URL access record includes the initial display URL record, the actual display URL record, and the browsed URL record, the number of visits corresponding to the initial display URL record, the actual display URL record, and the browsed URL record are one, two, and three times, respectively, and they are all the same URL, then it can be determined that the number of visits to the URL to be analyzed is six.

[0326] Optionally, the time of occurrence of the above-mentioned suspected behavior can also be the time when the resource to be displayed is successfully displayed, or when feedback information of the successful display of the resource to be displayed is obtained, for example, the time when the advertising window is successfully popped up or the feedback information of the successful pop-up advertising window is received. At this time, the monitoring period is a period of five seconds before and after the successful pop-up window. Since the resource to be displayed is successfully displayed, it means that the URLs visited during this monitoring period are likely to be strongly related to the suspected behavior, and the setting of the monitoring period, compared to only obtaining the URLs visited at the time of occurrence, can comprehensively and completely obtain all the URLs visited during the execution of the suspected behavior, such as the initial display URL record, the actual display URL record and the browsed URL record. Comprehensive data can make the judgment of illegal behavior more sufficient and the judgment result more accurate.

[0327] Afterwards, the terminal device can determine whether the suspected behavior is an illegal behavior according to the method in S602 above, which will not be repeated here.

[0328] In order to more clearly introduce the technical solution of this application, Figure 8 The illegal behavior determination method described in the embodiment of the present application is fully described with the software module, such as Figure 8 As shown, including:

[0329] S801: Receive a screen unlocking operation from a user.

[0330] S802: In response to a screen unlocking operation, unlock the screen.

[0331] Optionally, S801 and S802 may also be replaced by executing step S803 when there is no operation on the system desktop or the user is using other APPs normally.

[0332] S803: The APP to be displayed obtains a background startup message of the suspected behavior.

[0333] The background start message is used to indicate that a suspected behavior is started in the background.

[0334] S804: The APP to be displayed responds to the background start message and sends an initial display URL to the intermediate APP. The initial display URL is a URL that needs to be accessed when the resource to be displayed is pre-displayed at the display location.

[0335] S805 . The intermediate APP sends the domain name of the initial display URL to the domain name resolution module in response to the received initial display URL.

[0336] S806. The domain name resolution module records the domain name of the initial display website address to obtain an initial display website address record.

[0337] Specifically, when performing domain name (DNS) resolution, the domain name resolution module (netd) can cache multiple linked URLs, for example, 512 URL records, and provide a URL record interface for query.

[0338] Optionally, the format of recording the URL in the embodiment of the present application may be: user identification (UID), access time and domain name. Of course, it may also be other formats, including other content, as long as it can meet the needs.

[0339] S807. The domain name resolution module further resolves the domain name of the initial display website to obtain an initial IP address corresponding to the initial display website.

[0340] S808. The domain name resolution module sends the initial IP address to the intermediate APP.

[0341] S809, the intermediate APP obtains the user portrait.

[0342] The user portrait may include a user ID and corresponding labels, such as gender, age, preferences in various aspects, etc.

[0343] S810. The intermediate APP sends a resource display request to the resource server. The resource display request also carries an initial IP address.

[0344] S811. The resource server matches the user portrait and the initial IP address, obtains the resources to be displayed, and sends them to the intermediate APP.

[0345] Specifically, the resource server searches for resources according to the initial IP address, and selects resources to be displayed that match the user based on the user portrait, and then sends the resources to be displayed to the intermediate APP.

[0346] S812: The intermediate APP receives the resources to be displayed returned by the resource server, and fills the display positions according to the resources to be displayed to obtain the display results.

[0347] Specifically, the intermediate APP fills the display position according to the resources to be displayed, that is, renders the resources to be displayed, and obtains the display results required to display the resources to be displayed for subsequent display.

[0348] S813. The intermediate APP sends a filled message to the to-be-displayed APP, indicating that the resources are ready for display.

[0349] S814: The APP to be displayed responds to the filled message and displays the resources to be displayed according to the display result.

[0350] After receiving the filled message, the APP to be displayed determines that the resource display can be performed normally, and then displays the resources to be displayed according to the filled display results.

[0351] S815. The intermediate APP sends a message indicating that the display has been successful to the illegal behavior detection module, and the illegal behavior detection module starts timing.

[0352] At this time, the illegal behavior detection module can start timing when receiving the message that the display has been successful, such as starting a timer. The timing moment can be used as the time when the suspected behavior occurs, and the sub-periods before and after the timing moment can be the monitoring period.

[0353] S816. The APP to be displayed feeds back a display success record to the intermediate APP.

[0354] After the to-be-displayed APP successfully displays the to-be-displayed resource, a display success record indicating the successful display may be fed back to the intermediate APP.

[0355] S817. The intermediate APP sends a display success record to the domain name resolution module, and the display success record carries the actual display URL.

[0356] Specifically, after the intermediate APP receives the display success record, it sends it to the domain name resolution module.

[0357] S818. The domain name resolution module records the domain name of the actual displayed website address to obtain a record of the actual displayed website address.

[0358] The domain name resolution module records the actual display URL carried in the received display success record to obtain an actual display URL record.

[0359] S819. The intermediate APP sends a display success record to the record server.

[0360] S820. The recording server performs data settlement according to the display success record.

[0361] S821. The APP to be displayed receives and analyzes the user operation on the display interface of the resource to be displayed, obtains an operation event, and sends the operation event to the intermediate APP, where the operation event indicates the browsing URL.

[0362] Optionally, the APP to be displayed may also send relevant information of the user operation to the intermediate APP, and the intermediate APP parses and obtains the operation event. The embodiment of the present application does not limit which APP parses and obtains the operation event.

[0363] S822. The intermediate APP determines the domain name of the browsing URL indicated by the user operation according to the operation event, and sends a user selection request to the domain name resolution module, where the user request carries the domain name of the browsing URL.

[0364] S823. The domain name resolution module records the domain name of the browsed website and obtains a browsed website record.

[0365] At this time, if the count starts from the time when the time is set, the monitoring period may have ended, and the URLs visited during the monitoring period are recorded in the URL access record.

[0366] S824. The intermediate APP sends a selection result record representing the user's execution of the user operation to the recording server.

[0367] S825. The recording server performs data settlement according to the selection result records.

[0368] S826. The illegal behavior detection module requests to obtain the website access record, and determines whether the suspected behavior is an illegal behavior based on the website access record.

[0369] Above Figure 8 The detailed description of the steps shown can also be found in the relevant description in the previous text, which will not be repeated here. Figure 8 The execution order of the steps shown in the figure does not necessarily have to be performed according to the serial numbers between the steps. The execution order between the steps can also be swapped without affecting the implementation. The embodiment of the present application does not limit the execution order of the steps, as long as the entire process can be executed.

[0370] The above describes in detail an example of the method provided by the present application. It is understandable that, in order to implement the above functions, the corresponding device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0371] The present application can divide the illegal behavior determination device into functional modules according to the above method example. For example, each function can be divided into each functional module, or two or more functions can be integrated into one module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0372] Fig. 9 The schematic diagram of the structure of an illegal behavior determination device provided by the present application is shown. The device 900 includes:

[0373] The acquisition module 901 is used to acquire the website access records within a monitoring period, where the monitoring period is a period including the time when the suspected behavior occurs.

[0374] The determination module 902 is used to determine whether the suspected behavior is an illegal behavior based on the website access record and the preset illegal website list.

[0375] In some embodiments, the URL access record includes: an initial display URL record, which is a record of accessing the initial display URL. The acquisition module 901 is specifically used to obtain the initial display URL, which is the URL accessed by the suspected behavior during pre-display, and record the initial display URL to obtain the initial display URL record.

[0376] In some embodiments, the device 900 also includes: a display module, which is used to send a resource display request carrying an initial display URL to a resource server, the resource display request also carrying a user portrait, receive resources to be displayed returned by the resource server, the resources to be displayed are resources that the resource server responds to the resource display request and is matched according to the user portrait, and display the resources to be displayed.

[0377] In some embodiments, the acquisition module 901 is specifically configured to:

[0378] The APP to be displayed obtains the background startup message of the suspected behavior and sends the initial display URL to the intermediate application;

[0379] The intermediate APP responds to the received initial display URL by sending the domain name of the initial display URL to the domain name resolution module;

[0380] The domain name resolution module records the domain name of the initial display website address and obtains the initial display website address record;

[0381] The domain name resolution module also resolves the domain name of the initial display website to obtain an initial Internet Protocol IP address corresponding to the initial display website;

[0382] The domain name resolution module sends the initial IP address to the intermediate APP;

[0383] The middle APP obtains the user portrait;

[0384] The intermediate APP sends a resource display request to the resource server, and the resource display request also carries the initial IP address;

[0385] The intermediate APP receives the resources to be displayed returned by the resource server. The resources to be displayed are the resources matched by the resource server based on the user portrait and the initial IP address.

[0386] The middle APP fills the display position according to the resources to be displayed and obtains the display result;

[0387] The intermediate APP sends a filled message to the APP to be displayed, indicating that the resource is ready for display;

[0388] The APP to be displayed responds to the filled message and displays the resources to be displayed according to the display result.

[0389] In some embodiments, the URL access record also includes: an actual display URL record, which is a record of accessing the actual display URL. The acquisition module 901 is specifically used to obtain the actual display URL accessed by the resource to be displayed, and record the actual display URL to obtain the actual display URL record.

[0390] In some embodiments, the display module is further used to send a display success record of successful display of the resource to be displayed to the record server, so that the record server performs data settlement according to the display success record.

[0391] In some embodiments, the acquisition module 901 is specifically configured to:

[0392] The intermediate APP sends a display success record to the domain name resolution module, and the display success record carries the actual display URL;

[0393] The domain name resolution module records the domain name of the actual displayed website address and obtains the actual displayed website address record;

[0394] The display module is specifically used to enable: the intermediate APP to send a display success record to the recording server, so that the recording server performs data settlement according to the display success record.

[0395] In some embodiments, the URL access record includes: a browsing URL record, which is a record of browsing URLs that the user needs to browse. The acquisition module 901 is specifically used to receive user operations on the display interface of the resources to be displayed; in response to the user operation, the browsing URL corresponding to the user operation is recorded to obtain a browsing URL record.

[0396] In some embodiments, the display module is further used to send a selection result record representing the user's execution of the user operation to the recording server, so that the recording server performs data settlement according to the selection result record.

[0397] In some embodiments, the acquisition module 901 is specifically configured to:

[0398] The APP to be displayed analyzes the user operation, obtains the operation event, and sends the operation event to the intermediate APP. The operation event indicates the browsed URL;

[0399] The intermediate APP determines the domain name of the browsing website indicated by the user's operation according to the operation event;

[0400] The intermediate APP sends a user selection request to the domain name resolution module, and the user request carries the domain name of the browsed website;

[0401] The domain name resolution module records the domain name of the browsed website and obtains the browsed website record.

[0402] In some embodiments, the list of illegal URLs includes at least one URL corresponding to an illegal behavior, and the URL access record includes at least one URL to be analyzed and the corresponding number of visits. The determination module 902 is specifically used to determine that the suspected behavior is an illegal behavior when the URL to be analyzed exists in the list of illegal URLs and the number of visits corresponding to the URL to be analyzed exceeds a preset threshold.

[0403] In some embodiments, the determination module 902 is specifically configured to enable the illegal behavior detection module to determine whether the suspected behavior is an illegal behavior based on the website access records and the illegal website list.

[0404] In some embodiments, the monitoring period includes: a sub-period before the time when the suspected behavior occurs and / or a sub-period after the time when the suspected behavior occurs.

[0405] In some embodiments, the time when the suspected behavior occurs is the time when the resource to be displayed is displayed.

[0406] In some embodiments, the acquisition module 901 is further used to receive a screen unlocking operation of the user before acquiring the initial display URL, and unlock the screen in response to the screen unlocking operation.

[0407] The present application also provides an electronic device, including the above processor. The electronic device provided by this embodiment can be Figure 1 The terminal device 100 shown is used to execute the above-mentioned illegal behavior determination method. In the case of an integrated unit, the terminal device may include a processing module, a storage module and a communication module. Among them, the processing module can be used to control and manage the actions of the terminal device, for example, it can be used to support the terminal device to execute the steps performed by the display unit, the detection unit and the processing unit. The storage module can be used to support the terminal device to execute and store program codes and data, etc. The communication module can be used to support the communication between the terminal device and other devices.

[0408] Among them, the processing module can be a processor or a controller. It can implement or execute various exemplary logic boxes, modules and circuits described in conjunction with the disclosure of this application. The processor can also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processor (DSP) and a microprocessor, etc. The storage module can be a memory. The communication module can specifically be a device that interacts with other terminal devices, such as a radio frequency circuit, a Bluetooth chip, a Wi-Fi chip, etc.

[0409] In one embodiment, when the processing module is a processor and the storage module is a memory, the terminal device involved in this embodiment may be a Figure 1 Device of the structure shown.

[0410] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the processor executes the illegal behavior determination method described in any of the above embodiments.

[0411] The embodiment of the present application also provides a computer program product. When the computer program product is run on a computer, the computer is caused to execute the above-mentioned related steps to implement the illegal behavior determination method in the above-mentioned embodiment.

[0412] Among them, the electronic device, computer-readable storage medium, computer program product or chip provided in this embodiment are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above and will not be repeated here.

[0413] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, the replaced units may or may not be physically separated, and the components displayed as units may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0414] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0415] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0416] The above contents are only specific implementation methods of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for determining illegal behavior, characterized in that: include: Obtaining website access records within a monitoring period, wherein the monitoring period is a period including the time when the suspected behavior occurs; According to the website access record and a preset illegal website list, it is determined whether the suspected behavior is an illegal behavior.

2. The method according to claim 1, characterized in that: The website access record includes: an initial display website record, the initial display website record is a record of accessing the initial display website, and the website access record obtained during the monitoring period includes: Obtaining the initial display URL, where the initial display URL is the URL visited by the suspected behavior during the pre-display; The initial display URL is recorded to obtain the initial display URL record.

3. The method according to claim 2, characterized in that The recording of the initial display URL, after obtaining the initial display URL record, includes: Sending a resource display request carrying the initial display URL to a resource server, wherein the resource display request also carries a user portrait; receiving a resource to be displayed returned by the resource server, wherein the resource to be displayed is a resource matched by the resource server in response to the resource display request and according to the user profile; The resource to be displayed is displayed.

4. The method according to claim 3, characterized in that The obtaining of the initial display URL comprises: The application program APP to be displayed obtains the background startup message of the suspected behavior and sends the initial display URL to the intermediate APP; The recording of the initial display URL to obtain the initial display URL record includes: The intermediate APP sends the domain name of the initial display website to the domain name resolution module in response to the received initial display website; The domain name resolution module records the domain name of the initial display website to obtain the initial display website record; The domain name resolution module also resolves the domain name of the initial display website to obtain an initial Internet Protocol IP address corresponding to the initial display website; The domain name resolution module sends the initial IP address to the intermediate APP; The sending of the resource display request carrying the initial display URL to the resource server includes: The intermediate APP obtains the user portrait; The intermediate APP sends the resource display request to the resource server, where the resource display request also carries the initial IP address; The receiving the resource to be displayed returned by the resource server includes: The intermediate APP receives the to-be-displayed resource returned by the resource server, where the to-be-displayed resource is a resource matched by the resource server according to the user portrait and the initial IP address; The displaying of the resource to be displayed includes: The intermediate APP fills the display position according to the resources to be displayed to obtain a display result; The intermediate APP sends a filled message indicating that the resource display is ready to the APP to be displayed; The APP to be displayed responds to the filled message and displays the resource to be displayed according to the display result.

5. The method according to claim 4, characterized in that The website access record also includes: an actual display website record, wherein the actual display website record is a record of accessing the actual display website, and the website access record obtained during the monitoring period also includes: Obtaining the actual display URL accessed to display the resource to be displayed; The actual display URL is recorded to obtain the actual display URL record.

6. The method according to claim 5, characterized in that The method further comprises: A display success record indicating that the resource to be displayed is successfully displayed is sent to a record server, so that the record server performs data settlement according to the display success record.

7. The method according to claim 6, characterized in that The step of obtaining the actual display URL to be accessed for displaying the resource to be displayed includes: The intermediate APP sends a display success record to the domain name resolution module, and the display success record carries the actual display URL; The recording of the actual display URL to obtain the actual display URL record includes: The domain name resolution module records the domain name of the actual display website to obtain the actual display website record; The step of sending a successful display record of the resource to be displayed to a record server so that the record server performs data settlement according to the successful display record includes: The intermediate APP sends the display success record to the record server, so that the record server performs data settlement according to the display success record.

8. The method according to any one of claims 4 to 7, characterized in that The website access record includes: a browsing website record, which is a record of browsing websites that the user needs to browse, and the website access record obtained during the monitoring period also includes: Receiving a user operation on the display interface of the resource to be displayed; In response to the user operation, the browsing URL corresponding to the user operation is recorded to obtain the browsing URL record.

9. The method according to claim 8, characterized in that The method further comprises: A selection result record representing the user's execution of the user operation is sent to a record server, so that the record server performs data settlement according to the selection result record.

10. The method according to claim 9, characterized in that The step of recording the browsed URL corresponding to the selection operation in response to the user operation to obtain the browsed URL record includes: The to-be-displayed APP analyzes the user operation to obtain an operation event, and sends the operation event to the intermediate APP, wherein the operation event indicates the browsed URL; The intermediate APP determines the domain name of the browsing website indicated by the user operation according to the operation event; The intermediate APP sends a user selection request to the domain name resolution module, wherein the user request carries the domain name of the browsed website; The domain name resolution module records the domain name of the browsed website to obtain the browsed website record.

11. The method according to claim 1, characterized in that The illegal website list includes at least one website corresponding to an illegal behavior, the website access record includes at least one website to be analyzed and the corresponding number of visits, the website to be analyzed is any one or more of an initial display website, an actual display website, and a browsed website, and determining whether the suspected behavior is an illegal behavior based on the website access record and the preset illegal website list includes: If the URL to be analyzed exists in the list of illegal URLs, and the number of visits corresponding to the URL to be analyzed exceeds a preset number threshold, the suspected behavior is determined to be an illegal behavior.

12. The method according to claim 11, characterized in that Determining whether the suspected behavior is an illegal behavior based on the website access record and the preset illegal website list includes: The illegal behavior detection module determines whether the suspected behavior is an illegal behavior based on the website access record and the illegal website list.

13. The method according to any one of claims 4 to 12, characterized in that The monitoring period includes: a sub-period before the time when the suspected behavior occurs and / or a sub-period after the time when the suspected behavior occurs.

14. The method according to claim 13, characterized in that The time when the suspected behavior occurs is the time when the resource to be displayed is displayed.

15. The method according to claim 3, characterized in that Before obtaining the initial display URL, the method further includes: Receive the user's screen unlock operation; In response to the screen unlocking operation, the screen is unlocked.

16. An electronic device, characterized in that: include: Processors, memory, and interfaces; The processor, the memory and the interface cooperate with each other so that the electronic device executes the method as claimed in any one of claims 1 to 15.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 15.

Images