Application category feature library construction method, identification method, storage medium and terminal

Abstract

The embodiment of the invention provides an application category feature library construction method, an identification method, a storage medium and a terminal, and the method comprises the steps: determining an application set corresponding to each application category in an application category set, obtaining one or more feature information in registration file information, API call information and integrated SDK information of each application in the application set, and each kind of feature information is converted into a corresponding feature vector so as to measure the behavior features of the application. And generating one or more category feature vectors of the application categories corresponding to the application set according to the one or more feature vectors of each application in the application set to measure behavior features of the application categories, and forming an application category feature library by using the one or more category feature vectors of all the application categories in the application category set. By applying the method, accurate and efficient category identification of the applications can be realized, and by automatically classifying the applications, the application ecology can be better understood and managed, and the user experience and safety are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an application category feature library construction method, an identification method, a storage medium and a terminal. Background Art

[0002] With the rapid development of mobile Internet, the number of smartphone applications (Apps) has exploded, covering various categories such as social, entertainment, games, and finance. Different types of applications often exhibit specific behavior patterns, which can be identified by analyzing the operation and usage characteristics of the applications. For example, social applications usually frequently call APIs for contacts, messaging, and location services, and integrate SDKs related to instant messaging and social media; game applications tend to frequently call APIs for graphics rendering, sound processing, and user input, and integrate SDKs related to advertising, payment, and game engines.

[0003] Traditional application classification methods mainly rely on manual review and keyword matching. These methods are not only inefficient, but also difficult to cope with the increasingly complex and changing application behavior patterns. Therefore, there is an urgent need for an automated classification method based on application behavior characteristics, which can accurately and efficiently classify and identify applications by analyzing the behavior characteristics of applications. Summary of the invention

[0004] The embodiment of the present invention provides an application category feature library construction method, identification method, storage medium and terminal, which obtains category feature vectors corresponding to multiple application categories through one or more feature information in the application registration file information, API call information and integrated SDK information, and forms an application category feature library. It can realize accurate and efficient classification and identification of applications.

[0005] In a first aspect, an embodiment of the present invention provides a method for constructing an application category feature library, comprising:

[0006] Determine an application category set, the application category set including one or more application categories; determine an application set corresponding to each application category, the application set including one or more applications;

[0007] Obtaining a feature information set of each application in each application set; the feature information set includes one or more of registration file information, API call information, and integrated SDK information;

[0008] Obtaining a feature vector of any feature information according to a conversion strategy corresponding to any feature information, thereby obtaining one or more feature vectors of each application;

[0009] Generating one or more category feature vectors of the application category corresponding to each application set according to the one or more feature vectors of each application in each application set;

[0010] One or more category feature vectors of all application categories in the application category set are combined into an application category feature library.

[0011] In a second aspect, an embodiment of the present invention provides an application category identification method, including:

[0012] Acquire characteristic information of the target application; the characteristic information includes one or more of registration file information, API call information, and integrated SDK information;

[0013] Obtaining a feature vector of any feature information according to a conversion strategy corresponding to any feature information, thereby obtaining one or more feature vectors of the target application;

[0014] The one or more feature vectors are compared with one or more category feature vectors of each application category in an application category feature library to determine the application category of the target application; wherein the application category feature library is obtained according to the above-mentioned application category feature library construction method.

[0015] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the method steps described in the first aspect or the method steps described in the second aspect are implemented.

[0016] In a fourth aspect, an embodiment of the present invention provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method steps described in the first aspect or the method steps described in the second aspect when executing the computer program.

[0017] The application category feature library construction method, identification method, storage medium and terminal provided by the embodiments of the present invention have the following technical effects:

[0018] The embodiment of the present invention determines the application set corresponding to each application category in the application category set, obtains one or more feature information in the registration file information, API call information and integrated SDK information of each application in the application set, and converts each feature information into a corresponding feature vector, so as to measure the behavioral characteristics of the application. One or more category feature vectors of the application category corresponding to the application set are generated according to the one or more feature vectors of each application in the application set, the behavioral characteristics of the application category are measured using the behavioral characteristics of multiple applications of the same category, and one or more category feature vectors of all application categories in the application category set are formed into an application category feature library. According to the application category feature library and the feature information set of unknown applications, category identification can be performed on unknown applications. The above method can achieve accurate and efficient category identification of applications. By automatically classifying applications, the application ecosystem can be better understood and managed, and user experience and security can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A flow chart of a method for constructing an application category feature library provided by an embodiment of the present invention;

[0021] Figure 2 A flow chart of an application category identification method provided by an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of the structure of an application category feature library construction device provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of the structure of an application category identification device provided by an embodiment of the present invention;

[0024] Figure 5 A block diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are only examples of devices and methods consistent with some aspects of the present invention as detailed in the attached claims.

[0027] In the description of the present invention, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0028] With the rapid development of mobile Internet, the number of smartphone applications (Apps) has exploded, covering various categories such as social, entertainment, games, and finance. However, traditional application classification methods mainly rely on manual review and keyword matching. These methods are not only inefficient, but also difficult to cope with the increasingly complex and changeable application behavior patterns. Therefore, a more accurate and efficient application classification method is urgently needed.

[0029] In view of the above problems, the present invention provides an application category feature library construction method, identification method, storage medium and terminal. Below, the application category feature library construction method and application category identification method in the embodiment of the present invention will be described in more detail with reference to the accompanying drawings and embodiments.

[0030] Figure 1 A flow chart of a method for constructing an application category feature library provided by an embodiment of the present invention. Figure 1 As shown, the method of the embodiment of the present invention may include the following steps:

[0031] S101, determining an application category set, wherein the application category set includes one or more application categories; determining an application set corresponding to each application category, wherein the application set includes one or more applications.

[0032] In the embodiment of the present invention, when constructing an application category feature library, it is first necessary to determine the application category set, that is, the application category to be identified, which can be determined according to actual conditions and needs. The application category can be divided from the industry, or from the business model, or according to a combination of the two, or any other feasible method, such as social, game, shopping, etc., and can also be divided in more detailed dimensions, such as stranger dating, game, etc. After determining one or more application categories to be identified, an application category set is formed.

[0033] Furthermore, constructing an application category feature library means obtaining application features corresponding to each application category. Therefore, after determining the application category set, it is also necessary to determine one or more applications corresponding to each application category in the application category set. The specific number can be determined according to the actual situation. For example, for each application category, 100, 300, etc. applications can be obtained. In order to maintain uniformity, the same number of applications can be obtained for each application category. Of course, if the number of applications corresponding to some application categories is small and the number of applications corresponding to some application categories is large, different numbers of applications can also be obtained, which is not limited here.

[0034] Based on any of the above optional embodiments, S102, a feature information set of each application in each application set is obtained; the feature information set includes one or more of registration file information, API call information and integrated SDK information.

[0035] Optionally, after determining the application category set and the application set corresponding to each application category in the application category set, further obtain feature information of each application in each application set to generate a feature vector of the corresponding application category based on the feature information. Applications generally include feature information in multiple aspects, so the feature information set of each application in each application set can be obtained, wherein the feature information set includes one or more of registration file information, API call information, and integrated SDK information.

[0036] Optionally, the registration file is located in the root directory of the application. It is a file that each application has. The developer configures the components and permissions required for the application to run. This information reflects the basic functions and potential behaviors of the application. For example, if an application requests access to the address book, camera, and geolocation services, it can be inferred that it has social and location service features. Therefore, by obtaining the registration file information of the application, the functional features of the application can be preliminarily extracted. Since the registration file includes permission information and component information, the registration file information may include permission information and / or component information, that is, only permission information can be obtained, or only component information can be obtained, or both permission information and component information can be obtained.

[0037] Optionally, API calls are the actual behavior of the application when it is running. Different types of applications will show obvious differences in the frequency and order of API calls. By recording and analyzing the frequency and order of API calls, the dynamic behavior characteristics of the application can be captured, thereby more comprehensively reflecting the behavior pattern of the application. For example, shopping applications will call the payment API more frequently, while navigation applications will frequently call the location API. An application includes multiple functions, and the API situation for implementing each function call may be different. Therefore, in order to comprehensively obtain the API call information of the application, all functions of the application can be executed to obtain the API call information for each function. Since API calls include API call frequency, that is, the number of times each API is called, and API call order, the API call information may include API call frequency and / or API call order, that is, only the API call frequency can be obtained, or only the API call order can be obtained, or both the API call frequency and API call order can be obtained.

[0038] Optionally, many apps integrate third-party SDKs to extend their functionality. Different types of apps often integrate different types of SDKs. For example, social apps may integrate SDKs for instant messaging, audio and video processing, while gaming apps may integrate SDKs for advertising, payment, and game engines. By analyzing the SDKs integrated into an app, you can further identify the app's functional features and behavior patterns.

[0039] Based on any of the above optional embodiments, S103, according to the conversion strategy corresponding to any feature information, a feature vector corresponding to the any feature information is obtained, thereby obtaining one or more feature vectors for each application.

[0040] Optionally, after obtaining the feature information set of each application in each application set, in order to facilitate subsequent calculations, each feature information needs to be converted into a corresponding feature vector. Since each feature information is different, the corresponding conversion method will also be different. Therefore, it is necessary to obtain the feature vector corresponding to any feature information according to the conversion strategy corresponding to the feature information, thereby obtaining one or more feature vectors for each application. Specifically including:

[0041] S103.1, for any of the characteristic information, determine corresponding preset characteristic information;

[0042] S103.2, determine a preset feature vector; the length of the preset feature vector is equal to the amount of the preset feature information, and each feature value in the preset feature vector is a first preset value.

[0043] Optionally, when converting any feature information into a corresponding feature vector, since the feature information of each application is different, it is impossible to directly compare the connection and difference between the two, so a comparison standard needs to be set. For example, for the registration file information, application A includes permissions a, b, and c, and application B includes permissions c, d, e, and f. If the feature vector conversion is performed only according to its own situation, application A can only use permissions a, b, and c, and does not know that permissions d, e, and f also exist. The permission information and quantity of the two are different, and an intuitive comparison cannot be performed.

[0044] Therefore, for any feature information, the corresponding preset feature information must first be determined as a comparison standard, and then the corresponding preset feature vector is determined based on the preset feature information, wherein the length of the preset feature vector is equal to the number of preset feature information, and each eigenvalue in the preset feature vector corresponds to one feature information in the preset feature information, but the state of each feature information in the preset feature information is consistent, so each eigenvalue in the preset feature vector should be consistent and can be set to the first preset value. The first preset value can be set freely, such as being set to 0, and is not limited here. If the preset feature information corresponding to any feature information includes 100 feature information, the corresponding preset feature vector is a one-dimensional vector with a length of 100.

[0045] It should be noted that due to the different contents included in each feature information, the corresponding preset feature information will also be different. For example, for the registration file information, it includes permission information and / or component information, then the corresponding preset feature information is also permission information and / or component information. Some commonly used permission information and / or component information can be selected according to the actual situation, and the corresponding preset registration file information can be formed in a certain order. The specific number can be determined according to the actual situation, such as 100, 200, etc. For the API call information, it includes the API call frequency and / or API call sequence, then the corresponding preset API call information should also be determined according to the API call situation. However, the API call sequence is determined according to the function of each application, and the situation is diverse, and it is impossible to set a unified comparison standard. Therefore, it is only necessary to set the preset API call information according to the API call frequency. Some commonly used API call information can be selected according to the actual situation to form the corresponding preset API call information. The specific number can be determined according to the actual situation, such as 100, 200, etc. Similarly, for the integrated SDK information, some commonly used integrated SDK information can be selected to form the corresponding preset integrated SDK information. The specific number can be determined according to the actual situation.

[0046] S103.3, comparing the any feature information with the preset feature information, and converting the preset feature vector into a feature vector corresponding to the any feature information according to the comparison result, so as to obtain one or more feature vectors for each application.

[0047] Optionally, after determining the preset feature information corresponding to each feature information, when converting any feature information, any feature information can be matched with its corresponding preset feature information, and the corresponding preset feature vector can be converted into the feature vector corresponding to the any feature information according to the comparison result. Since any feature information can be any one of registration file information, API call information and integrated SDK information, each feature information corresponds to different preset feature information, and the comparison results and conversion methods will also be different. Therefore, for each feature information, corresponding conversion is performed according to its comparison result, and one or more feature vectors of the application can be obtained.

[0048] In an optional embodiment, for the registration file information, each permission information and / or component information in the registration file information is compared with the preset registration file information to obtain the position information of each permission information and / or component information in the preset registration file information;

[0049] According to the location information, the characteristic value corresponding to each permission information and / or component information in the preset registration file characteristic vector is converted into a second preset value to obtain a registration file characteristic vector.

[0050] Optionally, for the registration file information, each permission information and / or component information in the registration file information of the application may be compared with the preset registration file information to obtain the position information of each permission information and / or component information in the preset registration file information. Then, according to the position information, the feature value corresponding to each permission information and / or component information in the preset registration file feature vector is converted into a second preset value to obtain the registration file feature vector.

[0051] As can be seen from the foregoing, the preset registration file information includes a certain amount of permission information and / or component information, and is arranged in order, and each eigenvalue in the corresponding preset registration file feature vector corresponds to a feature information. For example, the preset registration file information includes permission a, permission b, permission c, permission d, permission e, permission f, permission g, then the corresponding preset registration file feature vector is a one-dimensional feature vector [a, b, c, d, e, f, g], wherein the first eigenvalue a corresponds to permission a, the second eigenvalue b corresponds to permission b, and so on. Since each eigenvalue in the preset registration file feature vector is the first preset value, the actual a, b, c, d, e, f, g are all the same value. If the first preset value is set to 0, the preset registration file feature vector [a, b, c, d, e, f, g] should be [0, 0, 0, 0, 0, 0].

[0052] If the registration file information of application A includes permission a, permission b, and permission c, after comparing the registration file information of application A with the preset registration file information, it can be known that the position information of the registration file information of application A is the first, second, and third positions, and the first, second, and third eigenvalues ​​in the preset registration file feature vector can be converted into second preset values ​​to obtain a registration file feature vector. The second preset value can be set according to the actual situation and can be different from the first preset value. For example, it can be set to 1, and the registration file feature vector of application A is [1, 1, 1, 0, 0, 0]; if the registration file information of application B includes permission c, permission d, permission e, and permission f, then the registration file feature vector of application B can be obtained by the same logic as [0, 0, 1, 1, 1, 1, 0]. In this way, different applications can obtain registration file feature vectors with the same length, which is convenient for subsequent calculation and comparison.

[0053] In another optional embodiment, for the API call information, each API call in the API call information is compared with the preset API call information to obtain the position information of each API call in the preset API call information; according to the position information, the feature value corresponding to each API call in the preset API call feature vector is converted into the call frequency of each API call to obtain the API call frequency feature vector; or

[0054] For the API call information, obtain all API call sequences in the API call information to obtain one or more API call sequence feature vectors for each application; or

[0055] For the API call information, each API call in the API call information is compared with the preset API call information to obtain the position information of each API call in the preset API call information; according to the position information, the feature value corresponding to each API call in the preset API call feature vector is converted into the call frequency of each API call to obtain the API call frequency feature vector; all API call sequences in the API call information are obtained to obtain one or more API call sequence feature vectors.

[0056] Optionally, as can be seen from the previous text, API call information includes API call frequency and / or API call order, but the API call order is determined according to the function of each application. The situations are diverse and it is impossible to set a unified comparison standard. Therefore, it is only necessary to set the preset API call information according to the API call frequency.

[0057] Therefore, if the API call information only includes the frequency of API calls, each API call in the API call information is compared with the preset API call information to obtain the position information of each API call in the preset API call information; according to the position information, the feature value corresponding to each API call in the preset API call feature vector is converted into the call frequency of each API call to obtain the API call feature vector. For example, the preset API call information includes API_a, API_b, API_c, API_d, API_e, API_f, API_g, then the corresponding preset API call feature vector is a one-dimensional feature vector [API_a, API_b, API_c, API_d, API_e, API_f, API_g], wherein the first feature value API_a corresponds to API_a, the second feature value API_b corresponds to API_b, and so on. Since each feature value in the preset API call feature vector is the first preset value, the actual API_a, API_b, API_c, API_d, API_e, API_f, and API_g are all the same value. If the first preset value is set to 0, the preset API call feature vector [API_a, API_b, API_c, API_d, API_e, API_f, API_g] should be [0, 0, 0, 0, 0, 0]. If the API call information of application A includes 3 calls to API_a, 2 calls to API_b, and 4 calls to API_c, after comparing the API call information of application A with the preset API call information, it can be known that the position information of the API call information of application A is the first, second, and third positions. The first feature value, the second feature value, and the third feature value in the preset API call feature vector can be converted into the frequency of the corresponding API call, and the corresponding API call feature vector is [3, 2, 4, 0, 0, 0, 0].

[0058] Optionally, if the API call information only includes the API call sequence, the corresponding API call sequence feature vector can be directly obtained according to the API call sequence. For example, if the API call information of application A includes a call sequence of calling API_a, API_b, and API_c, the corresponding call sequence [API_a, API_b, API_c] can be directly obtained.

[0059] Optionally, if the API call information includes both the API call frequency and the API call sequence, each API call in the API call information can be compared with the preset API call information to obtain the position information of each API call in the preset API call information; according to the position information, the feature value corresponding to each API call in the preset API call feature vector is converted into the call frequency of each API call to obtain the API call feature vector. Then, according to the API call sequence, the corresponding API call sequence feature vector is obtained.

[0060] In another optional embodiment, for the integrated SDK information, each integrated SDK information in the integrated SDK information is compared with preset integrated SDK information to obtain location information of each integrated SDK information in the preset integrated SDK information;

[0061] According to the position information, the feature value corresponding to each integrated SDK information in the preset integrated SDK feature vector is converted into a second preset value to obtain an integrated SDK feature vector.

[0062] Optionally, for the integrated SDK information, each integrated SDK information in the integrated SDK information of the application can be compared with the preset integrated SDK information to obtain the position information of each integrated SDK information in the preset integrated SDK information. According to the position information, the feature value corresponding to each integrated SDK information in the preset integrated SDK feature vector is converted into a second preset value to obtain the integrated SDK feature vector. The second preset value can be set according to the actual situation and can be different from the first preset value, such as being set to 1.

[0063] For example, the preset integrated SDK information includes preset SDK_a, SDK_b, SDK_c, SDK_d, SDK_e, and SDK_f, and the corresponding preset integrated SDK feature vector is a one-dimensional feature vector [SDK_a, SDK_b, SDK_c, SDK_d, SDK_e, SDK_f], where the first feature value SDK_a corresponds to SDK_a, the second feature value SDK_b corresponds to SDK_b, and so on. Since each feature value in the preset integrated SDK feature vector is the first preset value, the actual SDK_a, SDK_b, SDK_c, SDK_d, SDK_e, and SDK_f are all the same value. If the first preset value is set to 0, the preset integrated SDK feature vector [SDK_a, SDK_b, SDK_c, SDK_d, SDK_e, SDK_f] should be [0, 0, 0, 0, 0, 0]. If the integrated SDK information of application A includes integrated SDK_a, SDK_b, and SDK_d, the corresponding integrated SDK feature vector is [1, 1, 0, 1, 0, 0].

[0064] Based on any of the above optional embodiments, S104, one or more category feature vectors of the application category corresponding to each application set are generated according to the one or more feature vectors of each application in each application set.

[0065] Optionally, after obtaining one or more feature vectors of each application in each application set according to the above method, one or more category feature vectors of the application category corresponding to each application set may be generated based on the one or more feature vectors.

[0066] Optionally, when distinguishing application categories, the importance of each feature information in different application categories can be used to determine its contribution to the corresponding application category. Specifically, the term frequency-inverse document frequency (TF-IDF) method can be used to evaluate the importance of each feature in any feature information and assign weights to it. TF-IDF is a commonly used text analysis method that measures the importance of features by calculating the frequency of features in specific applications (TF) and the prevalence of features in the entire application library (IDF). Specifically, TF reflects the frequency of occurrence of a feature in a single application, while IDF measures the rarity of the feature in the entire application library. By combining TF and IDF, key features that are discriminative for specific application categories can be identified.

[0067] Therefore, one or more feature vectors of each application in each application set are used to generate one or more category feature vectors of the application category corresponding to each application set. Specifically, it includes:

[0068] S104.1, for any eigenvector, calculate the TF value corresponding to each eigenvalue in any eigenvector of each application, and obtain the average value of the TF values ​​corresponding to each eigenvalue of all applications in each application set;

[0069] S104.2, for any of the feature vectors, calculate an IDF value corresponding to each eigenvalue in the any of the feature vectors.

[0070] Optionally, as can be seen from the foregoing, any feature vector corresponds to any feature information, and each eigenvalue in any feature vector corresponds to one feature information in any feature information. Therefore, for any feature vector of each application in each application set, the TF value and IDF value corresponding to each eigenvalue in any feature vector are calculated. That is, the TF value and IDF value corresponding to each feature information in any feature information corresponding to any feature vector are calculated.

[0071] Optionally, the TF value is calculated according to the formula TF(t) = A(t) / S(t), where TF(t) is the TF value of the eigenvalue t, A(t) is the frequency of occurrence of the feature information corresponding to the eigenvalue t in the feature information set of the application, and S(t) is the frequency of occurrence of all feature information in the feature information set of the application. For example, the feature information set of application A includes registration file information, API call information, and integrated SDK information. The registration file feature vector corresponding to the registration file information is [1, 1, 1, 0, 0, 0, 0], the API call frequency feature vector corresponding to the API call information is [3, 2, 4, 0, 0, 0, 0], and the integrated SDK feature vector corresponding to the integrated SDK information is [1, 1, 0, 1, 0, 0]. Then for the first eigenvalue in the registration file feature vector, its corresponding TF value is 1 / (3+9+3)=1 / 15; if the API call sequence feature vectors corresponding to the above API call information are [a, b, c], [a, b], then the feature vector [a, b] is counted twice, then for the first eigenvalue in the registration file feature vector, its corresponding TF value is 1 / (3+3+3)=1 / 9. Thus, the TF value corresponding to each eigenvalue in any feature vector of each application in each application set can be calculated.

[0072] Optionally, since each application set includes one or more applications, and the feature vectors of each application are different, the TF value corresponding to each feature value in any feature vector of each application is also different. For example, for the first feature value in the registration file feature vector, the TF value corresponding to application A may be 1 / 10, and the TF value corresponding to application B may be 1 / 15. In order to reduce the error caused by a single application value, the average TF value of the feature value at the same position of all applications can be taken.

[0073] Optionally, the IDF value is calculated according to the formula IDF(t)=log(N / dft), where IDF(t) is the IDF value of the feature value t, N is the number of applications in each application set, and dft is the number of applications in the feature information set of each application set that include feature information corresponding to the feature value t. For example, if an application set includes 100 applications, then N is 100. For the first feature value in the registration file feature vector, the number of applications in the application set that include feature information corresponding to the first feature value is 50, and the IDF value corresponding to the first feature value is 50 / 100=1 / 2.

[0074] S104.3, taking the product of the average value and the IDF value as the category feature value of each feature value, and combining the category feature values ​​of all feature values ​​in any feature vector into the category feature vector of any feature vector, thereby obtaining one or more category feature vectors of the application category corresponding to each application set.

[0075] Optionally, after calculating the average value and IDF value of the TF value corresponding to each eigenvalue in any eigenvector according to the above method, the product of the average value and the IDF value is used as the category eigenvalue of each eigenvalue, and then the category eigenvalues ​​of all eigenvalues ​​in any eigenvector are combined to form the category eigenvector of any eigenvector. One or more category eigenvectors of the application category corresponding to each application set can be obtained.

[0076] Based on any of the above optional embodiments, S105, one or more category feature vectors of all application categories in the application category set are combined into an application category feature library.

[0077] Optionally, according to the above method, after obtaining one or more category feature vectors of the application category corresponding to each application, one or more category feature vectors of all application categories in the application category set are combined into an application category feature library, so that the application category of unknown applications can be directly compared when it is needed to identify them in the future.

[0078] In summary, an embodiment of the present invention provides a method for constructing an application category feature library, by determining the application set corresponding to each application category in the application category set, obtaining one or more feature information in the registration file information, API call information and integrated SDK information of each application in the application set, and converting each feature information into a corresponding feature vector, so as to measure the behavioral characteristics of the application. One or more category feature vectors of the application category corresponding to the application set are generated based on the one or more feature vectors of each application in the application set, the behavioral characteristics of the application category are measured using the behavioral characteristics of multiple applications of the same category, and one or more category feature vectors of all application categories in the application category set are formed into an application category feature library. According to the application category feature library and the feature information set of unknown applications, category identification can be performed on unknown applications. By applying the above method, accurate and efficient category identification of applications can be achieved. By automatically classifying applications, the application ecosystem can be better understood and managed, and user experience and security can be improved.

[0079] After the application category feature library is constructed by the above method, the application category of a certain unknown application can be identified by the application category feature library. The following is an embodiment of the application category identification method provided by the present invention. Figure 2 The following is a flow chart of an application category identification method provided by an embodiment of the present invention. Figure 2 As shown, the method of the embodiment of the present invention may include the following steps:

[0080] S201, obtaining a feature information set of a target application; the feature information set includes one or more of registration file information, API call information, and integrated SDK information;

[0081] S202: Obtain a feature vector of any feature information according to a conversion strategy corresponding to any feature information, thereby obtaining one or more feature vectors of the target application.

[0082] In the embodiment of the present invention, the characteristic information set of the target application is first obtained, and the characteristic information set includes one or more of registration file information, API call information and integrated SDK information. Among them, the registration file information includes permission information and / or component information; the API call information includes API call frequency information and / or API call sequence information; the integrated SDK information includes one or more integrated SDK information.

[0083] Then, according to the conversion strategy corresponding to any feature information, the feature vector corresponding to the feature information is obtained, thereby obtaining one or more feature vectors of the target application. Specifically, it includes:

[0084] (1) for any of the characteristic information, determining corresponding preset characteristic information;

[0085] (2) determining a preset feature vector; the length of the preset feature vector is equal to the amount of the preset feature information, and each feature value in the preset feature vector is a first preset value;

[0086] (3) Comparing the any feature information with the preset feature information, and converting the preset feature vector into a feature vector corresponding to the any feature information according to the comparison result, thereby obtaining one or more feature vectors for each application.

[0087] Optionally, the specific process can refer to the conversion process in the above-mentioned application category feature library construction method, which will not be repeated here. It should be noted that for any feature information, when determining the corresponding preset feature information, each preset feature information should be the same as the preset feature information determined in the above-mentioned application category feature library construction method, and the first preset value should also be the same as the first preset value set in the above-mentioned application category feature library construction method.

[0088] Based on any of the above optional embodiments, S203, the one or more feature vectors are compared with one or more category feature vectors of each application category in the application category feature library to determine the application category of the target application; wherein the application category feature library is obtained according to the above-mentioned application category feature library construction method.

[0089] Optionally, one or more feature vectors of the target application are compared with one or more category feature vectors of each application category in the application category feature library to calculate their similarity. When a certain similarity is greater than a preset threshold, the application category of the target application can be determined to be the application category corresponding to the similarity. The preset threshold can be set to 0.8, 0.9, etc., which is not limited here.

[0090] In summary, an embodiment of the present invention provides an application category identification method, which obtains one or more feature information in the registration file information, API call information, and integrated SDK information of the target application, and obtains a corresponding feature vector according to the conversion strategy corresponding to each feature information, so as to measure the behavioral characteristics of the target application. The one or more feature vectors of the target application are compared with one or more category feature vectors representing the behavioral characteristics of each application category in the application category feature library to determine the application category of the target application. The application of the above method can achieve accurate and efficient category identification of applications. By automatically classifying applications, the application ecosystem can be better understood and managed, and the user experience and security can be improved.

[0091] The following are embodiments of the device of the present invention, which can be used to implement the method embodiments of the present invention. For details not disclosed in the device embodiments of the present invention, please refer to the method embodiments of the present invention.

[0092] See also Figure 3 , which is a structural diagram of an application category feature library construction device provided in an embodiment of the present invention.

[0093] The application category feature library construction device 300 in the embodiment of the present invention includes: an application category set determination module 301, a feature information set acquisition module 302, a feature vector acquisition module 303, a category feature vector acquisition module 304 and an application category feature library construction module 305.

[0094] An application category set determination module, used to determine an application category set, the application category set including one or more application categories; determine an application set corresponding to each application category, the application set including one or more applications;

[0095] A feature information set acquisition module, used to acquire a feature information set of each application in each application set; the feature information set includes one or more of registration file information, API call information and integrated SDK information;

[0096] A feature vector acquisition module, used to obtain a feature vector corresponding to any feature information according to a conversion strategy corresponding to the feature information, thereby obtaining one or more feature vectors for each application;

[0097] A category feature vector acquisition module, configured to generate one or more category feature vectors of the application category corresponding to each application set according to one or more feature vectors of each application in each application set;

[0098] The application category feature library construction module is used to form an application category feature library by combining one or more category feature vectors of all application categories in the application category set.

[0099] It should be noted that the application category feature library construction device provided in the above embodiment only uses the division of the above-mentioned functional modules as an example when executing the application category feature library construction method. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the application category feature library construction device provided in the above embodiment and the application category feature library construction method embodiment belong to the same concept. Therefore, for details not disclosed in the embodiment of the device of the present invention, please refer to the embodiment of the application category feature library construction method of the present invention, which will not be repeated here.

[0100] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0101] See also Figure 4 , which is a structural diagram of an application category identification device provided in an embodiment of the present invention.

[0102] The application category identification device 400 in the embodiment of the present invention includes: a feature information set acquisition module 401 , a feature vector acquisition module 402 and an application category identification module 403 .

[0103] A feature information set acquisition module, used to acquire a feature information set of a target application; the feature information set includes one or more of registration file information, API call information, and integrated SDK information;

[0104] A feature vector acquisition module, used to obtain a feature vector of any feature information according to a conversion strategy corresponding to any feature information, thereby obtaining one or more feature vectors of the target application;

[0105] An application category identification module is used to compare the one or more feature vectors with one or more category feature vectors of each application category in an application category feature library to determine the application category of the target application; wherein the application category feature library is obtained according to the above-mentioned application category feature library construction method.

[0106] It should be noted that the application category identification device provided in the above embodiment only uses the division of the above functional modules as an example when executing the application category identification method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the application category identification device provided in the above embodiment belongs to the same concept as the application category identification method embodiment. Therefore, for details not disclosed in the embodiment of the device of the present invention, please refer to the embodiment of the application category identification method of the present invention, which will not be repeated here.

[0107] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0108] The embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the method of any of the above embodiments are implemented. The computer-readable storage medium may include, but is not limited to, any type of disk, including a floppy disk, an optical disk, a DVD, a CD-ROM, a micro drive, and a magneto-optical disk, a ROM, a RAM, an EPROM, an EEPROM, a DRAM, a VRAM, a flash memory device, a magnetic card or an optical card, a nanosystem (including a molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0109] An embodiment of the present invention further provides a terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any of the above-mentioned method embodiments when executing the program.

[0110] Figure 5 A block diagram of a terminal provided by an embodiment of the present invention. Figure 5 , an embodiment of the present invention provides a terminal 500, including: a processor (processor) 501, a communication interface (Communications Interface) 502, a memory (memory) 503 and a communication bus 504, wherein the processor 501, the communication interface 502, and the memory 503 complete mutual communication through the communication bus 504. The processor 501 can call the logic instructions in the memory 503 to execute the following method, including: determining an application category set, the application category set includes one or more application categories; determining an application set corresponding to each application category, the application set includes one or more applications; obtaining a feature information set of each application in each application set; the feature information set includes one or more of registration file information, API call information and integrated SDK information; according to the conversion strategy corresponding to any feature information, obtaining a feature vector corresponding to any feature information, thereby obtaining one or more feature vectors of each application; generating one or more category feature vectors of the application category corresponding to each application set according to the one or more feature vectors of each application in each application set; and forming an application category feature library with one or more category feature vectors of all application categories in the application category set.

[0111] Or by executing the following method, including: obtaining feature information of the target application; the feature information includes one or more of registration file information, API call information and integrated SDK information; according to the conversion strategy corresponding to any feature information, obtaining the feature vector of any feature information, thereby obtaining one or more feature vectors of the target application; comparing the one or more feature vectors with one or more category feature vectors of each application category in the application category feature library to determine the application category of the target application; wherein the application category feature library is obtained according to the above-mentioned application category feature library construction method.

[0112] The terminal structure block diagram shown in the embodiment of the present invention does not constitute a limitation on the terminal 500. The terminal 500 may include more or fewer components than those shown in the figure, or combine certain components, or adopt a different component arrangement.

[0113] An embodiment of the present invention discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: determining an application category set, wherein the application category set includes one or more application categories; determining an application set corresponding to each application category, wherein the application set includes one or more applications; obtaining a feature information set for each application in each application set; the feature information set includes one or more of registration file information, API call information, and integrated SDK information; according to a conversion strategy corresponding to any feature information, obtaining a feature vector corresponding to any feature information, thereby obtaining one or more feature vectors for each application; generating one or more category feature vectors of the application category corresponding to each application set according to the one or more feature vectors of each application in each application set; and combining one or more category feature vectors of all application categories in the application category set into application category features.

[0114] Or including: obtaining feature information of the target application; the feature information includes one or more of registration file information, API call information and integrated SDK information; obtaining a feature vector of any feature information according to a conversion strategy corresponding to any feature information, thereby obtaining one or more feature vectors of the target application; comparing the one or more feature vectors with one or more category feature vectors of each application category in an application category feature library to determine the application category of the target application; wherein the application category feature library is obtained according to the above-mentioned application category feature library construction method.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing an application category feature library, characterized in that: include: Determine an application category set, wherein the application category set includes one or more application categories; Determine an application set corresponding to each application category, wherein the application set includes one or more applications; Obtain a feature information set of each application in each application set; The feature information set includes one or more of registration file information, API call information, and integrated SDK information; According to the conversion strategy corresponding to any feature information, a feature vector corresponding to the any feature information is obtained, thereby obtaining one or more feature vectors for each application; Generating one or more category feature vectors of the application category corresponding to each application set according to the one or more feature vectors of each application in each application set; One or more category feature vectors of all application categories in the application category set are combined into an application category feature library.

2. The method according to claim 1, characterized in that: The step of obtaining a feature vector corresponding to any feature information according to a conversion strategy corresponding to any feature information, thereby obtaining one or more feature vectors for each application, includes: For any of the characteristic information, determining corresponding preset characteristic information; Determine a preset feature vector; the length of the preset feature vector is equal to the amount of the preset feature information, and each feature value in the preset feature vector is a first preset value; The any feature information is compared with the preset feature information, and according to the comparison result, the preset feature vector is converted into a feature vector corresponding to the any feature information, so as to obtain one or more feature vectors for each application.

3. The method according to claim 2, characterized in that: The registration file information includes permission information and / or component information; The comparing the any feature information with the preset feature information, and converting the preset feature vector into a feature vector corresponding to the any feature information according to the comparison result, includes: For the registration file information, compare each permission information and / or component information in the registration file information with the preset registration file information to obtain the position information of each permission information and / or component information in the preset registration file information; According to the location information, the characteristic value corresponding to each permission information and / or component information in the preset registration file characteristic vector is converted into a second preset value to obtain a registration file characteristic vector.

4. The method according to claim 2, characterized in that: The API call information includes API call frequency information and / or API call sequence information; The comparing the any feature information with the preset feature information, and converting the preset feature vector into a feature vector corresponding to the any feature information according to the comparison result, includes: For the API call information, compare each API call in the API call information with the preset API call information to obtain the position information of each API call in the preset API call information; according to the position information, convert the feature value corresponding to each API call in the preset API call feature vector into the call frequency of each API call to obtain the API call frequency feature vector; or For the API call information, obtain all API call sequences in the API call information to obtain one or more API call sequence feature vectors for each application; or For the API call information, each API call in the API call information is compared with the preset API call information to obtain the position information of each API call in the preset API call information; according to the position information, the feature value corresponding to each API call in the preset API call feature vector is converted into the call frequency of each API call to obtain the API call frequency feature vector; all API call sequences in the API call information are obtained to obtain one or more API call sequence feature vectors.

5. The method according to claim 2, characterized in that: The integrated SDK information includes one or more integrated SDK information; The comparing the any feature information with the preset feature information, and converting the preset feature vector into a feature vector corresponding to the any feature information according to the comparison result, includes: For the integrated SDK information, compare each integrated SDK information in the integrated SDK information with preset integrated SDK information to obtain position information of each integrated SDK information in the preset integrated SDK information; According to the position information, the feature value corresponding to each integrated SDK information in the preset integrated SDK feature vector is converted into a second preset value to obtain an integrated SDK feature vector.

6. The method according to any one of claims 1 to 5, characterized in that: The step of generating one or more category feature vectors of the application category corresponding to each application set according to the one or more feature vectors of each application in each application set includes: For any eigenvector, calculate the TF value corresponding to each eigenvalue in any eigenvector of each application, and obtain the average value of the TF values ​​corresponding to each eigenvalue of all applications in each application set; For any of the eigenvectors, calculating the IDF value corresponding to each eigenvalue in the any of the eigenvectors; The product of the average value and the IDF value is used as the category feature value of each feature value, and the category feature values ​​of all feature values ​​in any feature vector are combined to form the category feature vector of any feature vector, so as to obtain one or more category feature vectors of the application category corresponding to each application set.

7. The method according to claim 6, characterized in that: The TF value is calculated according to the formula TF(t)=A(t) / S(t), wherein TF(t) is the TF value of the feature value t, A(t) is the frequency of occurrence of the feature information corresponding to the feature value t in the feature information set of each application, and S(t) is the frequency of occurrence of the feature information in the feature information set of each application; The IDF value is calculated according to the formula IDF(t)=log(N / dft), where IDF(t) is the IDF value of the feature value t, N is the number of applications in each application set, and dft is the number of applications in which the feature information set in each application set includes feature information corresponding to the feature value t.

8. A method for identifying application categories, characterized in that: include: Obtain a feature information set of the target application; The feature information set includes one or more of registration file information, API call information, and integrated SDK information; Obtaining a feature vector of any feature information according to a conversion strategy corresponding to any feature information, thereby obtaining one or more feature vectors of the target application; The one or more feature vectors are compared with one or more category feature vectors of each application category in an application category feature library to determine the application category of the target application; wherein the application category feature library is obtained according to the method as described in any one of claims 1-7.

9. The method according to claim 8, characterized in that: The registration file information includes permission information and / or component information; the API call information includes API call frequency information and / or API call sequence information; the integrated SDK information includes one or more integrated SDK information; According to the conversion strategy corresponding to any feature information, a feature vector of the any feature information is obtained, thereby obtaining one or more feature vectors of the target application, including: For any of the characteristic information, determining corresponding preset characteristic information; Determine a preset feature vector; the length of the preset feature vector is equal to the amount of the preset feature information, and each feature value in the preset feature vector is a first preset value; The any feature information is compared with the preset feature information, and according to the comparison result, the preset feature vector is converted into a feature vector corresponding to the any feature information, so as to obtain one or more feature vectors for each application.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 or the method according to claim 8 or 9 is implemented.

11. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 or the method according to claim 8 or 9 is implemented.

Images