Security risk detection method and device of application program, equipment, medium and product

Abstract

The invention relates to the technical field of artificial intelligence, and provides a security risk detection method and device for an application program, equipment, a medium and a product, and the security risk detection method for the application program comprises the steps: obtaining a to-be-identified application program; inputting the to-be-recognized application program into a preset recognition model to obtain a detection result output by the preset recognition model; the preset identification model is obtained by analyzing data of an original application program installation package and training; the preset recognition model comprises a plurality of agents which work respectively, the agents are used for executing different function tasks, and the function tasks comprise task scheduling, data analysis and result decision making. By means of the mode, the intelligent level and the performance index of the recognition model can be remarkably improved, and therefore the accuracy of the safety risk detection result of the application program is improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to methods, apparatus, devices, media, and products for detecting security risks in applications. Background Art

[0002] In an era of rapid development in information and communication technology, abnormal apps (applications) may pose various harms to users and devices.

[0003] Abnormal apps, also known as malware, fake apps, or applications with security vulnerabilities, can cause problems such as data breaches, privacy violations, cybersecurity risks, false advertising and marketing, and the spread of malware, seriously affecting the user experience.

[0004] Current technologies for assessing abnormal apps have the following problems: 1) When assessing the security risks of apps, there is insufficient ability to identify risky apps that involve multimodal information, novel patterns, and highly abstract semantic features.

[0005] 2) It is highly dependent on feature engineering, resulting in unstable model performance and low level of intelligence. Summary of the Invention

[0006] This invention provides a method, apparatus, device, medium, and product for detecting security risks in applications, in order to solve the problems of low intelligence level of identification models and inaccurate detection results in the prior art.

[0007] This invention provides a method for detecting security risks in an application, comprising: acquiring an application to be identified; inputting the application to be identified into a preset identification model to obtain the detection result output by the preset identification model; the preset identification model is trained by parsing data from the original application installation package; wherein the preset identification model includes multiple intelligent agents, each working independently; the intelligent agents are used to perform different functional tasks, including task scheduling, data analysis, and result decision-making.

[0008] According to the present invention, a method for detecting security risks of an application includes a preset identification model comprising a first model and a second model. Before inputting the application to be identified into the preset identification model and obtaining the detection result output by the preset identification model, the method comprises: parsing the original application installation package to obtain the text features and icon features of the original application installation package; fine-tuning the first model based on the text features; wherein the fine-tuned first model is used to classify the application to be identified based on the text features, and fine-tuning the second model based on the icon features; wherein the fine-tuned second model is used to classify the application to be identified based on the icon features.

[0009] According to the security risk detection method for an application provided by the present invention, before inputting the application to be identified into a preset identification model and obtaining the detection result output by the preset identification model, the method further includes: constructing an association graph of the original application installation package using the similarity of permission calls and the similarity of icon embedding.

[0010] According to the security risk detection method for an application provided by the present invention, after constructing the association graph of the original application installation package using the similarity of permission calls and the similarity of icon embedding, the method further includes: encapsulating the first model, the second model, and the association graph into three model tools; creating an information acquisition tool; wherein the information tool includes a package name tool, a name tool, an activity tool, a permission tool, and a certificate tool; the model tools and the information tools are used by the intelligent agent.

[0011] According to the present invention, a method for detecting security risks of an application is provided, wherein the application to be identified is input into a preset identification model, and the detection result output by the preset identification model is obtained. The method includes: inputting the application to be identified into the preset identification model; a task scheduling agent generating several identification sub-tasks according to the application to be identified, and allocating the identification sub-tasks to various data analysis agents; after each data analysis agent executes the identification sub-task with the corresponding function, the results of each identification sub-task are returned to the task scheduling agent; and a result decision agent obtaining a final decision based on the integrated result of the results of each identification sub-task sent by the task scheduling agent; wherein the final decision is the detection result output by the preset identification model.

[0012] According to the present invention, a method for detecting security risks of an application is provided, wherein the application to be identified is input into a preset identification model, comprising: extracting text and icons from the application to be identified to obtain a first feature factor; resolving the network address of the application to be identified to obtain a second feature factor; obtaining a feature factor set based on the first feature factor and the second feature factor, and inputting the feature factor set into the preset identification model.

[0013] According to a security risk detection method for applications provided by the present invention, the association graph construction process includes: determining the similarity of permission calls between two applications as a first parameter; determining the similarity of icon embedding between two applications as a second parameter; determining the multimodal similarity between two applications as a third parameter based on the first and second parameters; determining the weighted undirected edges between the two applications based on the third parameter; and determining the association graph based on the weighted undirected edges between the two applications.

[0014] The present invention also provides a security risk detection device for an application, comprising: an acquisition module for acquiring an application to be identified; and a detection result module for inputting the application to be identified into a preset identification model to obtain the detection result output by the preset identification model; the preset identification model is obtained by training by parsing the data of the original application installation package; wherein the preset identification model includes multiple intelligent agents, each working in turn; the intelligent agents are used to perform different functional tasks, including task scheduling, data analysis, and result decision-making.

[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a security risk detection method for any of the above-described applications.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a security risk detection method for an application program as described above.

[0017] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements a security risk detection method for any of the above-described application programs.

[0018] This invention provides a method, apparatus, device, medium, and product for detecting security risks in applications. The method includes: acquiring an application to be identified; inputting the application to be identified into a preset identification model to obtain the detection result output by the preset identification model; the preset identification model is trained by parsing data from the original application installation package; the preset identification model includes multiple intelligent agents, each performing different functional tasks, including task scheduling, data analysis, and result decision-making. Through these methods, this invention can significantly improve the intelligence level and performance indicators of the identification model, thereby improving the accuracy of application security risk detection results. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the security risk detection method for applications provided in this embodiment of the invention.

[0021] Figure 2 This is a schematic diagram of the system architecture of the application security risk detection method provided in the embodiments of the present invention.

[0022] Figure 3 This is a schematic diagram of the structure of the application security risk detection device provided in the embodiment of the present invention.

[0023] Figure 4 This is a schematic diagram of the physical structure of the electronic device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0025] In the description of the embodiments of the present invention, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, unless otherwise expressly specified and limited, the terms "connected" and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in the embodiments of the present invention based on the specific circumstances.

[0026] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0027] This invention provides a method for detecting security risks in applications. Please refer to [link / reference]. Figure 1 , Figure 1 This is a flowchart illustrating the application security risk detection method provided in this embodiment of the invention. In this embodiment, the application security risk detection method includes steps S110 to S120, each step of which is as follows: S110: Obtain the application to be identified.

[0028] S120: Input the application to be identified into the preset identification model and obtain the detection result output by the preset identification model; wherein the preset identification model includes multiple intelligent agents, each of which works; the intelligent agents are used to perform different functional tasks, including task scheduling, data analysis and result decision-making.

[0029] Optionally, before inputting the application to be identified into the preset identification model, the original application installation package uploaded by the user can be stored and connected to the interface of the preset identification model; wherein the preset identification model is trained by parsing the data of the original application installation package. In this embodiment, the type of the application to be identified can be obtained from the detection results, wherein the type of application may include gambling-related apps, pornography-related apps, fraud-related apps, other illegal categories, and legal software.

[0030] In this embodiment, an agent refers to a system in the fields of computer science and artificial intelligence that is capable of perceiving the environment, making decisions, and performing actions. An agent can receive input information from the environment and make autonomous decisions without direct external control.

[0031] In this embodiment, the application is identified by parsing the application installation package. The application installation package can be of several types, depending on the operating system and platform.

[0032] Optionally, the application installation package includes, but is not limited to, APK (Android Package Kit) for the Android operating system, IPA (iOS Application Archive) for the iOS (iPhone, iPad) operating system, and DEB and RPM for the Linux operating system.

[0033] In this embodiment, the preset recognition model is a large language model, which can be obtained by training an initial large language model. The training data can be the data of the parsed original application installation package.

[0034] In related technologies, identification models suffer from difficulties in updating and cold-start issues in practical use, requiring a large number of labeled samples. However, this invention provides a method for detecting security risks in applications, comprising: storing the original application installation package uploaded by the user and connecting it to the interface of a preset identification model; wherein the preset identification model is trained by parsing data from the original application installation package; inputting the application to be identified into the preset identification model to obtain the detection result output by the preset identification model; through the above method, the preset identification model of this invention includes multiple intelligent agents, each performing different functional tasks, and each agent is a system entity capable of independently perceiving the environment, making decisions, and executing actions, wherein the functional tasks include task scheduling, data analysis, and result decision-making. This invention can significantly improve the intelligence level and performance indicators of the identification model, thereby improving the accuracy of application security risk detection results.

[0035] Based on any of the above embodiments, the preset recognition model includes a first model and a second model. The steps prior to inputting the application to be recognized into the preset recognition model and obtaining the detection result output by the preset recognition model may specifically include: The original application installation package is parsed to obtain its text features and icon features. A fine-tuned first model is used to classify the application to be identified based on the text features, and a second model is fine-tuned based on the icon features.

[0036] Specifically, after parsing the original application installation package, multiple feature fingerprints can be obtained. These multiple feature fingerprints are then combined to obtain text features. Based on these text features, the first model can be fine-tuned.

[0037] Specifically, icon features can be obtained by parsing the original application installation package, and the second model can be fine-tuned based on these icon features.

[0038] Optionally, the first model can be a T5 model and the second model can be a DeiT model; the fine-tuned T5 model and DeiT model are used to classify the application to be identified.

[0039] It should be noted that other types of models can also be used in other embodiments for fine-tuning and recognition of text features and / or chart features.

[0040] Based on any of the above embodiments, the step before inputting the application to be identified into the preset recognition model and obtaining the detection result output by the preset recognition model may specifically include: Construct a relationship graph of the original application installation packages by using the similarity of permission calls and the similarity of icon embeddings.

[0041] Optionally, the similarity of the access control call can be Jaccard similarity, and the similarity of the icon embedding can be cosine similarity.

[0042] Based on any of the above embodiments, the steps following the construction of the association graph of the original application installation package using the similarity of permission calls and the similarity of icon embeddings may specifically include: The first model, the second model, and the relationship graph are encapsulated into three model tools; an information acquisition tool is created; the information tools include package name tool, name tool, activity tool, permission tool, and certificate tool; the model tools and information tools are used by the intelligent agent.

[0043] Based on any of the above embodiments, data analysis includes at least one of icon analysis, content analysis, certificate review, package name tracking, permission analysis, and relationship analysis.

[0044] Based on any of the above embodiments, the step of inputting the application to be identified into a preset recognition model and obtaining the detection result output by the preset recognition model may specifically include: The application to be identified is input into the preset identification model. The task scheduling agent generates several identification sub-tasks based on the application to be identified and assigns the identification sub-tasks to various data analysis agents. After each data analysis agent executes the identification sub-task with the corresponding function, it returns the results of each identification sub-task to the task scheduling agent. The result decision agent obtains the final decision based on the integrated results of each identification sub-task sent by the task scheduling agent. The final decision serves as the detection result output by the preset identification model.

[0045] Based on any of the above embodiments, the step of inputting the application to be identified into the preset recognition model may specifically include: After extracting the text and icon of the application to be identified, the first feature factor is obtained; after resolving the network address (IP) of the application to be identified, the second feature factor is obtained; a feature factor set is obtained based on the first and second feature factors, and the feature factor set is input into the preset recognition model.

[0046] It should be noted that, for applications, text and icons are like a person's fingerprint information, which can be used as the application's identity features for identification.

[0047] Based on any of the above embodiments, the steps of the association graph construction process may specifically include: The similarity of permission calls between two applications is determined as the first parameter; the similarity of icon embedding between two applications is determined as the second parameter; the multimodal similarity between two applications is determined as the third parameter based on the first and second parameters; weighted undirected edges between two applications are determined based on the third parameter; and the association graph is determined based on the weighted undirected edges between two applications.

[0048] Please see Figure 2 , Figure 2 This is a schematic diagram of the system architecture of the application security risk detection method provided in the embodiments of the present invention.

[0049] This embodiment can be used in an abnormal app identification system. First, it receives app data uploaded by the user (including download address or installation package). This data undergoes format verification, cleaning, and formatting by the system's preprocessing module to ensure data quality and consistency. The preprocessed data is then sent to the core security risk detection module. This module, in conjunction with a multi-agent collaborative multi-model security assessment module, performs in-depth analysis and outputs the results.

[0050] Specifically, the system architecture of the application's security risk detection method can be divided into three main layers: the core capability layer, the service layer, and the data layer. Each layer contains several key modules that work together through well-defined interfaces to achieve the overall functionality of the system.

[0051] The data layer stores the original APK files uploaded by users, providing a data source for the system's static and dynamic parsing. Simultaneously, it stores textual and image features parsed from the APK files, including application name, package name, version number, MD5 hash, icon path, etc., providing foundational data for feature extraction and model training.

[0052] The service layer can connect to various model interfaces, such as the large language model interface, the Langchain interface, and the LangGraph interface.

[0053] Among them, the large language model interface includes, but is not limited to, DeepSeek-V2, for efficient data analysis, information extraction, and semantic analysis, improving the system's intelligence level and detection accuracy. The Langchain interface can provide chained reasoning and multi-step problem-solving capabilities, enhancing the system's analytical capabilities and decision support. The LangGraph interface can construct multimodal similarity metrics and knowledge graphs, supporting shell analysis and complex relationship mining.

[0054] In the core capability layer, fingerprints are extracted, tools are created, and relationship graphs are established in the static analysis layer. The final result is determined through multi-agent collaborative decision-making in the intelligent detection layer. In the report analysis layer, information is retrieved by the intelligent agent working group to generate a detection report. Multi-Agent technology can be used to achieve high performance and low false positive rate, while also ensuring the interpretability and generalization of the results. It has the capability of fully automated analysis and the analysis process is visible.

[0055] The overall process is summarized as follows: After data preprocessing is completed, the extracted feature data will be input into the trained and fine-tuned DeiT and T5 models, used for icon classification and text classification, respectively. The task scheduling and analysis module contains multiple agents, including a task scheduling agent, an outcome decision agent, and six data analysis agents that analyze different features.

[0056] The task scheduling agent is responsible for assigning detection tasks to various agents and monitoring task execution to ensure the efficiency of the analysis process. Six data analysis agents are responsible for icon analysis, content analysis, certificate review, package name tracking, sensitive permission analysis, and relationship analysis, respectively, constructing a graph of relationships between applications. The outcome decision agent, after collecting sufficient information, integrates the analysis results of all agents to conduct the final risk assessment and decision, generating a risk index and assessment results.

[0057] In summary, this embodiment extracts key information through in-depth analysis of samples, and then constructs a multi-agent collaborative team based on LLM and LangGraph to analyze fraud-related data from multiple angles and in all aspects. It boasts a high degree of intelligence and automation, enabling end-to-end, comprehensive, objective, and business-oriented evaluation of multiple abnormal app identification models or information. It also allows for flexible construction of evaluation systems, providing crucial guidance for final decision-making through multi-agent interaction and cooperation. The analysis and interpretation of model outputs across various dimensions based on a large language model overcomes the limitations of traditional data-driven indicator analysis, facilitating the understanding of model outputs and aiding in the next phase of abnormal app identification. Furthermore, by utilizing Jaccard similarity from permission calls and cosine similarity from icon embedding, a relationship graph between application installation packages is constructed. Agents can view the relationships between shell apps, helping users accurately combat illegal app criminal networks and improving the efficiency of fraud control.

[0058] To further illustrate the solution of the present invention, specific examples are provided below: Step 1: Data preprocessing.

[0059] First, each APK is parsed to obtain 14 features, including App_Name, Package_Name, Main_Activity, Activities, Services, Receivers, Permissions, Cert_SHA1, Cert_SHA256, Cert_Issuer, Cert_Subject, Cert_Hash_Algo, Cert_Signature_Algo, and Cert_Serial_Number. Then, the APK content is hashed using MD5 to obtain the APK's MD5 value.

[0060] Secondly, extract the APP's icon (Logo) and save it to the backend directory to obtain the Logo_Path feature.

[0061] Then, Androguard is used to decompile the APK's source code, and regular expressions are used to extract the domain name and IP associated with the APK.

[0062] Next, the ipinfo interface is used to obtain information such as latitude, longitude, country, region, and city for each IP address. The extracted 22 APK feature fingerprints are as follows:

[0063] Step 2: Fine-tuning the multimodal content model.

[0064] The T5 and DeiT models were fine-tuned using the parsed training data for APK classification. Each model is a multi-classifier that detects the category probability of the APK based on its content and icon, respectively.

[0065] The input to the T5 model is: The analyzed data features are synthesized to obtain text features. Then, the pre-trained Tokenizer of the T5 model is used to convert the merged text features into tensors, which are finally input into the T5 multi-class classification model for fine-tuning.

[0066] The input to the DeiT model is the image corresponding to the APK icon. After feature extraction, the features are converted into tensors and then input into the DeiT model for fine-tuning to solve the multi-classification problem of APK icons in the downstream task.

[0067] Step 3: Construct a multimodal relationship graph.

[0068] An APK association graph is constructed using Jaccard similarity from permission calls and cosine similarity from icon embeddings. A custom multimodal similarity metric is used to deeply analyze and mine related shell apps. The graph construction process is as follows: (1) Solve for the similarity of permission sets between APP A and APP B. : ; (2) Solve for the similarity of icons between APP A and APP B. : ; (3) Calculate the multimodal similarity between APP A and APP B. : ; Add a weighted undirected edge between A and B to the knowledge graph G: ; in, This is a relationship diagram. The degree of association between APKs, Jaccard similarity between APK permission calls Cosine similarity between icon embeddings of APKs It is a constant that can be adjusted between 0 and 1.

[0069] Step 4: Encapsulate model tools and information tools.

[0070] The T5 and DeiT models obtained from the fine-tuning steps above, as well as the multimodal relationship graph, are encapsulated into three model tools (get_content_prob, get_icon_prob, get_related_apps), and five information tools (get_package_name, get_name, get_activities, get_permissions, get_certificate) are created for subsequent use by intelligent agents.

[0071] Step 5: Detection of fraudulent apps based on multi-agent collaboration.

[0072] First, eight agents are created using the LangGraph and Prompt projects: task scheduling, icon analysis, content analysis, certificate review, package name tracking, sensitive permissions, correlation analysis, and result decision-making. The task scheduling agent assigns tasks to the six middle agents based on user-uploaded or selected APK data. These six agents then use pre-packaged tools to acquire relevant data and invoke T5 and DeiT models. After completing their work, the results are returned to the task scheduling agent, which integrates the results and sends them to the final decision-making agent. The final decision-making agent then determines the probability that the current APK belongs to each category based on the task completion status and results of each agent.

[0073] To ensure that each agent performs its designated functions, it is necessary to assign each agent a corresponding role and task. The roles and tasks of each agent are as follows: (1) Task scheduling agent

[0074] [Define Role] As a task scheduling agent, its role is to coordinate and manage the interaction and cooperation among a specific group of working members. These members include, but are not limited to, icon analysis agent, content analysis agent, certificate review agent, package name tracking agent, sensitive permission agent, and correlation analysis agent.

[0075] [Task Definition] Collaborate to classify Android application installation packages (APKs) according to their nature. This task aims to identify and determine the specific category of the APK as comprehensively as possible.

[0076] For example, upon receiving a user's request or submitted APK data, the task scheduling agent is responsible for allocating subsequent processing flows and determining which agent should perform the next operation. Each agent will perform analysis in its area of ​​expertise according to the predetermined task flow and report its results and status. The task scheduling agent should continuously monitor the entire process until all agents have completed their tasks. After all agents have completed their work and submitted their results, the task scheduling agent needs to collect all necessary information, summarize the analysis results, and transmit them to the final decision agent for comprehensive evaluation and final classification.

[0077] (2) Package Name Tracking Agent (APP_Package_Tracer)

[0078] [Define Role] As a package name tracking agent focused on static analysis of applications, its role is to reveal the information behind an application's package name by parsing it.

[0079] [Task Definition] Based on the obtained package name, make a preliminary judgment on whether the APK is suspicious. This task aims to identify the category to which the APK belongs as accurately as possible.

[0080] The package name tracking agent is authorized to use the following tools, combined with professional knowledge, to make judgments and provide basic information for subsequent analysis and decision-making to assist in completing the task: get_package_name: Retrieves the application's package name based on the MD5 hash.

[0081] get_name: Retrieves the application name based on the MD5 hash.

[0082] get_activities: Retrieves the application's main activities and a list of all its activities based on the MD5 hash.

[0083] (3) Sensitive Info Analyzer Agent

[0084] [Define Role] As a sensitive permission agent focused on application static analysis, it has the ability to conduct in-depth research on the permissions requested by the application, especially those permissions that may be suspected of abnormal behavior.

[0085] [Task Definition] Based on the obtained permission information, make a preliminary judgment on whether the APK exhibits any suspicious behavior. This task aims to identify the category to which the APK belongs as accurately as possible.

[0086] The sensitive permission agent is authorized to use the following tools to assist in completing the task: get_activities: Retrieves the application's main activities and a list of all its activities based on the MD5 hash.

[0087] get_service_receiver: Retrieves the service and receiver requested by the application based on the MD5 hash.

[0088] get_permissions: Retrieves the list of permissions requested by the application based on the MD5 hash.

[0089] (4) Certificate Inspector

[0090] [Define Role] As a certificate review agent focused on static analysis of Android applications, it is highly sensitive to certificate information involved in abnormal apps.

[0091] [Task Definition] Based on the obtained certificate information, make a preliminary judgment on whether the APK is suspicious. This task aims to identify the APK's category as accurately as possible. [Tool Licensing]

[0092] The certificate verification agent is authorized to use the following tools to assist in completing the task: get_certificate: Retrieves certificate information based on the MD5 hash.

[0093] (5) Content Analysis Agent (Content_Analyzer)

[0094] [Define Role] As a content analysis agent focused on static analysis, it is highly sensitive to textual information involved in abnormal apps. Please note that you should not rely too heavily on the results output by the content analysis model, as they may have a certain false positive rate.

[0095] [Task Definition] Invoke the content analysis model and summarize its results. This task aims to ensure that the information extracted from the text content accurately reflects the potential risk categories of the app.

[0096] The content analytics agent is authorized to use the following tools to assist in completing the task: get_content_prob: Gets the probability distribution of the corresponding APK content belonging to various types based on the MD5 code.

[0097] (6) Icon Analysis Agent (Icon_Analyzer)

[0098] [Define Role] As an icon analysis agent focused on static analysis, it is highly sensitive to icon information involved in abnormal apps. Please note that you should not rely too heavily on the results output by the icon analysis model, as they may have a certain false positive rate.

[0099] [Task Definition] Invoke the icon analysis model and organize and summarize its analysis results. This task aims to ensure that the information extracted from the icons accurately reflects the potential risk categories of the app.

[0100] The icon analysis agent is authorized to use the following tools to assist in completing the task: get_icon_prob: Gets the probability distribution of the corresponding APK icon belonging to the following types based on the MD5 code.

[0101] (7) Relationship Analysis Agent (Relationship_Analyzer)

[0102] [Defining Role] As a correlation analysis agent focused on identifying unauthorized apps, this agent excels at uncovering hidden relationship networks within applications. During the analysis, it does not overly rely on the results of relationship graphs, as their accuracy can be affected by various factors.

[0103] [Task Definition] Analyze other apps related to a given app to further determine the category of the given app. This task aims to explore the interrelationships between apps, identify potential risk signals, and provide supplementary evidence for the classification of a given app.

[0104] The association analysis agent is authorized to use the following tools to assist in completing the task: get_related_apps: Gets a list of other applications related to a given APK based on its MD5 hash.

[0105] (8) Outcome-based decision-making agent (Decision_Maker)

[0106] [Define Role] As the final decision-maker, the outcome decision agent is responsible for determining the category to which the APK belongs. The decision scope is limited to the following APP categories, each with a probability value between 0 and 1.

[0107] [Define Task] Output the decision results for each category, including the probability value and corresponding label for each category. The decision should comprehensively consider the consistency, relevance, and reliability of the analysis results from various agents, including data from multiple dimensions such as content analysis, icon analysis, certificate review, package name tracking, sensitive permission analysis, and correlation analysis.

[0108] This embodiment utilizes multi-agent interaction and collaboration, eliminating the need for complex feature construction and weight fusion as in traditional methods. Instead, by clearly defining the agents' roles and tasks, it fully leverages the LLM's generation capabilities, utilizing the app's fingerprint features and its powerful reasoning abilities to make the final decision. By combining a fine-tuned unimodal model, multimodal relationship graphs, and multidimensional information tools, and by authorizing the corresponding agents with these tools, multiple agents can fully utilize known probability distributions and information to assist the LLM in completing the corresponding tasks. This embodiment, based on DeepSeek, has been validated on large-scale test data, achieving an F1-Score of 0.9568 across all categories.

[0109] In summary, this embodiment proposes a multi-agent collaborative multi-model anomaly app evaluation method. It constructs a multi-agent collaborative team (comprising 8 agents with their own roles and their System Prompts) based on LLM and LangGraph, and builds 3 model tools and 5 information tools. It utilizes a large language model and novel agent technology to improve the accuracy and interpretability of the detection results; it constructs a self-updating multimodal anomaly app relationship graph to iteratively optimize the subsequent app detection process; and it analyzes and interprets the output results of each dimension of the model based on the large language model, overcoming the limitations of traditional data-driven indicator analysis.

[0110] The present invention also provides an application security risk detection device. The application security risk detection device provided by the present invention will be described below. The application security risk detection device described below can be referred to in correspondence with the application security risk detection method described above.

[0111] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of an application security risk detection device provided in an embodiment of the present invention. In this embodiment, the application security risk detection device may include an acquisition module 310 and a detection result module 320.

[0112] The acquisition module 310 is used to acquire the application to be identified.

[0113] The detection result module 320 is used to input the application to be identified into the preset recognition model and obtain the detection result output by the preset recognition model. The preset recognition model is trained by parsing the data of the original application installation package. The preset recognition model includes multiple intelligent agents, each of which performs different functional tasks, including task scheduling, data analysis, and result decision-making.

[0114] Optionally, the application security risk detection device may also include a storage connection module, which can be used to store the original application installation package uploaded by the user and connect to the interface of the preset recognition model.

[0115] Based on any of the above embodiments, the preset recognition model may include a first model and a second model, and the application security risk detection device may include a training module, which may specifically be used for: The original application installation package is parsed to obtain its text features and icon features. A fine-tuned first model is used to classify the application to be identified based on the text features, and a second model is fine-tuned based on the icon features.

[0116] Based on any of the above embodiments, the training module can also be used to: construct an association graph of the original application installation package using the similarity of permission calls and the similarity of icon embeddings.

[0117] Based on any of the above embodiments, the training module can also be used to: encapsulate the first model, the second model, and the relationship graph into three model tools; create an information acquisition tool; wherein the information tools include a package name tool, a name tool, an activity tool, a permission tool, and a certificate tool; and the model tools and information tools are used by the intelligent agent.

[0118] Based on any of the above embodiments, the detection result module 320 can specifically be used for: The application to be identified is input into the preset identification model. The task scheduling agent generates several identification sub-tasks based on the application to be identified and assigns the identification sub-tasks to various data analysis agents. After each data analysis agent executes the identification sub-task with the corresponding function, it returns the results of each identification sub-task to the task scheduling agent. The result decision agent obtains the final decision based on the integrated results of each identification sub-task sent by the task scheduling agent. The final decision serves as the detection result output by the preset identification model.

[0119] Based on any of the above embodiments, the detection result module 320 can specifically be used for: After extracting the text and icon of the application to be identified, the first feature factor is obtained; after parsing the network address of the application to be identified, the second feature factor is obtained; a feature factor set is obtained based on the first and second feature factors, and the feature factor set is input into the preset recognition model.

[0120] Based on any of the above embodiments, the steps of the association graph construction process may specifically include: The similarity of permission calls between two applications is determined as the first parameter; the similarity of icon embedding between two applications is determined as the second parameter; the multimodal similarity between two applications is determined as the third parameter based on the first and second parameters; weighted undirected edges between two applications are determined based on the third parameter; and the association graph is determined based on the weighted undirected edges between two applications.

[0121] On the other hand, embodiments of the present invention also provide an electronic device, please refer to... Figure 4 , Figure 4 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of the present invention, such as... Figure 4As shown, the electronic device may include: a memory 420, a processor 410, and a computer program stored in the memory 420 and executable on the processor 410. When the processor 410 executes the program, it implements the security risk detection methods for the application provided by the methods described above.

[0122] Optionally, the electronic device may further include a communication bus 430 and a communication interface 440, wherein the processor 410, the communication interface 440, and the memory 420 communicate with each other via the communication bus 430. The processor 410 can call a computer program in the memory 420 to execute a security risk detection method for an application program, which may include: The process involves: acquiring the application to be identified; inputting the application to be identified into a preset identification model; obtaining the detection results output by the preset identification model; the preset identification model is trained by parsing the data of the original application installation package; the preset identification model includes multiple intelligent agents, each with its own function; the intelligent agents are used to perform different functional tasks, including task scheduling, data analysis, and result decision-making.

[0123] Furthermore, the logical instructions in the aforementioned memory 420 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0124] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the security risk detection method for the application provided by the above methods. The steps and principles of the method have been described in detail in the above methods and will not be repeated here.

[0125] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a security risk detection method for executing the application provided by the above methods. The steps and principles of this method have been described in detail in the above methods and will not be repeated here.

[0126] Non-transitory computer-readable storage media can be any available medium or data storage device that can be accessed by a processor, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)).

[0127] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0128] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting security risks of an application, characterized in that: include: Get the application to be identified; Inputting the application to be identified into the preset recognition model to obtain a detection result output by the preset recognition model; The preset recognition model is obtained by training by parsing the data of the original application installation package; The preset recognition model includes multiple intelligent agents that work separately; the intelligent agents are used to perform different functional tasks, and the functional tasks include task scheduling, data analysis and result decision-making.

2. The method for detecting security risks of an application according to claim 1, characterized in that: The preset recognition model includes a first model and a second model. Before inputting the application to be recognized into the preset recognition model and obtaining the detection result output by the preset recognition model, the method includes: Parsing the original application installation package to obtain text features and icon features of the original application installation package; The first model is fine-tuned based on the text features; wherein the fine-tuned first model is used to classify the application to be identified according to the text features, The second model is fine-tuned based on the icon features; wherein the fine-tuned second model is used to classify the application to be identified according to the icon features.

3. The method for detecting security risks of an application according to claim 2, characterized in that: Before inputting the application to be identified into the preset identification model and obtaining the detection result output by the preset identification model, the method further includes: The association relationship graph of the original application installation package is constructed by using the similarity of permission calls and the similarity of icon embedding.

4. The method for detecting security risks of an application according to claim 3, characterized in that: After constructing the association relationship graph of the original application installation package by using the similarity of the permission call and the similarity of the icon embedding, the method further includes: Encapsulating the first model, the second model and the association relationship diagram into three model tools; Create an information acquisition tool; wherein the information tool includes a package name tool, a name tool, an activity tool, an authority tool and a certificate tool; the model tool and the information tool are used by the agent.

5. The method for detecting security risks of an application according to claim 4, characterized in that: The step of inputting the application to be identified into the preset identification model to obtain the detection result output by the preset identification model includes: The application to be identified is input into the preset identification model, the task scheduling agent generates a number of identification subtasks according to the application to be identified, and distributes the identification subtasks to each data analysis agent; after each data analysis agent performs the identification subtask of the corresponding function, it returns the result of each identification subtask to the task scheduling agent; the result decision agent obtains a final decision based on the integration result of each identification subtask result sent by the task scheduling agent; wherein the final decision is used as the detection result output by the preset recognition model.

6. The method for detecting security risks of an application according to claim 5, characterized in that: The step of inputting the application to be identified into the preset identification model includes: After extracting text and icon from the application to be identified, a first characteristic factor is obtained; After performing network address resolution on the application to be identified, a second characteristic factor is obtained; A feature factor set is obtained according to the first feature factor and the second feature factor, and the feature factor set is input into the preset recognition model.

7. The method for detecting security risks of an application according to claim 4, characterized in that: The association relationship graph construction process includes: Determine the similarity of permission calls between two applications as a first parameter; Determining the similarity of icon embedding between the two applications as a second parameter; Determining the multimodal similarity between the two applications as a third parameter based on the first parameter and the second parameter; determining a weighted undirected edge between the two applications based on the third parameter; The association relationship graph is determined based on the weighted undirected edges between the two applications.

8. A security risk detection device for an application, characterized in that: include: An acquisition module, used for acquiring an application to be identified; A detection result module, used for inputting the application to be identified into the preset recognition model to obtain the detection result output by the preset recognition model; the preset recognition model is obtained by training by parsing the data of the original application installation package; The preset recognition model includes multiple intelligent agents that work separately; the intelligent agents are used to perform different functional tasks, and the functional tasks include task scheduling, data analysis and result decision-making.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for detecting security risks of the application program according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting security risks of an application program according to any one of claims 1 to 7 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for detecting security risks of an application program according to any one of claims 1 to 7 is implemented.

Images