Application security risk detection method, device, equipment, medium and product

Abstract

The application relates to the technical field of artificial intelligence, and provides an application program security risk detection method, device, equipment, medium and product, the application program security risk detection method comprises the following steps: obtaining an application program to be identified; inputting the application program to be identified into a preset identification model to obtain a detection result output by the preset identification model; the preset identification model is obtained by training data of an original application program installation package; the preset identification model comprises multiple intelligent agents working respectively, and the intelligent agents are used for executing different function tasks, wherein the function tasks comprise task scheduling, data analysis and result decision. Through the above mode, the intelligent level and performance index of the identification model can be significantly improved, so that the accuracy of the security risk detection result of the application program is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to a security risk detection method and device for an application program, equipment, a medium and a product. BACKGROUND

[0002] In the era of rapid development of information communication technology, abnormal APPs (Application) may cause various harms to users and devices.

[0003] Abnormal APPs, also known as malicious software, disguised applications or applications with security risks, may cause problems such as data leakage, privacy invasion, network security risks, false advertising and marketing, and malicious software propagation, etc., which seriously affect the user experience.

[0004] The current evaluation technology for abnormal APPs has the following problems:

[0005] 1) In the evaluation of APP security risks, the recognition ability of risk APPs involving multi-modal information, new patterns and highly abstract semantic features is insufficient.

[0006] 2) Highly dependent on feature engineering, the model performance is unstable and the intelligent level is low. SUMMARY

[0007] The present application provides a security risk detection method and device for an application program, equipment, a medium and a product to solve the problem of low intelligent level of the recognition model and inaccurate detection results in the prior art.

[0008] The present application provides a security risk detection method for an application program, comprising: obtaining an application program to be identified; inputting the application program to be identified into a preset recognition model to obtain a detection result output by the preset recognition model; the preset recognition model is obtained by training data of an original application program installation package; wherein the preset recognition model includes a plurality of intelligent agents working independently; the intelligent agent is used to perform different functional tasks, and the functional tasks include task scheduling, data analysis and result decision.

[0009] According to the security risk detection method for an application program provided by the present application, the preset recognition model includes a first model and a second model, before the application program to be identified is input into the preset recognition model to obtain the detection result output by the preset recognition model, the original application program installation package is analyzed to obtain text features and icon features of the original application program installation package; the first model is fine-tuned based on the text features; wherein the fine-tuned first model is used to classify the application program to be identified according to the text features; the second model is fine-tuned based on the icon features; wherein the fine-tuned second model is used to classify the application program to be identified according to the icon features.

[0010] The application further provides a security risk detection method of an application program, wherein the method comprises the following steps: inputting an application program to be identified into a preset identification model; and obtaining a detection result output by the preset identification model, wherein the method further comprises the following steps before the step of inputting the application program to be identified into the preset identification model: constructing an association relationship graph of an original application program installation package by using a similarity of permission calling and a similarity of icon embedding.

[0011] The application further provides a security risk detection method of an application program, wherein the method comprises the following steps: inputting an application program to be identified into a preset identification model; and obtaining a detection result output by the preset identification model, wherein the method further comprises the following steps after the step of constructing the association relationship graph of the original application program installation package by using the similarity of permission calling and the similarity of icon embedding: encapsulating the first model, the second model and the association relationship graph into three model tools; and creating an information tool, wherein the information tool comprises a package name tool, a name tool, an activity tool, a permission tool and a certificate tool; and the model tools and the information tool are used by the intelligent agent.

[0012] The application further provides a security risk detection method of an application program, wherein the method comprises the following steps: inputting an application program to be identified into a preset identification model; and obtaining a detection result output by the preset identification model, wherein the method further comprises the following steps: inputting the application program to be identified into the preset identification model; generating a plurality of identification sub-tasks according to the application program to be identified by a task scheduling intelligent agent, and distributing the identification sub-tasks to each data analysis intelligent agent; returning each identification sub-task result to the task scheduling intelligent agent after each data analysis intelligent agent executes the identification sub-task of the corresponding function; and obtaining a final decision according to the integration result of each identification sub-task result sent by the task scheduling intelligent agent, wherein the final decision is taken as the detection result output by the preset identification model.

[0013] The application further provides a security risk detection method of an application program, wherein the method comprises the following steps: inputting an application program to be identified into a preset identification model; and obtaining a detection result output by the preset identification model, wherein the method further comprises the following steps: obtaining a first characteristic factor after text and icon extraction of the application program to be identified; obtaining a second characteristic factor after network address analysis of the application program to be identified; obtaining a characteristic factor set according to the first characteristic factor and the second characteristic factor; and inputting the characteristic factor set into the preset identification model.

[0014] The application further provides a security risk detection method of an application program, wherein the association relationship graph construction process comprises the following steps: determining a similarity of permission calling between two application programs as a first parameter; determining a similarity of icon embedding between the two application programs as a second parameter; determining a multi-modal similarity between the two application programs according to the first parameter and the second parameter as a third parameter; determining a weighted undirected edge between the two application programs based on the third parameter; and determining the association relationship graph based on the weighted undirected edge between the two application programs.

[0015] The application further provides an application security risk detection device, comprising: an acquisition module configured to acquire an application to be identified; a detection result module configured to input the application to be identified into a preset identification model to obtain a detection result output by the preset identification model; the preset identification model is obtained by training data of an original application installation package; and the preset identification model comprises a plurality of intelligent agents working independently.

[0016] The application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the application security risk detection method according to any one of the above embodiments when executing the program.

[0017] The application further provides a non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program is executable on a processor to implement the application security risk detection method according to any one of the above embodiments.

[0018] The application further provides a computer program product comprising a computer program, wherein the computer program is executable on a processor to implement the application security risk detection method according to any one of the above embodiments.

[0019] The application provides an application security risk detection method, device, equipment, medium and product, the application security risk detection method comprising: acquiring an application to be identified; inputting the application to be identified into a preset identification model to obtain a detection result output by the preset identification model; and the preset identification model is obtained by training data of an original application installation package; the preset identification model comprises a plurality of intelligent agents working independently, and the intelligent agents are configured to perform different functional tasks, wherein the functional tasks comprise task scheduling, data analysis and result decision. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the present application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0021] Figure 1 is a flowchart of the application security risk detection method provided by the embodiments of the present application.

[0022] Figure 2 is a system architecture schematic diagram of the application program security risk detection method provided by the embodiment of the application.

[0023] Figure 3 is a structural schematic diagram of the application program security risk detection device provided by the embodiment of the application.

[0024] Figure 4 is a physical structure schematic diagram of the electronic device provided by the embodiment of the application. DETAILED DESCRIPTION

[0025] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below with reference to the drawings in the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0026] In the description of the embodiments of the present application, the terms "first", "second", "third" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance. In addition, unless otherwise explicitly specified and limited, the terms "connected", "connected" should be understood broadly, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium. For those skilled in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0027] In the description of the present application, the description of the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of the present application. In the present application, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine the different embodiments or examples described in the present application and the features of the different embodiments or examples without contradiction.

[0028] The present application provides an application program security risk detection method, please refer to Figure 1 , Figure 1 is a flowchart of the application program security risk detection method provided by the embodiment of the present application. In the present embodiment, the application program security risk detection method comprises steps S110 to S120, and each step is specifically as follows:

[0029] S110: Obtain an application program to be identified.

[0030] S120: Input the application program to be identified into a preset identification model to obtain a detection result output by the preset identification model; wherein the preset identification model comprises a plurality of intelligent agents working respectively; the intelligent agents are used to perform different functional tasks, and the functional tasks include task scheduling, data analysis and result decision.

[0031] Optionally, before the application program to be identified is input into the preset identification model, an original application program installation package uploaded by a user can be stored, and an interface of the preset identification model is connected; wherein the preset identification model is obtained by training data of the original application program installation package. In this embodiment, the type of the application program to be identified can be obtained through the detection result, wherein the type of the application program can include gambling-related APP, pornography-related APP, fraud-related APP, other illegal categories and legal software.

[0032] In this embodiment, an intelligent agent (Agent) refers to a system capable of perceiving the environment, making decisions and performing actions in the field of computer science and artificial intelligence. The intelligent agent can receive input information from the environment and make decisions autonomously without external direct control.

[0033] In this embodiment, the identification of the application program is obtained by analyzing the application program installation package. The application program installation package can have multiple types, and the type depends on the operating system and platform.

[0034] Optionally, the application program installation package includes but is not limited to APK (Android Package Kit) for Android (Android) operating system, IPA (iOS Application Archive) for iOS (iPhone, iPad) operating system and DEB and RPM for Linux operating system.

[0035] In this embodiment, the preset identification model is a large language model, which can be obtained by training an initial large language model, wherein the training data can be the data of the original application program installation package obtained by analysis.

[0036] In the related art, the identification model has difficulty in updating, and has a cold start problem in actual use, and a large number of labeled samples are required. However, the embodiment of the application provides a security risk detection method of an application program, comprising: storing an original application installation package uploaded by a user, and connecting an interface of a preset identification model; wherein the preset identification model is obtained by training data of the original application installation package; inputting an application to be identified into the preset identification model to obtain a detection result output by the preset identification model; in the above manner, the preset identification model of the application includes a plurality of intelligent agents working respectively, the intelligent agents are used to perform different functional tasks, and the intelligent agents are system entities capable of independently perceiving the environment, decision-making and performing actions, wherein the functional tasks include task scheduling, data analysis and result decision-making. The embodiment of the application can significantly improve the intelligent level and performance index of the identification model, thereby improving the accuracy of the security risk detection result of the application program.

[0037] Based on any of the above embodiments, the preset identification model includes a first model and a second model, and before the step of inputting the application to be identified into the preset identification model to obtain the detection result output by the preset identification model, the step can specifically include:

[0038] The original application installation package is analyzed to obtain text features and icon features of the original application installation package; wherein the fine-tuned first model is used to classify the application to be identified according to the text features, and the second model is fine-tuned based on the icon features; wherein the fine-tuned second model is used to classify the application to be identified according to the icon features.

[0039] Specifically, after the original application installation package is analyzed, a plurality of feature fingerprints can be obtained, the plurality of feature fingerprints are synthesized to obtain text features, and the first model can be fine-tuned based on the text features.

[0040] Specifically, after the original application installation package is analyzed, icon features can be obtained, and the second model can be fine-tuned based on the icon features.

[0041] Optionally, the first model can be a T5 model, and the second model can be a DeiT model; the fine-tuned T5 model and DeiT model are used for classification of the application to be identified.

[0042] It should be noted that in other embodiments, other types of models can be used for fine-tuning and identification of text features and / or icon features.

[0043] Based on any of the above embodiments, before the step of inputting the application to be identified into the preset identification model to obtain the detection result output by the preset identification model, the step can specifically further include:

[0044] The similarity of the permission call and the similarity of the icon embedding are used to construct a correlation graph of the original application installation package.

[0045] Optionally, the similarity of the permission call can be Jaccard similarity, and the similarity of the icon embedding can be cosine similarity.

[0046] Based on any of the above embodiments, after the similarity of the permission call and the similarity of the icon embedding are used to construct a correlation graph of the original application installation package, the steps can specifically include:

[0047] The first model, the second model, and the correlation graph are encapsulated into three model tools; an information tool is created; the information tool includes a package name tool, a name tool, an activity tool, a permission tool, and a certificate tool; the model tools and the information tool are used by the intelligent agent.

[0048] Based on any of the above embodiments, the data analysis includes at least one of icon analysis, content analysis, certificate review, package name tracking, permission analysis, and relationship analysis.

[0049] Based on any of the above embodiments, the step of inputting the to-be-identified application into the preset identification model to obtain a detection result output by the preset identification model can specifically include:

[0050] The to-be-identified application is input into the preset identification model, the task scheduling intelligent agent generates a plurality of identification sub-tasks according to the to-be-identified application, and the identification sub-tasks are distributed to each data analysis intelligent agent; after each data analysis intelligent agent executes the identification sub-tasks of the corresponding function, the results of each identification sub-task are returned to the task scheduling intelligent agent; the result decision intelligent agent obtains a final decision according to the integration result of each identification sub-task result sent by the task scheduling intelligent agent; wherein the final decision is the detection result output by the preset identification model.

[0051] Based on any of the above embodiments, the step of inputting the to-be-identified application into the preset identification model can specifically include:

[0052] After the to-be-identified application is extracted for text and icons, a first characteristic factor is obtained; after the to-be-identified application is parsed for an Internet Protocol (IP) address, a second characteristic factor is obtained; a characteristic factor set is obtained according to the first characteristic factor and the second characteristic factor, and the characteristic factor set is input into the preset identification model.

[0053] It should be noted that for an application, text and icons are equivalent to fingerprint information of a person, which can be used as an identity feature of the application for identification.

[0054] Based on any of the above embodiments, the steps of the association graph construction process can specifically include:

[0055] The similarity of the permission call between the two applications is determined as a first parameter; the similarity of the icon embedding between the two applications is determined as a second parameter; the multi-modal similarity between the two applications is determined as a third parameter according to the first parameter and the second parameter; a weighted undirected edge between the two applications is determined based on the third parameter; and the association graph is determined based on the weighted undirected edge between the two applications.

[0056] Referring to Figure 2 , Figure 2 is a system architecture diagram of the application security risk detection method provided by the embodiments of the application.

[0057] The present embodiment can be used for an abnormal APP identification system. First, APP data uploaded by a user (including a download address or an installation package) is received, and the data is subjected to format verification, cleaning and formatting by a preprocessing module of the system to ensure the quality and consistency of the data. The preprocessed data is then sent to a core security risk detection module, which performs in-depth analysis in combination with a multi-model security evaluation module based on multi-agent cooperation and outputs the results.

[0058] Specifically, the system architecture of the application security risk detection method can be divided into three main levels: core capability layer, service layer and data layer. Each level contains several key modules that work together through well-defined interfaces to achieve the overall function of the system.

[0059] The data layer stores the original APK files uploaded by the user, providing data sources for static and dynamic analysis of the system. At the same time, it stores the text features and image features extracted from the APK files, including application name, package name, version number, MD5, icon path, etc., providing basic data for feature extraction and model training.

[0060] The service layer can connect various model interfaces. For example, large language model interface, Langchain interface and LangGraph interface.

[0061] Among them, the large language model interface includes but is not limited to DeepSeek-V2, etc., which is used for efficient data analysis, information extraction, semantic analysis, and improves the intelligent level and detection accuracy of the system. The Langchain interface can provide chain reasoning and multi-step problem solving functions, enhancing the analysis capability and decision support of the system. The LangGraph interface can construct multi-modal similarity measurement and knowledge graph, supporting shell analysis and complex relationship mining.

[0062] In the core capability layer, by extracting fingerprints, creating tools and establishing relationship diagrams in the static analysis layer, multi-agent collaborative decision-making is performed in the intelligent detection layer, and the final result is obtained. In the report analysis layer, the detection report is generated by searching information through the agent working group. Muti-Agent technology can be used to achieve high performance and low misdiagnosis rate, while ensuring the interpretability and generalization of the results. The whole process is automatically analyzed, and the analysis process is visible.

[0063] The overall process is as follows: after data preprocessing, the extracted feature data is input into the trained and fine-tuned DeiT model and T5 model for icon classification and text classification, respectively. The task scheduling and analysis module includes multiple agents, including a task scheduling agent, a result decision-making agent, and six data analysis agents for analyzing different features.

[0064] Among them, the task scheduling agent is responsible for assigning detection tasks to each agent and monitoring task execution to ensure the efficiency of the analysis process. The six data analysis agents are responsible for icon analysis, content analysis, certificate review, package name tracking, sensitive permission analysis, and relationship analysis, respectively, to build an association relationship graph between applications. The result decision-making agent collects enough information, integrates the analysis results of each agent, and makes a final risk assessment and decision to generate a risk index and evaluation result.

[0065] In the above, the embodiment extracts important information by deep analysis of samples, then builds a multi-agent collaboration team based on LLM and LangGraph, and analyzes fraud data from multiple angles. It is highly intelligent and automated, can comprehensively, objectively and business-orientedly evaluate multiple abnormal APP identification models or information from end to end, allows flexible construction of evaluation system, and provides important guidance for final decision-making through multi-agent interaction; based on large language model, the output results of each dimension model are analyzed and explained, breaking through the limitations of traditional index analysis data, facilitating understanding of model output results, and being conducive to the next step of abnormal APP identification work; the Jaccard similarity of permission call and the cosine similarity of icon embedding (Embedding) are weighted to build the association relationship graph between application installation packages. The agent can view the association relationship between the shell APPs, help users accurately crack illegal APP organized crime network, and improve the efficiency of fraud governance.

[0066] In order to further illustrate the scheme of the present application, the following will be described through specific examples:

[0067] Step 1: Data preprocessing.

[0068] First, parse each APK to get 14 features such as App_Name, Package_Name, Main_Activity, Activities, Services, Receivers, Permissions, Cert_SHA1, Cert_SHA256, Cert_Issuer, Cert_Subject, Cert_Hash_Algo, Cert_Signature_Algo, and Cert_Serial_Number. Then, perform MD5 hashing on the APK content to get the APK's MD5 value.

[0069] Second, extract the APP's icon Logo and save it to the backend directory to get the Logo_Path feature.

[0070] Then, use androguard to decompile the APK source code and use regular expressions to extract the associated domain name and IP of the APK.

[0071] Next, use the ipinfo interface to obtain the latitude, longitude, country, region, city, and other information of each IP. The extracted 22 APK feature fingerprints are as follows:

[0072]

[0073] Step two: Fine-tuning of multi-modal content model.

[0074] Fine-tune the T5 model and DeiT model using the parsed training data for APK classification. Each model is a multi-classifier that detects the class probability of the APK based on content and icon, respectively.

[0075] The input of the T5 model is: Synthesize the above parsed data features to get the text features, then use the T5 model's pre-trained Tokenizer to convert the merged text features into tensors, and finally input them into the T5 multi-classification model for fine-tuning.

[0076] The input of the DeiT model is: the picture corresponding to the APK icon. After feature extraction, convert the features to tensors and input them into the DeiT model for fine-tuning to solve the downstream task of APK icon multi-classification.

[0077] Step three: Build a multi-modal association graph.

[0078] Use the Jaccard similarity of permission calls and the cosine similarity of icon Embedding to build an APK association graph, define a multi-modal similarity metric, and deeply analyze and mine the associated APPs. The relationship graph construction process is as follows:

[0079] (1) Solve the similarity of the permission set between APP A and B :

[0080] ;

[0081] (2) Solve the similarity of the Icon between APP A and B :

[0082] ;

[0083] (3) Calculate the multi-modal similarity between APP A and B :

[0084] ;

[0085] Add a weighted undirected edge between A and B on the knowledge graph G:

[0086] ;

[0087] where, is the association graph, is the degree of association between APKs, is the Jaccard similarity between APK permission calls, is the cosine similarity between APK Icon Embeddings, is a constant adjustable between 0 and 1.

[0088] Step four: Model tools and information tools encapsulation.

[0089] Encapsulate the T5 and DeiT models fine-tuned in the above steps, as well as the multi-modal association graph, into three model tools (get_content_prob, get_icon_prob, get_related_apps), and create five information tools (get_package_name, get_name, get_activities, get_permissions, get_certificate) to obtain package name, name, activity, permission, and certificate, for subsequent agent use.

[0090] Step five: Fraud-related APP detection based on multi-agent collaboration.

[0091] First, LangGraph and Prompt engineering are used to create eight Agents for task scheduling, icon analysis, content analysis, certificate review, package name tracking, sensitive permissions, correlation analysis, and result decision-making. The task scheduling Agent arranges tasks for the six intermediate Agents by uploading or selecting APK data from the user, and each Agent performs its work. The six intermediate Agents obtain the corresponding data by using the encapsulated tools, call the T5 and DeiT models, and return the results to the task scheduling Agent after completing their work. The task scheduling Agent integrates the results and transmits them to the final decision-making Agent, which gives the probability of the current APK belonging to each category based on the task completion and results of each Agent.

[0092] To let each intelligent agent perform the function task as specified, the corresponding role and task need to be set for each intelligent agent. The role and task of each intelligent agent are as follows:

[0093] (1) Task scheduling Agent

[0094] [Define role] As a task scheduling Agent, the role is to coordinate and manage the interaction and cooperation between a group of specific work members. These members include but are not limited to icon analysis Agent, content analysis Agent, certificate review Agent, package name tracking Agent, sensitive permissions Agent, and correlation analysis Agent.

[0095] [Define task] Collaborate to complete the nature classification task of Android application installation package (APK). This task aims to identify and determine the specific category of APK as comprehensively as possible.

[0096] For example, when receiving the user's request or submitted APK data, the task scheduling Agent needs to be responsible for assigning the subsequent processing flow and determining which Agent should perform the next operation. Each Agent will perform analysis in its specialized field according to the predetermined task flow and feedback its results and status. The task scheduling Agent should continuously monitor the entire process until all Agents complete their tasks. After all Agents have completed their work and submitted the results, the task scheduling Agent needs to collect all necessary information, analyze the results, and pass them to the final decision-making Agent for comprehensive evaluation and final classification.

[0097] (2) Package name tracking Agent (APP_Package_Tracer)

[0098] [Definition Role] As a package name tracking agent focused on static analysis of applications, its role is to reveal the information behind the application package name through parsing.

[0099] [Definition Task] Based on the obtained package name, it preliminarily judges whether the APK has any suspicious abnormalities. This task aims to accurately identify the category of the APK as much as possible.

[0100] Among them, the package name tracking agent is authorized to use the following tools in combination with professional knowledge to make judgments, providing basic information for subsequent analysis and decision-making to assist in completing the task:

[0101] get_package_name: Get the package name of the application based on the MD5 code.

[0102] get_name: Get the name of the application based on the MD5 code.

[0103] get_activities: Get the main activity (Activity) and all activity lists of the application based on the MD5 code.

[0104] (3) Sensitive Permission Agent (Sensitive_Info_Analyzer)

[0105] [Definition Role] As a sensitive permission agent focused on static analysis of applications, it has the ability to conduct in-depth research on the permissions requested by the application, especially those that may be involved in abnormal behavior.

[0106] [Definition Task] Based on the obtained permission information, it preliminarily judges whether the APK has any suspicious behavior. This task aims to accurately identify the category of the APK as much as possible.

[0107] Among them, the sensitive permission agent is authorized to use the following tools to assist in completing the task:

[0108] get_activities: Get the main activity and all activity lists of the application based on the MD5 code.

[0109] get_service_receiver: Get the services and receivers requested by the application based on the MD5 code.

[0110] get_permissions: Get the permission list requested by the application based on the MD5 code.

[0111] (4) Certificate Inspection Agent (Certificate_Inspector)

[0112] [Definition] As a certificate review Agent focused on static analysis of Android applications, it has a high sensitivity to certificate information involved in abnormal APPs.

[0113] [Definition] Based on the obtained certificate information, it preliminarily judges whether the APK is suspicious. This task aims to accurately identify the category of the APK as much as possible. [Tool Authorization]

[0114] Among them, the certificate review Agent is authorized to use the following tools to assist in completing the task:

[0115] get_certificate: Obtain certificate information based on MD5 code.

[0116] (5) Content Analysis Agent (Content_Analyzer)

[0117] [Definition] As a content analysis Agent focused on static analysis of applications, it has a high sensitivity to text information involved in abnormal APPs. Please note that you should not rely too much on the results output by the content analysis model, as they may have a certain misjudgment rate.

[0118] [Definition] Call the content analysis model and summarize its results. This task aims to ensure that the information extracted from the text content accurately reflects the potential risk category of the APP.

[0119] Among them, the content analysis Agent is authorized to use the following tools to assist in completing the task:

[0120] get_content_prob: Obtain the probability distribution of the corresponding APK content belonging to each type based on MD5 code.

[0121] (6) Icon Analysis Agent (Icon_Analyzer)

[0122] [Definition] As an icon analysis Agent focused on static analysis of applications, it has a high sensitivity to icon information involved in abnormal APPs. Please note that you should not rely too much on the results output by the icon analysis model, as they may have a certain misjudgment rate.

[0123] [Definition] Call the icon analysis model and organize and summarize its analysis results. This task aims to ensure that the information extracted from the icon accurately reflects the potential risk category of the APP.

[0124] Among them, the icon analysis Agent is authorized to use the following tools to assist in completing the task:

[0125] get_icon_prob: Get the probability distribution of the corresponding APK icon belonging to each type based on the MD5 code.

[0126] (7) Relationship Analyzer Agent

[0127] [Definition of Role] As a Relationship Analyzer Agent focused on identifying illegal APPs, it is skilled in uncovering hidden relationship networks within applications. During analysis, it does not overly rely on the results of relationship graphs, as their accuracy may be influenced by various factors.

[0128] [Definition of Task] Analyze other APPs related to a given APP to further determine its category. This task aims to explore the interconnections between APPs, identify potential risk signals, and provide supplementary evidence for the classification of the given APP.

[0129] Among them, the Relationship Analyzer Agent is authorized to use the following tools to assist in completing the task:

[0130] get_related_apps: Get a list of other applications related to the given APK based on the MD5 code.

[0131] (8) Decision Maker Agent

[0132] [Definition of Role] As the final decision maker, the Decision Maker Agent is responsible for determining the category of the APK. The decision range is limited to the following categories of APPs, each with a probability value between 0 and 1.

[0133] [Definition of Task] Output the decision results for each category, including the probability value and corresponding label for each category. The decision should consider the consistency, relevance, and reliability of the analysis results from various Agents, including content analysis, icon analysis, certificate review, package name tracking, sensitive permission analysis, and relationship analysis.

[0134] The embodiment is through multi-agent interaction and cooperation, and no longer needs complex feature construction and weight fusion as in the traditional method, but only needs to define the [role] and [task] of the agent, so as to fully utilize the generation capability of the LLM, utilize the fingerprint features of the current APP and the powerful reasoning capability of the agent, and finally make a decision. In combination with the fine-tuned single-modal model, the multi-modal correlation graph and the multi-dimensional information tool, and the [tool authorization] of the corresponding agent, the multiple agents can fully utilize the known probability distribution and information to assist the LLM to complete the corresponding task. The embodiment based on DeepSeek has been verified in large-scale test data, and the full-class F1-Score can reach 0.9568.

[0135] In the above, the embodiment provides a multi-model abnormal APP evaluation method based on multi-agent cooperation, constructs a multi-agent cooperation team (containing 8 agents and their system prompts) based on LLM and LangGraph, constructs 3 model tools and 5 information tools, uses a large language model and a new type of agent technology to improve the accuracy and explainability of the detection result, constructs a self-updating multi-modal abnormal APP correlation graph, iteratively optimizes the detection process of the subsequent APP, and analyzes and explains the output results of each dimension model based on the large language model, thereby breaking through the limitation of traditional index analysis data.

[0136] The application further provides an application program security risk detection device, which is described below. The application program security risk detection device described below can be correspondingly referred to the application program security risk detection method described above.

[0137] Please refer to Figure 3 , Figure 3 is a structural schematic diagram of the application program security risk detection device provided by the embodiment of the application. In the embodiment, the application program security risk detection device can include an acquisition module 310 and a detection result module 320.

[0138] The acquisition module 310 is configured to acquire an application program to be identified.

[0139] The detection result module 320 is configured to input the application program to be identified into a preset identification model to obtain a detection result output by the preset identification model. The preset identification model is obtained by training data of an original application program installation package. The preset identification model includes a plurality of agents working independently. The agents are configured to perform different function tasks, including task scheduling, data analysis and result decision.

[0140] Optionally, the security risk detection device of the application program can further include a storage connection module, which can be used to store the original application installation package uploaded by the user and connect the interface of the preset identification model.

[0141] Based on any of the above embodiments, the preset identification model can include a first model and a second model, and the security risk detection device of the application program can include a training module, which can be specifically used to:

[0142] The original application installation package is analyzed to obtain text features and icon features of the original application installation package; wherein the fine-tuned first model is used to classify the application to be identified according to the text features, and the second model is fine-tuned based on the icon features; wherein the fine-tuned second model is used to classify the application to be identified according to the icon features.

[0143] Based on any of the above embodiments, the training module can be specifically used to: construct an association relationship graph of the original application installation package by using the similarity of the permission call and the similarity of the icon embedding.

[0144] Based on any of the above embodiments, the training module can be specifically used to: encapsulate the first model, the second model and the association relationship graph into three model tools; create an information tool; wherein the information tool includes a package name tool, a name tool, an activity tool, a permission tool and a certificate tool; the model tool and the information tool are used by the intelligent agent.

[0145] Based on any of the above embodiments, the detection result module 320 can be specifically used to:

[0146] The application to be identified is input into the preset identification model, the task scheduling intelligent agent generates a plurality of identification sub-tasks according to the application to be identified, and distributes the identification sub-tasks to each data analysis intelligent agent; each data analysis intelligent agent executes the identification sub-tasks of the corresponding function, and returns each identification sub-task result to the task scheduling intelligent agent; the result decision intelligent agent obtains the final decision according to the integration result of each identification sub-task result sent by the task scheduling intelligent agent; wherein the final decision is the detection result output by the preset identification model.

[0147] Based on any of the above embodiments, the detection result module 320 can be specifically used to:

[0148] After extracting the text and icon of the application to be identified, a first feature factor is obtained; after performing network address analysis on the application to be identified, a second feature factor is obtained; a feature factor set is obtained according to the first feature factor and the second feature factor, and the feature factor set is input into the preset identification model.

[0149] Based on any of the above embodiments, the steps of the association relationship graph construction process can specifically include:

[0150] The similarity of the permission call between the two applications is determined as a first parameter; the similarity of the icon embedding between the two applications is determined as a second parameter; the multi-modal similarity between the two applications is determined as a third parameter according to the first parameter and the second parameter; the weighted undirected edge between the two applications is determined based on the third parameter; and the association relationship graph is determined based on the weighted undirected edge between the two applications.

[0151] In another aspect, the embodiments of the present application also provide an electronic device, please refer to Figure 4 , Figure 4 is the schematic diagram of the physical structure of the electronic device provided by the embodiments of the present application, as Figure 4 shown, the electronic device can include: the electronic device can include a memory 420, a processor 410, and a computer program stored on the memory 420 and executable on the processor 410. The processor 410 implements the security risk detection method of the application program provided by the above-mentioned methods when executing the program.

[0152] Optionally, the electronic device can further include a communication bus 430 and a communication interface 440, wherein the processor 410, the communication interface 440, and the memory 420 communicate with each other through the communication bus 430. The processor 410 can call the computer program in the memory 420 to execute the security risk detection method of the application program, which can include:

[0153] Obtain the application program to be identified; input the application program to be identified into a preset identification model to obtain a detection result output by the preset identification model; the preset identification model is obtained by training the data of the original application installation package; wherein the preset identification model includes a plurality of intelligent agents working respectively; the intelligent agent is used to execute different functional tasks, and the functional tasks include task scheduling, data analysis and result decision.

[0154] In addition, the logic instructions in the memory 420 described above can be realized in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or the part of the prior art that contributes essentially or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0155] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program can be executed by a processor to enable the computer to execute the security risk detection method of the application program provided by the above method, the steps and principles of which have been described in detail in the above method and will not be repeated here.

[0156] In another aspect, the present application also provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the security risk detection method of the application program provided by the above method, the steps and principles of which have been described in detail in the above method and will not be repeated here.

[0157] The non-transitory computer readable storage medium can be any available medium or data storage device accessible by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as CD, DVD, BD, HVD, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state disk (SSD), etc.).

[0158] The device embodiments described above are only schematic, wherein the units illustrated as separate components can or can not be physically separated, and the components illustrated as units can or can not be physical units, i.e., they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0159] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0160] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A security risk detection method of an application program, characterized by, The application comprises: obtaining an application to be identified; inputting the application to be identified into a preset identification model to obtain a detection result output by the preset identification model; the preset identification model is obtained by training data of an original application installation package; wherein the preset identification model comprises a plurality of intelligent agents working independently; the intelligent agents are used to perform different functional tasks, including task scheduling, data analysis and result decision-making; the preset identification model comprises a first model and a second model, and before the application to be identified is input into the preset identification model to obtain the detection result output by the preset identification model, the process comprises: performing analysis processing on the original application installation package to obtain text features and icon features of the original application installation package; fine-tuning the first model based on the text features; wherein the fine-tuned first model is used to classify the application to be identified according to the text features, fine-tuning the second model based on the icon features; wherein the fine-tuned second model is used to classify the application to be identified according to the icon features; constructing a correlation relationship graph of the original application installation package by using the similarity of permission calls and the similarity of icon embedding; the application to be identified is input into the preset identification model, which comprises: after extracting the text and icon of the application to be identified, obtaining a first feature factor; after performing network address analysis on the application to be identified, obtaining a second feature factor; obtaining a feature factor set according to the first feature factor and the second feature factor, and inputting the feature factor set into the preset identification model.

2. The method of claim 1, wherein the security risk detection of the application program is performed by a security risk detection module of the application program. after constructing the correlation relationship graph of the original application installation package by using the similarity of permission calls and the similarity of icon embedding, the process further comprises: encapsulating the first model, the second model and the correlation relationship graph into three model tools; creating an information tool; wherein the information tool comprises a package name tool, a name tool, an activity tool, a permission tool and a certificate tool; the model tool and the information tool are used by the intelligent agents.

3. The method of claim 2, wherein the security risk detection of the application program is performed by the security risk detection server. the application to be identified is input into the preset identification model to obtain the detection result output by the preset identification model, which comprises: inputting the application to be identified into the preset identification model, and the task scheduling intelligent agent generates a plurality of identification sub-tasks according to the application to be identified, and distributes the identification sub-tasks to each data analysis intelligent agent; each data analysis intelligent agent executes the corresponding functional identification sub-tasks, and returns each identification sub-task result to the task scheduling intelligent agent; the result decision-making intelligent agent obtains the final decision-making according to the integration result of each identification sub-task result sent by the task scheduling intelligent agent; wherein the final decision-making is used as the detection result output by the preset identification model.

4. The method of claim 2, wherein the security risk detection of the application program is performed by a security risk detection module of the application program. the correlation relationship graph construction process comprises: determining the similarity of permission calls between two applications as a first parameter; determining the similarity of icon embedding between the two applications as a second parameter; determining a multimodal similarity between the two applications according to the first parameter and the second parameter as a third parameter; determining a weighted undirected edge between the two applications based on the third parameter; determining the association graph based on the weighted undirected edge between the two applications.

5. An apparatus for detecting security risks of an application program, characterized by comprising: Comprise: an acquisition module configured to acquire an application to be identified; a detection result module configured to input the application to be identified into a preset identification model to obtain a detection result output by the preset identification model; the preset identification model is obtained by training data of an original application installation package; wherein the preset identification model comprises a plurality of intelligent agents working independently; the intelligent agents are configured to perform different functional tasks, and the functional tasks comprise task scheduling, data analysis, and result decision-making; the preset identification model comprises a first model and a second model, and the application security risk detection device further comprises a training module, which is specifically configured to: analyze the original application installation package to obtain text features and icon features of the original application installation package; fine-tune the first model based on the text features; wherein the fine-tuned first model is configured to classify the application to be identified according to the text features, fine-tune the second model based on the icon features; wherein the fine-tuned second model is configured to classify the application to be identified according to the icon features; and construct an association graph of the original application installation package using the similarity of permission calling and the similarity of icon embedding; the detection result module is specifically configured to: after extracting the text and icon of the application to be identified, obtain a first feature factor; after analyzing the network address of the application to be identified, obtain a second feature factor; obtain a feature factor set according to the first feature factor and the second feature factor, and input the feature factor set into the preset identification model.

6. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the application security risk detection method of any one of claims 1-4.

7. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the application security risk detection method of any one of claims 1-4.

8. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the application security risk detection method of any one of claims 1-4.

Images