APP risk identification method based on APP risk identification model and storage medium

Abstract

The invention discloses an APP risk identification method based on an APP risk identification model. The method comprises the following steps: acquiring data information of an APP from an APP category and issuing information module, an APP permission application module, an APP background operation module and a user information collection module of the APP; extracting feature data from the obtained data information through a static analysis method and a dynamic analysis method; constructing an APP risk identification model, sequentially inputting the extracted feature data into the APP risk identification model for training until a loss function of the APP risk identification model converges, and completing training of the APP risk identification model; and extracting feature data from a to-be-identified APP, inputting the extracted feature data into the trained APP risk identification model, and predicting a risk value and a violation risk type of the APP. According to the method, the APP risk value can be determined, the risk type of APP violation can be determined, and the accuracy of APP risk identification is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of APP violation risk detection, and in particular, to an APP risk identification method and storage medium based on an APP risk identification model. Background Art

[0002] Mobile devices are an important part of most people's daily lives. Currently, there are a wide variety of program applications for mobile devices, among which there may be some malicious and illegal APPs. If downloaded to mobile devices, they are likely to bring hidden dangers such as privacy leakage and property loss. Especially for elderly users who are not proficient in using mobile devices, the risk is higher. Therefore, the problem of identifying illegal APPs has attracted the attention of more and more users.

[0003] At present, the mainstream APP violation detection tools are not effective in the comprehensive analysis of all information generated during APP operation, especially the lack of comparative analysis between user-visible processes and actual background data transmission processes. There is also a lack of comparative analysis of data flows for permission applications or user information reading applications based on different characteristics such as APP types, resulting in inaccurate identification of the risk level of illegal APPs. Summary of the invention

[0004] In response to the problems existing in the prior art, the present invention provides an APP risk identification method and storage medium based on an APP risk identification model. The APP risk identification model is used to analyze the feature data extracted by static analysis and dynamic analysis methods to determine the APP risk value and the risk type of APP violation, thereby improving the accuracy of APP risk identification.

[0005] To achieve the above technical objectives, the present invention adopts the following technical solution: an APP risk identification method based on an APP risk identification model, specifically comprising the following steps:

[0006] Step S1, obtaining APP data information from the APP category and issuance information module, APP permission application module, APP background operation module and user information collection module of the APP;

[0007] Step S2, extracting characteristic data from the acquired data information through static analysis and dynamic analysis;

[0008] Step S3: construct an APP risk identification model, and input the extracted feature data into the APP risk identification model in sequence for training until the loss function of the APP risk identification model converges, thereby completing the training of the APP risk identification model;

[0009] Step S4: extract feature data from the APP to be identified according to steps S1-S2, input the extracted feature data into the trained APP risk identification model, and predict the risk value and violation risk type of the APP.

[0010] Furthermore, the feature data extracted in step S2 includes: APP category features, issuing company and platform features, APP permission application and use features, and user information collection and use features.

[0011] Furthermore, the extraction process of the APP category feature is as follows: obtaining the APP category from the APP category and distribution information module through static analysis, establishing a one-hot vector for the APP category according to the 39 categories of APP specified by the Ministry of Industry and Information Technology, and obtaining the APP category feature.

[0012] Furthermore, the extraction process of the issuing company and platform features is as follows: obtaining the issuing company and platform of the APP from the APP category and issuing information module through static analysis, establishing a one-hot vector, and obtaining the issuing company and platform features.

[0013] Furthermore, the process of applying for APP permissions and extracting usage features is as follows:

[0014] i. Dynamically analyze the permission application behavior of the APP permission application module during the APP permission application and use process, as well as the API interface information called by the APP background running module;

[0015] ii. Weight all permission application behaviors according to the permission classification feature standard to obtain the permission application front-end features;

[0016] iii. Use the word2vec method to encode the API interface information called by the APP background running module into the background features of permission application.

[0017] Furthermore, the process of collecting user information and extracting usage features is as follows:

[0018] i. Dynamically analyze the front-end information request behavior recorded by the user information collection module called by the APP when requesting the user to fill in the information, and the API interface information called by the APP background running module when requesting the user to fill in the information;

[0019] ii. Weighting the front-end information application behavior according to the user information classification feature standard to obtain the information application front-end feature;

[0020] iii. Use the word2vec method to encode the API interface information called by the APP background running module when requesting users to fill in information into information application background features.

[0021] Further, the APP risk identification model in step S3 includes: a multi-head self-attention layer, a first residual connection & normalization layer, a feedforward neural network layer, a multi-head cross attention layer, a second residual connection & normalization layer and an output head;

[0022] The multi-head self-attention layer is used to perform consistency analysis on the foreground features of permission application and the background features of permission application to obtain the APP permission features, and to perform consistency analysis on the foreground features of information application and the background features of information application to obtain the user information application features;

[0023] The first residual connection & normalization layer is used to capture the position dependency between the APP permission features and the user information application features;

[0024] The feedforward neural network layer is used to perform nonlinear transformation on the APP permission features and user information application features that capture the location dependency;

[0025] The multi-head cross attention layer is used to obtain the cross-relationships among the APP permission features and user information application features output by the feedforward neural network layer, as well as the APP category features, issuing company and platform features;

[0026] The second residual connection & normalization layer is used to capture the position dependency in the cross relationship to obtain the cross feature;

[0027] The output head is composed of a classification head and a regression head. The classification head derives the violation risk type of the APP according to the cross-features, and the regression head derives the risk value of the APP according to the cross-features.

[0028] Furthermore, the loss function L of the APP risk identification model in step S3 is decoder Specifically:

[0029]

[0030] Among them, L represents the total number of training times, l represents the index of L, represents the cross entropy loss function of the classification head under the lth training, represents the L1 loss function of the regression head in the lth training, β 1 express The weight coefficient, β 2 express The weight coefficient of .

[0031] Furthermore, if the risk value of APP is 0≤≤25, it is a low-risk level APP; if the risk value of APP is 25<≤50, it is a medium-risk level APP; if the risk value of APP is 50<≤75, it is a high-risk level APP; if the risk value of APP is 75<≤99, it is an extremely high-risk level APP; if the risk value of APP is 99<≤100, it is a violation level APP.

[0032] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the APP risk identification method based on the APP risk identification model.

[0033] Compared with the prior art, the present invention has the following beneficial effects: the APP risk identification method based on the APP risk identification model of the present invention extracts feature data through static analysis and dynamic analysis methods, thereby obtaining static features and dynamic features related to the APP, and providing a favorable basis for the prediction of the violation risk of the APP; the present invention utilizes the multi-head self-attention layer in the APP risk identification model for the consistency analysis of the foreground features and the background features, thereby determining the correspondence between the front-end features and the back-end features, and can process a large amount of data more quickly, and accurately capture the correlation between them; in addition, the present invention utilizes the multi-head cross-attention layer in the APP risk identification model to obtain the cross-relationship of features, captures the correlation between features of different dimensions, and thus improves the accuracy of APP risk identification. Therefore, the APP risk identification model of the present invention is used to analyze whether the APP is in violation, and gives the corresponding risk degree and risk type, which can help users quickly and effectively identify risky APPs. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a flow chart of the APP risk identification method based on the APP risk identification model of the present invention;

[0035] Figure 2 It is a structural diagram of the APP risk identification model in the present invention. DETAILED DESCRIPTION

[0036] The technical solution of the present invention is further explained below in conjunction with the accompanying drawings.

[0037] like Figure 1 The following is a flow chart of an APP risk identification method based on an APP risk identification model of the present invention. The APP risk identification method specifically includes the following steps:

[0038] Step S1: based on the user's wishes, obtain the root permission of the mobile device, and obtain the data information of the APP from the APP category and distribution information module, APP permission application module, APP background operation module and user information collection module of the APP.

[0039] Step S2: Extract characteristic data from the acquired data information through static analysis and dynamic analysis, including: APP category characteristics, issuing company and platform characteristics, APP permission application and use characteristics, and user information collection and use characteristics. Static analysis is used to analyze static data related to APP, such as APP issuance category, APP issuing company and platform, so as to preliminarily obtain APP related characteristics. These static information are likely to find similar products again, and provide certain leading information prompts for judging whether APP violates regulations; dynamic analysis obtains the front-end and back-end data of APP during operation, and judges whether the visible prompts of APP front-end users are consistent with the actual operation data of the back-end. Inconsistency indicates that the risk of APP violation is high.

[0040] The process of extracting APP category features is as follows: obtain APP categories from APP category and distribution information modules through static analysis, establish one-hot vectors for APP categories according to the 39 categories of APPs specified by the Ministry of Industry and Information Technology, and obtain APP category features. Considering that an APP may belong to multiple categories, one-dimensional convolution is used to upgrade the category features, and the upgraded features are used as APP category features.

[0041] The extraction process of the issuing company and platform features is as follows: obtain the issuing company and platform of the APP from the APP category and distribution information module through static analysis, establish a one-hot vector, and obtain the issuing company and platform features. At the same time, the obtained One-hot vector is upgraded through one-dimensional convolution, and the upgraded features are used as the issuing company and platform features.

[0042] The process of applying for APP permissions and extracting usage features is as follows:

[0043] i. Dynamically analyze the permission application behavior of the APP permission application module during the APP permission application and use process, as well as the API interface information called by the APP background running module;

[0044] ii. All permission application behaviors are weighted according to the permission classification feature standard to obtain the permission application foreground feature. Among them, the permission classification feature standard is based on the current mainstream APP permissions, which have a total of 235, 163 of which are hardware-accessible permissions, and the remaining permissions are information access permissions that require users to provide. Therefore, based on the existing mainstream APP permission feature data, permissions can be reclassified according to sensitivity, with password storage and location permissions being given higher weights, and recording and reading file permissions being slightly lower, which is obtained by weighting different permissions according to levels;

[0045] iii. Use the word2vec method to encode the API interface information called by the APP background running module into the background features of permission application.

[0046] The process of collecting user information and extracting usage features is as follows:

[0047] i. Dynamically analyze the front-end information request behavior recorded by the user information collection module called by the APP when requesting the user to fill in the information, and the API interface information called by the APP background running module when requesting the user to fill in the information;

[0048] ii. Weight the front-end information application behavior according to the user information classification feature standard to obtain the information application front-end feature. The user information classification feature standard is based on the "Regulations on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications" issued by the Ministry of Industry and Information Technology to classify user information, such as passwords, ID card numbers and other information as sensitive information, names, phone numbers and other information as common information, and avatars, nicknames and other information as secondary information, and weights different information according to the level;

[0049] iii. Use the word2vec method to encode the API interface information called by the APP background running module when requesting users to fill in information into information application background features.

[0050] Step S3: construct an APP risk identification model, input the extracted feature data into the APP risk identification model in sequence for training, until the loss function of the APP risk identification model converges, and the training of the APP risk identification model is completed; Figure 2The APP risk identification model in the present invention includes: a multi-head self-attention layer, a first residual connection & normalization layer, a feedforward neural network layer, a multi-head cross attention layer, a second residual connection & normalization layer and an output head; the multi-head self-attention layer is used to perform consistency analysis on the foreground features of permission application and the background features of permission application to obtain APP permission features, and to perform consistency analysis on the foreground features of information application and the background features of information application to obtain user information application features. The multi-head self-attention layer can process a large amount of data more quickly and accurately capture the correlation between them in judging the correspondence between the front-end features and the back-end features of the same type of features; the first residual connection & normalization layer is used to capture the APP permission features and the user information application The position dependency in the features; the feedforward neural network layer is used to perform nonlinear transformation on the APP permission features and user information application features that capture the position dependency; the multi-head cross attention layer is used to obtain the cross relationship between the APP permission features and user information application features output by the feedforward neural network layer, as well as the APP category features, issuing company and platform features, which can capture the correlation between features of different dimensions, thereby improving the accuracy of APP risk identification; the second residual connection & normalization layer is used to capture the position dependency in the cross relationship and obtain the cross feature; the output head consists of a classification head and a regression head, where the classification head derives the APP violation risk type based on the cross feature, and the regression head derives the APP risk value based on the cross feature. The risk value of the APP is 0-100, so there are 100 categories, so it is necessary to adopt the idea of ​​divide and conquer. First, the score with a span of 100 is divided into 5 categories. The classification head is used to determine which category the app risk level belongs to, and the regression head is used to output the specific offset score in the category. This greatly reduces the span range of the APP risk identification model output, which can not only accelerate the training speed of the APP risk identification model, but also improve the accuracy of the APP risk identification model.

[0051] The loss function L of the APP risk identification model in the present invention is decoder Specifically:

[0052]

[0053] Among them, L represents the total number of training times, l represents the index of L, represents the cross entropy loss function of the classification head under the lth training, represents the L1 loss function of the regression head in the lth training, β 1 express The weight coefficient, β 2 express The weight coefficient of .

[0054] Step S4, extract feature data from the APP to be identified according to steps S1-S2, input the extracted feature data into the trained APP risk identification model, and predict the risk value and violation risk type of the APP: if 0≤APP's risk value≤25, it is a low-risk level APP; if 25<APP's risk value≤50, it is a medium-risk level APP; if 50<APP's risk value≤75, it is a high-risk level APP; if 75<APP's risk value≤99, it is an extremely high-risk level APP; if 99<APP's risk value≤100, it is a violation level APP.

[0055] In a technical solution of the present invention, a computer-readable storage medium is also provided, storing a computer program, wherein the computer program enables a computer to execute the APP violation risk identification method based on the APP risk identification model.

[0056] In a technical solution of the present invention, an electronic device is also provided, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the APP violation risk identification method based on the APP risk identification model is implemented.

[0057] In a technical solution of the present invention, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the APP violation risk identification method based on the APP risk identification model.

[0058] In the embodiments disclosed in the present application, the computer storage medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. The computer storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of computer storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0059] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0060] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. An APP risk identification method based on an APP risk identification model, characterized in that: The specific steps include: Step S1, obtaining APP data information from the APP category and distribution information module, APP permission application module, APP background operation module and user information collection module of the APP; Step S2, extracting characteristic data from the acquired data information through static analysis and dynamic analysis; Step S3: construct an APP risk identification model, and input the extracted feature data into the APP risk identification model in sequence for training until the loss function of the APP risk identification model converges, thereby completing the training of the APP risk identification model; Step S4: extract feature data from the APP to be identified according to steps S1-S2, input the extracted feature data into the trained APP risk identification model, and predict the risk value and violation risk type of the APP.

2. According to claim 1, the APP risk identification method based on the APP risk identification model is characterized in that: The feature data extracted in step S2 include: APP category features, issuing company and platform features, APP permission application and use features, and user information collection and use features.

3. The APP risk identification method based on the APP risk identification model according to claim 2 is characterized in that: The extraction process of the APP category feature is as follows: obtaining the APP category from the APP category and distribution information module through static analysis, establishing a one-hot vector for the APP category according to the 39 categories of APP specified by the Ministry of Industry and Information Technology, and obtaining the APP category feature.

4. The APP risk identification method based on the APP risk identification model according to claim 3 is characterized in that: The extraction process of the issuing company and platform features is as follows: obtaining the issuing company and platform of the APP from the APP category and issuing information module through static analysis, establishing a one-hot vector, and obtaining the issuing company and platform features.

5. According to claim 4, the APP violation risk identification method based on the APP risk identification model is characterized in that: The process of applying for APP permissions and extracting usage features is as follows: i. Dynamically analyze the permission application behavior of the APP permission application module during the APP permission application and use process, as well as the API interface information called by the APP background running module; ii. All permission application behaviors are weighted according to the permission classification feature standard to obtain the permission application front-end features; iii. Use the word2vec method to encode the API interface information called by the APP background running module into the background features of permission application.

6. The APP risk identification method based on the APP risk identification model according to claim 5 is characterized in that: The process of collecting user information and extracting usage features is as follows: i. Dynamically analyze the front-end information request behavior recorded by the user information collection module called by the APP when requesting the user to fill in the information, and the API interface information called by the APP background running module when requesting the user to fill in the information; ii. Weighting the front-end information application behavior according to the user information classification feature standard to obtain the information application front-end features; iii. Use the word2vec method to encode the API interface information called by the APP background running module when requesting users to fill in information into the information application background features.

7. The APP risk identification method based on the APP risk identification model according to claim 1 is characterized in that: The APP risk identification model in step S3 includes: a multi-head self-attention layer, a first residual connection & normalization layer, a feedforward neural network layer, a multi-head cross attention layer, a second residual connection & normalization layer and an output head; The multi-head self-attention layer is used to perform consistency analysis on the foreground features of permission application and the background features of permission application to obtain the APP permission features, and to perform consistency analysis on the foreground features of information application and the background features of information application to obtain the user information application features; The first residual connection & normalization layer is used to capture the position dependency between the APP permission features and the user information application features; The feedforward neural network layer is used to perform nonlinear transformation on the APP permission features and user information application features that capture the location dependency; The multi-head cross attention layer is used to obtain the cross-relationships among the APP permission features and user information application features output by the feedforward neural network layer, as well as the APP category features, issuing company and platform features; The second residual connection & normalization layer is used to capture the position dependency in the cross relationship to obtain the cross feature; The output head is composed of a classification head and a regression head. The classification head derives the violation risk type of the APP according to the cross-features, and the regression head derives the risk value of the APP according to the cross-features.

8. The APP risk identification method based on the APP risk identification model according to claim 7 is characterized in that: The loss function L of the APP risk identification model in step S3 decoder Specifically: Among them, L represents the total number of training times, l represents the index of L, represents the cross entropy loss function of the classification head under the lth training, represents the L1 loss function of the regression head in the lth training, and β1 represents The weight coefficient, β2 represents The weight coefficient of .

9. The APP risk identification method based on the APP risk identification model according to claim 8 is characterized in that: If 0≤APP’s risk value≤25, it is a low-risk APP; If 25<the risk value of the APP≤50, it is a medium-risk level APP; If 50<APP’s risk value≤75, it is a high-risk APP; If 75<APP’s risk value≤99, it is an extremely high-risk APP; If 99<APP’s risk value≤100, it is a violation-level APP.

10. A computer-readable storage medium storing a computer program, characterized in that: The computer program enables a computer to execute the APP risk identification method based on the APP risk identification model as described in any one of claims 1 to 9.

Images