Information determination method and device, equipment and computer storage medium

Abstract

The embodiment of the invention discloses an information determination method, which comprises the following steps of: processing a programming file corresponding to a to-be-analyzed application based on target prompt information by adopting a target natural language processing model to obtain an analysis result; wherein the analysis result is used for representing an operation which can be generated by the target programming statement; the programming file is used for generating the application to be analyzed; based on the analysis result, generating a target application behavior for the to-be-analyzed application; wherein the target application behavior represents an operation generated by the to-be-analyzed application. The embodiment of the invention further discloses an information determination device and equipment and a computer readable storage medium.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an information determination method, device, equipment and computer storage medium. Background Art

[0002] At present, one of the most effective means of defending against abnormal behavior is to detect through application behavior whitelist. In general, whitelists can better defend against attack behaviors and resist unknown threats; if the application behavior whitelist is not comprehensive, it will bring extremely high false alarm rates to security products, which will affect business operations. Based on this, in related technologies, application behavior whitelists are constructed by extracting through dynamic learning or static program analysis; among them, dynamic learning is prone to incomplete behavior triggering, resulting in incomplete whitelists; static program analysis can obtain a more complete whitelist by analyzing the source code, but it is necessary to develop the corresponding static program analysis algorithm according to the source code development language; in summary, the method of constructing application behavior whitelists in related technologies has the problems of false alarms, low compatibility and high development difficulty. Summary of the invention

[0003] In order to solve the above technical problems, the embodiments of the present application hope to provide an information determination method, device, equipment and computer storage medium, which solves the problems of false alarms, low compatibility and high development difficulty in the method of determining the application behavior whitelist in the related technology.

[0004] The technical solution of this application is implemented as follows:

[0005] A method for determining information, the method comprising:

[0006] Using a target natural language processing model, the programming file corresponding to the application to be analyzed is processed based on the target prompt information to obtain an analysis result; wherein the analysis result is used to characterize the operations that can be generated by the programming file; the programming file is used to generate the application to be analyzed;

[0007] Based on the analysis result, a target application behavior for the application to be analyzed is generated; wherein the target application behavior represents an operation that will be generated by the application to be analyzed.

[0008] In the above scheme, the target natural language processing model is used to process the programming file corresponding to the application to be analyzed based on the target prompt information to obtain the analysis result, including:

[0009] Determining whether a target programming statement that generates a target operation is included in the programming file corresponding to the application to be analyzed;

[0010] The target natural language processing model is used to process the target programming statement based on the target prompt information to obtain the analysis result; wherein the analysis result is used to characterize the operation that can be generated by the target programming statement.

[0011] In the above solution, the step of determining that a target programming statement for a target operation exists in the programming file corresponding to the application to be analyzed includes:

[0012] Determine the programming language of the programming file corresponding to the application to be analyzed;

[0013] Based on a target extraction condition matching the programming language, the target programming statement is extracted from a programming file corresponding to the application to be analyzed.

[0014] In the above solution, the target natural language processing model is used to process the target programming statement based on the target prompt information to obtain an analysis result, including:

[0015] Determining first target sub-prompt information for analyzing the target programming statement; wherein the target prompt information includes the first target sub-prompt information;

[0016] The target natural language processing model is used to analyze the target programming statement based on the first target sub-prompt information to obtain the analysis result.

[0017] In the above solution, generating a target application behavior for the application to be analyzed based on the analysis result includes:

[0018] Filtering the analysis results based on the target filtering condition to obtain a filtering result;

[0019] Optimizing the analysis result based on the filtering result to obtain an optimized result;

[0020] The target application behavior is generated based on the optimized result.

[0021] In the above solution, the optimizing the analysis result based on the filtering result to obtain the optimized result includes:

[0022] If the filtering result indicates that the analysis result is incorrect, deleting the analysis result to obtain the optimized result;

[0023] If the filtering result indicates that the result of the analysis is correct but the format is incorrect, adjusting the format of the analysis result to obtain the optimized result;

[0024] If the filtering result indicates that the result and format of the analysis result are correct, verifying the analysis result to obtain the optimized result;

[0025] In the above scheme, the verification of the analysis result to obtain the optimized result includes:

[0026] The target natural language processing model is used to process the analysis result and the programming statement to be optimized corresponding to the analysis result based on the second target sub-prompt information to obtain the optimized result.

[0027] In the above scheme, the target natural language processing model is used to process the analysis result and the programming statement to be optimized corresponding to the analysis result based on the second target sub-prompt information to obtain the optimized result, including:

[0028] Determining the second target sub-prompt information for verifying the target programming statement;

[0029] Using the target natural language processing model, analyzing the programming statement to be optimized based on the second target sub-prompt information to obtain an analysis result to be matched;

[0030] The target natural language processing model is adopted to determine the optimized result based on the analysis result to be matched and the analysis result.

[0031] In the above scheme, the method further includes:

[0032] Obtaining a sample programming file corresponding to a sample application; wherein the sample programming file has a label for characterizing an operation behavior corresponding to the sample programming file;

[0033] The initial natural language processing model is trained based on the sample programming file to obtain the target natural language processing model.

[0034] A method for determining information, the method comprising:

[0035] Obtain the operation behaviors to be analyzed generated during the operation of the application to be analyzed;

[0036] Matching the operation behavior to be analyzed with the target application behavior to obtain a processing result; wherein the target application behavior is generated based on the analysis result obtained by processing the programming file corresponding to the application to be analyzed based on the target prompt information using the target natural language processing model, and the analysis result is used to characterize the operation that can be generated by the programming file;

[0037] Based on the processing result, it is determined whether the operation behavior to be analyzed is an abnormal operation behavior.

[0038] A first information determination device, the device comprising:

[0039] A processing unit, configured to use a target natural language processing model to process a programming file corresponding to the application to be analyzed based on target prompt information to obtain an analysis result; wherein the analysis result is used to characterize the operations that can be generated by the programming file; and the programming file is used to generate the application to be analyzed;

[0040] A generating unit is used to generate a target application behavior for the application to be analyzed based on the analysis result; wherein the target application behavior represents an operation that will be generated by the application to be analyzed.

[0041] A second information determining device, the device comprising:

[0042] An acquisition unit, used to acquire the operation behavior to be analyzed generated during the operation of the application to be analyzed;

[0043] A matching unit, used for matching the operation behavior to be analyzed with the target application behavior to obtain a processing result; wherein the target application behavior is generated based on the analysis result obtained by processing the programming file corresponding to the application to be analyzed based on the target prompt information using the target natural language processing model, and the analysis result is used to characterize the operation that can be generated by the programming file;

[0044] A determination unit is used to determine whether the operation behavior to be analyzed is an abnormal operation behavior based on the processing result.

[0045] An information determination device, the device comprising: a processor, a memory, and a communication bus;

[0046] The communication bus is used to realize the communication connection between the processor and the memory;

[0047] The processor is used to execute the information determination program in the memory to implement the steps of the above-mentioned information determination method.

[0048] A computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the above-mentioned information determination method.

[0049] The information determination method, apparatus, device and computer storage medium provided in the embodiments of the present application can adopt a target natural language processing model to process the programming file corresponding to the application to be analyzed based on the target prompt information to obtain an analysis result, the analysis result is used to characterize the operations that the programming file can generate, the programming file is used to generate the application to be analyzed, and then generate a target application behavior for the application to be analyzed based on the analysis result, the target application behavior characterizes the operations that the application to be analyzed will generate, in this way, by adopting the target natural language processing model and based on the target prompt information to obtain the analysis results of the programming statements that can generate the target operations in the application to be analyzed, an application behavior whitelist for the application to be analyzed can be constructed without the need for dynamic learning or static program analysis methods, thereby solving the problems of false alarms, low compatibility and high development difficulty in the method of determining the application behavior whitelist in the related art. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A flowchart of an information determination method provided in an embodiment of the present application;

[0051] Figure 2 A flowchart of another information determination method provided in an embodiment of the present application;

[0052] Figure 3 A schematic diagram of an architecture for determining an application behavior whitelist in an information determination method provided in an embodiment of the present application;

[0053] Figure 4 A flowchart of another information determination method provided in an embodiment of the present application;

[0054] Figure 5 A flowchart of an information determination method provided for another embodiment of the present application;

[0055] Figure 6 A schematic diagram of the structure of a first information determination device provided in an embodiment of the present application;

[0056] Figure 7 A schematic diagram of the structure of a second information determination device provided in an embodiment of the present application;

[0057] Figure 8 A schematic diagram of the structure of a first information determination device provided in an embodiment of the present application;

[0058] Fig. 9 A schematic diagram of the structure of a second information determination device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0060] It should be understood that the "embodiments of the present application" or "the aforementioned embodiments" mentioned throughout the specification mean that specific features, structures or characteristics related to the embodiments are included in at least one embodiment of the present application. Therefore, "in the embodiments of the present application" or "in the aforementioned embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the various embodiments of the present application, the size of the sequence numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned sequence numbers of the embodiments of the present application are for description only and do not represent the advantages and disadvantages of the embodiments.

[0061] Unless otherwise specified, any step in the embodiments of the present application may be performed by a processor of the device. It is also worth noting that the embodiments of the present application do not limit the order in which the device executes the following steps. In addition, the methods used to process data in different embodiments may be the same method or different methods. It should also be noted that any step in the embodiments of the present application can be independently executed by the device, that is, when the device executes any step in the following embodiments, it may not rely on the execution of other steps.

[0062] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0063] The present application provides an information determination method, which can be applied to an information determination device. Figure 1 As shown, the method may include the following steps:

[0064] Step 101: Use a target natural language processing model to process the programming file corresponding to the application to be analyzed based on target prompt information to obtain an analysis result.

[0065] The analysis result is used to characterize the operations that can be generated by the programming file corresponding to the application to be analyzed; the programming file is used to generate the application to be analyzed.

[0066] In an embodiment of the present application, the application to be analyzed may refer to any application program (Application, APP) for which an application behavior whitelist needs to be determined; the programming file corresponding to the application to be analyzed may refer to the program code used to generate and run the application to be analyzed. It should be noted that the programming file may include function code blocks and non-function code. In addition, the programming file (i.e., program code) corresponding to the application to be analyzed can be used as input information of the target natural language processing model, that is, the program code of the application to be analyzed is input into the target natural language processing model, and the program code of the application to be analyzed is analyzed and processed based on the determined target prompt information, so that the target natural language processing model can output the analysis results of the program code of the application to be analyzed.

[0067] In an embodiment of the present application, the target natural language processing model may refer to a natural language processing model based on a Transformer architecture; in a feasible implementation, the target natural language processing model may be a generative pre-trained Transformer model (GPT). The target prompt information may refer to the prompt in the GPT model; that is, the information determination device may adopt the GPT model, and analyze the programming file corresponding to the application to be analyzed based on the prompt in the GPT model, thereby obtaining the analysis result of the programming file corresponding to the application to be analyzed.

[0068] Step 102: Generate target application behavior for the application to be analyzed based on the analysis result.

[0069] The target application behavior represents the operations that will be performed by the application to be analyzed.

[0070] In an embodiment of the present application, after determining the analysis results of the target programming statements for the application to be analyzed, the information determination device can further filter the analysis results, and optimize the analysis results based on the filtered results, and then generate the target application behavior based on the optimized analysis results.

[0071] It should be noted that the target application behavior may refer to the operation behavior that the application to be analyzed will definitely generate, and the target application behavior may be stored in the form of a list. In a feasible implementation, the target application behavior may refer to the application behavior whitelist of the application to be analyzed; or the target application behavior may refer to the application behavior blacklist of the application to be analyzed.

[0072] In addition, if the target application behavior can refer to the application behavior whitelist of the application to be analyzed, the generated operations can be compared with the operations in the application behavior whitelist when the application to be analyzed is running. If the generated operation is not in the application behavior whitelist, then the operation is considered to be an abnormal operation, which is an attack behavior against the device and will pose a threat to the device; if the generated operation is in the application behavior whitelist, then the operation is considered to be a normal operation and will not pose a threat to the device.

[0073] The information determination method provided in the embodiments of the present application can construct an application behavior whitelist for the application to be analyzed by adopting a target natural language processing model and obtaining analysis results of programming statements that can generate target operations in the application to be analyzed based on target prompt information, without the need for dynamic learning or static program analysis methods, thereby solving the problems of false alarms, low compatibility and high development difficulty in the method of determining the application behavior whitelist in the related art.

[0074] Based on the above embodiments, the present application provides an information determination method, referring to Figure 2 As shown, the method may include the following steps:

[0075] Step 201: The information determination device determines whether a programming file corresponding to the application to be analyzed contains a target programming statement that generates a target operation.

[0076] The target operation may be a pre-set operation for the device deployed by the application to be analyzed; the target programming statement may be a program code in the program code corresponding to the application to be analyzed that may (i.e., is suspected of) generating the target operation. Furthermore, the target programming statement may be extracted by analyzing the program code corresponding to the application to be analyzed.

[0077] It should be noted that when the programming file may include function code blocks and non-function codes, the determined target programming statement may also include target function codes and target non-function codes.

[0078] In other embodiments of the present application, step 201 may be implemented in the following manner:

[0079] Step 201a: The information determination device determines the programming language of the programming file corresponding to the application to be analyzed.

[0080] Among them, the programming file is used to generate the application to be analyzed.

[0081] In an embodiment of the present application, the programming language of the programming file corresponding to the application to be analyzed may refer to the programming language used to write the program code of the application to be analyzed; in a feasible implementation method, the programming language may include Java language, C language, Go language, Python language, Hypertext Preprocessor (PHP) language, etc.

[0082] Step 201b: The information determination device extracts target programming statements from the programming file corresponding to the application to be analyzed based on the target extraction condition matching the programming language.

[0083] The target extraction condition may be an extraction rule applicable to the programming language of the program code corresponding to the application to be analyzed, which is used to extract the target programming statement in the program code corresponding to the application to be analyzed; in the embodiment of the present application, the target extraction condition may be set in Figure 3 In the code extraction module shown. That is, the code extraction module can be provided with multiple extraction conditions for different programming languages. In a feasible implementation, the target extraction condition can refer to a specific programming statement that can generate a target operation.

[0084] In the embodiment of the present application, the information determination device can Figure 3 The code extraction module shown in the figure extracts the target programming statement from the program code corresponding to the application to be analyzed based on the target extraction condition. Moreover, after the target programming statement is extracted, only the target programming statement needs to be analyzed later, instead of analyzing the programming statements in all programming files, so that the code blocks irrelevant to the target operation can be quickly filtered out, thereby improving the analysis efficiency of the programming file corresponding to the application to be analyzed (i.e., the source code of the application to be analyzed).

[0085] Step 202: The information determination device uses a target natural language processing model to process the target programming statement based on the target prompt information to obtain an analysis result.

[0086] The analysis results are used to characterize the operations that can be generated by the target programming statement.

[0087] In an embodiment of the present application, the first target sub-prompt information used to analyze the programming statement can be used to process the target programming statement to obtain an analysis result; if the target natural language processing model is GPT, then the information determination device can use the GPT model, and analyze the target programming statement based on the prompt prompt in the GPT model, thereby obtaining an analysis result for the target programming statement.

[0088] It should be noted that the information determination device can obtain a sample programming file corresponding to the sample application; wherein the sample programming file has a label for characterizing the operation behavior corresponding to the sample programming file; and the initial natural language processing model is trained based on the sample programming file to obtain a target natural language processing model. In addition, a deep neural network algorithm can be used to train the initial natural language processing model to obtain a target natural language processing model.

[0089] Step 202a: The information determination device determines first target sub-prompt information for analyzing a target programming statement.

[0090] The target prompt information includes first target sub-prompt information.

[0091] In the embodiment of the present application, the first target sub-prompt information can be Figure 3 The GPT analysis module shown is set in the GPT model. That is, the GPT model can be set with target prompt information required for a variety of different scenarios; in a feasible implementation, the first target sub-prompt information can refer to the first prompt, and the first prompt can be constructed from multiple angles such as application scenarios, problem-solving steps, examples, answer format specifications, problem background, keywords, etc.

[0092] Step 202b: The information determination device adopts a target natural language processing model to analyze the target programming statement based on the first target sub-prompt information to obtain an analysis result.

[0093] The analysis results are used to characterize the operations that can be generated by the target programming statement.

[0094] In an embodiment of the present application, the target programming statement can be used as input information, that is, the target programming statement is input into the GPT model and the target programming statement is processed using the determined first prompt, thereby obtaining an analysis result about the target programming statement. It should be noted that the analysis result can be an operation that can be generated by the determined target programming language.

[0095] Step 203: The information determination device filters the analysis result based on the target filtering condition to obtain a filtering result.

[0096] In the embodiment of the present application, after obtaining the analysis result for the target programming statement, the information determination device can Figure 3The result optimization module shown in further optimizes the analysis results based on the target filtering conditions. The target filtering conditions can be pre-set by the code statements of the application to be analyzed and the parameters of the programming language; in a feasible implementation, the target filtering conditions can refer to those determined based on the domain knowledge, grammatical rules, common error patterns, etc. of the code statements of the application to be analyzed.

[0097] It should be noted that the result optimization module can be used to judge the analysis results using pre-set target filtering conditions, thereby determining analysis results that are obviously incorrect, analysis results that are correct but not in a standardized format, and analysis results that are correct and in a standardized format.

[0098] Step 204: The information determination device optimizes the analysis result based on the filtering result to obtain an optimized result.

[0099] In an embodiment of the present application, the operation information determination device can perform different optimization processing on the programming statements corresponding to different analysis results in the target programming statements according to the determined filtering results through the result optimization module, and thus obtain the optimized results; that is, the target programming statements corresponding to different filtering results have different corresponding optimization processing methods.

[0100] Wherein, step 204 can be implemented in the following manner:

[0101] Step 204a: If the result of the filtering result characterizing the analysis result is incorrect, the information determination device deletes the analysis result to obtain an optimized result.

[0102] Among them, the result optimization module can be used to determine the obviously incorrect analysis results in the analysis results corresponding to the target programming statements; the information determination device can delete the incorrect analysis results in the analysis results output by the GPT model, which can ensure the accuracy of the obtained analysis results and improve the accuracy of the obtained target application behavior.

[0103] Step 204b: If the filtering result indicates that the result of the analysis is correct but the format is incorrect, the information determination device adjusts the format of the analysis result to obtain an optimized result.

[0104] The result optimization module may determine that the analysis result corresponding to the target programming statement is correct but has a format problem; and the incorrect format may refer to a format that is different from the format set in the target filtering condition. The information determination device may modify the format of the analysis result that is correct but has an incorrect format to a correct format, thereby obtaining an optimized result.

[0105] Step 204c: If the result and format of the analysis result represented by the filtering result are correct, the information determination device verifies the analysis result to obtain an optimized result.

[0106] In the embodiment of the present application, the result optimization module can be used to determine that the analysis result corresponding to the target programming statement is correct and the format is also correct; in order to ensure that the target application behavior finally generated is correct, the analysis result with both correct result and format can be further verified. Then, the result optimization module can be used to verify the analysis result with both correct result and format based on the target natural language processing model, thereby obtaining the optimized result.

[0107] Step 205: The information determination device generates a target application behavior based on the optimized result.

[0108] In the embodiment of the present application, after Figure 3 After the result optimization module shown optimizes the analysis result, the final target application behavior can be generated according to the optimized result.

[0109] The information determination method provided in the embodiments of the present application can construct an application behavior whitelist for the application to be analyzed by adopting a target natural language processing model and obtaining analysis results of programming statements that can generate target operations in the application to be analyzed based on target prompt information, without the need for dynamic learning or static program analysis methods, thereby solving the problems of false alarms, low compatibility and high development difficulty in the method of determining the application behavior whitelist in the related art.

[0110] Based on the above embodiments, the present application provides an information determination method, referring to Figure 4 As shown, the method may include the following steps:

[0111] Step 301: The information determination device determines the programming language of the programming file corresponding to the application to be analyzed.

[0112] Among them, the programming file is used to generate the application to be analyzed.

[0113] Step 302: The information determination device extracts target programming statements from a programming file corresponding to the application to be analyzed based on a target extraction condition that matches the programming language.

[0114] Step 303: The information determination device determines first target sub-prompt information for analyzing the target programming statement.

[0115] The target prompt information includes first target sub-prompt information.

[0116] Step 304: The information determination device adopts a target natural language processing model to analyze the target programming statement based on the first target sub-prompt information to obtain an analysis result.

[0117] The analysis results are used to characterize the operations that can be generated by the target programming statement.

[0118] Step 305: The information determination device filters the analysis result based on the target filtering condition to obtain a filtering result.

[0119] It should be noted that after step 305, you can choose to execute step 306, step 307, or step 308.

[0120] Step 306: If the result of the filtering result characterizing the analysis result is incorrect, the information determination device deletes the analysis result to obtain an optimized result.

[0121] Step 307: If the filtering result indicates that the result of the analysis is correct but the format is incorrect, the information determination device adjusts the format of the analysis result to obtain an optimized result.

[0122] Step 308: If the result and format of the analysis result represented by the filtering result are correct, the information determination device adopts the target natural language processing model to process the analysis result and the programming statement to be optimized corresponding to the analysis result based on the second target sub-prompt information to obtain the optimized result.

[0123] The second target sub-prompt information can be Figure 3 The GPT analysis module shown is set in the GPT model. In a feasible implementation, the second target sub-prompt information may refer to a second prompt, and the second prompt may be constructed from multiple angles such as application scenarios, problem-solving steps, examples, answer format specifications, problem background, keywords, etc.

[0124] In an embodiment of the present application, the analysis results with correct results and formats and the programming statements to be optimized corresponding to the analysis results with correct results and formats can be used as input information, that is, the analysis results with correct results and formats and the programming statements to be optimized are input into the GPT model, and the programming statements to be optimized are processed based on the determined second prompt to obtain the optimized results.

[0125] Wherein, step 308 can be implemented by:

[0126] Step 308a: The information determination device determines second target sub-prompt information for verifying the target programming statement.

[0127] Step 308b: The information determination device adopts the target natural language processing model to analyze the programming statement to be optimized based on the second target sub-prompt information to obtain the analysis result to be matched.

[0128] In an embodiment of the present application, the programming statement to be optimized can be input into the GPT model, and the programming statement to be optimized can be processed based on the determined second prompt to obtain the analysis result to be matched.

[0129] Step 308c: The information determination device uses the target natural language processing model to determine the optimized result based on the analysis result to be matched and the analysis result.

[0130] In an embodiment of the present application, the target natural language processing model can be used to compare the analysis results to be matched with the analysis results with correct results and formats, and the programming statements to be optimized whose analysis results to be matched are inconsistent with the analysis results with correct results and formats are deleted, so that the analysis results corresponding to the remaining programming statements, that is, the analysis results with correct results and formats that are the same as the analysis results to be matched, are the optimized results.

[0131] It should be noted that step 309 may be executed after step 306 , step 307 and step 308 .

[0132] Step 309: The information determination device generates a target application behavior based on the optimized result.

[0133] In an embodiment of the present application, if the target application behavior refers to an application behavior whitelist, the operation behavior in the optimized result can be used as the application behavior whitelist corresponding to the final application to be analyzed, thereby reducing the impact of incorrect answers and providing more reliable source code analysis results.

[0134] Furthermore, the optimized result may refer to normal operation behaviors that will definitely be generated by the application to be analyzed.

[0135] In other embodiments of the present application, if the target application behavior refers to an application behavior blacklist, the abnormal operation behavior corresponding to the application to be analyzed can be determined based on the operation behavior in the optimized result, and these abnormal operation behaviors can be used as the application behavior blacklist corresponding to the application to be analyzed.

[0136] At the same time, the embodiments of the present application can efficiently build an application behavior whitelist by supporting GPT and code analysis capabilities in multiple languages ​​(java, go, c++), greatly reducing the false alarm rate of the attack / abnormal behavior detection engine, and can be applied to any security protection product that detects attack / abnormal behavior.

[0137] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0138] The information determination method provided in the embodiments of the present application can construct an application behavior whitelist for the application to be analyzed by adopting a target natural language processing model and obtaining analysis results of programming statements that can generate target operations in the application to be analyzed based on target prompt information, without the need for dynamic learning or static program analysis methods, thereby solving the problems of false alarms, low compatibility and high development difficulty in the method of determining the application behavior whitelist in the related art.

[0139] Based on the above embodiments, the present application provides an information determination method, referring to Figure 5 As shown, the method may include the following steps:

[0140] Step 401: The information determination device obtains the operation behavior to be analyzed generated during the operation of the application to be analyzed.

[0141] In the embodiment of the present application, the operation behavior to be analyzed may refer to all operation behaviors generated by the application to be analyzed on the information determination device during the operation process after the application to be analyzed is started and runs in the information determination device.

[0142] Step 402: The information determination device matches the operation behavior to be analyzed with the target application behavior to obtain a processing result.

[0143] Among them, the target application behavior is generated based on the analysis results obtained after using the target natural language processing model to process the programming file corresponding to the application to be analyzed based on the target prompt information. The analysis results are used to characterize the operations that the programming file can produce.

[0144] Step 403: The information determination device determines whether the operation behavior to be analyzed is an abnormal operation behavior based on the processing result.

[0145] Among them, whether the operation behavior to be analyzed is an abnormal operation behavior can be determined based on the matching relationship between the operation behavior to be analyzed and the target application behavior represented by the processing result. It should be noted that if the target application behavior refers to the application behavior whitelist, then when the processing result represents that the operation behavior to be analyzed matches the target application behavior, it can be considered that the operation behavior to be analyzed is not an abnormal operation behavior; when the processing result represents that the operation behavior to be analyzed does not match the target application behavior, it can be considered that the operation behavior to be analyzed is an abnormal operation behavior. If the target application behavior refers to the application behavior blacklist, then when the processing result represents that the operation behavior to be analyzed matches the target application behavior, it is considered that the operation behavior to be analyzed is an abnormal operation behavior; when the processing result represents that the operation behavior to be analyzed does not match the target application behavior, it is considered that the operation behavior to be analyzed is not an abnormal operation behavior.

[0146] In the embodiment of the present application, the target application behavior refers to the application behavior whitelist for specific explanation: the operation behavior to be analyzed can be compared with the target application behavior. If the target application behavior contains the same operation behavior as the operation behavior to be analyzed, then it can be considered that all the operation behaviors to be analyzed currently generated by the application to be analyzed are normal operation behaviors; if the target application behavior does not contain the same operation behavior as the operation behavior to be analyzed, then it can be considered that the operation behavior to be analyzed currently generated by the application to be analyzed is abnormal operation behavior; at this time, the abnormal operation behavior can be intercepted and killed to avoid danger to the device and ensure the security of the data in the device.

[0147] The information determination method provided in the embodiments of the present application can directly match the operation behavior to be analyzed with the target application behavior to determine the abnormal operation behavior in the operation behavior generated by the application to be analyzed during operation, thereby improving the accuracy of the determined abnormal operation behavior and ensuring the security of the device and the normal operation of the application to be analyzed; at the same time, it solves the problems of false alarms in the method of determining the application behavior whitelist, as well as low compatibility and high development difficulty.

[0148] Based on the above embodiments, the present application provides a first information determination device, which can be applied to Figure 1 , 2 In the information determination method provided in the embodiment corresponding to 4, refer to Figure 6 As shown, the first information determination device 5 may include: a processing unit 51 and a generating unit 52, wherein:

[0149] The processing unit 51 is used to use the target natural language processing model to process the programming file corresponding to the application to be analyzed based on the target prompt information to obtain an analysis result; wherein the analysis result is used to characterize the operation that can be generated by the programming file; the programming file is used to generate the application to be analyzed;

[0150] The generating unit 52 is used to generate a target application behavior for the application to be analyzed based on the analysis result; wherein the target application behavior represents the operation that will be generated by the application to be analyzed.

[0151] In other embodiments of the present application, the processing unit 51 is further configured to perform the following steps:

[0152] Determine whether a target programming statement that generates a target operation exists in a programming file corresponding to the application to be analyzed;

[0153] A target natural language processing model is used to process a target programming statement based on target prompt information to obtain an analysis result; wherein the analysis result is used to characterize the operations that can be generated by the target programming statement.

[0154] In other embodiments of the present application, the processing unit 51 is further configured to perform the following steps:

[0155] Determine the programming language of the programming file corresponding to the application to be analyzed;

[0156] Based on a target extraction condition matching the programming language, a target programming statement is extracted from a programming file corresponding to the application to be analyzed.

[0157] In other embodiments of the present application, the processing unit 51 is further configured to perform the following steps:

[0158] Determining first target sub-prompt information for analyzing a target programming statement; wherein the target prompt information includes the first target sub-prompt information;

[0159] The target natural language processing model is used to analyze the target programming statement based on the first target sub-prompt information to obtain an analysis result.

[0160] In other embodiments of the present application, the generating unit 52 is further configured to perform the following steps:

[0161] Filter the analysis results based on the target filtering conditions to obtain filtering results;

[0162] Optimize the analysis results based on the filtering results to obtain optimized results;

[0163] Generate target application behavior based on the optimized results.

[0164] In other embodiments of the present application, the generating unit 52 is further configured to perform the following steps:

[0165] If the result of the filter result characterizing the analysis result is incorrect, delete the analysis result to obtain an optimized result;

[0166] If the filtering result indicates that the analysis result is correct but the format is incorrect, the format of the analysis result is adjusted to obtain an optimized result;

[0167] If the results and format of the filter result characterizing the analysis result are correct, the analysis result is verified to obtain the optimized result.

[0168] In other embodiments of the present application, the generating unit 52 is further configured to perform the following steps:

[0169] The target natural language processing model is adopted to process the analysis result and the programming statement to be optimized corresponding to the analysis result based on the second target sub-prompt information to obtain the optimized result.

[0170] In other embodiments of the present application, the generating unit 52 is further configured to perform the following steps:

[0171] Determining second target sub-prompt information for verifying the target programming statement;

[0172] Using the target natural language processing model, analyzing the programming statement to be optimized based on the second target sub-prompt information, and obtaining the analysis result to be matched;

[0173] The target natural language processing model is used to determine the optimized results based on the analysis results to be matched and the analysis results.

[0174] It should be noted that the specific description of the steps performed by each unit can be found in Figure 1 , 2 The information determination method provided in the embodiment corresponding to 4 is not repeated here.

[0175] The first information determination device provided in the embodiment of the present application can construct an application behavior whitelist for the application to be analyzed by adopting a target natural language processing model and obtaining analysis results of programming statements that can generate target operations in the application to be analyzed based on target prompt information, without the need to use dynamic learning or static program analysis methods, thereby solving the problems of false alarms, low compatibility and high development difficulty in the method of determining the application behavior whitelist in the related art.

[0176] Based on the above embodiments, the present application provides a second information determination device, which can be applied to Figure 5 In the information determination method provided in the corresponding embodiment, refer to Figure 7 As shown, the second information determination device 6 may include: an acquisition unit 61, a matching unit 62 and a determination unit 63, wherein:

[0177] An acquisition unit 61 is used to acquire the operation behavior to be analyzed generated during the operation of the application to be analyzed;

[0178] A matching unit 62 is used to match the operation behavior to be analyzed with the target application behavior to obtain a processing result; wherein the target application behavior is generated based on the analysis result obtained by processing the programming file corresponding to the application to be analyzed using the target natural language processing model based on the target prompt information, and the analysis result is used to characterize the operation that can be generated by the programming file;

[0179] The determination unit 63 is used to determine whether the operation behavior to be analyzed is an abnormal operation behavior based on the processing result.

[0180] It should be noted that the specific description of the steps performed by each unit can be found in Figure 5 The information determination method provided in the corresponding embodiment will not be repeated here.

[0181] The second information determination device provided in the embodiment of the present application can directly match the operation behavior to be analyzed with the target application behavior to determine the abnormal operation behavior in the operation behavior generated by the application to be analyzed during the operation process, thereby improving the accuracy of the determined abnormal operation behavior and ensuring the security of the equipment and the normal operation of the application to be analyzed; at the same time, it solves the problems of false alarms in the method of determining the application behavior whitelist, as well as low compatibility and high development difficulty.

[0182] Based on the foregoing embodiments, an embodiment of the present application provides an information determination device, which may include a first information determination device, which may be applied to Figure 1 , 2 In the information determination method provided in the embodiment corresponding to 4, refer to Figure 8 As shown, the first information determination device 7 may include: a first processor 71, a first memory 72 and a first communication bus 73, wherein:

[0183] The first communication bus 73 is used to realize the communication connection between the first processor 71 and the first memory 72;

[0184] The first processor 71 is used to execute the information determination program in the first memory 72 to implement the following steps:

[0185] Using a target natural language processing model, the programming file corresponding to the application to be analyzed is processed based on the target prompt information to obtain an analysis result; wherein the analysis result is used to characterize the operations that can be generated by the programming file; the programming file is used to generate the application to be analyzed;

[0186] Based on the analysis results, a target application behavior for the application to be analyzed is generated; wherein the target application behavior represents the operation that will be generated by the application to be analyzed.

[0187] In other embodiments of the present application, the first processor 71 is used to execute the information determination program in the first memory 72, adopt the target natural language processing model, and process the programming file corresponding to the application to be analyzed based on the target prompt information to obtain the analysis result, so as to implement the following steps:

[0188] Determine whether a target programming statement that generates a target operation exists in a programming file corresponding to the application to be analyzed;

[0189] A target natural language processing model is used to process a target programming statement based on target prompt information to obtain an analysis result; wherein the analysis result is used to characterize the operations that can be generated by the target programming statement.

[0190] In other embodiments of the present application, the first processor 71 is used to execute the information determination program in the first memory 72 to determine that the programming file corresponding to the application to be analyzed has a target programming statement that generates a target operation, so as to implement the following steps:

[0191] Determine the programming language of the programming file corresponding to the application to be analyzed;

[0192] Based on a target extraction condition matching the programming language, a target programming statement is extracted from a programming file corresponding to the application to be analyzed.

[0193] In other embodiments of the present application, the first processor 71 is used to execute the information determination program in the first memory 72 using a target natural language processing model, and processes the target programming statement based on the target prompt information to obtain an analysis result, so as to implement the following steps:

[0194] Determining first target sub-prompt information for analyzing a target programming statement; wherein the target prompt information includes the first target sub-prompt information;

[0195] The target natural language processing model is used to analyze the target programming statement based on the first target sub-prompt information to obtain an analysis result.

[0196] In other embodiments of the present application, the first processor 71 is used to execute the information determination program in the first memory 72 based on the analysis result, and generate a target application behavior for the application to be analyzed, so as to implement the following steps:

[0197] Filter the analysis results based on the target filtering conditions to obtain filtering results;

[0198] Optimize the analysis results based on the filtering results to obtain optimized results;

[0199] Generate target application behavior based on the optimized results.

[0200] In other embodiments of the present application, the first processor 71 is used to execute the information determination program in the first memory 72 to optimize the analysis result based on the filtering result to obtain the optimized result, so as to implement the following steps:

[0201] If the result of the filter result characterizing the analysis result is incorrect, delete the analysis result to obtain an optimized result;

[0202] If the filtering result indicates that the analysis result is correct but the format is incorrect, the format of the analysis result is adjusted to obtain an optimized result;

[0203] If the results and format of the filter result characterizing the analysis result are correct, the analysis result is verified to obtain the optimized result.

[0204] In other embodiments of the present application, the first processor 71 is used to execute the information determination program in the first memory 72 to verify the analysis result to obtain an optimized result, so as to implement the following steps:

[0205] The target natural language processing model is adopted to process the analysis result and the programming statement to be optimized corresponding to the analysis result based on the second target sub-prompt information to obtain the optimized result.

[0206] In other embodiments of the present application, the first processor 71 is used to execute the information in the first memory 72 to determine the target natural language processing model of the program, and to process the analysis result and the programming statement to be optimized corresponding to the analysis result based on the second target sub-prompt information to obtain the optimized result, so as to implement the following steps:

[0207] Determining second target sub-prompt information for verifying the target programming statement;

[0208] Using the target natural language processing model, analyzing the programming statement to be optimized based on the second target sub-prompt information, and obtaining the analysis result to be matched;

[0209] The target natural language processing model is used to determine the optimized results based on the analysis results to be matched and the analysis results.

[0210] It should be noted that the specific description of the steps performed by the first processor can be referred to Figure 1 , 2 The information determination method provided in the embodiment corresponding to 4 is not repeated here.

[0211] The first information determination device provided in the embodiment of the present application can construct an application behavior whitelist for the application to be analyzed by adopting a target natural language processing model and obtaining analysis results of programming statements that can generate target operations in the application to be analyzed based on target prompt information, without the need for dynamic learning or static program analysis methods, thereby solving the problems of false alarms, low compatibility and high development difficulty in the method of determining the application behavior whitelist in the related art.

[0212] Based on the foregoing embodiments, embodiments of the present application provide an information determination device, which may include a second information determination device, which may be applied to Figure 5 In the information determination method provided in the corresponding embodiment, refer to Fig. 9 As shown, the second information determination device 8 may include: a second processor 81, a second memory 82, and a second communication bus 83, wherein:

[0213] The second communication bus 83 is used to realize the communication connection between the second processor 81 and the second memory 82;

[0214] The second processor 81 is used to execute the information determination program in the second memory 82 to implement the following steps:

[0215] Obtain the operation behaviors to be analyzed generated during the operation of the application to be analyzed;

[0216] Matching the operation behavior to be analyzed with the target application behavior to obtain a processing result; wherein the target application behavior is generated based on the analysis result obtained by processing the programming file corresponding to the application to be analyzed using the target natural language processing model based on the target prompt information, and the analysis result is used to characterize the operation that the programming file can generate;

[0217] Based on the processing result, it is determined whether the operation behavior to be analyzed is an abnormal operation behavior.

[0218] It should be noted that the specific description of the steps performed by the second processor can be referred to Figure 5 The information determination method provided in the corresponding embodiment will not be repeated here.

[0219] The second information determination device provided in the embodiment of the present application can directly match the operation behavior to be analyzed with the target application behavior to determine the abnormal operation behavior in the operation behavior generated during the operation of the application to be analyzed, thereby improving the accuracy of the determined abnormal operation behavior and ensuring the security of the device and the normal operation of the application to be analyzed; at the same time, it solves the problems of false alarms in the method of determining the application behavior whitelist, as well as low compatibility and high development difficulty.

[0220] Based on the foregoing embodiments, the embodiments of the present application provide a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement Figure 1 , 2 , 4 and 5 correspond to the steps of the information determination method provided in the embodiments.

[0221] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of hardware embodiments, software embodiments, or embodiments in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0222] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data transmission device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data transmission device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0223] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data transmission device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0224] These computer program instructions may also be loaded onto a computer or other programmable data transmission device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0225] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A method for determining information, characterized in that: The method comprises: Using a target natural language processing model, the programming file corresponding to the application to be analyzed is processed based on the target prompt information to obtain an analysis result; wherein the analysis result is used to characterize the operations that can be generated by the programming file; the programming file is used to generate the application to be analyzed; Based on the analysis result, a target application behavior for the application to be analyzed is generated; wherein the target application behavior represents an operation that will be generated by the application to be analyzed.

2. The method according to claim 1, characterized in that The target natural language processing model is used to process the programming file corresponding to the application to be analyzed based on the target prompt information to obtain the analysis result, including: Determining whether a target programming statement that generates a target operation is included in the programming file corresponding to the application to be analyzed; The target natural language processing model is used to process the target programming statement based on the target prompt information to obtain the analysis result; wherein the analysis result is used to characterize the operation that can be generated by the target programming statement.

3. The method according to claim 2, characterized in that The step of determining whether a target programming statement generating a target operation is present in the programming file corresponding to the application to be analyzed, comprises: Determine the programming language of the programming file corresponding to the application to be analyzed; Extracting the target programming statement from the programming file corresponding to the application to be analyzed based on a target extraction condition matching the programming language; Accordingly, the target natural language processing model is used to process the target programming statement based on the target prompt information to obtain an analysis result, including: Determining first target sub-prompt information for analyzing the target programming statement; wherein the target prompt information includes the first target sub-prompt information; The target natural language processing model is used to analyze the target programming statement based on the first target sub-prompt information to obtain the analysis result.

4. The method according to claim 1, characterized in that: The generating a target application behavior for the application to be analyzed based on the analysis result includes: Filter the analysis results based on the target filtering condition to obtain a filtering result; Optimizing the analysis result based on the filtering result to obtain an optimized result; The target application behavior is generated based on the optimized result.

5. The method according to claim 4, characterized in that The optimizing the analysis result based on the filtering result to obtain the optimized result includes: If the filtering result indicates that the analysis result is incorrect, deleting the analysis result to obtain the optimized result; If the filtering result indicates that the result of the analysis is correct but the format is incorrect, adjusting the format of the analysis result to obtain the optimized result; If the filtering result indicates that the result and format of the analysis result are correct, the analysis result is verified to obtain the optimized result.

6. A method for determining information, characterized in that: The method comprises: Obtain the operation behaviors to be analyzed generated during the operation of the application to be analyzed; Matching the operation behavior to be analyzed with the target application behavior to obtain a processing result; wherein the target application behavior is generated based on the analysis result obtained by processing the programming file corresponding to the application to be analyzed based on the target prompt information using the target natural language processing model, and the analysis result is used to characterize the operation that can be generated by the programming file; Based on the processing result, it is determined whether the operation behavior to be analyzed is an abnormal operation behavior.

7. A first information determination device, characterized in that: The device comprises: A processing unit, configured to use a target natural language processing model to process a programming file corresponding to the application to be analyzed based on target prompt information to obtain an analysis result; wherein the analysis result is used to characterize the operations that can be generated by the programming file; and the programming file is used to generate the application to be analyzed; A generating unit is used to generate a target application behavior for the application to be analyzed based on the analysis result; wherein the target application behavior represents an operation that will be generated by the application to be analyzed.

8. A second information determining device, characterized in that: The device comprises: An acquisition unit, used to acquire the operation behavior to be analyzed generated during the operation of the application to be analyzed; A matching unit, used for matching the operation behavior to be analyzed with the target application behavior to obtain a processing result; wherein the target application behavior is generated based on the analysis result obtained by processing the programming file corresponding to the application to be analyzed based on the target prompt information using the target natural language processing model, and the analysis result is used to characterize the operation that can be generated by the programming file; A determination unit is used to determine whether the operation behavior to be analyzed is an abnormal operation behavior based on the processing result.

9. An information determination device, characterized in that: The device comprises: a processor, a memory and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information determination program in the memory to implement the steps of the information determination method according to any one of claims 1 to 5 or 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the information determination method according to any one of claims 1 to 5 or 6.

Images