Illegal Android application detection method based on user interface conversion diagram and electronic equipment

Abstract

The invention discloses an illegal Android application detection method based on a user interface conversion diagram and electronic equipment, and the method comprises the steps: carrying out the dynamic analysis of a to-be-detected Android application, and obtaining a dynamic user interface conversion diagram; performing static analysis on the to-be-detected Android application to obtain a static user interface conversion diagram and metadata of the to-be-detected Android application; establishing mapping between the static user interface conversion diagram and the dynamic user interface conversion diagram, and aligning and fusing the static user interface conversion diagram and the dynamic user interface conversion diagram to obtain a mixed user interface conversion diagram; performing link prediction on the mixed user interface conversion diagram, and updating the user interface conversion diagram; metadata of the to-be-detected Android application is input into an encoder to be encoded, metadata feature vectors obtained through encoding and the updated user interface conversion diagram are spliced, and a mixed feature diagram is obtained; and inputting the mixed feature graph into a graph neural network for label prediction to obtain a category corresponding to the to-be-detected Android application.

Description

Technical Field

[0001] The present invention belongs to the technical field of Android application detection, and in particular to an illegal Android application detection method and electronic device based on a user interface conversion diagram. Background Art

[0002] Android is a mobile operating system that is mainly used in mobile devices such as smartphones and tablets. In recent years, with the continuous development of the Internet and the increasing popularity of Android applications, a considerable number of illegal industries have begun to choose to rely on web pages and Android applications for dissemination and profit.

[0003] WebView is a special native user interface in Android that can quickly access and interact with local HTML resources or remote web pages. It is a special user interface management method compared to static layout and dynamic generation. Because WebView can reuse web pages and reduce development costs, some illegal Android applications will use WebView to display illegal content on web pages. WebView will have a certain impact on the analysis of Android applications because the content displayed in it is not included in the code, and the loading process is also different from the regular UI.

[0004] Most of the existing research on Android application classification focuses on whether the application is a "malicious application", and relatively few studies focus on whether its content is illegal.

[0005] At the same time, the existing Android application classification methods usually only use dynamic or static analysis. Dynamic analysis requires running the program and simulating user behavior. Only the triggered or jumped content will be collected with detailed data. The behavior that is triggered multiple times will be recorded multiple times. The user interface and transition that are not triggered are not in the user interface transition map. Therefore, there are many redundant data and low coverage. Although the results of the user interface transition map obtained by static analysis are more comprehensive, its accuracy is not ideal. There are false positives and missed jumps. At the same time, it cannot handle the content in the dynamically loaded WebView.

[0006] Therefore, it is urgent to propose a method for detecting illegal Android applications. Summary of the invention

[0007] In view of the deficiencies in the prior art, the present invention provides an illegal Android application detection method and electronic device based on a user interface transition diagram.

[0008] In a first aspect, an embodiment of the present invention provides a method for detecting illegal Android applications based on a user interface transition graph, the method comprising the following steps:

[0009] Perform dynamic analysis on the Android application to be tested and obtain the dynamic user interface transition graph;

[0010] Perform static analysis on the Android application to be tested, and obtain a static user interface transition graph and metadata of the Android application to be tested;

[0011] Establishing a mapping between the static user interface transition graph and the dynamic user interface transition graph, aligning and fusing the static user interface transition graph and the dynamic user interface transition graph to obtain a hybrid user interface transition graph;

[0012] Perform link prediction on the hybrid user interface transition graph, and update the user interface transition graph;

[0013] Inputting metadata of the Android application to be detected into an encoder for encoding, and concatenating the metadata feature vector obtained by encoding with the updated user interface transition map to obtain a hybrid feature map;

[0014] The mixed feature map is input into the graph neural network for label prediction to obtain the category corresponding to the Android application to be detected.

[0015] In a second aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the above-mentioned illegal Android application detection method based on user interface transition diagram.

[0016] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned illegal Android application detection method based on user interface transition diagram.

[0017] In a fourth aspect, an embodiment of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-mentioned illegal Android application detection method based on user interface transition diagram.

[0018] Compared with the prior art, the present invention has the following beneficial effects:

[0019] The present invention provides an illegal Android application detection method based on a user interface conversion graph, by dynamically and statically analyzing the Android application to be detected, a dynamic user interface conversion graph and a static user interface conversion graph are obtained; the dynamic and static user interface conversion graphs are mapped, aligned, and spliced ​​to obtain a hybrid user interface conversion graph; the hybrid user interface conversion graph is predicted with directed edges and edge addition and deletion operations are performed by a gravity-inspired GAE neural network, effectively improving the problems of low node coverage and low conversion edge accuracy. The present invention can efficiently analyze the Android application to be detected, and has high robustness. When one or two parts of the dynamic user interface conversion graph, the static user interface conversion graph, and the static extraction metadata fail to be extracted, other features can still be extracted normally and the final prediction can be completed. It has a wide range of application value in illegal Android application governance, Android application platform review and other tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0021] Figure 1 A flowchart of a method for detecting illegal Android applications based on a user interface transition diagram provided by an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of establishing a mapping between a static user interface transition diagram and a dynamic user interface transition diagram provided in an embodiment of the present invention;

[0023] Figure 3 A schematic diagram of link prediction provided by an embodiment of the present invention;

[0024] Figure 4 A schematic diagram of a mixed feature map provided by an embodiment of the present invention;

[0025] Figure 5 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] It should be noted that, in the absence of conflict, the features in the following embodiments and implementations may be combined with each other.

[0028] In order to clearly explain the technical solutions provided by the embodiments of the present application, some concepts that may appear in subsequent embodiments will be introduced first.

[0029] User Interface (UI): It is the medium for mobile applications to exchange information and interact with users. Android UI includes all applications related to user audio and video and can interact with them. It is composed of layout and controls. It can be controlled by XML static layout and code dynamic generation. In actual use, a combination of the two can also be used to flexibly manage UI.

[0030] User Interface Transition Graph (UI Transition Graph): is a visualization method used to describe the transition relationship and process between different user interfaces (UIs) in an application. It is usually composed of a series of nodes and edges, where nodes represent UIs and edges represent actions or events that users perform to transition from one UI to another.

[0031] like Figure 1 As shown, an embodiment of the present invention provides a method for detecting illegal Android applications based on a user interface transition diagram, the method comprising:

[0032] Step S1, dynamically analyzing the Android application to be detected to obtain a dynamic user interface conversion diagram.

[0033] Specifically, step S1 includes the following sub-steps:

[0034] Step S101 , dynamically analyzing the Android application to be detected, obtaining a number of user interfaces including a web view (WebView), jump relationships between user interfaces, and a user interface tree and activity name corresponding to each user interface.

[0035] Specifically, in this example, a dynamic analysis method based on a breadth-first search strategy is adopted to test the Android application to be tested using the DroidBot tool and the Talkback accessibility plug-in, and several user interfaces including the web view (WebView), the jump relationship between user interfaces, and the user interface tree and activity name corresponding to each user interface are obtained.

[0036] Exemplarily, in this instance, the Android application apk file to be tested is run in the simulator, and the DroidBot tool is automatically called by configuring the Python script to perform dynamic analysis of the breadth-first search strategy, and the information dynamically loaded on the web view WebView is obtained by obtaining the content of the rendering pipeline; the analysis results of the DroidBot tool include a large number of json files; among them, a first json file and several second json files, the first json file includes the jump relationship between the user interface and the user interface, and the second json file includes the user interface tree, activity name, controls and control layout of the user interface.

[0037] Step S102, calculating the similarity between two user interfaces based on the user interface tree, treating two user interfaces with a similarity greater than a threshold as different states of the same user interface; merging redundant user interfaces, and updating the jump relationship between user interfaces.

[0038] Specifically, in this example, the similarity between two user interfaces is calculated through the Levenstein distance calculation user interface tree, two user interfaces with a similarity greater than a threshold are regarded as different states of the same user interface, user interfaces with high similarity are merged, and the jump relationship between user interfaces is updated to alleviate the information explosion caused by the DroidBot tool distinguishing different user interfaces through the hash value of the user interface tree.

[0039] Step S103 , constructing a dynamic user interface transition graph using the merged user interfaces as nodes and the jump relationships between the updated user interfaces as edges.

[0040] Step S2, static analysis is performed on the Android application to be detected to obtain a static user interface transition graph and metadata of the Android application to be detected.

[0041] Specifically, step S2 includes the following steps:

[0042] Perform static analysis on the Android application to be tested to obtain several user interfaces, jump relationships between user interfaces, and the user interface tree and activity name corresponding to each user interface.

[0043] A static user interface transition graph is constructed with user interfaces as nodes, jump relations between user interfaces as edges, and basic properties and listener methods of jump relations between user interfaces as edge features.

[0044] Among them, the process of statically analyzing the Android application to be detected and obtaining several user interfaces includes: for each activity of the Android application to be detected, traversing the nodes in the call graph of the onCreate method corresponding to each activity, finding the node corresponding to the setContentView method in the call graph, and determining the user interface associated with the activity by checking the parameters of the setContentView method.

[0045] Among them, the basic attributes of the jump relationship between user interfaces are obtained: basic attributes including text, id, and clickable (whether it can be clicked) are obtained according to the user interface.

[0046] Among them, the process of obtaining the listener method corresponding to the jump relationship between user interfaces includes: reversing the code of the Android application to be detected, traversing all instance functions in its reverse code for each activity of the Android application, using the FlowDroid tool to build a call graph of the instance function (the call graph has function methods as nodes and call relationships as edges), and searching on the call graph to obtain the listener method corresponding to the jump relationship between user interfaces.

[0047] Exemplarily, static analysis is performed on Android applications. First, the potential triggerable controls and UI features are obtained by using the PermDroid tool and code analysis. Then, a static UI transition graph is constructed by identifying functions involved in activity transitions. Then, Androguard and Jadx are used to obtain static metadata.

[0048] Furthermore, the metadata of the Android application to be detected includes: text data, image data; wherein the text data includes: application name, package name, certificate information; and the image data includes: application icon.

[0049] Step S3, establishing a mapping between the static user interface transition graph and the dynamic user interface transition graph, aligning and merging the static user interface transition graph and the dynamic user interface transition graph to obtain a hybrid user interface transition graph.

[0050] Specifically, step S3 includes the following sub-steps:

[0051] Step S301, calculate the similarity between two nodes with the same activity name in the static user interface transition graph and the dynamic user interface transition graph. When the similarity is greater than a threshold (set to 0.87 in this example), the two nodes with the same activity name are regarded as using one user interface, thereby completing the mapping of nodes between the static user interface transition graph and the dynamic user interface transition graph.

[0052] Furthermore, in this example, the Levenstein distance is used to calculate the node similarity between two nodes with the same activity name in the static user interface transition graph and the dynamic user interface transition graph.

[0053] Step S302: When there is a node mapping relationship between two source nodes in the static user interface conversion graph and the dynamic user interface conversion graph, and there is a node mapping relationship between two destination nodes in the static user interface conversion graph and the dynamic user interface conversion graph, and the listener method corresponding to the edge between the source node and the destination node in the static user interface conversion graph is the same as the listener method corresponding to the edge between the source node and the destination node in the dynamic user interface conversion graph, there is an edge mapping relationship between the edge between the source node and the destination node in the static user interface conversion graph and the edge between the source node and the destination node in the dynamic user interface conversion graph; all edges in the static user interface conversion graph and the dynamic user interface conversion graph are traversed pairwise, thereby completing the mapping of edges between the static user interface conversion graph and the dynamic user interface conversion graph.

[0054] It should be noted that when the same UI node triggers a conversion with the same characteristics, the target UI node is uniquely determined; therefore, in order to further match more conversion pairs, all edges in the dynamic and static user interface conversion graph are traversed in pairs to find out those edges that have source nodes that are considered to be the same user interface and have matching trigger controls and operation methods (the trigger controls in the static graph and the operation methods in the dynamic graph match, such as setOnClickListener() and the click operation are a pair of matching controls and methods). These two edges are regarded as the same conversion, and the edge mapping is completed. The target nodes of these two edges are also marked as the same user interface.

[0055] Step S303: Generate a hybrid user interface transition graph according to the mapping relationship between nodes and the mapping relationship between edges in the static user interface transition graph and the dynamic user interface transition graph.

[0056] For example, Figure 2As shown, the first activity name 'A' and the first user interface tree of the first node in the static user interface conversion diagram are obtained, and the second activity name 'A' and the second user interface tree of the second node in the static user interface conversion diagram are obtained; the activity name 'A' and the third user interface tree of the third node in the dynamic user interface conversion diagram are obtained, and the activity name 'A' and the fourth user interface tree of the fourth node in the dynamic user interface conversion diagram are obtained. The Levenstein distance is used to calculate the similarity between the first node in the static user interface conversion diagram and the third node in the dynamic user interface conversion diagram. If the similarity is greater than the threshold value of 0.87, the two nodes are regarded as the same user interface and can be merged. The Levenstein distance is used to calculate the similarity between the second node in the static user interface conversion diagram and the fourth node in the dynamic user interface conversion diagram. If the similarity is greater than the threshold value of 0.87, the two nodes are regarded as the same user interface and can be merged. There is a node mapping relationship between the first node in the static user interface conversion graph and the third node in the dynamic user interface conversion graph, and there is a node mapping relationship between the second node in the static user interface conversion graph and the fourth node in the dynamic user interface conversion graph. The listener method corresponding to the edge between the first node and the second node in the static user interface conversion graph is setOnClickListener(), and the listener method corresponding to the edge between the third node and the fourth node in the dynamic user interface conversion graph is a click operation, that is, the listener method corresponding to the edge between the source node and the destination node in the static user interface conversion graph is the same as the listener method corresponding to the edge between the source node and the destination node in the dynamic user interface conversion graph. Then, it is determined that there is an edge mapping relationship between the edge between the first node and the second node in the static user interface conversion graph and the edge between the third node and the fourth node in the dynamic user interface conversion graph.

[0057] Step S4, performing link prediction on the hybrid user interface transition graph, and updating the user interface transition graph.

[0058] Specifically, step S4 includes the following steps:

[0059] Step S401, inputting the activity name of the user interface corresponding to each node in the hybrid user interface transition graph and the text data in the user interface tree into the pre-trained BERT model to obtain a node feature vector.

[0060] Specifically, for the activity name of the user interface, the processing token length is set to 64, the encoding length is 64, and a BERT model specifically designed for case-insensitive English is used; for the text data in the user interface tree, the processing token length is set to 256, the encoding length is 64, and a BERT model for Chinese is used. The loaded pre-trained BERT model is fine-tuned through the MLM task, that is, the content of several tokens is randomly masked, allowing the BERT model to predict the content that should be filled in that position.

[0061] Step S402 , input the node feature vector and the hybrid user interface transition graph into a pre-trained Gravity-Inspired Graph Autoencoders neural network to perform directed edge prediction on the hybrid user interface transition graph, and obtain the scores of directed connections between nodes in the hybrid user interface transition graph.

[0062] It should be noted that the gravity-inspired GAE neural network introduces gravity parameters, so that the GAE, which is unable to handle directional features, can output different results for directed edges.

[0063] In this example, a gravity-inspired GAE neural network is used as a link prediction model. The training process of the link prediction model includes: using a hybrid user interface transition graph as a real graph, training the link prediction model to train the ability to predict whether an edge exists, and then fine-tuning using a manually corrected user interface transition graph.

[0064] Step S403 : Based on the scores of directed connections between nodes in the hybrid user interface transition graph and whether there are edges in the hybrid user interface transition graph, edge addition and deletion operations are performed on the hybrid user interface transition graph, thereby updating the user interface transition graph.

[0065] Specifically, based on the scores of directed connections between nodes in the hybrid user interface transition graph, the quartiles thereof are calculated to determine an upper score threshold (in this example, the upper score threshold is 0.408) and a lower score threshold (in this example, the lower score threshold is 0.202);

[0066] The possible edges in the hybrid user interface transition graph are traversed: when the score of the directed connection between two nodes is greater than the upper score threshold, the directed connection between the two nodes is taken as an edge to be added and added to the set of edges to be added; when the score of the directed connection between two nodes is less than the lower score threshold, the directed connection between the two nodes is taken as an edge to be deleted and added to the set of edges to be deleted.

[0067] Traverse the edge set to be added and the edge set to be deleted: for the edge to be added, if the edge does not exist in the current hybrid user interface conversion graph, add the corresponding connection relationship in the current hybrid user interface conversion graph; for the edge to be deleted, delete the corresponding connection relationship in the current hybrid user interface conversion graph;

[0068] It should be noted that, for the edges to be deleted, since the edge information derived from the dynamic analysis must be true, when only the edges obtained by the static analysis exist in the original UI transition graph, the connection relationship is deleted.

[0069] According to the modified connection relationship, an updated user interface conversion diagram is obtained.

[0070] Step S5: input the metadata of the Android application to be detected into an encoder for encoding, and concatenate the metadata feature vector obtained by encoding with the updated user interface transition map to obtain a mixed feature map.

[0071] Specifically, step S5 includes the following sub-steps:

[0072] Step S501, encoding text data in the metadata of the Android application to be detected to obtain text features;

[0073] Specifically, the text data in the metadata of the Android application to be detected, including the application name, package name, and certificate information, all Chinese text data are converted into pinyin, and the unparseable characters are pre-processed and deleted, and encoded into a 128-dimensional feature vector using the BiGRU model trained by the classification task.

[0074] The classification task is achieved by adding a fully connected layer outside the BiGRU model, taking text data as input, and the confidence scores of the first violation category, the second violation category, ..., the Nth violation category as output, and training the BiGRU model with cross entropy as the loss function.

[0075] Step S502 , encoding the image data in the metadata of the Android application to be detected to obtain image features.

[0076] Specifically, the RGB values ​​of the image pixels are counted, and the three channels of R, G, and B are counted respectively. The 256 values ​​are divided into 16 groups, and the proportion of pixels contained in each group in the entire image is calculated to obtain a total of 48-dimensional vectors as the first vector.

[0077] Furthermore, similar operations are performed on the HSV channel. Since the V channel has 180 values, it is divided into 10 groups, and finally a 42-dimensional feature vector is obtained as the second vector.

[0078] Finally, EasyOCR is used to identify the number of texts in the image, whether there are keywords related to illegal content, and whether there are web links through regular matching, resulting in a total of 6-dimensional features as the third vector.

[0079] The first vector, the second vector, and the third vector are normalized and concatenated to obtain image features.

[0080] Step S503, the text features and the image features are spliced ​​to obtain the metadata features of the Android application to be detected; the metadata features are spliced ​​before each node feature of the updated user interface transition graph to obtain a mixed feature graph of the Android application to be detected, such as Figure 4 shown.

[0081] Step S6: Input the mixed feature map into the graph neural network for label prediction to obtain the category corresponding to the Android application to be detected.

[0082] Specifically, the mixed feature map is input into the graph neural network for label prediction to obtain the confidence scores of the Android application to be detected in the first violation category, the second violation category, ..., the Nth violation category respectively; the category with the highest confidence score is selected as the category corresponding to the Android application to be detected.

[0083] In summary, the present invention provides an illegal Android application detection method based on a user interface conversion graph, by dynamically and statically analyzing the Android application to be detected, a dynamic user interface conversion graph and a static user interface conversion graph are obtained; the dynamic and static user interface conversion graphs are mapped, aligned, and spliced ​​to obtain a hybrid user interface conversion graph; the hybrid user interface conversion graph is predicted with directed edges and edge addition and deletion operations are performed by a gravity-inspired GAE neural network, effectively alleviating the problems of low accuracy of the static user interface conversion graph and low coverage of the dynamic user interface conversion graph. The present invention can efficiently analyze the Android application to be detected, and has high robustness. When one or two parts of the dynamic user interface conversion graph, the static user interface conversion graph, and the static extraction metadata fail to be extracted, other features can still be extracted normally and the final prediction can be completed, realizing the identification and category judgment of illegal Android applications, and has a wide range of application value in illegal Android application governance, Android application platform review and other tasks.

[0084] According to an embodiment of the present invention, the present invention also provides an electronic device and a readable storage medium.

[0085] Figure 5A schematic block diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are only examples, and are not intended to limit the implementation of the present invention described and / or required herein. The electronic device includes a computing unit 101, which can perform various appropriate actions and processes according to a computer program stored in ROM 102 or a computer program loaded from a storage unit 108 into RAM 103. In RAM 103, various programs and data required for the operation of the electronic device can also be stored. The computing unit 101, ROM 102, and RAM 103 are connected to each other via a bus 104. An I / O interface 105 is also connected to the bus 104.

[0086] A number of components in the electronic device are connected to the I / O interface 105, including: an input unit 106, such as a keyboard, a mouse, etc.; an output unit 107, such as various types of displays, speakers, etc.; a storage unit 108, such as a disk, an optical disk, etc.; and a communication unit 109, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 109 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0087] The computing unit 101 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 101 performs the various methods and processes described above. For example, in some embodiments, the method in the multidimensional early warning system for pressure injuries may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 108. In some embodiments, part or all of the computer program may be loaded and / or installed on an electronic device via ROM 102 and / or a communication unit 109. When the computer program is loaded into RAM 103 and executed by the computing unit 101, one or more steps of the method in the multidimensional early warning system for pressure injuries described above may be executed. Alternatively, in other embodiments, the computing unit 101 may be configured to execute the method in the multidimensional early warning system for pressure injuries in any other appropriate manner (e.g., by means of firmware).

[0088] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0089] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0090] In the context of the present invention, a readable storage medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A readable storage medium may be a machine-readable signal medium or a machine-readable storage medium. A readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. More specific examples of readable storage media may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0091] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0092] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0093] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0094] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

[0095] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting illegal Android applications based on a user interface transition graph, characterized in that: The method comprises the following steps: Perform dynamic analysis on the Android application to be tested and obtain the dynamic user interface transition graph; Perform static analysis on the Android application to be tested, and obtain a static user interface transition graph and metadata of the Android application to be tested; Establishing a mapping between the static user interface transition graph and the dynamic user interface transition graph, aligning and fusing the static user interface transition graph and the dynamic user interface transition graph to obtain a hybrid user interface transition graph; Perform link prediction on the hybrid user interface transition graph, and update the user interface transition graph; Inputting metadata of the Android application to be detected into an encoder for encoding, and concatenating the metadata feature vector obtained by encoding with the updated user interface transition map to obtain a hybrid feature map; The mixed feature map is input into the graph neural network for label prediction to obtain the category corresponding to the Android application to be detected.

2. According to claim 1, a method for detecting illegal Android applications based on a user interface transition graph is characterized in that: The process of dynamically analyzing the Android application to be tested and obtaining the dynamic user interface transition graph includes: Dynamically analyze the Android application to be tested to obtain the user interface, the jump relationship between user interfaces, and the user interface tree corresponding to each user interface; Calculate the similarity between two user interfaces based on the user interface tree, and regard two user interfaces with a similarity greater than a threshold as different states of the same user interface; merge redundant user interfaces, and update the jump relationship between user interfaces; A dynamic user interface transition graph is constructed with the merged user interfaces as nodes and the jump relationships between the updated user interfaces as edges.

3. According to claim 1, a method for detecting illegal Android applications based on a user interface transition graph is characterized in that: The process of statically analyzing the Android application to be tested and obtaining the static user interface transition graph includes: Perform static analysis on the Android application to be tested to obtain several user interfaces, jump relationships between user interfaces, and user interface trees and activity names corresponding to each user interface; A static user interface transition graph is constructed with user interfaces as nodes, jump relationships between user interfaces as edges, and basic attributes and listener methods of jump relationships between user interfaces as edge features. Among them, the process of obtaining the listener method corresponding to the jump relationship between user interfaces includes: reversing the code of the Android application to be detected, traversing all instance functions in its reverse code for each activity of the Android application, building a call graph of the instance function, and searching on the call graph to obtain the listener method corresponding to the jump relationship between user interfaces.

4. The method for detecting illegal Android applications based on a user interface transition graph according to claim 1, characterized in that: The process of establishing a mapping between the static user interface transition graph and the dynamic user interface transition graph, aligning and fusing the static user interface transition graph and the dynamic user interface transition graph to obtain a hybrid user interface transition graph includes: Calculate the similarity between two nodes with the same activity name in the static user interface transition graph and the dynamic user interface transition graph. When the similarity is greater than a threshold, the two nodes with the same activity name are regarded as using one user interface, thereby completing the mapping of nodes between the static user interface transition graph and the dynamic user interface transition graph. When there is a node mapping relationship between two source nodes in the static user interface conversion graph and the dynamic user interface conversion graph, and there is a node mapping relationship between two destination nodes in the static user interface conversion graph and the dynamic user interface conversion graph, and the listener method corresponding to the edge between the source node and the destination node in the static user interface conversion graph is the same as the listener method corresponding to the edge between the source node and the destination node in the dynamic user interface conversion graph, there is an edge mapping relationship between the edge between the source node and the destination node in the static user interface conversion graph and the edge between the source node and the destination node in the dynamic user interface conversion graph; all edges in the static user interface conversion graph and the dynamic user interface conversion graph are traversed pairwise, thereby completing the mapping of edges between the static user interface conversion graph and the dynamic user interface conversion graph; A hybrid user interface transition graph is generated according to the mapping relationship between nodes and the mapping relationship between edges in the static user interface transition graph and the dynamic user interface transition graph.

5. The method for detecting illegal Android applications based on user interface transition graph according to claim 1, characterized in that: The process of performing link prediction on the hybrid user interface transition graph and updating the user interface transition graph includes: Input the activity name of the user interface corresponding to each node in the hybrid user interface transition graph and the text data in the user interface tree into the pre-trained BERT model to obtain the node feature vector; Input the node feature vector and the hybrid UI transition graph into the pre-trained gravity-inspired GAE neural network to perform directed edge prediction on the hybrid UI transition graph, and obtain the scores of directed connections between nodes in the hybrid UI transition graph; Based on the scores of directed connections between nodes in the hybrid user interface transition graph and whether there are edges in the hybrid user interface transition graph, edge addition and deletion operations are performed on the hybrid user interface transition graph, thereby updating the user interface transition graph.

6. The method for detecting illegal Android applications based on user interface transition graph according to claim 5, characterized in that: Based on the scores of directed connections between nodes in the hybrid user interface transition graph and whether there are edges in the hybrid user interface transition graph, adding and deleting edges in the hybrid user interface transition graph, thereby updating the user interface transition graph includes: Based on the scores of directed connections between nodes in the hybrid user interface transition graph, quartiles thereof are calculated to determine an upper score threshold and a lower score threshold; The edges that may exist in the hybrid user interface transition graph are traversed: when the score of the directed connection between two nodes is greater than the upper score threshold, the directed connection between the two nodes is taken as an edge to be added and added to the set of edges to be added; when the score of the directed connection between two nodes is less than the lower score threshold, the directed connection between the two nodes is taken as an edge to be deleted and added to the set of edges to be deleted; Traverse the edge set to be added and the edge set to be deleted: for the edge to be added, if the edge does not exist in the current hybrid user interface conversion graph, add the corresponding connection relationship in the current hybrid user interface conversion graph; for the edge to be deleted, delete the corresponding connection relationship in the current hybrid user interface conversion graph; According to the modified connection relationship, an updated user interface conversion diagram is obtained.

7. The method for detecting illegal Android applications based on user interface transition graph according to claim 1, characterized in that: The process of inputting the mixed feature map into the graph neural network for label prediction and obtaining the category corresponding to the Android application to be detected includes: Input the mixed feature map into the graph neural network for label prediction, and obtain the confidence scores of the Android application to be detected in the first illegal category, the second illegal category, ..., the Nth illegal category respectively; The category with the highest confidence score is selected as the category corresponding to the Android application to be detected.

8. An electronic device, comprising a memory and a processor, characterized in that: The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the illegal Android application detection method based on the user interface conversion diagram as described in any one of claims 1-7 above.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, it implements the illegal Android application detection method based on the user interface conversion diagram as described in any one of claims 1-7.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the illegal Android application detection method based on the user interface conversion diagram described in any one of claims 1-7 is implemented.

Images