Risk reminding method and device and electronic equipment

Abstract

The embodiment of the invention discloses a risk reminding method and device and electronic equipment. The risk reminding method comprises the steps of obtaining a detection strategy which is downloaded from a cloud server and aims at a non-preset application, wherein the non-preset application is an application which is not downloaded through a preset downloading channel; under the condition that a user executes related behaviors aiming at a target non-preset application through the user terminal, carrying out detection operation aiming at a risk application on related data of the target non-preset application according to the detection strategy; and under the condition that a detection result indicates that the target non-preset application conforms to the risk application contained in the detection strategy, reminding the user of the risk application through the user terminal.

Description

Technical Field

[0001] This document belongs to the field of data processing technology, and specifically relates to a risk reminder method, device and electronic equipment. Background Art

[0002] In various online fraud scenarios, illegal online industries usually guide users to install various illegal malicious applications on their terminals. These illegal malicious applications are different from viruses, Trojans and other applications, and are difficult to be identified by user terminal managers or antivirus engines.

[0003] At present, the commonly used reminder solutions for illegal and malicious applications basically obtain the installation packages of illegal and malicious applications by crawling the entire network while meeting the privacy needs of users, analyze and identify the installation packages on the cloud detection platform, and then send risk reminders to users on the user terminal based on the identification results determined in the cloud. This risk reminder solution cannot meet the risk reminder needs for illegal and malicious applications. Therefore, it is necessary to provide a better risk reminder solution to meet the risk reminder needs for illegal and malicious applications. Summary of the invention

[0004] The embodiments of this specification provide a method, device and electronic device for risk reminder, so as to provide a solution for risk reminder.

[0005] In a first aspect, an embodiment of the present specification provides a method for risk reminder, the method comprising: obtaining a detection strategy for non-preset applications downloaded from a cloud server, wherein the non-preset applications are applications that have not been downloaded through a preset download channel; when a user performs related actions for a target non-preset application through the user terminal, performing a detection operation for risky applications on relevant data of the target non-preset application according to the detection strategy; when the detection result indicates that the target non-preset application meets the risky application included in the detection strategy, reminding the user of the risky application through the user terminal.

[0006] In a second aspect, an embodiment of the present specification provides a method for risk reminder, the method comprising: obtaining relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, the non-preset applications being applications that have not been downloaded through a preset download channel, and the relevant data comprising at least the download data of the application; performing detection operations on the relevant data for risky applications to determine the risky applications in the non-preset applications; determining a detection strategy for the risky applications based on the relevant data corresponding to the risky applications; and sending the detection strategy to the user terminal so that the user terminal reminds the user of risky applications when using the detection strategy.

[0007] On the third aspect, an embodiment of the present specification provides a risk reminder device, including: a policy acquisition module, used to obtain a detection strategy for non-preset applications downloaded from a cloud server, wherein the non-preset applications are applications that have not been downloaded through a preset download channel; a risk detection module, used to perform a detection operation for risky applications on relevant data of the target non-preset application according to the detection strategy when the user performs relevant actions for the target non-preset application through the user terminal; and a risk reminder module, used to remind the user of risky applications through the user terminal when the detection result indicates that the target non-preset application meets the risk application included in the detection strategy.

[0008] In a fourth aspect, an embodiment of the present specification provides a risk reminder device, comprising: an application acquisition module, used to obtain relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, the non-preset applications are applications that have not been downloaded through a preset download channel, and the relevant data at least includes the download data of the application; a risk application module, used to perform detection operations on the relevant data for risky applications, and determine the risky applications in the non-preset applications; a policy determination module, used to determine the detection strategy for the risky application based on the relevant data corresponding to the risky application; and a policy delivery module, used to send the detection strategy to the user terminal, so that the user terminal reminds the user of risky applications when using the detection strategy.

[0009] In a fifth aspect, an embodiment of the present specification provides an electronic device, comprising: a processor, and a memory arranged to store computer executable instructions, wherein when the executable instructions are executed, the processor can: obtain a detection strategy for non-preset applications downloaded from a cloud server, wherein the non-preset applications are applications that have not been downloaded through a preset download channel; when a user performs relevant actions for a target non-preset application through the user terminal, according to the detection strategy, perform a detection operation for risky applications on relevant data of the target non-preset application; when the detection result indicates that the target non-preset application meets the risky application included in the detection strategy, remind the user of the risky application through the user terminal.

[0010] In a sixth aspect, an embodiment of the present specification provides an electronic device, comprising: a processor, and a memory arranged to store computer executable instructions, wherein when the executable instructions are executed, the processor can: obtain relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, wherein the non-preset applications are applications that have not been downloaded through a preset download channel, and the relevant data at least includes the download data of the application; perform detection operations on the relevant data for risky applications to determine the risky applications in the non-preset applications; determine a detection strategy for the risky applications based on the relevant data corresponding to the risky applications; and send the detection strategy to the user terminal so that the user terminal reminds the user of risky applications when using the detection strategy.

[0011] In the seventh aspect, an embodiment of the present specification provides a storage medium for storing a computer program, which can be executed by a processor to implement the following process: obtaining a detection strategy for non-preset applications downloaded from a cloud server, wherein the non-preset applications are applications that have not been downloaded through a preset download channel; when a user performs related actions for a target non-preset application through the user terminal, performing a detection operation for risky applications on the relevant data of the target non-preset application according to the detection strategy; when the detection result indicates that the target non-preset application meets the risky application included in the detection strategy, reminding the user of the risky application through the user terminal.

[0012] In an eighth aspect, an embodiment of the present specification provides a storage medium for storing a computer program, wherein the computer program can be executed by a processor to implement the following process: obtaining relevant data of non-preset applications collected by each terminal manufacturer from each user terminal, wherein the non-preset application is an application that has not been downloaded through a preset download channel, and the relevant data includes at least the download data of the application; performing a detection operation on the relevant data for risky applications to determine the risky applications in the non-preset applications; determining a detection strategy for the risky application based on the relevant data corresponding to the risky application; and sending the detection strategy to the user terminal so that the user terminal reminds the user of risky applications when using the detection strategy.

[0013] In a ninth aspect, an embodiment of the present specification provides a computer program product, comprising a computer program, which implements the following process when executed by a processor: obtaining a detection strategy for non-preset applications downloaded from a cloud server, wherein the non-preset applications are applications that have not been downloaded through a preset download channel; when a user performs related actions for a target non-preset application through the user terminal, performing a detection operation for risky applications on the relevant data of the target non-preset application according to the detection strategy; when the detection result indicates that the target non-preset application meets the risky application included in the detection strategy, reminding the user of the risky application through the user terminal.

[0014] In a tenth aspect, an embodiment of the present specification provides a computer program product, comprising a computer program, which implements the following process when executed by a processor: obtaining relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, wherein the non-preset applications are applications that have not been downloaded through a preset download channel, and the relevant data at least includes the download data of the application; performing detection operations on the relevant data for risky applications to determine the risky applications in the non-preset applications; determining a detection strategy for the risky applications based on the relevant data corresponding to the risky applications; and sending the detection strategy to the user terminal so that the user terminal reminds the user of risky applications when using the detection strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate one or more embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in one or more embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a flowchart of a risk reminder method provided in an embodiment of this specification; Figure 2 This is a framework diagram of a risk reminder system for end-cloud collaboration provided by an embodiment of this specification; Figure 3 This is a schematic diagram of an application scenario of a risk reminder method provided in an embodiment of this specification; Figure 4 It is a flowchart of a risk reminder method provided in an embodiment of this specification; Figure 5 It is a structural schematic diagram of a risk reminder device provided in an embodiment of this specification; Figure 6It is a structural schematic diagram of a risk reminder device provided in an embodiment of this specification; Figure 7 It is a structural diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this document.

[0018] The terms "first", "second", etc. in the specification and claims of this document are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of this specification can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims means at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0019] The risk reminder method, device and electronic device provided in the embodiments of this specification are described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0020] Figure 1 A method for risk reminder provided by an embodiment of the present invention is shown. The method can be executed by an electronic device, and the electronic device can include a terminal device, wherein the terminal device can be, for example, a vehicle-mounted terminal or a mobile phone terminal. In other words, the method can be executed by software or hardware installed in the aforementioned electronic device, and the risk reminder method includes the following steps: Step S102: Obtain a detection strategy for non-preset applications downloaded from a cloud server.

[0021] Among them, non-preset applications are applications that are not downloaded through preset download channels. Preset download channels can be: downloading from the application market provided by the manufacturer of the terminal device or a well-known third-party platform, downloading using security software that performs security checks on the downloaded applications, etc. Since each application in the application market is usually strictly reviewed and the security software performs security checks on the downloaded applications, the software downloaded through these preset download channels usually has a higher security. The preset download channels are not specifically limited in this specification and can be determined and updated according to actual conditions.

[0022] In various online fraud scenarios, in order to avoid being audited by manufacturers or third-party platforms, illegal online industries usually guide users to download and install applications developed by illegal online industries on user terminals through non-preset download channels. These applications downloaded through non-preset download channels are non-preset applications. Currently, non-preset download channels include downloading through the use of identification codes, links, etc.

[0023] In order to provide security for user terminals, the cloud server will regularly crawl the installation packages of non-preset applications from the Internet, analyze and identify the non-preset applications in the cloud server, and finally send the identification results (including a list of malicious applications, etc.) to the user terminal through the terminal manufacturer, so that the user terminal has the ability to identify the malicious applications determined by the identification results. However, since the life cycle of malicious applications is very short (sometimes only two or three days), when the cloud server identifies the malicious application, the malicious application is likely to have expired. Therefore, this type of solution usually has a lag.

[0024] In order to achieve timely reminders of malicious applications on user terminals, in one example, a detection strategy for non-preset applications that is easy to execute on user terminals and lightweight can be formulated in the cloud server. The cloud server provides the detection strategy to the user terminal through the terminal manufacturer or the end-cloud collaborative link (the link built between the application terminal and the cloud server). In this way, the detection process of malicious applications can be delegated to the user terminal, and the real-time nature of risk reminders can be improved through the detection of malicious applications by the user terminal. In addition, the proportion of malicious applications in the installation packages crawled from the Internet is low and unstable, while the proportion of malicious applications from non-preset channels provided by the user terminal is high, which will improve the accuracy of the detection strategy. In order to prevent the detection strategy from being tampered with by malicious applications, in one example, the detection strategy can be set in a trusted execution environment (TEE).

[0025] Specifically, the detection strategy can be composed of multiple different conditions through a preset logical operation relationship, and each condition in the detection strategy can include three elements: feature, comparison value and logical operator. For example, in the detection strategy (feture1>1 or feature1<0) and feature2!=-1 and feature3>0, it contains 4 conditions (i.e., feture1>1, feautre1<0, feautre2!=-1 and feature3>0) and 3 logical operation relationships (i.e., or, and and, and), and each condition includes a feature (i.e., feture1, feture1, feture2 and feture3), a comparison value (1, 0, -1 and 0) and a logical operator (>, <, != and >). The feature content is not specifically limited in this specification and can be determined according to actual conditions. In order to improve the detection efficiency of risk applications, in one example, the cloud server can convert each detection strategy into a detection model and send it to the user terminal. In addition, the detection model can also be constructed based on the detection strategy and / or risk features (static features and dynamic features). This specification does not specifically limit the structure and training process of the detection model and can be determined based on actual conditions.

[0026] Step S104: when the user executes a related behavior for a target non-preset application through the user terminal, a detection operation for risky applications is performed on the related data of the target non-preset application according to the detection strategy.

[0027] The target non-preset application may be any non-preset application that is about to be or is currently running on the user terminal, and the related behavior may be the downloading, using (data entry, browsing, querying, etc.) and other behaviors corresponding to the target non-preset application performed by the user, and the static data corresponding to the target non-preset application or the dynamic data generated during the execution of the related behavior is the related data. Static data is the data used by the downloaded application, and dynamic data is the data generated by the used application.

[0028] Since the relevant data of the target non-preset application corresponding to different relevant behaviors are different, the cloud server can set different detection strategies based on the relevant data generated by different relevant behaviors, and the user terminal can execute different detection strategies for the relevant data corresponding to different relevant behaviors based on the detection strategies.

[0029] Specifically, before the target non-preset application is installed on the user terminal, it is necessary to use a link or QR code to jump to the corresponding download address and verify the application signature. Therefore, before installing the application, the relevant data may be static data such as links, QR codes, signatures, etc., and then the detection strategies corresponding to these static data may be used to perform risky application detection operations on the target non-preset application; after the target non-preset application is installed on the user terminal, the relevant data may be dynamic data such as file directory structures generated by version updates and accumulation of user usage information, and then the detection strategies corresponding to these dynamic data may be used to perform risky application detection operations on the target non-preset application.

[0030] Step S106: When the detection result indicates that the target non-preset application meets the risk application included in the detection policy, the user is reminded of the risk application through the user terminal.

[0031] The detection result is the result corresponding to the aforementioned detection operation, which usually includes two results: the first is that the target non-preset application meets the risk application included in the detection strategy, that is, the target non-preset application is a risk application; the target non-preset application does not meet the risk application included in the detection strategy, that is, the target non-preset application is not a risk application. For the former result, the user terminal can send reminders such as stop operation, delete application, pay attention to financial account security to the user; for the latter result, dynamic data can continue to be monitored at any time to ensure the user's financial security.

[0032] Figure 2 A framework diagram of a risk reminder system with end-cloud collaboration is provided. Figure 2 As shown, the risk reminder system includes a cloud server and an application terminal. The cloud server sends the detection strategy to the application terminal so that the risk application can be detected through the detection strategy at the user terminal.

[0033] In the embodiments of this specification, the detection strategy for non-preset applications determined by the cloud server is set on the user terminal. When the user performs relevant actions, the detection strategy is used to detect the relevant data, and the user is reminded when the target non-preset application is detected as a risky application. This process proposes a new end-cloud collaborative risk reminder framework for non-preset applications, which transfers the detection strategy from the cloud server to the user terminal. While utilizing the powerful computing power of the cloud server to obtain a detection strategy with a higher credibility, it also utilizes the high real-time performance of the user terminal to achieve a rapid response to risky applications, effectively improving the real-time and confrontational nature of risk reminders, thereby improving the robustness of the risk reminder process.

[0034] Figure 3 A schematic diagram of the application scenario of a risk reminder method is provided, such as Figure 3As shown, the cloud server provides the user terminal with a detection strategy for non-preset applications through the terminal manufacturer or the terminal-cloud collaborative link, and the user terminal uses the risk reminder method in this manual to remind the user of risky applications.

[0035] The detection strategy provided by the cloud server to the user terminal may include the features of various risky applications. By comparing these features with the features extracted from the relevant data, the risk detection operation of the target non-preset application can be implemented. In one implementation, the relevant behavior includes the application download behavior. Step S104 can be executed as the following steps A1-A2: Step A1, when a user executes an application download behavior through a user terminal, extracting a feature of download data corresponding to the application download behavior to obtain a first feature; Step A2: Use the static features of the downloaded data corresponding to the risky application in the detection strategy to perform a detection operation on the first feature.

[0036] The download data is the data required for downloading the application, which may include link data, signature data, QR code data, etc. The static feature is the feature of the download data corresponding to the download risk application, and the first feature is the feature of the download data corresponding to the download target non-preset application. Figure 2 As shown, the cloud server can set up a feature library of static features and dynamic features, and send it to the user terminal together with the detection strategy to perform risk detection operations.

[0037] Specifically, after obtaining the detection strategy, the link data, signature data, QR code data and other downloaded data can be converted into vector data as the first feature. The method for obtaining the first feature is not specifically limited in this specification and can be determined according to actual conditions.

[0038] After determining the first feature, the first feature can be matched with the corresponding static features in the detection strategy to implement the detection operation of the first feature. A successful match indicates that the target non-preset application is consistent with the risk application included in the detection strategy. The method for determining the static feature corresponding to the first feature can be determined according to the data type. For example, when the first feature is a feature corresponding to the link data of the target non-preset application, the static feature corresponding to the first feature is a feature of the link data corresponding to the risk application.

[0039] Whether the first feature matches the static feature can be determined by using a similarity measurement method based on the distance or angle between the first feature and the static feature. When the similarity value is greater than a threshold, it can be determined that the first feature to be compared matches the static feature. The similarity measurement method can use Euclidean distance, cosine similarity, Pearson correlation coefficient, etc. The specific similarity measurement method used is not limited in this specification.

[0040] While collecting information about risky applications to build detection strategies, the cloud server can also collect information about non-risky applications. In one implementation, the detection strategy includes a whitelist for excluding non-risky applications. Step A2 can be executed as the following steps B1-B2: Step B1, performing an advance detection operation on the first feature according to the static features of the downloaded data corresponding to the non-risk applications in the whitelist; Step B2: When the detection result of the advance detection operation indicates that the target non-preset application does not meet the non-risk application, a detection operation is performed on the first feature using the static feature of the downloaded data corresponding to the risky application in the detection strategy.

[0041] Among them, non-risk applications are applications that the cloud server determines are risk-free. The whitelist can be a collection of non-risk applications and legal digital signature certificates collected by the cloud server. The whitelist can include a download link whitelist, a digital certificate whitelist, etc. The whitelist can be set in the detection strategy. Specifically, the cloud server can collect terminal applications and digital signature certificates published on the websites of various certified Internet companies, and build a download link whitelist (i.e., Figure 2 URL whitelist library in the ), build a digital certificate whitelist based on these data signature certificates (i.e. Figure 2 CA whitelist library in ).

[0042] In one example, the cloud server can extract the static features of the download data and digital signature certificates of each non-risk application in the whitelist, and set the feature library composed of the static features together with the whitelist in the detection strategy. After determining the first feature, the static features in the whitelist can be used to perform an early detection operation on the first feature, and the early detection operation is an operation before the detection operation is performed on the first feature.

[0043] The method of the advance detection operation is similar to the aforementioned method of using the static features of risky applications to detect the first feature, and will not be described in detail here. Further, in the case where the detection result corresponding to the advance detection operation indicates that the target non-preset application does not conform to the non-risk application in the whitelist, the detection strategy can continue to be used to perform the detection operation on the first feature; in the case where the advance detection result indicates that the target non-preset application conforms to the non-risk application in the whitelist, the target non-preset application can no longer be tracked and detected.

[0044] In the above process, the first feature is detected in advance through the whitelist, which can save computing resources of the user terminal when the target non-preset application meets the non-risk application in the whitelist.

[0045] In the embodiments of this specification, the detection operation of the target non-preset application in the application download stage is implemented through the first feature of the target non-preset application and the static feature of the risky application, which helps to improve the security of the user terminal when downloading the target non-preset application.

[0046] In one implementation, the related behavior includes application usage behavior. Step S104 may be executed as follows: Steps C1-C2: Step C1, when a user performs an application usage behavior through a user terminal, extracting a feature of usage data corresponding to the application usage behavior to obtain a second feature; Step C2: using the dynamic features of the usage data corresponding to the risky application in the detection strategy, perform a detection operation on the second feature.

[0047] Among them, the usage data is the data generated by the use of the application, and the usage data may include interface keyword data, file directory structure data, recommended product time data, Android installation package data (APK data), etc. The dynamic feature is the feature of the usage data corresponding to the risk application, and the second feature is the feature of the usage data generated by the use of the target non-preset application.

[0048] Specifically, after obtaining the detection strategy, the interface keyword data, file directory structure data, recommended product time data and other usage data can be converted into vector data as the second feature. The method for obtaining the second feature is not specifically limited in this specification and can be determined according to actual conditions.

[0049] After determining the second feature, the second feature can be matched with the corresponding dynamic features in the detection strategy to implement the detection operation of the second feature. A successful match means that the target non-preset application is consistent with the risk application included in the detection strategy. Among them, the method for determining the dynamic feature corresponding to the second feature can be determined according to the data type. For example, when the second feature is the feature corresponding to the interface keyword data of the target non-preset application, the dynamic feature corresponding to the second feature is the feature of the interface keyword data corresponding to the risk application.

[0050] Whether the second feature matches the dynamic feature can be determined by using a similarity measurement method based on the distance or angle between the second feature and the dynamic feature. When the similarity value is greater than a threshold, it can be determined that the second feature being compared matches the dynamic feature.

[0051] like Figure 2As shown, a feature extraction module and a feature analysis module can be set in the user terminal, the former is used to extract the first feature and the second feature, and the latter is used to use the static feature in the detection strategy to perform a detection operation on the first feature and use the dynamic feature in the detection strategy to perform a detection operation on the second feature. In addition, the aforementioned detection model can also be used to directly perform a detection operation on the first feature and the second feature.

[0052] In the embodiments of this specification, the second feature of the target non-preset application and the dynamic feature of the risky application are used to implement the detection operation of the target non-preset application in the application use phase, which helps to improve the security of the user terminal when using the target non-preset application.

[0053] After the user terminal uses the detection strategy to perform risk detection, the user terminal can also collect non-preset applications and send them to the cloud server to update the detection strategy. In one implementation, the risk reminder method also includes: The download data of the target non-preset application is sent to the cloud server, so that the cloud server performs a detection operation for the target non-preset application for risky applications.

[0054] Specifically, in addition to implementing risk detection on target non-preset applications on the user terminal, the target non-preset applications can also be sent to the cloud server to achieve accurate detection of the target non-preset applications, and the existing detection strategy can be updated based on the detection result.

[0055] In order to reduce the amount of computing on the cloud server and improve the efficiency of developing detection strategies, the first feature and / or the second feature of the target non-preset application can also be sent to the cloud server together with the download data of the target non-preset application. Specifically, the relevant data of the collaborative detection application can be sent to the cloud server through the end-cloud collaborative link.

[0056] In one example, a whitelist can be used to filter target non-preset applications, and then target non-preset applications that do not meet the non-risk applications in the whitelist can be sent to the cloud server, so as to reduce the amount of data transmission between the user terminal and the cloud server while improving the update efficiency of the cloud server's detection strategy.

[0057] In an embodiment of the present specification, the user terminal sends the target non-preset application to the cloud server to utilize the powerful computing power of the cloud server to perform further risk detection on the target non-preset application. Furthermore, the detection strategy can be dynamically updated according to the detection results, thereby improving the detection effect of the risk application of the user terminal while improving the risk reminder method's combat capability.

[0058] Figure 4A risk reminder method provided by an embodiment of the present invention is shown. The method can be executed by a cloud server. The risk reminder method includes the following steps: Step S402: Acquire relevant data of non-preset applications collected by various terminal manufacturers from various user terminals; Step S404: performing a detection operation on the relevant data for risky applications, and determining risky applications among non-preset applications; Step S406: Determine a detection strategy for the risk application based on relevant data corresponding to the risk application; Step S408: Send the detection policy to the user terminal, so that the user terminal reminds the user of risky applications when using the detection policy.

[0059] Among them, non-preset applications are applications that have not been downloaded through the preset download channels. As mentioned above, the preset download channels can be downloaded from the software provided by the application market and security software. The method of obtaining non-preset applications can be that the terminal manufacturer uploads the relevant data of non-preset applications collected from the user terminal to the cloud server according to the agreed time frequency (such as the time frequency can be 1 day / time). The terminal manufacturer is the manufacturer of the terminal device that has agreed with the cloud server to provide the relevant data of non-preset applications. It should be understood that each user terminal in step S402 may be different. Compared with the workload required to crawl non-preset applications from the entire network, the workload of obtaining non-preset applications through terminal manufacturers is greatly reduced. At the same time, since the cloud server and the user terminal do not directly interact with data, the user's privacy can be protected.

[0060] Related data is data used or generated when operating a non-preset application. Related data at least includes application download data. In the embodiment of this specification, the related data of a non-preset application may be the download data of the non-preset application, such as download QR code data, download link data, etc. Figure 2 As shown, in addition, the relevant data may also include features of non-preset applications extracted by the user terminal, such as features of static data and features of dynamic data. Among them, static data is data used to download non-preset applications, and dynamic data is data generated by using non-preset applications.

[0061] After obtaining relevant data of multiple non-preset applications, the relevant data can be used to perform risk application detection operations on non-preset applications. Specifically, a risk application detection model can be built on a cloud server, and a trained risk application detection model can be used to detect risk applications from the collected non-preset applications. The risk application detection model can determine whether the non-preset application is a risk application through the static data and dynamic data of the non-preset application. The structure and training process of the risk application detection model are not specifically limited in this specification, and can be determined based on actual conditions.

[0062] Before performing risky application detection operations on non-preset applications, you can first use the whitelist set in the cloud server to exclude non-risky applications. Specifically, the whitelist can be a collection of non-risky applications and legal digital signature certificates collected by the cloud server, that is, the whitelist can include download link whitelists, digital certificate whitelists, etc., and the whitelist can be set in the detection strategy. Specifically, the cloud server can use the link whitelist and the data certificate whitelist in turn to filter non-risky applications. After two layers of filtering, the number of non-preset applications for detection operations will be reduced, which can improve the hit rate of risky applications while improving the efficiency of building detection strategies for cloud servers.

[0063] The cloud server can determine the detection strategy based on the relevant data of the risk application. Specifically, the detection strategy can be determined based on the characteristics of the static data and dynamic data of the risk application. For example, when the signature data (static data) corresponding to the risk application and the non-risk application are different, the detection strategy can be determined based on the characteristics of the signature data of the risk application; when the file directory structure data (dynamic data) of the risk application and the non-risk application are different, the detection strategy can be determined based on the characteristics of the file directory structure data of the risk application.

[0064] Furthermore, the detection strategy can be sent to the terminal manufacturer so that the detection strategy can be issued to the user terminal through the terminal manufacturer. In this way, the user terminal receiving the detection strategy can use the detection strategy to detect risky applications of non-preset applications. In addition, the cloud server can also use the end-cloud collaborative link to issue the detection strategy to the user terminal.

[0065] In the embodiments of this specification, the cloud server formulates a detection strategy based on the relevant data of non-preset applications provided by the user terminal, and sends the detection strategy to the user terminal. This process proposes a new end-cloud collaborative risk reminder framework for non-preset applications, which transfers the detection strategy from the cloud server to the user terminal. While utilizing the powerful computing power of the cloud server to obtain a more reliable detection strategy, it also utilizes the high real-time performance of the user terminal to achieve a rapid response to risky applications, effectively improving the real-time and confrontational nature of risk reminders, thereby improving the robustness of the risk reminder process.

[0066] In one implementation, the relevant data includes download data and usage data. Step S406 may be executed as follows: Steps D1-D3: Step D1, extracting static features of the risky application from the download data corresponding to the risky application, where the download data is data required to download the application; Step D2, using the download data corresponding to the risk application to download the risk application, and extracting the dynamic features of the risk application from the usage data corresponding to the risk application, where the usage data is data generated by using the application; Step D3: determining a detection strategy for risky applications according to static characteristics of risky applications and / or dynamic characteristics of risky applications.

[0067] Generally, in order to reduce the amount of data transmitted by the terminal manufacturer to the cloud server, the terminal manufacturer can only transmit the download data of non-preset applications to the cloud server for analysis. For example, the terminal manufacturer can only transmit the download link data of non-preset applications to the cloud server. After obtaining the download data such as the download link data of the non-preset application, the cloud server can also obtain the download data including signature data based on the download link. Furthermore, the cloud server can extract the static features of the risky application from the download data corresponding to the risky application (such as download link data, signature data, etc.).

[0068] As mentioned above, the data of risky applications may include download data when the risky applications are downloaded and usage data when the risky applications are used. Therefore, dynamic features may also be extracted from the usage data corresponding to the risky applications. Specifically, the cloud server may download non-preset applications using download link data, and obtain dynamic data by using the non-preset applications, and then extract dynamic features of risky applications from dynamic data (such as file directory structure, etc.).

[0069] Furthermore, the detection strategy can be determined based on the static characteristics and / or dynamic characteristics of the risky application. Specifically, the detection strategy when the user terminal downloads a non-preset application can be determined based on the static characteristics of the risky application; the detection strategy when the user terminal uses a target non-preset application can be determined based on the dynamic characteristics of the risky application.

[0070] In the embodiments of this specification, the static features of risky applications are extracted from the download data corresponding to the risky applications, and the dynamic features of risky applications are extracted from the usage data corresponding to the risky applications, and then the detection strategy is determined according to the dynamic features and / or static features. This process determines the two-stage detection strategy of downloading and using non-risky applications, and can provide users with all-round protection when the user terminal performs related operations of non-risky applications.

[0071] In various online fraud scenarios, illegal online industries usually use the same development framework or similar signatures to develop risky applications to save costs and improve development efficiency. In one implementation, step D1 can be executed as the following steps F1-F2: Step F1, clustering the risky applications based on at least one preset type of download data to obtain at least one first cluster; Step F2, extracting static features of risky applications from the downloaded data of risky applications corresponding to each first cluster; Step D1 can be executed as the following steps F3-F4: Step F3, clustering the risk applications based on at least one preset type of usage data to obtain at least one second cluster; Step F4: extracting static features of risky applications from the downloaded data of risky applications corresponding to each second cluster.

[0072] Among them, download data and usage data can be classified based on different data types. Specifically, download data can be divided into signature data, download link data and other types, and usage data can be divided into keyword data, framework data and other types.

[0073] In one example, a clustering operation can be performed on risky applications based on at least one preset type of download data, and the first cluster is the cluster obtained by taking the clustering operation. Further, static features of risky applications can be extracted from the download data corresponding to each first cluster. Specifically, static features of risky applications can be extracted from download data of preset types in the first cluster and / or download data other than preset types.

[0074] In the above steps, since the risky applications in the same first cluster are relatively similar, compared with directly extracting static features from the download data of risky applications, the static features extracted from the download data of multiple risky applications in the first cluster are more representative, and thus the detection strategy formulated using the static features can have better detection capabilities.

[0075] Similarly, a clustering operation can be performed on risky applications based on at least one preset type of usage data, and the second cluster is the cluster obtained by taking the clustering operation. Further, the dynamic features of risky applications can be extracted from the downloaded data corresponding to each second cluster. Specifically, the dynamic features of risky applications can be extracted from the usage data of the preset types in the second cluster and / or the usage data other than the preset types.

[0076] In the above steps, since the risk applications in the same second cluster are relatively similar, compared with directly extracting dynamic features from the usage data of risk applications, the dynamic features extracted from the usage data of multiple risk applications in the second cluster are more representative, and thus the detection strategy formulated using the dynamic features has better detection capabilities.

[0077] like Figure 2As shown in FIG, after receiving high-risk APK download traffic (i.e., obtaining non-preset applications collected by terminal manufacturers from user terminals at a preset frequency), the cloud server obtains static features and dynamic features and performs analysis, and can build a feature library based on the static features and dynamic features. Figure 2 In the feature library, the family feature is the APK feature of the risky application, the package feature is the feature of the folder after the risky application is decompressed, the framework feature is the feature of the development framework of the risky application, and the signature feature is the feature of the signature of the risky application. Among them, these four features can be features obtained using clustering operations. It should be noted that the execution subject of the risk reminder method provided in the embodiments of this specification may be a risk reminder device, or a control module in the risk reminder device for executing the risk reminder method. In the embodiments of this specification, the risk reminder method executed by the risk reminder device is taken as an example to illustrate the risk reminder device provided in the embodiments of this specification.

[0078] Figure 5 Schematic diagram of the structure of the risk reminder device according to an embodiment of the present invention. Figure 5 As shown, the risk reminder device 500 includes: A policy acquisition module 510 is used to acquire a detection policy for a non-preset application downloaded from a cloud server, where the non-preset application is an application that is not downloaded through a preset download channel; The risk detection module 520 is used to perform a detection operation on the relevant data of the target non-preset application according to the detection strategy when the user performs a related behavior on the target non-preset application through the user terminal; The risk reminder module 530 is used to remind the user of the risk application through the user terminal when the detection result indicates that the target non-preset application meets the risk application included in the detection policy.

[0079] In one embodiment, the related behavior includes application downloading behavior, and the risk detection module 520 includes: A first extraction unit is used to extract a feature of download data corresponding to the application download behavior when the user executes the application download behavior through the user terminal, and obtain a first feature, where the download data is data required for downloading the application; The first detection unit is used to perform a detection operation on the first feature by using the static feature of the downloaded data corresponding to the risky application in the detection strategy.

[0080] In one embodiment, the relevant behavior includes application usage behavior, and the risk detection module 520 includes: A second extraction unit is used to extract the characteristics of the usage data corresponding to the application usage behavior when the user performs the application usage behavior through the user terminal to obtain the second characteristics, where the usage data is the data generated by the use of the application; The second detection unit is used to use the dynamic feature of the usage data corresponding to the risk application in the detection strategy to perform a detection operation on the second feature.

[0081] In one embodiment, the detection strategy includes a whitelist for excluding non-risk applications, and a first detection unit for: According to the static characteristics of the downloaded data corresponding to the non-risk applications in the whitelist, an advance detection operation is performed on the first characteristic; When the detection result of the advance detection operation indicates that the target non-preset application does not qualify as a non-risk application, a detection operation is performed on the first feature using static features of the downloaded data corresponding to the risky application in the detection strategy.

[0082] In one embodiment, the risk reminder device 500 further includes: The upload module is used to send the download data of the target non-preset application to the cloud server, so that the cloud server performs a detection operation for the target non-preset application for risky applications.

[0083] It should be noted that the embodiments of the risk reminder device in this specification and the embodiments of the risk reminder method in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the corresponding risk reminder method mentioned above, and the repeated parts will not be repeated.

[0084] Each module in the above risk warning device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the terminal device or the processor on the server in the form of hardware, or can be stored in the memory in the terminal device or the memory on the server in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0085] Figure 6 Schematic diagram of the structure of the risk reminder device according to an embodiment of the present invention. Figure 6 As shown, the risk reminder device 600 includes: The application acquisition module 610 is used to acquire relevant data of non-preset applications collected by various terminal manufacturers from various user terminals. The non-preset applications are applications that are not downloaded through a preset download channel. The relevant data at least includes download data of the applications. The risk application module 620 is used to perform a detection operation on the relevant data for risk applications, and determine the risk applications in non-preset applications; A strategy determination module 630 is used to determine a detection strategy for risky applications based on relevant data corresponding to the risky applications; The policy delivery module 640 is used to send the detection policy to the user terminal so that the user terminal can remind the user of risky applications when using the detection policy.

[0086] In one embodiment, the relevant data includes download data and usage data, and the policy determination module 630 includes: A static unit, used to extract static features of the risky application from the download data corresponding to the risky application, where the download data is data required to download the application; A dynamic unit, used to download the risk application using download data corresponding to the risk application, and extract dynamic features of the risk application from usage data corresponding to the risk application, where the usage data is data generated by using the application; The strategy unit is used to determine a detection strategy for the risky application according to the static characteristics of the risky application and / or the dynamic characteristics of the risky application.

[0087] In one embodiment, the static unit is used to: Based on at least one preset type of download data, clustering the risky applications to obtain at least one first cluster; Extracting static features of risky applications from the download data of risky applications corresponding to each first cluster; Extract the dynamic features of risky applications from the usage data corresponding to the risky applications, including: Based on at least one preset type of usage data, clustering the risky applications to obtain at least one second cluster; Extract static features of the risky applications from the downloaded data of the risky applications corresponding to each second cluster.

[0088] It should be noted that the embodiments of the risk reminder device in this specification and the embodiments of the risk reminder method in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the corresponding risk reminder method mentioned above, and the repeated parts will not be repeated.

[0089] Each module in the above risk warning device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the terminal device or the processor on the server in the form of hardware, or can be stored in the memory in the terminal device or the memory on the server in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0090] Furthermore, corresponding to the risk reminder method described above, based on the same technical concept, one or more embodiments of this specification also provide an electronic device, which is used to execute the risk reminder method described above. Figure 7 A schematic diagram of the structure of an electronic device provided for one or more embodiments of this specification.

[0091] Based on the same idea, one or more embodiments of this specification also provide an electronic device, such as Figure 7 As shown. The electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors 701 and memory 702, and the memory 702 may store one or more storage applications or data. Among them, the memory 702 may be a temporary storage or a permanent storage. The application stored in the memory 702 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the electronic device. Furthermore, the processor 701 can be configured to communicate with the memory 702 to execute a series of computer executable instructions in the memory 702 on the electronic device. The electronic device may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input and output interfaces 705, and one or more keyboards 706.

[0092] In a specific embodiment, the electronic device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions for the electronic device, and the one or more programs configured to be executed by one or more processors include the following computer executable instructions: Obtaining a detection policy for non-preset applications downloaded from a cloud server, where the non-preset applications are applications that are not downloaded through a preset download channel; When a user performs a related behavior on a target non-preset application through a user terminal, a detection operation on risky applications is performed on the related data of the target non-preset application according to the detection strategy; When the detection result indicates that the target non-preset application meets the risk application included in the detection policy, the user is reminded of the risk application through the user terminal.

[0093] It should be noted that the embodiments of the electronic device in this specification and the embodiments of the risk reminder method in this specification are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the corresponding risk reminder method mentioned above, and the repeated parts will not be repeated.

[0094] In a specific embodiment, the electronic device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions for the electronic device, and the one or more programs configured to be executed by one or more processors include the following computer executable instructions: Acquire relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, wherein the non-preset applications are applications that are not downloaded through a preset download channel, and the relevant data at least includes download data of the applications; Perform detection operations on relevant data for risky applications and identify risky applications in non-preset applications; Determine the detection strategy for risk applications based on the relevant data corresponding to the risk applications; The detection policy is sent to the user terminal so that the user terminal can remind the user of risky applications by using the detection policy.

[0095] It should be noted that the embodiments of the electronic device in this specification and the embodiments of the risk reminder method in this specification are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the corresponding risk reminder method mentioned above, and the repeated parts will not be repeated.

[0096] Furthermore, corresponding to the risk reminder method described above, based on the same technical concept, one or more embodiments of this specification further provide a storage medium for storing computer executable instructions. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instructions stored in the storage medium are executed by the processor, the following process can be implemented: Obtaining a detection policy for non-preset applications downloaded from a cloud server, where the non-preset applications are applications that are not downloaded through a preset download channel; When a user performs a related behavior on a target non-preset application through a user terminal, a detection operation on risky applications is performed on the related data of the target non-preset application according to the detection strategy; When the detection result indicates that the target non-preset application meets the risk application included in the detection policy, the user is reminded of the risk application through the user terminal.

[0097] It should be noted that the embodiment of the storage medium in this specification and the method of risk reminder in this specification are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the corresponding risk reminder method mentioned above, and the repeated parts will not be repeated.

[0098] Furthermore, corresponding to the risk reminder method described above, based on the same technical concept, one or more embodiments of this specification further provide a storage medium for storing computer executable instructions. In a specific embodiment, the storage medium may be a USB flash drive, an optical disk, a hard disk, etc. When the computer executable instructions stored in the storage medium are executed by the processor, the following process can be implemented: Acquire relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, wherein the non-preset applications are applications that are not downloaded through a preset download channel, and the relevant data at least includes download data of the applications; Perform detection operations on relevant data for risky applications and identify risky applications in non-preset applications; Determine the detection strategy for risk applications based on the relevant data corresponding to the risk applications; The detection policy is sent to the user terminal so that the user terminal can remind the user of risky applications by using the detection policy.

[0099] It should be noted that the embodiment of the storage medium in this specification and the method of risk reminder in this specification are based on the same inventive concept, so the specific implementation of this embodiment can refer to the implementation of the corresponding risk reminder method mentioned above, and the repeated parts will not be repeated.

[0100] Furthermore, corresponding to the risk reminder method described above, based on the same technical concept, one or more embodiments of this specification also provide a computer program product, which includes a computer program. When the computer program is executed by a processor, the following process can be implemented: Obtaining a detection policy for non-preset applications downloaded from a cloud server, where the non-preset applications are applications that are not downloaded through a preset download channel; When a user performs a related behavior on a target non-preset application through a user terminal, a detection operation on risky applications is performed on the related data of the target non-preset application according to the detection strategy; When the detection result indicates that the target non-preset application meets the risk application included in the detection policy, the user is reminded of the risk application through the user terminal.

[0101] It should be noted that the embodiment of the computer program product in this specification and the embodiment of the risk reminder method in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the corresponding risk reminder method mentioned above, and the repeated parts will not be repeated.

[0102] Furthermore, corresponding to the risk reminder method described above, based on the same technical concept, one or more embodiments of this specification also provide a computer program product, which includes a computer program. When the computer program is executed by a processor, the following process can be implemented: Acquire relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, wherein the non-preset applications are applications that are not downloaded through a preset download channel, and the relevant data at least includes download data of the applications; Perform detection operations on relevant data for risky applications and identify risky applications in non-preset applications; Determine the detection strategy for risk applications based on the relevant data corresponding to the risk applications; The detection policy is sent to the user terminal so that the user terminal can remind the user of risky applications by using the detection policy.

[0103] It should be noted that the embodiment of the computer program product in this specification and the embodiment of the risk reminder method in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the corresponding risk reminder method mentioned above, and the repeated parts will not be repeated.

[0104] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0105] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0106] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0107] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0108] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing the embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0109] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0110] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0111] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0112] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0113] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0114] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0115] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0116] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0117] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0118] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0119] The above description is only an embodiment of this document and is not intended to limit this document. For those skilled in the art, this document may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this document should be included in the scope of the claims of this document.

Claims

1. A risk reminder method, used in a user terminal, comprising: Obtaining a detection strategy for a non-preset application downloaded from a cloud server, wherein the non-preset application is an application that is not downloaded through a preset download channel; When a user performs a related behavior for a target non-preset application through the user terminal, a detection operation for risky applications is performed on the related data of the target non-preset application according to the detection strategy; When the detection result indicates that the target non-preset application meets the risk application included in the detection policy, the user is reminded of the risk application through the user terminal.

2. The method according to claim 1, wherein the related behavior includes an application download behavior, and when the user executes the related behavior for the target non-preset application through the user terminal, performing a detection operation for the risk application on the related data of the target non-preset application according to the detection strategy, comprising: When the user executes the application downloading behavior through the user terminal, extracting a feature of the download data corresponding to the application downloading behavior to obtain a first feature, wherein the download data is data required for downloading the application; The first feature is detected using the static feature of the downloaded data corresponding to the risky application in the detection strategy.

3. The method according to claim 2, wherein the related behavior includes application usage behavior, and when the user performs the related behavior for the target non-preset application through the user terminal, performing a detection operation for the risk application on the related data of the target non-preset application according to the detection strategy, comprising: When the user performs the application usage behavior through the user terminal, extracting a feature of usage data corresponding to the application usage behavior to obtain a second feature, wherein the usage data is data generated by using the application; The second feature is detected using the dynamic feature of the usage data corresponding to the risky application in the detection strategy.

4. The method according to claim 2, wherein the detection strategy includes a whitelist for excluding non-risk applications, and the static feature of the downloaded data corresponding to the risky application in the detection strategy is used to perform a detection operation on the first feature, comprising: According to the static characteristics of the downloaded data corresponding to the non-risk applications in the whitelist, the first characteristics are detected in advance; When the detection result of the advance detection operation indicates that the target non-preset application does not qualify as a non-risk application, a detection operation is performed on the first feature using a static feature of the downloaded data corresponding to the risky application in the detection strategy.

5. The method according to claim 2, further comprising: The download data of the target non-preset application is sent to the cloud server, so that the cloud server performs a detection operation for risky applications on the target non-preset application.

6. A risk reminder method, used in a cloud server, comprising: Acquire relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, wherein the non-preset applications are applications that are not downloaded through a preset download channel, and the relevant data at least includes download data of the applications; Performing a detection operation on the relevant data for risky applications to determine risky applications among the non-preset applications; Determining a detection strategy for the risk application according to relevant data corresponding to the risk application; The detection strategy is sent to the user terminal, so that the user terminal reminds the user of risky applications when using the detection strategy.

7. The method according to claim 6, wherein the relevant data includes download data and usage data, and the step of determining the detection strategy for the risky application based on the relevant data corresponding to the risky application includes: Extracting static features of the risky application from the download data corresponding to the risky application, wherein the download data is data required for downloading the application; Downloading the risk application using download data corresponding to the risk application, and extracting dynamic features of the risk application from usage data corresponding to the risk application, wherein the usage data is data generated by using the application; A detection strategy for the risky application is determined according to the static characteristics of the risky application and / or the dynamic characteristics of the risky application.

8. The method according to claim 7, wherein extracting static features of the risky application from the downloaded data corresponding to the risky application comprises: Based on at least one preset type of download data, clustering the risky applications to obtain at least one first cluster; Extracting static features of the risky applications from the downloaded data of the risky applications corresponding to each of the first clusters; The extracting the dynamic features of the risk application from the usage data corresponding to the risk application includes: Based on at least one preset type of usage data, clustering the risky applications to obtain at least one second cluster; Extracting static features of the risky applications from the downloaded data of the risky applications corresponding to each of the second clusters.

9. A risk reminder device, comprising: A policy acquisition module, used to acquire a detection policy for a non-preset application downloaded from a cloud server, wherein the non-preset application is an application that is not downloaded through a preset download channel; a risk detection module, configured to, when a user performs a related behavior for a target non-preset application through the user terminal, perform a detection operation for risky applications on the related data of the target non-preset application according to the detection strategy; The risk reminder module is used to remind the user of the risk application through the user terminal when the detection result indicates that the target non-preset application meets the risk application included in the detection strategy.

10. A risk reminder device, comprising: An application acquisition module, used to acquire relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, wherein the non-preset applications are applications that are not downloaded through a preset download channel, and the relevant data at least includes download data of the applications; A risk application module, used to perform a detection operation on the relevant data for risk applications, and determine risk applications in the non-preset applications; A strategy determination module, used to determine the detection strategy of the risk application according to the relevant data corresponding to the risk application; The policy delivery module is used to send the detection policy to the user terminal, so that the user terminal reminds the user of risky applications when using the detection policy.

11. An electronic device, comprising: processor, and a memory arranged to store computer executable instructions which, when executed, cause the processor to: Obtaining a detection strategy for a non-preset application downloaded from a cloud server, wherein the non-preset application is an application that is not downloaded through a preset download channel; When a user performs a related behavior for a target non-preset application through the user terminal, a detection operation for risky applications is performed on the related data of the target non-preset application according to the detection strategy; When the detection result indicates that the target non-preset application meets the risk application included in the detection policy, the user is reminded of the risk application through the user terminal.

12. An electronic device comprising: processor, and a memory arranged to store computer executable instructions which, when executed, cause the processor to: Acquire relevant data of non-preset applications collected by various terminal manufacturers from various user terminals, wherein the non-preset applications are applications that are not downloaded through a preset download channel, and the relevant data at least includes download data of the applications; Performing a detection operation on the relevant data for risky applications to determine risky applications among the non-preset applications; Determining a detection strategy for the risk application according to relevant data corresponding to the risk application; The detection strategy is sent to the user terminal, so that the user terminal reminds the user of risky applications when using the detection strategy.

Images