Program analysis method and device and electronic equipment

Abstract

The invention provides a program analysis method and device and electronic equipment, and relates to the technical field of computers, in particular to the application fields of application program development, mobile terminal product security, information technology, network security detection, network security defense, financial risk control and the like. According to the specific implementation scheme, multiple to-be-analyzed features of a target program are obtained; performing risk analysis on the plurality of to-be-analyzed features through a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the plurality of to-be-analyzed features; performing risk analysis on the unknown behavior through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behavior; wherein the unknown behavior is determined from the plurality of to-be-analyzed features based on the first risk analysis result.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to application fields such as application development, mobile product security, information technology, network security detection, network security defense, and financial risk control, and specifically to a program analysis method, device, and electronic device. Background Art

[0002] With the rapid development of information technology, the challenges facing network security are becoming increasingly severe. Specifically, the activities of the black industry chain tend to be more covert and complex, and the risky codes / risky behaviors hidden in applications as their core means have further aggravated the difficulty of traditional security protection measures. Summary of the invention

[0003] The present disclosure provides a program analysis method, device and electronic device.

[0004] According to a first aspect of the present disclosure, a program analysis method is provided, comprising:

[0005] Obtain multiple features to be analyzed of the target program;

[0006] Perform risk analysis on the multiple features to be analyzed by using a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed;

[0007] Through the behavior correlation analysis strategy, risk analysis is performed on the unknown behavior to obtain a second risk analysis result for the unknown behavior; wherein the unknown behavior is determined from multiple features to be analyzed based on the first risk analysis result.

[0008] According to a second aspect of the present disclosure, a program analysis method is provided, comprising:

[0009] Based on the target program, multiple features to be analyzed are obtained;

[0010] Send multiple features to be analyzed to a service device; wherein the service device is used to perform risk analysis on the multiple features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed, and is used to perform risk analysis on unknown behaviors through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behaviors; the unknown behaviors are determined from the multiple features to be analyzed based on the first risk analysis result.

[0011] According to a third aspect of the present disclosure, there is provided a program analysis device, comprising:

[0012] A first feature acquisition unit, used to acquire a plurality of features to be analyzed of a target program;

[0013] A first risk analysis unit is used to perform risk analysis on multiple features to be analyzed by using a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed;

[0014] The second risk analysis unit is used to perform risk analysis on the unknown behavior through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behavior; wherein the unknown behavior is determined from a plurality of features to be analyzed based on the first risk analysis result.

[0015] According to a fourth aspect of the present disclosure, there is provided a program analysis device, comprising:

[0016] A second feature acquisition unit is used to obtain a plurality of features to be analyzed based on the target program;

[0017] A feature sending unit is used to send multiple features to be analyzed to a service device; wherein the service device is used to perform risk analysis on the multiple features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed, and is used to perform risk analysis on unknown behaviors through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behaviors; the unknown behaviors are determined from the multiple features to be analyzed based on the first risk analysis result.

[0018] According to a fifth aspect of the present disclosure, there is provided an electronic device, including:

[0019] at least one processor;

[0020] a memory communicatively coupled to the at least one processor;

[0021] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method provided in the first aspect of the present disclosure.

[0022] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method provided according to the first aspect of the present disclosure.

[0023] According to a seventh aspect of the present disclosure, a computer program product is provided, comprising a computer program, which implements the method provided according to the first aspect of the present disclosure when executed by a processor.

[0024] The use of the present disclosure can improve the reliability of risk analysis results related to the target program.

[0025] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0027] Figure 1 A flowchart of a program analysis method applied to a first electronic device provided in an embodiment of the present disclosure;

[0028] Figure 2 A flowchart of a program analysis method applied to a second electronic device provided in an embodiment of the present disclosure;

[0029] Figure 3 A complete flow chart of a program analysis method provided by an embodiment of the present disclosure;

[0030] Figure 4 An auxiliary illustration of the integrity process of a program analysis method provided by an embodiment of the present disclosure;

[0031] Figure 5 A schematic diagram of a scenario of a program analysis method provided by an embodiment of the present disclosure;

[0032] Figure 6 A schematic structural block diagram of a program analysis device applied to a first electronic device provided in an embodiment of the present disclosure;

[0033] Figure 7 A schematic structural block diagram of a program analysis device applied to a second electronic device provided in an embodiment of the present disclosure;

[0034] Figure 8 A schematic structural block diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present disclosure. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0036] At present, the commonly used program analysis method is static analysis. Specifically, the application can be decompiled to obtain the code decompilation result, and the code decompilation result can be cut to obtain multiple code fragments to be analyzed, and then each of the multiple code fragments to be analyzed is used as a target code fragment to compare the characteristics of the target code fragment with multiple known risk code fragments to obtain the risk analysis result for the application. However, the inventors have found that when the application is processed using complex code obfuscation technology and self-modifying code technology, the static analysis method will affect its effectiveness due to its single analysis dimension. Moreover, the static analysis method cannot capture the dynamic behavior of the application, which will eventually seriously affect the reliability of the risk analysis results.

[0037] In view of the above problems, the embodiments of the present disclosure provide a program analysis method, which can be applied to a first electronic device. The first electronic device can be a terminal device, for example, a conventional computer (desktop computer, laptop computer, etc.), a car computer, a tablet computer, a smart phone, a personal digital assistant or other similar computing devices. Figure 1 The flowchart diagram shown in the figure illustrates a program analysis method provided by the embodiment of the present disclosure. It should be noted that although the logical order is shown in the flowchart diagram, in some cases, the steps shown or described in the flowchart can also be executed in other orders.

[0038] Step S101, based on the target program, a plurality of features to be analyzed are obtained.

[0039] The target program may be any application package to be analyzed, for example, an Android application package (APK); the multiple features to be analyzed may include multiple code snippets to be analyzed and / or multiple behaviors to be analyzed based on the target program. Here, the multiple behaviors to be analyzed may be dynamic behaviors captured when the target program is running, and may specifically include network request behaviors, file operation behaviors, process management behaviors, system call behaviors, etc., which will not be elaborated in the embodiments of the present disclosure.

[0040] Step S102: sending a plurality of features to be analyzed to a service device.

[0041] The service device may be used to perform risk analysis on multiple features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed, and to perform risk analysis on unknown behaviors through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behaviors. Here, the unknown behaviors are determined from the multiple features to be analyzed based on the first risk analysis result.

[0042] In the disclosed embodiment, the static feature comparison strategy can be used to instruct the analysis of multiple code snippets to be analyzed included in the multiple features to be analyzed, and obtain the overall analysis results for the multiple code snippets to be analyzed, as the first type of analysis results for the multiple features to be analyzed; the dynamic behavior detection strategy can be used to instruct the analysis of multiple behaviors to be analyzed included in the multiple features to be analyzed, and obtain the overall analysis results for the multiple behaviors to be analyzed, as the second type of analysis results for the multiple features to be analyzed. After obtaining the first type of analysis results and the second type of analysis results, a first risk analysis result for the multiple features to be analyzed can be obtained based on the first type of analysis results and the second type of analysis results. In addition, in the disclosed embodiment, the behavior correlation analysis strategy can be used to instruct the correlation comparison of unknown behaviors with multiple first known risk behaviors, and obtain a second risk analysis result for the unknown behavior.

[0043] By using the program analysis method provided in the embodiment of the present disclosure, a plurality of features to be analyzed can be obtained based on the target program, and the plurality of features to be analyzed can be sent to a service device, and the service device can be used to obtain the plurality of features to be analyzed of the target program, and perform risk analysis on the plurality of features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy, and obtain a first risk analysis result for the plurality of features to be analyzed, and then perform risk analysis on unknown behaviors (the unknown behaviors are determined from the plurality of features to be analyzed based on the first risk analysis result) through a behavior correlation analysis strategy, and obtain a second risk analysis result for the unknown behaviors. That is to say, in the embodiment of the present disclosure, a static feature comparison strategy and / or a dynamic behavior detection strategy, as well as a correlation analysis strategy, are combined to obtain risk analysis results (including a first risk analysis result and a second risk analysis result) related to the target program. Compared with the method of obtaining the risk analysis results of the application program by only using the static analysis method in the prior art, this method can not only analyze the target program from multiple dimensions, but also capture the dynamic behavior of the target program, thereby improving the reliability of the risk analysis results related to the target program.

[0044] In some optional implementations, step S101, i.e., “obtaining a plurality of features to be analyzed based on the target program” may include:

[0045] Decompile the target program to obtain the code decompilation result;

[0046] Cut the code decompilation results to obtain multiple code fragments to be analyzed;

[0047] Based on the multiple code snippets to be analyzed, multiple features to be analyzed are obtained.

[0048] The decompilation result may include multiple code function blocks, where each of the multiple code function blocks can implement a specific code function (eg, data processing, network request, etc.).

[0049] In addition, it can be understood that in the embodiment of the present disclosure, multiple code fragments to be analyzed can correspond one to one with multiple code function blocks. Based on this, in one example, the target program can be decompiled by a preset reverse engineering tool to obtain a code decompilation result, and the code decompilation result can be analyzed to obtain multiple code function blocks, and then based on the position of each code function block in the code decompilation result, the code decompilation result can be cleaned and cut to obtain multiple code fragments to be analyzed corresponding one to one with multiple code function blocks, and finally, multiple features to be analyzed including multiple code fragments to be analyzed are generated.

[0050] Through the above method, in the embodiment of the present disclosure, the target program can be decompiled to obtain the code decompilation result, and the code decompilation result can be cut to obtain multiple code fragments to be analyzed, and then based on the multiple code fragments to be analyzed, multiple features to be analyzed are obtained. That is to say, in the embodiment of the present disclosure, the multiple features to be analyzed can include multiple code fragments to be analyzed. In this way, each of the multiple code fragments to be analyzed can be used as an analysis object in the subsequent analysis to reduce the analysis granularity of the target program, thereby further improving the reliability of the risk analysis results related to the target program.

[0051] In some optional implementations, step S101, i.e., “obtaining a plurality of features to be analyzed based on the target program” may include:

[0052] Perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed;

[0053] Based on the multiple behaviors to be analyzed, multiple features to be analyzed are obtained.

[0054] In one example, dynamic behavior detection can be performed on the target program in a sandbox environment or a virtual machine to obtain multiple behaviors to be analyzed. Specifically, a proxy packet capture tool and / or a hook tool (for example, Frida, Xposed, etc.) can be used to perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed. In another example, detection confrontation technology can be used to perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed. In combination with these two examples, in the embodiments of the present disclosure, a proxy packet capture tool and / or a hook tool that uses detection confrontation technology can be used to perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed.

[0055] Based on the above content, it can be understood that in the embodiments of the present disclosure, the detection and confrontation technology may include a proxy packet capture detection and confrontation technology and / or a hook tool detection and confrontation technology.

[0056] In one example, the proxy packet capture detection countermeasure technology can be used to indicate: integrating support for network traffic management tools (e.g., Iptables) in the target program's operating system (e.g., when the target program is APK, the target program's operating system can be an Android system), so as to perform proxy settings at the operating system level, and call the network traffic management tool through a programming interface, and then add corresponding forwarding rules to implement traffic forwarding, thereby performing dynamic behavior detection on the target program and obtaining multiple behaviors to be analyzed. In this way, compared with the traditional proxy packet capture detection technology, the proxy setting method from the application layer is converted to the proxy setting at the operating system level, so that the dynamic behavior detection of the target program becomes more secretive and will not be detected by the target program (generally speaking, when the target program realizes that it is in a detected state, it may choose not to trigger risky behavior temporarily to avoid detection), thereby increasing the difficulty of detecting and avoiding risky behaviors, that is, increasing the possibility of exposing risky behaviors.

[0057] In one example, the hook tool detection countermeasure technology can be used to indicate: when the target program is subjected to dynamic behavior detection through the hook tool, the detection traces are quickly erased. For example, code obfuscation technology, memory protection mechanism, timely self-cleaning mechanism, etc. can be used to quickly erase the detection traces. In a specific example, a hook tool can be used on the key execution path of the target program to intercept its key dynamic behavior to achieve the purpose of dynamic behavior detection of the target program. Among them, the key dynamic behavior can include network request behavior, file operation behavior, process management behavior, system call behavior, etc. In this way, the dynamic behavior detection of the target program can also be made more secretive without the target program noticing, thereby increasing the difficulty of detecting and avoiding risky behaviors, that is, increasing the possibility of exposure of risky behaviors.

[0058] In addition, it should be noted that in the embodiments of the present disclosure, in order to prevent the target program from evading detection of the system environment of the running system (for example, when the first electronic device is in a system debugging state, the target program may detect through the application programming interface (API) of its running system that the first electronic device is in a system debugging state, and choose not to trigger risky behavior temporarily to avoid detection), the running environment of the running system can also be customized to disguise the system debugging state. For example, the system debugging state can be disguised as a debugging state that is not started, so that the target program mistakenly believes that the system environment of the running system is in a safe state, thereby triggering risky behavior to increase the possibility of exposure of risky behavior.

[0059] Further, in the embodiment of the present disclosure, after obtaining a plurality of behaviors to be analyzed, a plurality of features to be analyzed may be obtained based on the plurality of behaviors to be analyzed. For example, a plurality of features to be analyzed including the plurality of behaviors to be analyzed may be generated.

[0060] Through the above method, in the embodiment of the present disclosure, dynamic behavior detection can be performed on the target program to obtain multiple behaviors to be analyzed, and multiple features to be analyzed can be obtained based on the multiple behaviors to be analyzed. That is to say, in the embodiment of the present disclosure, the multiple features to be analyzed can include multiple behaviors to be analyzed. In this way, each of the multiple behaviors to be analyzed can be used as an analysis object in the future to reduce the analysis granularity of the target program, thereby further improving the reliability of the risk analysis results related to the target program.

[0061] The present disclosure provides a program analysis method, which can be applied to a second electronic device. The second electronic device can be a service device, such as a server or other similar computing device. Figure 2 The flowchart diagram shown in the figure illustrates a program analysis method provided by the embodiment of the present disclosure. It should be noted that although the logical order is shown in the flowchart diagram, in some cases, the steps shown or described in the flowchart can also be executed in other orders.

[0062] Step S201, obtaining a plurality of features to be analyzed of a target program.

[0063] The target program may be any application package to be analyzed, such as APK; the multiple features to be analyzed may include multiple code snippets to be analyzed and / or multiple behaviors to be analyzed based on the target program. Here, the multiple behaviors to be analyzed may be dynamic behaviors captured when the target program is running, which may include network request behaviors, file operation behaviors, process management behaviors, system call behaviors, etc., which will not be elaborated in the embodiments of the present disclosure.

[0064] In addition, in the embodiment of the present disclosure, obtaining the multiple features to be analyzed of the target program may be receiving the multiple features to be analyzed sent by the first electronic device.

[0065] Step S202: performing risk analysis on the multiple features to be analyzed by using a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed.

[0066] Among them, the static feature comparison strategy can be used to instruct the analysis of multiple code snippets to be analyzed included in the multiple features to be analyzed, and obtain the overall analysis results for the multiple code snippets to be analyzed as the first type of analysis results for the multiple features to be analyzed; the dynamic behavior detection strategy can be used to instruct the analysis of multiple behaviors to be analyzed included in the multiple features to be analyzed, and obtain the overall analysis results for the multiple behaviors to be analyzed as the second type of analysis results for the multiple features to be analyzed. After obtaining the first type of analysis results and the second type of analysis results, the first risk analysis results for the multiple features to be analyzed can be obtained based on the first type of analysis results and the second type of analysis results.

[0067] Step S203: Perform risk analysis on the unknown behavior through the behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behavior.

[0068] Among them, the behavior correlation analysis strategy can be used to instruct to compare the correlation between the unknown behavior and multiple first known risk behaviors to obtain a second risk analysis result for the unknown behavior; the unknown behavior is determined from multiple features to be analyzed based on the first risk analysis result.

[0069] In addition, in the embodiments of the present disclosure, when the first risk analysis result is used to characterize which of the multiple code fragments to be analyzed included in the multiple features to be analyzed are risky code fragments and which are non-risky code fragments, and is used to characterize which of the multiple behaviors to be analyzed included in the multiple features to be analyzed are risky behaviors and which are non-risky behaviors, the unknown behavior can be each of the multiple behaviors to be analyzed that is characterized as a non-risk behavior by the first risk analysis result.

[0070] Exemplarily, the multiple behaviors to be analyzed include behavior A1 to be analyzed, behavior A2 to be analyzed, behavior A3 to be analyzed, behavior A4 to be analyzed, and behavior A5 to be analyzed, and the first risk analysis result characterizes that among behaviors A1 to be analyzed, A2 to be analyzed, A3 to be analyzed, A4 to be analyzed, and A5, behaviors A1 to be analyzed, A2 to be analyzed, and A3 to be analyzed are risk behaviors, and behaviors A4 to be analyzed and A5 to be analyzed are non-risk behaviors, then, the unknown behavior can be each of the behaviors A1 to be analyzed, A2 to be analyzed, and A3 to be analyzed.

[0071] By adopting the program analysis method provided in the embodiment of the present disclosure, it is possible to obtain multiple features to be analyzed of the target program, and perform risk analysis on the multiple features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy, to obtain a first risk analysis result for the multiple features to be analyzed, and then perform risk analysis on unknown behaviors (the unknown behaviors are determined from the multiple features to be analyzed based on the first risk analysis result) through a behavior correlation analysis strategy, to obtain a second risk analysis result for the unknown behaviors. That is to say, in the embodiment of the present disclosure, a static feature comparison strategy and / or a dynamic behavior detection strategy, as well as a correlation analysis strategy, are combined to obtain risk analysis results related to the target program (including a first risk analysis result and a second risk analysis result). Compared with the prior art method of only using static analysis to obtain risk analysis results of an application program, this method can not only analyze the target program from multiple dimensions, but also capture the dynamic behavior of the target program, thereby improving the reliability of the risk analysis results related to the target program.

[0072] In some optional implementations, step S202, that is, "performing risk analysis on multiple features to be analyzed by a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed" may include:

[0073] Through the static feature comparison strategy, risk analysis is performed on multiple features to be analyzed, and the first type of analysis results for multiple features to be analyzed are obtained;

[0074] Through the dynamic behavior detection strategy, risk analysis is performed on multiple features to be analyzed, and the second type of analysis results for multiple features to be analyzed are obtained;

[0075] Based on the first type of analysis results and the second type of analysis results, a first risk analysis result for the plurality of features to be analyzed is obtained.

[0076] As mentioned above, in the embodiment of the present disclosure, the multiple features to be analyzed may include multiple code snippets to be analyzed. Based on this, in one example, "through a static feature comparison strategy, risk analysis is performed on multiple features to be analyzed to obtain a first type of analysis result for multiple features to be analyzed" may include:

[0077] Each of the multiple code fragments to be analyzed is used as a target code fragment, and features of the target code fragment are compared with multiple known risk code fragments to obtain a single fragment analysis result for the target code fragment;

[0078] Based on the single fragment analysis result, an overall analysis result for the multiple code fragments to be analyzed is obtained as a first type of analysis result for the multiple features to be analyzed.

[0079] Among them, multiple known risk code snippets can be stored in a risk code database included in the risk knowledge base; a single snippet analysis result can be used to characterize whether the target code snippet belongs to a risk code snippet; the first type of analysis result can be used to characterize which of the multiple code snippets to be analyzed belong to risk code snippets and which belong to non-risk code snippets.

[0080] In addition, in the embodiment of the present disclosure, the feature comparison of the target code fragment with multiple known risk code fragments can be respectively comparing the target code fragment with multiple known risk code fragments for similarity. Based on this, in a specific example, after taking each of the multiple code fragments to be analyzed as the target code fragment, the target code fragment can be converted into a target code vector using an embedded model, and the multiple known risk code fragments can be converted into multiple known risk code vectors one by one using the embedded model, and the target code vector can be respectively compared with the multiple known risk code vectors for similarity, and then, in the case that there are similar risk code vectors with high similarity (for example, the similarity is greater than a first preset similarity threshold; the first preset similarity threshold can be set according to actual application requirements) with the target code vector in the multiple known risk code vectors, a single fragment analysis result is obtained for characterizing that the target code fragment belongs to the risk code fragment; or, in the case that there are no similar risk code vectors with high similarity with the target code vector in the multiple known risk code vectors, a single fragment analysis result is obtained for characterizing that the target code fragment does not belong to the risk code fragment.

[0081] It should be noted that in the above example, when a single fragment analysis result characterizes that the target code fragment belongs to a risky code fragment, the target code fragment can be treated as a new known risky code fragment and stored in the risk code database included in the risk knowledge base to update the risk code database, thereby improving the reliability of the first type of analysis results for multiple features to be analyzed.

[0082] In the above example, each of the multiple code fragments to be analyzed can be used as a target code fragment, so as to compare the characteristics of the target code fragment with the multiple known risk code fragments respectively, and obtain a single fragment analysis result for the target code fragment, and based on the single fragment analysis result, obtain an overall analysis result for the multiple code fragments to be analyzed as a first-class analysis result for the multiple features to be analyzed. In this process, no complex data processing logic is involved, so the execution efficiency of the program analysis method can be improved.

[0083] As mentioned above, in the embodiment of the present disclosure, the multiple features to be analyzed may include multiple behaviors to be analyzed. Based on this, in one example, "through a dynamic behavior detection strategy, risk analysis is performed on the multiple features to be analyzed to obtain a second type of analysis result for the multiple features to be analyzed" may include:

[0084] Each of the multiple behaviors to be analyzed is used as a target behavior, and characteristics of the target behavior are compared with the multiple first known risk behaviors to obtain a single behavior analysis result for the target behavior;

[0085] Based on the single behavior analysis result, an overall analysis result for multiple behaviors to be analyzed is obtained as a second type of analysis result for multiple features to be analyzed.

[0086] Among them, multiple first known risk behaviors can be stored in a risk behavior database included in the risk knowledge base; a single behavior analysis result can be used to characterize whether the target behavior is a risk behavior; the second type of analysis result can be used to characterize which of the multiple behaviors to be analyzed are risk behaviors and which are non-risk behaviors.

[0087] In addition, in the embodiment of the present disclosure, the feature comparison of the target behavior with multiple first known risk behaviors can be respectively comparing the target behavior with multiple first known risk behaviors by similarity. Based on this, in a specific example, after taking each of the multiple behaviors to be analyzed as the target behavior, the target behavior can be converted into a target behavior vector using an embedded model, and the multiple first known risk behaviors can be converted into multiple known risk behavior vectors one by one using an embedded model, and the target behavior vector can be respectively compared with the multiple known risk behavior vectors by similarity, and then, in the case that there are similar risk behavior vectors with high similarity (for example, the similarity is greater than a second preset similarity threshold; the second preset similarity threshold can be set according to actual application requirements) with the target behavior vector in the multiple known risk behavior vectors, a single behavior analysis result is obtained for characterizing that the target behavior belongs to a risk behavior; or, in the case that there are no similar risk behavior vectors with high similarity with the target behavior in the multiple known risk behavior vectors, a single behavior analysis result is obtained for characterizing that the target behavior does not belong to a risk behavior.

[0088] It should be noted that in the above examples, when a single behavior analysis result characterizes that the target behavior is a risky behavior, the target behavior can be taken as a new first known risky behavior and stored in the risk behavior database included in the risk knowledge base to update the risk behavior database, thereby improving the reliability of the second type of analysis results for multiple features to be analyzed.

[0089] In the above example, each of the multiple behaviors to be analyzed can be used as a target behavior to compare the characteristics of the target behavior with the multiple first known risk behaviors, and obtain a single behavior analysis result for the target behavior. Based on the single behavior analysis result, an overall analysis result for the multiple behaviors to be analyzed is obtained as a second type of analysis result for the multiple features to be analyzed. This process does not involve complex data processing logic, so the execution efficiency of the program analysis method can be improved.

[0090] After obtaining the first type of analysis results and the second type of analysis results, a first risk analysis result for multiple features to be analyzed can be obtained based on the first type of analysis results and the second type of analysis results. In one example, the first type of analysis results and the second type of analysis results can be used together as the first risk analysis result for each feature to be analyzed. Based on this, it can be understood that in the embodiment of the present disclosure, the first risk analysis result can be used to characterize which of the multiple code fragments to be analyzed included in the multiple features to be analyzed are risky code fragments and which are non-risky code fragments, and to characterize which of the multiple behaviors to be analyzed included in the multiple features to be analyzed are risky behaviors and which are non-risky behaviors.

[0091] Through the above methods, in the embodiments of the present disclosure, a risk analysis can be performed on multiple features to be analyzed through a static feature comparison strategy to obtain a first type of analysis result for multiple features to be analyzed, and a risk analysis can be performed on multiple features to be analyzed through a dynamic behavior detection strategy to obtain a second type of analysis result for multiple features to be analyzed, and based on the first type of analysis result and the second type of analysis result, a first risk analysis result for multiple features to be analyzed is obtained. That is to say, in the embodiments of the present disclosure, a static feature comparison strategy and a dynamic behavior detection strategy are combined to obtain a risk analysis result (including a first risk analysis result) related to a target program. Compared with the prior art method of only using a static analysis method to obtain a risk analysis result of an application program, this method can not only analyze the target program from multiple dimensions, but also capture the dynamic behavior of the target program, thereby improving the reliability of the risk analysis result related to the target program.

[0092] In some optional implementations, step S203, that is, "performing a risk analysis on the unknown behavior through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behavior" may include:

[0093] taking each first known risk behavior among the plurality of first known risk behaviors as a first behavior to be compared, so as to obtain first behavior association information of the first behavior to be compared;

[0094] Obtaining second behavior association information of unknown behavior;

[0095] By comparing the correlation between the first behavior correlation information and the second behavior correlation information, a second risk analysis result for the unknown behavior is obtained.

[0096] The first behavior association information may include the external behavior association information and internal behavior pattern of the first behavior to be compared; the second behavior association information may include the external behavior association information and internal behavior pattern of the unknown behavior; and the second risk analysis result may be used to characterize whether the unknown behavior is a risky behavior. Here, the external behavior association information may include: a preset number of external behaviors that are positionally associated with the current behavior subject (e.g., the first behavior to be compared or the unknown behavior), and the positional association relationship between the current behavior subject and the preset number of external behaviors; the internal behavior pattern may include: the internal behavior action of the current behavior subject.

[0097] For example, the preset number is 4, then for a current subject behavior, its external behavior association information can be characterized as: previous association behavior B1-previous association behavior B2-current behavior subject-later association behavior B3-later association behavior B4. Among them, the previous association behavior B1 is located before the current behavior subject and is separated from the current behavior subject by one external behavior; the previous association behavior B2 is located before the current behavior subject and is adjacent to the current behavior subject; the later association behavior B3 is located after the current behavior subject and is adjacent to the current behavior subject; the later association behavior B4 is located after the current behavior subject and is separated from the current behavior subject by one external behavior.

[0098] For example, for a current subject behavior, its internal behavior pattern may include:

[0099] Internal behavior action C1: After the target program is started, the auxiliary service function is applied;

[0100] Internal behavior action C2: There is an automated click framework file in the target program’s system file “system / data / tmp / ”;

[0101] Internal behavior action C3: An exception is found in the touch event parameters of the target program.

[0102] In one example, “obtaining a second risk analysis result for the unknown behavior by comparing the first behavior association information with the second behavior association information” may include:

[0103] By comparing the correlation between the first behavior correlation information and the second behavior correlation information, a primary analysis result for the unknown behavior is obtained;

[0104] When the initial analysis result indicates that the unknown behavior is a risky behavior, the initial analysis result is used as a second risk analysis result for the unknown behavior; or, when the initial analysis result indicates that the unknown behavior is a non-risky behavior, a large language model is used to obtain a second risk analysis result for the unknown behavior.

[0105] Among them, comparing the correlation between the first behavior association information and the second behavior association information can be comparing the similarity between the first behavior association information and the second behavior association information. Based on this, in a specific example, the first behavior association information can be converted into a first behavior association vector using an embedded model, and the second behavior association information can be converted into a second behavior association vector using an embedded model, and the first behavior association vector and the second behavior association vector can be compared for similarity, and then, when the first behavior association vector and the second behavior association vector have a high similarity (for example, the similarity is greater than a third preset similarity threshold; the third preset similarity threshold can be set according to actual application requirements), a preliminary analysis result is obtained to characterize that the unknown behavior belongs to a risky behavior; or, when the first behavior association vector and the second behavior association vector do not have a high similarity, a preliminary analysis result is obtained to characterize that the unknown behavior does not belong to a risky behavior.

[0106] It should be noted that in the above example, when the second risk analysis result (specifically, it can be the initial analysis result) characterizes that the unknown behavior is a risky behavior, the unknown behavior can be used as a new first known risky behavior and stored in the risk behavior database included in the risk knowledge base to update the risk behavior database, thereby improving the reliability of the initial analysis result for the unknown behavior; when the second risk analysis result (specifically, it can be the initial analysis result) characterizes that the unknown behavior is a non-risky behavior, the unknown behavior can continue to be judged, for example, a large language model can be used to obtain a second risk analysis result for the unknown behavior. In a specific example, "using a large language model to obtain a second risk analysis result for the unknown behavior" can include:

[0107] Using large language models, multiple second known risk behaviors are identified;

[0108] taking each second known risk behavior among the plurality of second known risk behaviors as a second behavior to be compared, so as to obtain third behavior association information of the second behavior to be compared;

[0109] By comparing the correlation between the second behavior correlation information and the third behavior correlation information, a second risk analysis result for the unknown behavior is obtained.

[0110] Among them, the large language model can be a pre-trained neural network model, which has universal and massive language knowledge, world knowledge, professional knowledge in various fields, etc. In one example, the large language model can be an autoregressive generative model of the Transformer architecture. Based on this, it can be understood that in the embodiments of the present disclosure, the large language model can be used to determine multiple second known risk behaviors from its massive professional knowledge in various fields (for example, professional knowledge in the field of information technology).

[0111] After obtaining multiple second known risk behaviors, the large language model can be used to take each of the multiple second known risk behaviors as the second behavior to be compared, so as to obtain the third behavior association information of the second behavior to be compared, and obtain the second risk analysis result for the unknown behavior by comparing the second behavior association information and the third behavior association information. The third behavior association information may include the external behavior association information and the internal behavior pattern of the second behavior to be compared; the second risk analysis result is used to characterize whether the unknown behavior is a risky behavior.

[0112] In addition, it should be noted that in the disclosed embodiment, in order to improve the reliability of the second risk analysis result for unknown behavior obtained by using the large language model, a prompt word (Prompt) can be designed for the large language model to indicate how the large language model obtains the second risk analysis result for unknown behavior. Specifically, it can be used to instruct the large language model to use each of the multiple second known risk behaviors as the second behavior to be compared, so as to obtain the third behavior association information of the second behavior to be compared, and to obtain the second risk analysis result for the unknown behavior by comparing the second behavior association information and the third behavior association information. Exemplarily, the prompt word can be, "You are an expert in black industry chain analysis. I will give you an analysis example. Please follow this analysis example and tell me whether the unknown behavior belongs to risk behavior", and provide this analysis example for the large language model. For example, there is a first behavior D1 to be compared and an unknown behavior D2. By comparing the first behavior association information of the first behavior D1 to be compared and the second behavior association information of the unknown behavior D2, the initial analysis result for characterizing that the unknown behavior belongs to risk behavior is obtained. Then, this analysis example can be the specific process of obtaining the initial analysis results related to the first behavior to be compared D1 and the unknown behavior D2, and the analysis example can be stored in the rule example database included in the risk database after the initial analysis results related to the first behavior to be compared D1 and the unknown behavior D2 are initially obtained.

[0113] Through the above method, in the embodiment of the present disclosure, each first known risk behavior among multiple first known risk behaviors can be used as the first behavior to be compared, so as to obtain the first behavior association information of the first behavior to be compared, and obtain the second behavior association information of the unknown behavior, and obtain the second risk analysis result for the unknown behavior by performing a correlation comparison between the first behavior association information and the second behavior association information. That is to say, in the embodiment of the present disclosure, the deeper features of the target program (specifically the unknown behavior in the target program) can also be excavated through the correlation comparison of the behavior association information, and the risk analysis results related to the target program (including the second risk analysis results) can be obtained accordingly, thereby further improving the reliability of the risk analysis results.

[0114] In addition, in the disclosed embodiment, in the process of "obtaining a second risk analysis result for the unknown behavior by comparing the first behavior association information and the second behavior association information for correlation", specifically, the first behavior association information and the second behavior association information are compared for correlation to obtain a primary analysis result for the unknown behavior, and when the primary analysis result characterizes that the unknown behavior is a risky behavior, the primary analysis result is used as the second risk analysis result for the unknown behavior; or, when the primary analysis result characterizes that the unknown behavior is a non-risky behavior, the large language model is used to obtain a second risk analysis result for the unknown behavior. That is to say, in the disclosed embodiment, the large language model is also used to analyze the unknown behavior, and based on the powerful knowledge reserve capacity and data analysis capacity of the large language model, the reliability of the risk analysis results (including the second risk analysis results) related to the target program can be further ensured.

[0115] The following will be combined Figure 3 and 4 , the integrity process of a program analysis method provided by an embodiment of the present disclosure is described.

[0116] First of all, it should be noted that before executing the program analysis method provided by the embodiment of the present disclosure, a risk knowledge base needs to be constructed. Among them, the risk knowledge base may include a risk code database and a risk behavior database. Here, the risk code database can be used to store multiple known risk code fragments, and each of the multiple known risk code fragments can be vectorized data; the risk behavior database can be used to store multiple first known risk behaviors, and each of the multiple first known risk behaviors can be vectorized data.

[0117] Thereafter, on the first electronic device side (eg, the terminal device side), the following operations may be performed:

[0118] (1) Obtain the target program.

[0119] The target program may be any application package that needs to be analyzed, such as APK.

[0120] (2) Decompiling the target program to obtain a code decompilation result, segmenting the code decompilation result to obtain a plurality of code segments to be analyzed, and then sending the plurality of code segments to be analyzed to a second electronic device (e.g., a service device).

[0121] The decompilation result may include multiple code function blocks, where each of the multiple code function blocks can implement a specific code function (eg, data processing, network request, etc.).

[0122] In addition, it can be understood that in the embodiment of the present disclosure, multiple code fragments to be analyzed can correspond one to one with multiple code function blocks. Based on this, in one example, the target program can be decompiled by a preset reverse engineering tool to obtain a code decompilation result, and the code decompilation result can be analyzed to obtain multiple code function blocks, and then based on the position of each code function block in the code decompilation result, the code decompilation result can be cleaned and cut to obtain multiple code fragments to be analyzed corresponding one to one with multiple code function blocks, and finally, multiple features to be analyzed including multiple code fragments to be analyzed are generated.

[0123] (3) Perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed, and send the multiple behaviors to be analyzed to a second electronic device (eg, a service device).

[0124] In one example, dynamic behavior detection can be performed on the target program in a sandbox environment or a virtual machine to obtain multiple behaviors to be analyzed. Specifically, a proxy packet capture tool and / or a hook tool (for example, Frida, Xposed, etc.) can be used to perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed. In another example, detection confrontation technology can be used to perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed. In combination with these two examples, in the embodiments of the present disclosure, a proxy packet capture tool and / or a hook tool that uses detection confrontation technology can be used to perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed.

[0125] Based on the above content, it can be understood that in the embodiments of the present disclosure, the detection and confrontation technology may include a proxy packet capture detection and confrontation technology and / or a hook tool detection and confrontation technology.

[0126] In one example, the proxy packet capture detection countermeasure technology can be used to indicate: integrating support for network traffic management tools (e.g., Iptables) in the target program's operating system (e.g., when the target program is APK, the target program's operating system can be an Android system), so as to perform proxy settings at the operating system level, and call the network traffic management tool through a programming interface, and then add corresponding forwarding rules to implement traffic forwarding, thereby performing dynamic behavior detection on the target program and obtaining multiple behaviors to be analyzed. In this way, compared with the traditional proxy packet capture detection technology, the proxy setting method from the application layer is converted to the proxy setting at the operating system level, so that the dynamic behavior detection of the target program becomes more secretive and will not be detected by the target program (generally speaking, when the target program realizes that it is in a detected state, it may choose not to trigger risky behavior temporarily to avoid detection), thereby increasing the difficulty of detecting and avoiding risky behaviors, that is, increasing the possibility of exposing risky behaviors.

[0127] In one example, the hook tool detection countermeasure technology can be used to indicate: when the target program is subjected to dynamic behavior detection through the hook tool, the detection traces are quickly erased. For example, code obfuscation technology, memory protection mechanism, timely self-cleaning mechanism, etc. can be used to quickly erase the detection traces. In a specific example, a hook tool can be used on the key execution path of the target program to intercept its key dynamic behavior to achieve the purpose of dynamic behavior detection of the target program. Among them, the key dynamic behavior can include network request behavior, file operation behavior, process management behavior, system call behavior, etc. In this way, the dynamic behavior detection of the target program can also be made more secretive without the target program noticing, thereby increasing the difficulty of detecting and avoiding risky behaviors, that is, increasing the possibility of exposure of risky behaviors.

[0128] In addition, it should be noted that in the embodiments of the present disclosure, in order to prevent the target program from evading detection of the system environment of the running system (for example, when the first electronic device is in a system debugging state, the target program may detect through the API of its running system that the first electronic device is in a system debugging state, and choose not to trigger risky behavior temporarily to avoid detection), the running environment of the running system can also be customized to disguise the system debugging state. For example, the system debugging state can be disguised as a debugging state that is not started, so that the target program mistakenly believes that the system environment of the running system is in a safe state, thereby triggering risky behavior to increase the possibility of exposure of risky behavior.

[0129] The above can be achieved based on the decompilation tools (including code decompilation unit, code cleaning unit, code cutting unit, etc.) and the operating environment (including detection and confrontation technology, proxy packet capture tools, hook tools, etc.) provided by the data monitoring layer in the program analysis framework.

[0130] Next, on the second electronic device side (eg, the service device side), the following operations may be performed:

[0131] (4) Receiving multiple features to be analyzed sent by the first electronic device.

[0132] The multiple features to be analyzed may include multiple code snippets to be analyzed and multiple behaviors to be analyzed.

[0133] (5) Through the static feature comparison strategy, risk analysis is performed on multiple features to be analyzed, and the first type of analysis results for the multiple features to be analyzed are obtained.

[0134] In one example, “performing risk analysis on multiple features to be analyzed by using a static feature comparison strategy to obtain a first type of analysis result for the multiple features to be analyzed” may include:

[0135] Each of the multiple code fragments to be analyzed is used as a target code fragment, and features of the target code fragment are compared with multiple known risk code fragments to obtain a single fragment analysis result for the target code fragment;

[0136] Based on the single fragment analysis result, an overall analysis result for the multiple code fragments to be analyzed is obtained as a first type of analysis result for the multiple features to be analyzed.

[0137] Among them, multiple known risk code snippets can be stored in a risk code database included in the risk knowledge base; a single snippet analysis result can be used to characterize whether the target code snippet belongs to a risk code snippet; the first type of analysis result can be used to characterize which of the multiple code snippets to be analyzed belong to risk code snippets and which belong to non-risk code snippets.

[0138] In addition, in the embodiment of the present disclosure, the feature comparison of the target code fragment with multiple known risk code fragments can be respectively comparing the target code fragment with multiple known risk code fragments for similarity. Based on this, in a specific example, after taking each of the multiple code fragments to be analyzed as the target code fragment, the target code fragment can be converted into a target code vector using an embedded model, and the multiple known risk code fragments can be converted into multiple known risk code vectors one by one using an embedded model, and the target code vector can be respectively compared with the multiple known risk code vectors for similarity, and then, in the case that there are similar risk code vectors with high similarity (for example, the similarity is greater than a first preset similarity threshold; the first preset similarity threshold can be set according to actual application requirements) with the target code vector in the multiple known risk code vectors, a single fragment analysis result is obtained for characterizing that the target code fragment belongs to the risk code fragment; or, in the case that there are no similar risk code vectors with high similarity with the target code vector in the multiple known risk code vectors, a single fragment analysis result is obtained for characterizing that the target code fragment does not belong to the risk code fragment.

[0139] It should be noted that in the above example, when a single fragment analysis result characterizes that the target code fragment belongs to a risky code fragment, the target code fragment can be treated as a new known risky code fragment and stored in the risk code database included in the risk knowledge base to update the risk code database, thereby improving the reliability of the first type of analysis results for multiple features to be analyzed.

[0140] (6) Through the dynamic behavior detection strategy, risk analysis is performed on multiple features to be analyzed, and a second type of analysis result for the multiple features to be analyzed is obtained.

[0141] In one example, “performing risk analysis on multiple features to be analyzed through a dynamic behavior detection strategy to obtain a second type of analysis result for the multiple features to be analyzed” may include:

[0142] Each of the multiple behaviors to be analyzed is used as a target behavior, and characteristics of the target behavior are compared with the multiple first known risk behaviors to obtain a single behavior analysis result for the target behavior;

[0143] Based on the single behavior analysis result, an overall analysis result for multiple behaviors to be analyzed is obtained as a second type of analysis result for multiple features to be analyzed.

[0144] Among them, multiple first known risk behaviors can be stored in a risk behavior database included in the risk knowledge base; a single behavior analysis result can be used to characterize whether the target behavior is a risk behavior; the second type of analysis result can be used to characterize which of the multiple behaviors to be analyzed are risk behaviors and which are non-risk behaviors.

[0145] In addition, in the embodiment of the present disclosure, the feature comparison of the target behavior with multiple first known risk behaviors can be respectively comparing the target behavior with multiple first known risk behaviors by similarity. Based on this, in a specific example, after taking each of the multiple behaviors to be analyzed as the target behavior, the target behavior can be converted into a target behavior vector using an embedded model, and the multiple first known risk behaviors can be converted into multiple known risk behavior vectors one by one using an embedded model, and the target behavior vector can be respectively compared with the multiple known risk behavior vectors by similarity, and then, in the case that there are similar risk behavior vectors with high similarity (for example, the similarity is greater than a second preset similarity threshold; the second preset similarity threshold can be set according to actual application requirements) with the target behavior vector in the multiple known risk behavior vectors, a single behavior analysis result is obtained for characterizing that the target behavior belongs to a risk behavior; or, in the case that there are no similar risk behavior vectors with high similarity with the target behavior in the multiple known risk behavior vectors, a single behavior analysis result is obtained for characterizing that the target behavior does not belong to a risk behavior.

[0146] It should be noted that in the above examples, when a single behavior analysis result characterizes that the target behavior is a risky behavior, the target behavior can be taken as a new first known risky behavior and stored in the risk behavior database included in the risk knowledge base to update the risk behavior database, thereby improving the reliability of the second type of analysis results for multiple features to be analyzed.

[0147] (7) Based on the first type of analysis results and the second type of analysis results, a first risk analysis result for the plurality of features to be analyzed is obtained.

[0148] In one example, the first type of analysis result and the second type of analysis result can be used together as the first risk analysis result for each feature to be analyzed. Based on this, it can be understood that in the embodiment of the present disclosure, the first risk analysis result can be used to characterize which of the multiple code fragments to be analyzed included in the multiple features to be analyzed are risky code fragments and which are non-risky code fragments, and to characterize which of the multiple behaviors to be analyzed included in the multiple features to be analyzed are risky behaviors and which are non-risky behaviors.

[0149] (8) Each first known risk behavior among the multiple first known risk behaviors is used as a first behavior to be compared, so as to obtain first behavior association information of the first behavior to be compared.

[0150] The first behavior association information may include the external behavior association information and internal behavior pattern of the first behavior to be compared. Here, the external behavior association information may include: a preset number of external behaviors that are positionally associated with the current behavior subject (e.g., the first behavior to be compared), and the positional association relationship between the current behavior subject and the preset number of external behaviors; the internal behavior pattern may include: the internal behavior actions of the current behavior subject.

[0151] (9) Obtain the second behavior association information of the unknown behavior.

[0152] The unknown behavior may be each of the behaviors to be analyzed that is characterized as a non-risk behavior by the first risk analysis result among the multiple behaviors to be analyzed; and the second behavior association information may include external behavior association information and internal behavior patterns of the unknown behavior.

[0153] (10) By comparing the correlation between the first behavior correlation information and the second behavior correlation information, a second risk analysis result for the unknown behavior is obtained.

[0154] The second risk analysis result may be used to characterize whether the unknown behavior is a risky behavior.

[0155] In one example, “obtaining a second risk analysis result for the unknown behavior by comparing the first behavior association information with the second behavior association information” may include:

[0156] By comparing the correlation between the first behavior correlation information and the second behavior correlation information, a primary analysis result for the unknown behavior is obtained;

[0157] When the initial analysis result indicates that the unknown behavior is a risky behavior, the initial analysis result is used as a second risk analysis result for the unknown behavior; or, when the initial analysis result indicates that the unknown behavior is a non-risky behavior, a large language model is used to obtain a second risk analysis result for the unknown behavior.

[0158] Among them, comparing the correlation between the first behavior association information and the second behavior association information can be comparing the similarity between the first behavior association information and the second behavior association information. Based on this, in a specific example, the first behavior association information can be converted into a first behavior association vector using an embedded model, and the second behavior association information can be converted into a second behavior association vector using an embedded model, and the first behavior association vector and the second behavior association vector can be compared for similarity, and then, when the first behavior association vector and the second behavior association vector have a high similarity (for example, the similarity is greater than a third preset similarity threshold; the third preset similarity threshold can be set according to actual application requirements), a preliminary analysis result is obtained to characterize that the unknown behavior belongs to a risky behavior; or, when the first behavior association vector and the second behavior association vector do not have a high similarity, a preliminary analysis result is obtained to characterize that the unknown behavior does not belong to a risky behavior.

[0159] It should be noted that in the above example, when the second risk analysis result (specifically, it can be the initial analysis result) characterizes that the unknown behavior is a risky behavior, the unknown behavior can be used as a new first known risky behavior and stored in the risk behavior database included in the risk knowledge base to update the risk behavior database, thereby improving the reliability of the initial analysis result for the unknown behavior; when the second risk analysis result (specifically, it can be the initial analysis result) characterizes that the unknown behavior is a non-risky behavior, the unknown behavior can continue to be judged, for example, a large language model can be used to obtain a second risk analysis result for the unknown behavior. In a specific example, "using a large language model to obtain a second risk analysis result for the unknown behavior" can include:

[0160] Using large language models, multiple second known risk behaviors are identified;

[0161] taking each second known risk behavior among the plurality of second known risk behaviors as a second behavior to be compared, so as to obtain third behavior association information of the second behavior to be compared;

[0162] By comparing the correlation between the second behavior correlation information and the third behavior correlation information, a second risk analysis result for the unknown behavior is obtained.

[0163] In the disclosed embodiment, a large language model may be used to determine a plurality of second known risk behaviors from a large amount of professional knowledge in various fields (eg, professional knowledge in the field of information technology).

[0164] After obtaining multiple second known risk behaviors, the large language model can be used to take each of the multiple second known risk behaviors as the second behavior to be compared, so as to obtain the third behavior association information of the second behavior to be compared, and obtain the second risk analysis result for the unknown behavior by comparing the second behavior association information and the third behavior association information. The third behavior association information may include the external behavior association information and the internal behavior pattern of the second behavior to be compared; the second risk analysis result is used to characterize whether the unknown behavior is a risky behavior.

[0165] In addition, it should be noted that in the disclosed embodiment, in order to improve the reliability of the second risk analysis result for unknown behavior obtained by using the large language model, a prompt word can be designed for the large language model to indicate how the large language model obtains the second risk analysis result for unknown behavior. Specifically, it can be used to instruct the large language model to use each of the multiple second known risk behaviors as the second behavior to be compared, so as to obtain the third behavior association information of the second behavior to be compared, and to obtain the second risk analysis result for the unknown behavior by comparing the second behavior association information and the third behavior association information. Exemplarily, the prompt word can be, "You are an expert in black industry chain analysis. I will give you an analysis example. Please follow this analysis example and tell me whether the unknown behavior belongs to risk behavior", and provide this analysis example for the large language model. For example, there is a first behavior D1 to be compared and an unknown behavior D2. By comparing the first behavior association information of the first behavior D1 to be compared and the second behavior association information of the unknown behavior D2, the initial analysis result for characterizing that the unknown behavior belongs to risk behavior is obtained. Then, this analysis example can be a specific acquisition process of the initial analysis result related to the first behavior to be compared D1 and the unknown behavior D2, and the analysis example can be stored in the rule example database included in the risk database after the initial analysis result related to the first behavior to be compared D1 and the unknown behavior D2 is obtained. The second risk analysis result (specifically, the second risk analysis result obtained by the large language model) characterizes that the unknown behavior belongs to the risk behavior

[0166] It should also be noted that in the above specific examples, when the second risk analysis result (specifically, the second risk analysis result obtained by the large language model) characterizes that the unknown behavior is a risky behavior, the unknown behavior can be verified by online verification to further confirm whether the unknown behavior is a risky behavior. When the unknown behavior is confirmed to be a risky behavior, the unknown behavior can be used as a new first known risky behavior and stored in the risk behavior database included in the risk knowledge base to update the risk behavior database, thereby improving the reliability of the initial analysis results for the unknown behavior. Among them, online verification can be running the unknown behavior in the actual system environment to further confirm whether the unknown behavior is a risky behavior.

[0167] The above can be achieved based on the risk knowledge base (including the generation risk code database, risk behavior database and rule example database) and the large language model provided by the data analysis layer in the program analysis framework.

[0168] After completing the above steps, an analysis report for the target program can be generated. The analysis report may include:

[0169] (1) Risky code snippets and risky behaviors identified based on the risk knowledge base;

[0170] (2) Risk behaviors inferred through large language models and verified online;

[0171] (3) Update records of the risk knowledge base and recommendations for future defense strategies.

[0172] It should be noted that in the embodiments of the present disclosure, the process of outputting the latest determined risk code snippets and risk behaviors, and the process of generating an analysis report for the target program can be implemented based on the data output layer in the program analysis framework.

[0173] Finally, the program analysis method provided by the embodiment of the present disclosure has the following advantages:

[0174] (1) Improving the comprehensiveness of black industry chain attack identification

[0175] At present, the commonly used program analysis method is the static analysis method. In the disclosed embodiment, the static feature comparison strategy and / or the dynamic behavior detection strategy, as well as the correlation analysis strategy, are combined to obtain the risk analysis results related to the target program (including the first risk analysis result and the second risk analysis result). Compared with the prior art method of only using the static analysis method to obtain the risk analysis results of the application program, this method can not only analyze the target program from multiple dimensions, but also capture the dynamic behavior of the target program, thereby improving the reliability of the risk analysis results related to the target program.

[0176] (2) Ability to infer unknown attacks

[0177] When faced with new and unknown attacks (i.e., unknown behaviors), existing program analysis methods often rely on manual analysis and expert judgment, and their response speed is slow. In the disclosed embodiment, a mechanism of large language model reasoning and knowledge enhancement (i.e., correlation comparison) is introduced, so that the program analysis method has the ability to automatically infer new and unknown attacks. Its specific advantages may include:

[0178] a. Knowledge-enhanced inference: Through the accumulated analysis examples, new and unknown attacks are regularized and inferred to avoid blind guesses, making the risk analysis results related to the target program (specifically, the second risk analysis results obtained through the large language model) more reasonable.

[0179] b. Large model reasoning: Based on the large-scale reasoning capability of the deep learning model and combined with the prompt word technology, it can quickly determine whether the unknown behavior is a risky behavior, and then verify it online.

[0180] c. Data flywheel: When a single segment analysis result indicates that the target code segment is a risk code segment, the target code segment can be used as a new known risk code segment and stored in the risk code database included in the risk knowledge base; when a single behavior analysis result indicates that the target behavior is a risk behavior, the target behavior can be used as a new first known risk behavior and stored in the risk behavior database included in the risk knowledge base; when the second risk analysis result (specifically, it can be the initial analysis result) indicates that the unknown behavior is a risk behavior, the unknown behavior can be used as a new first known risk behavior and stored in the risk behavior database included in the risk knowledge base; when the second risk analysis result (specifically, it can be the second risk analysis result obtained by the large language model) indicates that the unknown behavior is a risk behavior, and the unknown behavior is verified by online verification to further confirm that the unknown behavior is a risk behavior, the unknown behavior can be used as a new first known risk behavior and stored in the risk behavior database included in the risk knowledge base. In this way, the risk database can form a closed loop of continuous self-optimization, making the program analysis method more and more intelligent and more adaptable to new and unknown attacks.

[0181] (3) Enhance the ability to detect risky behaviors

[0182] The proxy packet capture tool and / or hook tool using detection confrontation technology performs dynamic behavior detection on the target program and obtains multiple behaviors to be analyzed. In this way, the means of risky behavior evading detection can be effectively avoided, making the dynamic behavior detection strategy more robust and ensuring that risky behaviors are fully exposed.

[0183] See also Figure 5 , which is a schematic diagram of an application scenario of a program analysis method provided by an embodiment of the present disclosure. The application analysis method can be applied to an electronic device, where the electronic device can be a first electronic device or a second electronic device. Specifically, the first electronic device can be a terminal device, which can be a conventional computer (desktop computer, laptop computer, etc.), a car computer, a tablet computer, a smart phone, a personal digital processing or other similar computing device; the second electronic device can be a service device.

[0184] Specifically, the first electronic device can be used for:

[0185] Based on the target program, multiple features to be analyzed are obtained.

[0186] Send multiple features to be analyzed to a service device; wherein the service device is used to perform risk analysis on the multiple features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed, and is used to perform risk analysis on unknown behaviors through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behaviors; the unknown behaviors are determined from the multiple features to be analyzed based on the first risk analysis result.

[0187] Specifically, the second electronic device can be used for:

[0188] Obtain multiple features to be analyzed of the target program;

[0189] Perform risk analysis on the multiple features to be analyzed by using a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed;

[0190] Through the behavior correlation analysis strategy, risk analysis is performed on the unknown behavior to obtain a second risk analysis result for the unknown behavior; wherein the unknown behavior is determined from multiple features to be analyzed based on the first risk analysis result.

[0191] After obtaining the first risk analysis result and the second risk analysis result, they can be fed back to the first electronic device so that the first electronic device can perform effective risk management when running the target program again. They can also be applied to subsequent application upgrade operations, which will not be elaborated in the present disclosed embodiment.

[0192] It should be noted that in the embodiments of the present disclosure, Figure 5 The scene diagram shown is only illustrative and not restrictive. Those skilled in the art can Figure 5 Various obvious changes and / or substitutions are made to the examples, and the obtained technical solutions still fall within the scope of the disclosure of the embodiments of the present disclosure.

[0193] In order to better implement the program analysis method applied to the first electronic device, the embodiment of the present disclosure also provides a program analysis device 600, which can be integrated into the first electronic device. The first electronic device can be a terminal device, for example, a conventional computer (desktop computer, laptop computer, etc.), a car computer, a tablet computer, a smart phone, a personal digital assistant or other similar computing devices. Figure 6 The schematic structural block diagram shown illustrates a program analysis device 600 provided in the disclosed embodiment.

[0194] The program analysis device 600 comprises:

[0195] A second feature acquisition unit 601 is used to obtain a plurality of features to be analyzed based on the target program;

[0196] The feature sending unit 602 is used to send multiple features to be analyzed to the service device; wherein the service device is used to perform risk analysis on the multiple features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed, and is used to perform risk analysis on unknown behaviors through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behaviors; the unknown behaviors are determined from the multiple features to be analyzed based on the first risk analysis result.

[0197] In some optional implementations, the second feature acquisition unit 601 is used to:

[0198] Decompile the target program to obtain the code decompilation result;

[0199] Cut the code decompilation results to obtain multiple code fragments to be analyzed;

[0200] Based on the multiple code snippets to be analyzed, multiple features to be analyzed are obtained.

[0201] In some optional implementations, the second feature acquisition unit 601 is used to:

[0202] Perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed;

[0203] Based on the multiple behaviors to be analyzed, multiple features to be analyzed are obtained.

[0204] In some optional implementations, the second feature acquisition unit 601 is used to:

[0205] The detection and confrontation technology is used to perform dynamic behavior detection on the target program and obtain multiple behaviors to be analyzed.

[0206] In the embodiment of the present disclosure, the specific functions and examples of each unit in the program analysis device 600 can refer to the relevant descriptions of the corresponding steps in the aforementioned embodiment of the program analysis method applied to the first electronic device, and will not be repeated here.

[0207] In order to better implement the program analysis method applied to the second electronic device, the embodiment of the present disclosure further provides a program analysis device 700, which can be integrated into the second electronic device. The second electronic device can be a service device, such as a server or other similar computing device. Figure 7 The schematic structural block diagram shown illustrates a program analysis device 700 provided by the disclosed embodiment.

[0208] The program analysis device 700 comprises:

[0209] A first feature acquisition unit 701 is used to acquire a plurality of features to be analyzed of a target program;

[0210] A first risk analysis unit 702 is used to perform risk analysis on multiple features to be analyzed by using a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed;

[0211] The second risk analysis unit 703 is used to perform risk analysis on the unknown behavior through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behavior; wherein the unknown behavior is determined from a plurality of features to be analyzed based on the first risk analysis result.

[0212] In some optional implementations, the second risk analysis unit 703 is used to:

[0213] taking each first known risk behavior among the plurality of first known risk behaviors as a first behavior to be compared, so as to obtain first behavior association information of the first behavior to be compared;

[0214] Obtaining second behavior association information of unknown behavior;

[0215] By comparing the correlation between the first behavior correlation information and the second behavior correlation information, a second risk analysis result for the unknown behavior is obtained.

[0216] In some optional implementations, the second risk analysis unit 703 is used to:

[0217] By comparing the correlation between the first behavior correlation information and the second behavior correlation information, a primary analysis result for the unknown behavior is obtained;

[0218] When the initial analysis result indicates that the unknown behavior is a risky behavior, the initial analysis result is used as a second risk analysis result for the unknown behavior; or, when the initial analysis result indicates that the unknown behavior is a non-risky behavior, a large language model is used to obtain a second risk analysis result for the unknown behavior.

[0219] In some optional implementations, the second risk analysis unit 703 is used to:

[0220] Using large language models, multiple second known risk behaviors are identified;

[0221] taking each second known risk behavior among the plurality of second known risk behaviors as a second behavior to be compared, so as to obtain third behavior association information of the second behavior to be compared;

[0222] By comparing the correlation between the second behavior correlation information and the third behavior correlation information, a second risk analysis result for the unknown behavior is obtained.

[0223] In some optional implementations, the first risk analysis unit 702 is used to:

[0224] Through the static feature comparison strategy, risk analysis is performed on multiple features to be analyzed, and the first type of analysis results for multiple features to be analyzed are obtained;

[0225] Through the dynamic behavior detection strategy, risk analysis is performed on multiple features to be analyzed, and the second type of analysis results for multiple features to be analyzed are obtained;

[0226] Based on the first type of analysis results and the second type of analysis results, a first risk analysis result for the plurality of features to be analyzed is obtained.

[0227] In some optional implementations, the multiple features to be analyzed include multiple code snippets to be analyzed; the first risk analysis unit 702 is used to:

[0228] Each of the multiple code fragments to be analyzed is used as a target code fragment, and features of the target code fragment are compared with multiple known risk code fragments to obtain a single fragment analysis result for the target code fragment;

[0229] Based on the single fragment analysis result, an overall analysis result for the multiple code fragments to be analyzed is obtained as a first type of analysis result for the multiple features to be analyzed.

[0230] In some optional implementations, the multiple features to be analyzed include multiple behaviors to be analyzed; the first risk analysis unit 702 is used to:

[0231] Each of the multiple behaviors to be analyzed is used as a target behavior, and characteristics of the target behavior are compared with the multiple first known risk behaviors to obtain a single behavior analysis result for the target behavior;

[0232] Based on the single behavior analysis result, an overall analysis result for multiple behaviors to be analyzed is obtained as a second type of analysis result for multiple features to be analyzed.

[0233] In the embodiment of the present disclosure, the specific functions and examples of each unit in the program analysis device 700 can refer to the relevant descriptions of the corresponding steps in the aforementioned embodiment of the program analysis method applied to the second electronic device, and will not be repeated here.

[0234] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0235] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0236] Figure 8 A schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as vehicle-mounted computing devices, laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0237] like Figure 8 As shown, the electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 to a random access memory (RAM) 803. In RAM 803, various programs and data required for the operation of the electronic device 800 can also be stored. The computing unit 801, ROM 802, and RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0238] A number of components in the electronic device 800 are connected to the I / O interface 805, including: an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of renderers, speakers, etc.; a storage unit 808, such as a disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0239] The computing unit 801 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSP), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 801 performs the various methods and processes described above, such as program analysis methods. For example, in some embodiments, the program analysis method may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps in the program analysis method described above may be executed. Alternatively, in other embodiments, the computing unit 801 may be configured as a program analysis method in any other appropriate manner (eg, by means of firmware).

[0240] Various embodiments of the systems and techniques described above herein may be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0241] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0242] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM) or a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0243] To provide interaction with a user, the systems and techniques described herein may be implemented on a computer having: a rendering device (e.g., a cathode ray tube (CRT) renderer or a liquid crystal display (LCD)) for rendering information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices are also used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0244] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: Local Area Network (LAN), Wide Area Network (WAN), and the Internet.

[0245] The computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server can be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0246] The embodiment of the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute a program analysis method.

[0247] The embodiment of the present disclosure also provides a computer program product, including a computer program, which implements the program analysis method when executed by a processor.

[0248] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in the present disclosure can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, and this document is not limited here. In addition, in the present disclosure, relational terms such as "first", "second", "third", etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. In addition, "multiple" in the present disclosure can be understood as at least two.

[0249] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A program analysis method, comprising: Obtain multiple features to be analyzed of the target program; Performing risk analysis on the multiple features to be analyzed by using a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed; Through the behavior correlation analysis strategy, risk analysis is performed on the unknown behavior to obtain a second risk analysis result for the unknown behavior; wherein the unknown behavior is determined from the multiple features to be analyzed based on the first risk analysis result.

2. The analysis method according to claim 1, wherein The risk analysis of the unknown behavior is performed through the behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behavior, including: Taking each first known risk behavior among the plurality of first known risk behaviors as a first behavior to be compared, so as to obtain first behavior association information of the first behavior to be compared; Obtaining second behavior association information of unknown behavior; By comparing the first behavior association information and the second behavior association information, a second risk analysis result for the unknown behavior is obtained.

3. The method according to claim 2, wherein: The obtaining of a second risk analysis result for the unknown behavior by comparing the first behavior association information with the second behavior association information includes: Obtaining a primary analysis result for the unknown behavior by comparing the first behavior association information with the second behavior association information; When the initial analysis result characterizes that the unknown behavior is a risky behavior, the initial analysis result is used as a second risk analysis result for the unknown behavior; or, when the initial analysis result characterizes that the unknown behavior is a non-risky behavior, a large language model is used to obtain a second risk analysis result for the unknown behavior.

4. The method according to claim 3, wherein: The using of the large language model to obtain a second risk analysis result for the unknown behavior includes: Using large language models, multiple second known risk behaviors are identified; taking each second known risk behavior among the plurality of second known risk behaviors as a second behavior to be compared, so as to obtain third behavior association information of the second behavior to be compared; By comparing the correlation between the second behavior association information and the third behavior association information, a second risk analysis result for the unknown behavior is obtained.

5. The method according to any one of claims 1 to 4, wherein: The risk analysis is performed on the multiple features to be analyzed by using a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed, including: Performing risk analysis on the multiple features to be analyzed by using a static feature comparison strategy to obtain a first type of analysis result for the multiple features to be analyzed; Performing risk analysis on the multiple features to be analyzed by a dynamic behavior detection strategy to obtain a second type of analysis result for the multiple features to be analyzed; Based on the first type of analysis results and the second type of analysis results, a first risk analysis result for the multiple features to be analyzed is obtained.

6. The method according to claim 5, wherein: The multiple features to be analyzed include multiple code snippets to be analyzed; the risk analysis is performed on the multiple features to be analyzed by using a static feature comparison strategy to obtain a first type of analysis results for the multiple features to be analyzed, including: Taking each of the multiple code fragments to be analyzed as a target code fragment, and performing feature comparison between the target code fragment and multiple known risk code fragments, respectively, to obtain a single fragment analysis result for the target code fragment; Based on the single fragment analysis result, an overall analysis result for the multiple code fragments to be analyzed is obtained as a first type of analysis result for the multiple features to be analyzed.

7. The method according to claim 5, wherein: The multiple features to be analyzed include multiple behaviors to be analyzed; the risk analysis is performed on the multiple features to be analyzed by the dynamic behavior detection strategy to obtain the second type of analysis results for the multiple features to be analyzed, including: Taking each of the multiple behaviors to be analyzed as a target behavior, and comparing the characteristics of the target behavior with the multiple first known risk behaviors respectively, to obtain a single behavior analysis result for the target behavior; Based on the single behavior analysis result, an overall analysis result for the multiple behaviors to be analyzed is obtained as a second type of analysis result for the multiple features to be analyzed.

8. A program analysis method, comprising: Based on the target program, multiple features to be analyzed are obtained; The multiple features to be analyzed are sent to a service device; wherein the service device is used to perform risk analysis on the multiple features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed, and is used to perform risk analysis on unknown behaviors through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behaviors; the unknown behaviors are determined from the multiple features to be analyzed based on the first risk analysis result.

9. The method according to claim 8, wherein: Based on the target program, a plurality of features to be analyzed are obtained, including: Decompile the target program to obtain the code decompilation result; Cut the code decompilation results to obtain multiple code fragments to be analyzed; Based on the multiple code snippets to be analyzed, multiple features to be analyzed are obtained.

10. The method according to claim 8, wherein: Based on the target program, a plurality of features to be analyzed are obtained, including: Perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed; Based on the multiple behaviors to be analyzed, multiple features to be analyzed are obtained.

11. The method according to claim 10, wherein: The target program is dynamically tested for behavior, and multiple behaviors to be analyzed are obtained, including: The detection and confrontation technology is used to perform dynamic behavior detection on the target program and obtain multiple behaviors to be analyzed.

12. A program analysis device, comprising: A first feature acquisition unit, used to acquire a plurality of features to be analyzed of a target program; A first risk analysis unit, configured to perform risk analysis on the plurality of features to be analyzed by using a static feature comparison strategy and / or a dynamic behavior detection strategy, and obtain a first risk analysis result for the plurality of features to be analyzed; The second risk analysis unit is used to perform risk analysis on the unknown behavior through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behavior; wherein the unknown behavior is determined from the multiple features to be analyzed based on the first risk analysis result.

13. The analysis device according to claim 12, wherein: The second risk analysis unit is used for: Taking each first known risk behavior among the plurality of first known risk behaviors as a first behavior to be compared, so as to obtain first behavior association information of the first behavior to be compared; Obtaining second behavior association information of unknown behavior; By comparing the first behavior association information and the second behavior association information, a second risk analysis result for the unknown behavior is obtained.

14. The device according to claim 13, wherein: The second risk analysis unit is used for: Obtaining a primary analysis result for the unknown behavior by comparing the first behavior association information with the second behavior association information; In the case where the initial analysis result indicates that the unknown behavior is a risky behavior, using the initial analysis result as a second risk analysis result for the target program; Alternatively, when the initial analysis result indicates that the unknown behavior is a non-risky behavior, a large language model is used to obtain a second risk analysis result for the unknown behavior.

15. The device according to claim 14, wherein: The second risk analysis unit is used for: Using large language models, multiple second known risk behaviors are identified; taking each second known risk behavior among the plurality of second known risk behaviors as a second behavior to be compared, so as to obtain third behavior association information of the second behavior to be compared; By comparing the correlation between the second behavior association information and the third behavior association information, a second risk analysis result for the unknown behavior is obtained.

16. The device according to any one of claims 12 to 15, wherein: The first risk analysis unit is used for: Performing risk analysis on the multiple features to be analyzed by using a static feature comparison strategy to obtain a first type of analysis result for the multiple features to be analyzed; Performing risk analysis on the multiple features to be analyzed by a dynamic behavior detection strategy to obtain a second type of analysis result for the multiple features to be analyzed; Based on the first type of analysis results and the second type of analysis results, a first risk analysis result for the multiple features to be analyzed is obtained.

17. The device according to claim 16, wherein: The multiple features to be analyzed include multiple code fragments to be analyzed; the first risk analysis unit is used to: Taking each of the multiple code fragments to be analyzed as a target code fragment, and performing feature comparison between the target code fragment and multiple known risk code fragments, respectively, to obtain a single fragment analysis result for the target code fragment; Based on the single fragment analysis result, an overall analysis result for the multiple code fragments to be analyzed is obtained as a first type of analysis result for the multiple features to be analyzed.

18. The device according to claim 16, wherein: The multiple features to be analyzed include multiple behaviors to be analyzed; the first risk analysis unit is used to: Taking each of the multiple behaviors to be analyzed as a target behavior, and comparing the characteristics of the target behavior with the multiple first known risk behaviors respectively, to obtain a single behavior analysis result for the target behavior; Based on the single behavior analysis result, an overall analysis result for the multiple behaviors to be analyzed is obtained as a second type of analysis result for the multiple features to be analyzed.

19. A program analysis device, comprising: A second feature acquisition unit is used to obtain a plurality of features to be analyzed based on the target program; A feature sending unit is used to send the multiple features to be analyzed to a service device; wherein the service device is used to perform risk analysis on the multiple features to be analyzed through a static feature comparison strategy and / or a dynamic behavior detection strategy to obtain a first risk analysis result for the multiple features to be analyzed, and is used to perform risk analysis on unknown behaviors through a behavior correlation analysis strategy to obtain a second risk analysis result for the unknown behaviors; the unknown behaviors are determined from the multiple features to be analyzed based on the first risk analysis result.

20. The device according to claim 19, wherein The second feature acquisition unit is used for: Decompile the target program to obtain the code decompilation result; Cut the code decompilation results to obtain multiple code fragments to be analyzed; Based on the multiple code snippets to be analyzed, multiple features to be analyzed are obtained.

21. The device according to claim 19, wherein The second feature acquisition unit is used for: Perform dynamic behavior detection on the target program to obtain multiple behaviors to be analyzed; Based on the multiple behaviors to be analyzed, multiple features to be analyzed are obtained.

22. The device according to claim 21, wherein The second feature acquisition unit is used for: The detection and confrontation technology is used to perform dynamic behavior detection on the target program and obtain multiple behaviors to be analyzed.

23. An electronic device, comprising: at least one processor; a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 11.

24. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 11.

25. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 11.

Images