Depth detection method for effective core domain names of harmful APPs

Abstract

The invention relates to the technical field of APP detection data processing, and discloses a deep detection method for an effective core domain name of a harmful APP, which comprises the following steps: firstly, constructing a sandbox environment, constructing a network proxy service in the sandbox environment, comprehensively acquiring communication flow information of the APP, and accessing the Internet after connecting a gateway in a TUN mode in a sandbox test environment; performing internal operation of the automatic operation APP, wherein the internal operation comprises login, registration and refreshing operation; and carrying out operation analysis, and limiting network bandwidth, delay and packet loss rate parameters. Carrying out core domain name analysis, wherein the core domain name analysis specifically comprises carrying out deep detection on a traffic log; and training the model according to the traffic log, analyzing the traffic log through the model, performing model analysis by using a machine learning decision tree algorithm or a data analysis method, and confirming and analyzing effective condition data of the APP. According to the method, an APP communication log analysis model is constructed based on a decision tree algorithm, and suspected core domain names are identified based on dimensions such as communication behaviors and communication contents.

Description

Technical Field

[0001] The present invention relates to the technical field of APP detection data processing, and in particular to a method for deep detection of effective core domain names of harmful APPs. Background Art

[0002] With the rapid development of mobile Internet, various types of apps are emerging one after another. However, some harmful apps have also been mixed in, posing serious threats to users' device security, privacy protection and network environment. At present, the detection of harmful apps mainly focuses on code analysis and behavior monitoring, but the in-depth detection of key domain names is relatively insufficient. Traditional domain name detection methods can often only identify known malicious domain names. With the update and iteration of technology, key domain names are disguised and dynamically loaded, which makes it difficult to effectively detect.

[0003] At present, the following two existing technologies are mainly used to detect harmful APP key domain names:

[0004] (1) A method and system for discovering APP primary domain name based on simulated sandbox technology

[0005] Technical content: After the APP to be tested is operated based on the simulated sandbox, the domain name set returned by the APP to be tested is collected; the main domain name of the APP to be tested is obtained by using the domain name set returned by the APP to be tested, and the main domain name of the APP is effectively discovered, with high accuracy and execution efficiency. Through full-process automated static and dynamic rapid monitoring, the harmful APP discovery and analysis system is further optimized, the existing system's discovery of harmful APP data is enhanced, the effect of the application of dynamic detection technology is optimized, and the system's APP traceability and registration information query functions are enhanced, so that the harmful APP discovery and analysis system can be fully utilized.

[0006] Patent publication number: CN114021114A

[0007] (2) A method for verifying APP domain names

[0008] Technical content: Obtain the original data traffic packets generated by all operations of the APP to be tested; filter the original data traffic packets with the public API knowledge base, remove the public URL, and obtain the remaining data traffic packets; perform comprehensive calculations on the remaining data traffic packets; determine the actual domain name of the APP to be tested; check whether the actual domain name of the APP has been filed; the public API knowledge base only considers the domain name, ignoring the difference in parameters or files. The method of the present invention can accurately and quickly obtain the real domain names of batches of APPs, and verify whether they are filed, so as to determine whether they are trustworthy.

[0009] Therefore, to address the above issues, a method for deep detection of effective core domain names of harmful apps is needed. Summary of the invention

[0010] The purpose of the present invention is to provide a method for deep detection of effective core domain names of harmful APPs. The present invention automatically runs the APP through the APP sandbox operating environment, and constructs an automated click operation method to trigger the relevant functions of the APP, extracts the communication traffic logs generated by the APP (including domain names, IPs, ports, protocols, payloads, etc.), and builds a core domain name identification model based on the decision tree algorithm. The suspected core domain names are analyzed and discovered and intercepted and verified on the gateway side. Most importantly, the present invention performs multiple time periods, automated simulation operations, switching network environments, weak network states, resetting installation states, and other operations during the monitoring process, monitors the triggered new traffic, and loops the above process to obtain a comprehensive APP communication log.

[0011] The present invention is achieved in that:

[0012] The present invention provides a method for deep detection of effective core domain names of harmful apps, which is specifically performed in the following steps:

[0013] S1: First, build a sandbox environment, build a network proxy service in the sandbox environment, fully obtain the communication traffic information of the APP, and then access the Internet after connecting to the gateway through TUN mode in the sandbox test environment; automatically operate the internal operations of the APP, including login, registration, and refresh operations;

[0014] S2: Perform operation analysis, simulate different degrees of weak network conditions by limiting network bandwidth, delay and packet loss rate parameters, and monitor the communication behavior of the APP;

[0015] S3: Restart the APP according to the test progress, and detect the communication behavior of the APP during the initialization process and state switching process after the restart;

[0016] S4: Perform a reset installation during the test to simulate the first installation by a new user. Through the reset installation, detect issues such as the functional integrity, initialization settings, and user guidance of the APP in a new installation state, and the access to the Internet in various device network environments.

[0017] S5: Conduct core domain name analysis, including in-depth detection of traffic logs; train models based on traffic logs, where traffic logs specifically include domain name, IP, port, protocol, communication volume, communication time, path, parameters, and return information data.

[0018] Traffic logs are analyzed through models, specifically based on the cleaned traffic logs and constructed dimensional indicators, and model analysis is performed using machine learning decision tree algorithms or data analysis methods to determine the core domain name of the APP, based on the cleaned traffic logs and constructed dimensional indicators. The construction of dimensional indicators specifically includes constructing a core domain name analysis dimension based on the analyzed APP type, specifically including domain name, filing information, path, port, correlation, content monitoring, and trusted domain name list information to construct dimensional indicators.

[0019] The specific steps for model analysis using machine learning decision tree algorithms or data analysis methods are as follows:

[0020] S 5.1 : First, through the traffic log dataset D ＝ {(d1 , d2 ,..., d n )} ;

[0021] Where di represents the i-th traffic log record, and each record di contains the following fields: domain name, IP, port, protocol, communication volume, communication time, path, parameters, and return information;

[0022] S 5.2 : Clean the traffic log data set, remove duplicate values, process missing values, and detect and process outliers;

[0023] S 5.3 : Construct features, first encode the domain name, and perform One-Hot encoding: create a binary vector for each domain name. The length of the vector is the number of domain name types. The position of the corresponding domain name is 1, and the rest are 0;

[0024] S 5.4 : Perform feature scaling and standardize or normalize numerical features including communication volume and communication time, as shown in the following formula:

[0025]

[0026] Among them, μ is the mean of the feature, σ is the standard layer of the feature;

[0027] S 5.5 : Scale the eigenvalues ​​to the range specified by 0 to 1, as shown below;

[0028]

[0029] Among them, min(x) and max(x) are the minimum and maximum values ​​of the feature respectively;

[0030] S5.5 : Conduct core domain name analysis and use the information gain or Gini impurity index in the decision tree algorithm to evaluate the correlation between the domain name and the APP type; as shown in the following formula;

[0031]

[0032] Among them, H(D) is the entropy of the data set D, V(A) is all possible values ​​of the domain name of attribute A, and D v is a subset of attribute A with value v, H(D v ) is a subset D v Entropy of

[0033] Furthermore, by recursively dividing the data space, a series of if-then rules are formed, and finally a tree structure that reflects the relationship between domain names and APP types is formed;

[0034] Filing information check: verify the filing information corresponding to the domain name, and use regular expressions or database query methods to match and verify the filing information;

[0035] Path keyword detection: perform keyword detection on the path and use text matching algorithm to detect keywords and identify whether there are specially named keywords or sensitive information; as shown below;

[0036]

[0037] Among them, C is the category, whether the keyword exists, X is the feature vector, which is the text in the path;

[0038] Non-standard port detection: Check the port data to identify whether there are non-standard ports (i.e. non-standard service ports, such as HTTP port 80, HTTPS port 443, etc.);

[0039] Relevance analysis evaluates the text matching relevance between the domain name and the business, using cosine similarity and Jaccard similarity indicators for measurement; by calculating the similarity between the domain name and the business description, the domain name that is highly relevant to the business is identified; as shown in the following formula;

[0040]

[0041] Among them, A and B are two vectors, which are the word frequency vectors of domain name description and business description;

[0042] Content monitoring uses natural language processing (NLP), such as word segmentation, part-of-speech tagging, named entity recognition, etc. to perform content analysis to match and monitor the text in the body to identify whether there is malicious content or sensitive information. Model analysis specifically includes model evaluation and optimization, where model evaluation indicators include accuracy, precision, recall, and F1 score indicators to evaluate model performance, and cross-validation, using K-fold cross-validation to evaluate the stability and generalization ability of the model. Model analysis is as follows;

[0043]

[0044] Among them, is the ratio of correctly classified domain names to the total domain names;

[0045]

[0046] Among them, the proportion of domain names predicted to be core domain names that are actually core domain names;

[0047]

[0048] Among them, Recal l is the proportion of correctly predicted domain names among all the domain names that are truly core domain names;

[0049]

[0050] Among them, F1 is the harmonic mean of precision and recall.

[0051] S6: The suspected core domain name is analyzed and intercepted and verified on the gateway side to confirm the valid situation data of the analysis APP;

[0052] The dimensional indicator information of domain name, filing information, path, port, relevance, content monitoring, and trusted domain name list information is constructed, including judging the relevance between the domain name and the APP;

[0053] Check the filing information to see if there is any filing information, check the path to see if there are any specially named keywords, check the port to see if there is any port data of a non-standard port, check the relevance to see the text matching relevance between the domain name and the business, match the content detection to see the specific text in the Body, and perform whitelist filtering on the trusted domain name list.

[0054] Furthermore, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of any one of the above-mentioned methods for deep detection of effective core domain names of harmful apps are implemented.

[0055] Furthermore, the present invention provides a computer-storable medium, wherein the computer-readable storage medium includes an embedded processing system and a stored program, and when the embedded system control program is running, the method for deep detection of effective core domain names of harmful apps is controlled to execute any one of the above-mentioned embedded-based industrial motion control methods.

[0056] Compared with the prior art, the present invention has the following beneficial effects:

[0057] 1. By building a sandbox environment, running the APP through automated means, identifying and triggering key business segments such as APP login, registration, and list refresh, and monitoring the communication traffic sent by the APP by building a network proxy service, switching the network access environment, simulating a weak network environment, and restarting and reinstalling the APP multiple times during the analysis process to obtain the complete communication traffic of the APP; building an APP communication log analysis model based on the decision tree algorithm, and identifying suspected core domain names based on communication behavior, communication content and other dimensions.

[0058] 2. Automatically run the APP through the APP sandbox operating environment, and build an automated click operation method to trigger the relevant functions of the APP, extract the communication traffic log generated by the APP (including domain name, IP, port, protocol, payload, etc.), build a core domain name recognition model based on the decision tree algorithm, analyze and find suspected core domain names and intercept and verify them on the gateway side. Most importantly, the present invention monitors the triggered new traffic in multiple time periods, automated simulation operations, switching network environment, weak network status, resetting installation status, etc. during the monitoring process, and loops the above process to obtain a comprehensive APP communication log. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It is understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0060] Figure 1 is a flow chart of the method of the present invention;

[0061] Figure 2 The data processing code of the present invention is Figure 1 ;

[0062] Figure 3 The data processing code of the present invention is Figure 2 ;

[0063] Figure 4 The data processing code of the present invention is Figure 3 . DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but is only for selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0065] See also Figure 1-Figure 4 , the present invention provides a method for deep detection of effective core domain names of harmful APPs;

[0066] Please follow the steps below:

[0067] S1: First, build a sandbox environment, build a network proxy service in the sandbox environment, fully obtain the communication traffic information of the APP, and then access the Internet after connecting to the gateway through TUN mode in the sandbox test environment; automatically operate the internal operations of the APP, including login, registration, and refresh operations;

[0068] S2: Perform operation analysis, simulate different degrees of weak network conditions by limiting network bandwidth, delay and packet loss rate parameters, and monitor the communication behavior of the APP;

[0069] S3: Restart the APP according to the test progress, and detect the communication behavior of the APP during the initialization process and state switching process after the restart;

[0070] S4: Perform a reset installation during the test to simulate the first installation by a new user. Through the reset installation, detect issues such as the functional integrity, initialization settings, and user guidance of the APP in a new installation state, and the access to the Internet in various device network environments.

[0071] S5: Conduct core domain name analysis, including in-depth detection of traffic logs; train models based on traffic logs, where traffic logs specifically include domain name, IP, port, protocol, communication volume, communication time, path, parameters, and return information data.

[0072] Traffic logs are analyzed through models, specifically based on the cleaned traffic logs and constructed dimensional indicators, and model analysis is performed using machine learning decision tree algorithms or data analysis methods to determine the core domain name of the APP, based on the cleaned traffic logs and constructed dimensional indicators. The construction of dimensional indicators specifically includes constructing a core domain name analysis dimension based on the analyzed APP type, specifically including domain name, filing information, path, port, correlation, content monitoring, and trusted domain name list information to construct dimensional indicators.

[0073] The specific steps for model analysis using machine learning decision tree algorithms or data analysis methods are as follows:

[0074] S 5.1 : First, through the traffic log dataset D ＝ {(d1 , d2 ,..., d n )} ;

[0075] Where di represents the i-th traffic log record, and each record di contains the following fields: domain name, IP, port, protocol, communication volume, communication time, path, parameters, and return information;

[0076] S 5.2 : Clean the traffic log data set, remove duplicate values, process missing values, and detect and process outliers;

[0077] S 5.3 : Construct features, first encode the domain name, and perform One-Hot encoding: create a binary vector for each domain name. The length of the vector is the number of domain name types. The position of the corresponding domain name is 1, and the rest are 0;

[0078] S 5.4 : Perform feature scaling and standardize or normalize numerical features including communication volume and communication time, as shown in the following formula:

[0079]

[0080] Among them, μ is the mean of the feature, σ is the standard layer of the feature;

[0081] S 5.5 : Scale the eigenvalues ​​to the range specified by 0 to 1, as shown below;

[0082]

[0083] Among them, min(x) and max(x) are the minimum and maximum values ​​of the feature respectively;

[0084] S5.5 : Conduct core domain name analysis and use the information gain or Gini impurity index in the decision tree algorithm to evaluate the correlation between the domain name and the APP type; as shown in the following formula;

[0085]

[0086] Among them, H(D) is the entropy of the data set D, V(A) is all possible values ​​of the domain name of attribute A, and D v is a subset of attribute A with value v, H(D v ) is a subset D v Entropy of

[0087] In this embodiment, by recursively dividing the data space, a series of if-then rules are formed, and finally a tree structure reflecting the relationship between domain names and APP types is formed;

[0088] Filing information check: verify the filing information corresponding to the domain name, and use regular expressions or database query methods to match and verify the filing information;

[0089] Path keyword detection: perform keyword detection on the path and use text matching algorithm to detect keywords and identify whether there are specially named keywords or sensitive information; as shown below;

[0090]

[0091] Among them, C is the category, whether the keyword exists, X is the feature vector, which is the text in the path;

[0092] Non-standard port detection: Check the port data to identify whether there are non-standard ports (i.e. non-standard service ports, such as HTTP port 80, HTTPS port 443, etc.);

[0093] Relevance analysis evaluates the text matching relevance between the domain name and the business, using cosine similarity and Jaccard similarity indicators for measurement; by calculating the similarity between the domain name and the business description, the domain name that is highly relevant to the business is identified; as shown in the following formula;

[0094]

[0095] Among them, A and B are two vectors, which are the word frequency vectors of domain name description and business description;

[0096] Content monitoring uses natural language processing (NLP), such as word segmentation, part-of-speech tagging, named entity recognition, etc. to perform content analysis to match and monitor the text in the body to identify whether there is malicious content or sensitive information. Model analysis specifically includes model evaluation and optimization, where model evaluation indicators include accuracy, precision, recall, and F1 score indicators to evaluate model performance, and cross-validation, using K-fold cross-validation to evaluate the stability and generalization ability of the model. Model analysis is as follows;

[0097]

[0098] Among them, is the ratio of correctly classified domain names to the total domain names;

[0099]

[0100] Among them, the proportion of domain names predicted to be core domain names that are actually core domain names;

[0101]

[0102] Among them, Recal l is the proportion of correctly predicted domain names among all the domain names that are truly core domain names;

[0103]

[0104] Among them, F1 is the harmonic mean of precision and recall.

[0105] S6: The suspected core domain name is analyzed and intercepted and verified on the gateway side to confirm the valid situation data of the analysis APP;

[0106] The dimensional indicator information of domain name, filing information, path, port, relevance, content monitoring, and trusted domain name list information is constructed, including judging the relevance between the domain name and the APP;

[0107] Check the filing information to see if there is any filing information, check the path to see if there are any specially named keywords, check the port to see if there is any port data of a non-standard port, check the relevance to see the text matching relevance between the domain name and the business, match the content detection to see the specific text in the Body, and perform whitelist filtering on the trusted domain name list.

[0108] In this embodiment, the steps of the above-mentioned harmful APP effective core domain name in-depth detection method are as follows through the illegal lending APP instance data:

[0109] S1: Build sandbox environment and network proxy service

[0110] Build a sandbox environment: Use virtualization technology (such as Docker, VMware, etc.) to create an isolated test environment to ensure that the testing process does not affect the real network environment.

[0111] Build a network proxy service: Configure a network proxy (such as Squid, Charles, etc.) in the sandbox environment to capture all network communication traffic of the APP.

[0112] TUN mode connection gateway: Connect the sandbox environment to the external network (such as the Internet) through TUN mode to ensure that the APP can access the network normally.

[0113] Automatically operate the APP: Use automated testing tools (such as Appium, UiAutomator, etc.) to simulate user login, registration, refresh and other operations to trigger the APP's network communication.

[0114] S2: Operation analysis and weak network simulation

[0115] Limit network bandwidth: Use network traffic control tools (such as tc, Traffic Control) to limit the network bandwidth of the sandbox environment and simulate a low-speed network environment.

[0116] Delay and packet loss rate parameters: Also use tools such as tc to set network delay and packet loss rate to simulate different degrees of weak network conditions.

[0117] Monitor communication behavior: In a weak network environment, capture the communication behavior of the APP through the proxy service, including request frequency, response time, retry mechanism, etc.

[0118] S3: Restart operation and communication behavior detection

[0119] Restart APP: Restart the APP according to the test progress.

[0120] Initialization and state switching: After the app is restarted, the proxy service is used to capture the communication behaviors during the initialization process and state switching process to analyze whether there is abnormal communication.

[0121] S4: Reinstallation and new environment testing

[0122] Reset installation: Delete the app and reinstall it in the sandbox environment to simulate the first installation by a new user.

[0123] Functional integrity testing: Use automated testing tools to perform functional testing on the APP to ensure its functional integrity in a newly installed state.

[0124] Initial setup and user guidance: Check the initial setup and user guidance process of the APP to ensure a good user experience.

[0125] Device network environment test: Access the Internet under different devices and network environments, and observe the communication behavior and performance of the APP.

[0126] S5: core domain name analysis and model training; the results are shown in Table 1;

[0127] Table 1 Analysis of loan APP domain name data

[0128]

[0129] In this embodiment, the access frequency and communication volume analysis shows that the access frequency and communication volume of loan123.com and cashnow.io are both high, indicating that these two domain names have high activity and data transmission volume among users.

[0130] The access frequency and communication volume of quickcash.net and fastmoney.co are moderate, and they may be medium-sized illegal lending platforms.

[0131] The access frequency and communication volume of easyloan.org are low, which may belong to a small or start-up illegal lending platform.

[0132] In this embodiment, communication time pattern analysis;

[0133] The communication time of loan123.com is mainly concentrated in working hours, indicating that this domain name may carry out a large amount of data transmission and communication activities on weekdays.

[0134] The communication times of quickcash.net are distributed around the clock, indicating that the domain name may be conducting illegal lending activities at any time.

[0135] The communication time of easyloan.org is mainly active at night, which may be an illegal lending platform operating at night or have other abnormal behaviors.

[0136] The communication time of fastmoney.co is concentrated during the peak hours on weekdays, which is consistent with the communication pattern of formal financial service providers.

[0137] The communication time of cashnow.io is frequent and random, indicating that the domain name may be conducting illegal and covert network activities.

[0138] In this embodiment, in summary, the core domain names and related information of illegal loan apps were successfully identified and analyzed. For these core domain names, it is recommended that relevant departments take the following measures:

[0139] Further investigate domain names of suspected illegal lending platforms such as loan123.com, quickcash.net, and cashnow.io, and ban their illegal activities in accordance with the law.

[0140] Pay special attention to and monitor small or start-up illegal lending platforms such as easyloan.org to prevent them from expanding in scale and harming society.

[0141] Verify the business legitimacy and supervise formal financial service providers that may pose risks, such as fastmoney.co.

[0142] In this embodiment, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of any one of the above-mentioned methods for deep detection of effective core domain names of harmful apps are implemented.

[0143] In this embodiment, the present invention provides a computer-storable medium, wherein the computer-readable storage medium includes an embedded processing system and a stored program, and when the embedded system control program is running, the method for deep detection of effective core domain names of harmful apps is controlled to execute any one of the above-mentioned embedded-based industrial motion control methods.

[0144] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention has various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for deep detection of effective core domain names of harmful apps, characterized by: Please follow the steps below: S1: First, build a sandbox environment, build a network proxy service in the sandbox environment, fully obtain the communication traffic information of the APP, and then access the Internet after connecting to the gateway through TUN mode in the sandbox test environment; automatically operate the internal operations of the APP, including login, registration, and refresh operations; S2: Perform operation analysis, simulate different degrees of weak network conditions by limiting network bandwidth, delay and packet loss rate parameters, and monitor the communication behavior of the APP; S3: Restart the APP according to the test progress, and detect the communication behavior of the APP during the initialization process and state switching process after the restart; S4: Perform a reset installation during the test to simulate the first installation by a new user; S5: Conduct core domain name analysis, including in-depth detection of traffic logs; train models based on traffic logs, analyze traffic logs through models, and use machine learning decision tree algorithms or data analysis methods to conduct model analysis based on cleaned traffic logs and constructed dimension indicators to determine the core domain name of the APP; S6: The suspected core domain name will be analyzed and intercepted and verified on the gateway side to confirm the valid situation data of the analysis APP.

2. According to claim 1, a method for deep detection of effective core domain names of harmful apps is characterized by: In step S5, the traffic log is deeply inspected, wherein the traffic log specifically includes data on domain name, IP, port, protocol, communication volume, communication time, path, parameters, and return information.

3. According to claim 1, a method for deep detection of effective core domain names of harmful apps is characterized by: Constructing dimensional indicators specifically includes constructing a core domain name analysis dimension based on the type of APP being analyzed, which specifically includes domain name, filing information, path, port, correlation, content monitoring, and trusted domain name list information to construct dimensional indicators.

4. According to claim 3, a method for deep detection of effective core domain names of harmful apps is characterized by: The dimensional indicator information of domain name, filing information, path, port, relevance, content monitoring, and trusted domain name list information is constructed, including judging the relevance between the domain name and the APP; Check the filing information to see if there is any filing information, check the path to see if there are any specially named keywords, check the port to see if there is any port data of a non-standard port, check the relevance to see the text matching relevance between the domain name and the business, match the content detection to see the specific text in the Body, and perform whitelist filtering on the trusted domain name list.

5. According to claim 1, a method for deep detection of effective core domain names of harmful apps is characterized by: Based on the cleaned traffic logs and constructed dimension indicators, use the machine learning decision tree algorithm or data analysis method to perform model analysis. The specific steps are as follows: S 5.1 : First, through the traffic log dataset D ＝ {(d1 , d2 ,..., d n )} ; Where di represents the i-th traffic log record, and each record di contains the following fields: domain name, IP, port, protocol, communication volume, communication time, path, parameters, and return information; S 5.2 : Clean the traffic log data set, remove duplicate values, process missing values, and detect and process outliers; S 5.3 : Construct features, first encode the domain name, and perform One-Hot encoding: create a binary vector for each domain name. The length of the vector is the number of domain name types. The position of the corresponding domain name is 1, and the rest are 0; S 5.4 : Perform feature scaling and standardize or normalize numerical features including communication volume and communication time, as shown in the following formula: Among them, μ is the mean of the feature, σ is the standard layer of the feature; S 5.5 : Scale the eigenvalues ​​to the range specified by 0 to 1, as shown below; Among them, min(x) and max(x) are the minimum and maximum values ​​of the feature respectively; S 5.5 : Conduct core domain name analysis and use the information gain or Gini impurity index in the decision tree algorithm to evaluate the correlation between the domain name and the APP type; as shown in the following formula; Among them, H(D) is the entropy of the data set D, V(A) is all possible values ​​of the domain name of attribute A, and D v is a subset of attribute A with value v, H(D v ) is a subset D v Entropy of By recursively dividing the data space, a series of if-then rules are formed, which eventually form a tree structure that reflects the relationship between domain names and APP types; Filing information check: verify the filing information corresponding to the domain name, and use regular expressions or database query methods to match and verify the filing information; Path keyword detection: perform keyword detection on the path and use text matching algorithm to detect keywords and identify whether there are specially named keywords or sensitive information; as shown in the following formula; Among them, C is the category, whether the keyword exists, X is the feature vector, which is the text in the path; Non-standard port detection: check the port data to identify whether there are non-standard ports; Relevance analysis evaluates the text matching relevance between the domain name and the business, using cosine similarity and Jaccard similarity indicators for measurement; by calculating the similarity between the domain name and the business description, the domain name that is highly relevant to the business is identified; as shown in the following formula; Among them, A and B are two vectors, which are the word frequency vectors of domain name description and business description; Content monitoring uses natural language processing (NLP) to identify whether there is malicious content or sensitive information.

6. A method for deep detection of effective core domain names of harmful apps according to claim 5, characterized in that: Model analysis specifically includes model evaluation and optimization. Model evaluation indicators include using accuracy, precision, recall, and F1 score indicators to evaluate model performance, and cross-validation, using K-fold cross-validation to evaluate the stability and generalization ability of the model.

7. A method for deep detection of effective core domain names of harmful apps according to claim 6, characterized in that: The model analysis is as follows; Among them, is the ratio of correctly classified domain names to the total domain names; Among them, the proportion of domain names predicted to be core domain names that are actually core domain names; Among them, Recall is the proportion of correctly predicted domain names among all the domain names that are truly core domain names; Among them, F1 is the harmonic mean of precision and recall.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of a method for deep detection of effective core domain names of harmful apps as described in any one of claims 1-7 are implemented.

9. A computer storable medium, characterized in that: The computer-readable storage medium includes an embedded processing system and a stored program. When the embedded system control program is running, the method for deep detection of effective core domain names of harmful apps is controlled to execute the steps of any one of the methods for deep detection of effective core domain names of harmful apps in claims 1-7.

Images