A harmful app effective core domain name depth detection method

Abstract

The application relates to the technical field of APP detection data processing, and discloses a harmful APP effective core domain name deep detection method, which comprises the following steps: firstly, a sandbox environment is constructed, a network proxy service is constructed in the sandbox environment, and communication traffic information of an APP is comprehensively acquired; then, the APP accesses the Internet through a TUN mode connection gateway in the sandbox test environment; internal operations of the APP are automatically operated, including login, registration and refreshing operations; running analysis is carried out by limiting network bandwidth, delay and packet loss rate parameters; core domain name analysis is carried out, specifically including deep detection of traffic logs; a training model is established according to the traffic logs, the traffic logs are analyzed through the model, a machine learning decision tree algorithm or a data analysis method is used for model analysis, and effective situation data of the APP is confirmed and analyzed. The application constructs an APP communication log analysis model based on a decision tree algorithm, and identifies suspected core domain names based on dimensions such as communication behavior and communication content.

Description

Technical Field

[0001] This invention relates to the field of APP detection data processing technology, specifically a method for deep detection of the effective core domain name of a harmful APP. Background Technology

[0002] With the rapid development of the mobile internet, various apps have emerged in endless streams. However, some harmful apps have also infiltrated this landscape, posing a serious threat to users' device security, privacy protection, and the online environment. Currently, the detection of harmful apps mainly focuses on code analysis and behavioral monitoring, but in-depth detection of key domains is relatively insufficient. Traditional domain detection methods often can only identify known malicious domains, and with technological updates and iterations, key domains are increasingly being disguised and dynamically loaded, making them difficult to detect effectively.

[0003] Currently, the detection of critical domains of harmful apps mainly employs the following two existing technologies:

[0004] (1) A method and system for discovering the main domain name of an APP based on simulated sandbox technology

[0005] Technical Content: After the tested APP operates in a simulated sandbox, a set of domain names returned by the tested APP is collected; the main domain name of the tested APP is obtained using the set of domain names returned by the tested APP, effectively discovering the main domain name of the APP with high accuracy and execution efficiency. Through fully automated static and dynamic rapid monitoring, the system for discovering and analyzing harmful APPs is further optimized, enhancing the existing system's ability to discover harmful APP data, optimizing the effect of using dynamic detection technology, and enhancing the system's functions for APP source tracing and location and registration information query, so that the system for discovering and analyzing harmful APPs can be fully utilized.

[0006] Patent Publication Number: CN114021114A

[0007] (2) A method for verifying APP domain names

[0008] Technical Content: This invention involves obtaining raw data traffic packets generated by all operations of the app under test; filtering the raw data traffic packets using a public API knowledge base to remove public URLs and obtain the remaining data traffic packets; performing comprehensive calculations on the remaining data traffic packets; determining the actual domain name of the app under test; and verifying whether the app's actual domain name has been registered. The public API knowledge base only considers the domain name, ignoring parameter or file differences. Using this method, the real domain names of a batch of apps can be accurately and quickly obtained, and their registration status can be verified, thereby determining their trustworthiness.

[0009] Therefore, to address the above issues, a method for in-depth detection of the effective core domains of harmful apps is needed. Summary of the Invention

[0010] The purpose of this invention is to provide a method for deep detection of the effective core domains of harmful apps. This invention automates the operation of the app within an app sandbox environment and constructs automated click operations to trigger relevant app functions. It extracts the communication traffic logs generated by the app (including domain names, IP addresses, ports, protocols, payloads, etc.), constructs a core domain identification model based on a decision tree algorithm, analyzes and identifies suspected core domains, and intercepts and verifies them at the gateway. Most importantly, this invention monitors new traffic triggered by multiple time periods, automated simulations, network environment switching, weak network conditions, and installation status resets during the monitoring process, and repeats the above process to obtain comprehensive app communication logs.

[0011] This invention is implemented as follows:

[0012] This invention provides a method for deep detection of the effective core domain name of a harmful APP, which is specifically performed according to the following steps:

[0013] S1: First, a sandbox environment is built. A network proxy service is then constructed within the sandbox environment to comprehensively acquire the APP's communication traffic information. Next, in the sandbox testing environment, the APP's internal operations are accessed via a TUN mode connection to the gateway. Automated operations are then performed on the APP's internal processes, including login, registration, and refresh.

[0014] S2: Perform operational analysis by limiting network bandwidth, latency, and packet loss rate parameters to simulate different levels of weak network conditions and monitor the APP's communication behavior;

[0015] S3: Restart the APP according to the test progress and test the communication behavior of the APP during the initialization process and state transition process after restart;

[0016] S4: Reinstall the app during the test to simulate a new user's first installation. By reinstalling, test the app's functionality, initialization settings, user guidance, and access to the internet under various device network environments.

[0017] S5: Perform core domain name analysis, specifically including in-depth inspection of traffic logs; train models based on traffic logs, which specifically include data such as domain name, IP address, port, protocol, communication volume, communication time, path, parameters, and return information.

[0018] Traffic log analysis is performed using a model. Specifically, based on the cleaned traffic logs and constructed dimensional indicators, machine learning decision tree algorithms or data analysis methods are used for model analysis to determine the core domain of the APP. The constructed dimensional indicators specifically include constructing core domain analysis dimensions based on the analyzed core domain of the APP, including domain name, filing information, path keyword detection, non-standard port detection, relevance analysis, content monitoring, and trusted domain name list information.

[0019] To perform model analysis using machine learning decision tree algorithms or data analysis methods, follow these steps:

[0020] S 5.1 First, use the traffic log dataset D={(d1,d2,...,dn)};

[0021] Where di represents the i-th traffic log record, and each record di contains the following fields: domain name, IP address, port, protocol, communication volume, communication time, path, parameters, and return information;

[0022] S 5.2 The traffic log dataset is cleaned to remove duplicate values ​​and handle missing values, as well as detect and handle outliers.

[0023] S 5.3 Feature construction begins with domain name encoding, specifically One-Hot encoding: a binary vector is created for each domain name, with the length of the vector equal to the number of domain name categories, and the corresponding position of the domain name is set to 1, while the rest are 0.

[0024] S 5.4 Feature scaling is performed on numerical features, including communication volume and communication time, by standardizing or normalizing them, as shown in the following formula:

[0025]

[0026] in, The mean of the features, The standard layer is characterized by its features;

[0027] S 5.5 : Scale the feature values ​​to a specified range of 0 to 1, as shown in the following formula;

[0028]

[0029] in, and These are the minimum and maximum values ​​of the feature, respectively;

[0030] S 5.6: Conduct core domain name analysis, and use the information gain or Gini impurity index in the decision tree algorithm to evaluate the correlation between the dimensional indicators and the core domain name of the APP; as shown in the following formula;

[0031]

[0032] in, It is the entropy of dataset D. It represents all possible values ​​for the attribute A (domain name). It is a subset of attribute A that takes the value v. It is a subset Entropy;

[0033] Furthermore, by recursively dividing the data space, a series of if-then rules are formed, creating a tree structure that reflects the relationship between dimensional indicators and the core domain name of the APP;

[0034] The registration information is checked by verifying the registration information corresponding to the domain name, using regular expressions or database query methods to match and verify the registration information.

[0035] Path keyword detection involves performing keyword detection on the path using a text matching algorithm to identify whether there are specially named keywords or sensitive information; as shown in the following formula;

[0036]

[0037] Where C is the category, indicating whether the keyword exists, and X is the feature vector, which is the text in the path;

[0038] Non-standard port detection involves checking port data to identify the presence of non-standard ports (i.e., non-standard service ports, such as port 80 for HTTP and port 443 for HTTPS).

[0039] Relevance analysis assesses the textual matching relevance between domain names and business information, using cosine similarity and Jaccard similarity metrics. By calculating the similarity between domain names and business descriptions, domain names highly relevant to the business are identified, as shown in the following formula.

[0040]

[0041] Among them, A and B are two vectors, which are the word frequency vectors of domain name description and business description;

[0042] Content monitoring utilizes Natural Language Processing (NLP) techniques, such as word segmentation, part-of-speech tagging, and named entity recognition, to analyze and match text within data packets, identifying the presence of malicious content or sensitive information. Model analysis specifically includes model evaluation and optimization. Evaluation metrics include accuracy, precision, recall, and F1 score to assess model performance, and cross-validation is performed, using K-fold cross-validation to evaluate model stability and generalization ability. The model analysis is illustrated below;

[0043]

[0044] Where, in the formula, is the proportion of correctly classified domain names to the total number of domain names;

[0045]

[0046] Among the domains predicted to be core domains, the proportion that are actually core domains;

[0047]

[0048] Here, Recall is the proportion of all domains that are truly core domains that were correctly predicted;

[0049]

[0050] F1 is the harmonic mean of precision and recall.

[0051] S6: Analyze and identify suspected core domains and intercept and verify them on the gateway side to confirm the validity of the analysis APP's data.

[0052] The specific dimensional indicators for constructing domain name, filing information, path keyword detection, non-standard port detection, relevance analysis, content monitoring, and trusted domain name list information include, in particular, judging the relevance between the domain name and the APP;

[0053] Check the filing information to see if there is any filing information; check the path to see if there are any specially named keywords; check the port to see if there is any non-standard port data; check the relevance of the domain name and the text matching of the business; detect the content and match the text in the data packet; and whitelist the trusted domain name list.

[0054] Furthermore, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method for deep detection of the effective core domain name of a harmful APP as described above.

[0055] Furthermore, the present invention provides a computer-readable storage medium, the computer-readable storage medium including an embedded processing system and a stored program, wherein the embedded system control program, when running, controls the method for deep detection of the effective core domain name of a harmful APP to execute any of the above-described embedded-based industrial motion control methods.

[0056] Compared with the prior art, the beneficial effects of the present invention are:

[0057] 1. By constructing a sandbox environment and automating the operation of the APP, we can identify and trigger key business modules such as APP login, registration, and list refresh. By constructing a network proxy service, we can monitor the communication traffic sent by the APP and analyze the complete communication traffic of the APP by switching network access environments, simulating weak network environments, and restarting and reinstalling the APP multiple times. Based on the decision tree algorithm, we can build an APP communication log analysis model and identify suspected core domain names based on communication behavior, communication content and other dimensions.

[0058] 2. The app is run automatically in an app sandbox environment, and automated click actions are used to trigger relevant app functions. Communication traffic logs generated by the app (including domain name, IP address, port, protocol, payload, etc.) are extracted. A core domain name identification model is built based on a decision tree algorithm to analyze and identify suspected core domain names, which are then intercepted and verified at the gateway. Most importantly, this invention monitors new traffic triggered by multiple time periods, automated simulations, network environment switching, weak network conditions, and installation status resets during the monitoring process, repeating the above process to obtain comprehensive app communication logs. Attached Figure Description

[0059] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0060] Figure 1 This is a flowchart of the method of the present invention;

[0061] Figure 2 This is a screenshot of the data processing code of the present invention. Figure 1 ;

[0062] Figure 3 This is a screenshot of the data processing code of the present invention. Figure 2 ;

[0063] Figure 4 This is a screenshot of the data processing code of the present invention. Figure 3 . Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to describe selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] Please see Figures 1-4 This invention provides a method for deep detection of the effective core domain name of a harmful APP;

[0066] Follow these steps:

[0067] S1: First, a sandbox environment is built. A network proxy service is then constructed within the sandbox environment to comprehensively acquire the APP's communication traffic information. Next, in the sandbox testing environment, the APP's internal operations are accessed via a TUN mode connection to the gateway. Automated operations are then performed on the APP's internal processes, including login, registration, and refresh.

[0068] S2: Perform operational analysis by limiting network bandwidth, latency, and packet loss rate parameters to simulate different levels of weak network conditions and monitor the APP's communication behavior;

[0069] S3: Restart the APP according to the test progress and test the communication behavior of the APP during the initialization process and state transition process after restart;

[0070] S4: Reinstall the app during the test to simulate a new user's first installation. By reinstalling, test the app's functionality, initialization settings, user guidance, and access to the internet under various device network environments.

[0071] S5: Perform core domain name analysis, specifically including in-depth inspection of traffic logs; train models based on traffic logs, which specifically include data such as domain name, IP address, port, protocol, communication volume, communication time, path, parameters, and return information.

[0072] Traffic log analysis is performed using a model. Specifically, based on the cleaned traffic logs and constructed dimensional indicators, machine learning decision tree algorithms or data analysis methods are used for model analysis to determine the core domain of the APP. The constructed dimensional indicators specifically include constructing core domain analysis dimensions based on the analyzed core domain of the APP, including domain name, filing information, path keyword detection, non-standard port detection, relevance analysis, content monitoring, and trusted domain name list information.

[0073] To perform model analysis using machine learning decision tree algorithms or data analysis methods, follow these steps:

[0074] S 5.1 First, use the traffic log dataset D={(d1,d2,...,dn)};

[0075] Where di represents the i-th traffic log record, and each record di contains the following fields: domain name, IP address, port, protocol, communication volume, communication time, path, parameters, and return information;

[0076] S 5.2 The traffic log dataset is cleaned to remove duplicate values ​​and handle missing values, as well as detect and handle outliers.

[0077] S 5.3 Feature construction begins with domain name encoding, specifically One-Hot encoding: a binary vector is created for each domain name, with the length of the vector equal to the number of domain name categories, and the corresponding position of the domain name is set to 1, while the rest are 0.

[0078] S 5.4 Feature scaling is performed on numerical features, including communication volume and communication time, by standardizing or normalizing them, as shown in the following formula:

[0079]

[0080] in, The mean of the features, The standard layer is characterized by its features;

[0081] S 5.5 : Scale the feature values ​​to a specified range of 0 to 1, as shown in the following formula;

[0082]

[0083] in, and These are the minimum and maximum values ​​of the feature, respectively;

[0084] S 5.6: Conduct core domain name analysis, and use the information gain or Gini impurity index in the decision tree algorithm to evaluate the correlation between the dimensional indicators and the core domain name of the APP; as shown in the following formula;

[0085]

[0086] in, It is the entropy of dataset D. It represents all possible values ​​for the attribute A (domain name). It is a subset of attribute A that takes the value v. It is a subset Entropy;

[0087] In this embodiment, by recursively dividing the data space, a series of if-then rules are formed, which constitute a tree structure that reflects the relationship between dimensional indicators and the core domain name of the APP.

[0088] The registration information is checked by verifying the registration information corresponding to the domain name, using regular expressions or database query methods to match and verify the registration information.

[0089] Path keyword detection involves performing keyword detection on the path using a text matching algorithm to identify whether there are specially named keywords or sensitive information; as shown in the following formula;

[0090]

[0091] Where C is the category, indicating whether the keyword exists, and X is the feature vector, which is the text in the path;

[0092] Non-standard port detection involves checking port data to identify the presence of non-standard ports (i.e., non-standard service ports, such as port 80 for HTTP and port 443 for HTTPS).

[0093] Relevance analysis assesses the textual matching relevance between domain names and business information, using cosine similarity and Jaccard similarity metrics. By calculating the similarity between domain names and business descriptions, domain names highly relevant to the business are identified, as shown in the following formula.

[0094]

[0095] Among them, A and B are two vectors, which are the word frequency vectors of domain name description and business description;

[0096] Content monitoring utilizes Natural Language Processing (NLP) techniques, such as word segmentation, part-of-speech tagging, and named entity recognition, to analyze and match text within data packets, identifying the presence of malicious content or sensitive information. Model analysis specifically includes model evaluation and optimization. Evaluation metrics include accuracy, precision, recall, and F1 score to assess model performance, and cross-validation is performed, using K-fold cross-validation to evaluate model stability and generalization ability. The model analysis is illustrated below;

[0097]

[0098] Where, in the formula, is the proportion of correctly classified domain names to the total number of domain names;

[0099]

[0100] Among the domains predicted to be core domains, the proportion that are actually core domains;

[0101]

[0102] Here, Recall is the proportion of all domains that are truly core domains that were correctly predicted;

[0103]

[0104] F1 is the harmonic mean of precision and recall.

[0105] S6: Analyze and identify suspected core domains and intercept and verify them on the gateway side to confirm the validity of the analysis APP's data.

[0106] The specific dimensional indicators for constructing domain name, filing information, path keyword detection, non-standard port detection, relevance analysis, content monitoring, and trusted domain name list information include, in particular, judging the relevance between the domain name and the APP;

[0107] Check the filing information to see if there is any filing information; check the path to see if there are any specially named keywords; check the port to see if there is any non-standard port data; check the relevance of the domain name and the text matching of the business; detect the content and match the text in the data packet; and whitelist the trusted domain name list.

[0108] In this embodiment, the steps of the above-mentioned method for deep detection of the effective core domain names of harmful apps using instance data of illegal lending apps are as follows:

[0109] S1: Building a sandbox environment and network proxy services

[0110] Building a sandbox environment: Use virtualization technologies (such as Docker, VMware, etc.) to create an isolated test environment to ensure that the testing process does not affect the real network environment.

[0111] Build a network proxy service: Configure a network proxy (such as Squid, Charles, etc.) in the sandbox environment to capture all network communication traffic of the APP.

[0112] TUN mode connection gateway: Connect the sandbox environment to the external network (such as the Internet) through TUN mode to ensure that the APP can access the network normally.

[0113] Automated App Operations: Use automated testing tools (such as Appium, UiAutomator, etc.) to simulate user login, registration, refresh, and other operations to trigger network communication within the app.

[0114] S2: Operational Analysis and Weak Network Simulation

[0115] Limit network bandwidth: Use network traffic control tools (such as tc, Traffic Control) to limit the network bandwidth of the sandbox environment to simulate a low-speed network environment.

[0116] Latency and packet loss rate parameters: Using tools such as tc, network latency and packet loss rate are set to simulate different levels of weak network conditions.

[0117] Monitoring communication behavior: In weak network environments, the proxy service captures the communication behavior of the APP, including request frequency, response time, retry mechanism, etc.

[0118] S3: Reboot Operation and Communication Behavior Detection

[0119] Restart the app: Restart the app according to the testing progress.

[0120] Initialization and State Transition: After the APP restarts, the communication behavior during its initialization and state transition processes is captured through the proxy service to analyze whether there is any abnormal communication.

[0121] S4: Reset Installation and Testing in a Fresh Environment

[0122] Reset Installation: Delete and reinstall the app in a sandbox environment to simulate a new user's first installation.

[0123] Functional integrity testing: The app is functionally tested using automated testing tools to ensure its functionality is complete in a newly installed state.

[0124] Initial setup and user onboarding: Check the app's initial setup and user onboarding process to ensure a good user experience.

[0125] Device network environment test: Access the Internet under different devices and network environments to observe the communication behavior and performance of the APP.

[0126] S5: Core domain name analysis and model training; results are shown in Table 1;

[0127] Table 1. Domain Name Data Analysis for Lending Apps

[0128] Serial Number domain name Organization affiliation (speculated) Server location (IP address resolution) Access frequency Communication volume Communication Time Mode 1 loan123.com Unknown Fintech Company A data center in California, USA high big Concentrated during working hours 2 quickcash.net Suspected illegal lending platform A server hosting company in Hong Kong, China middle middle All-weather distribution 3 easyloan.org Financial companies registered in the Philippines Manila Data Center, Philippines Low Small active at night 4 fastmoney.co A UK financial service provider (questionable) A data center in London, UK middle big Weekday peak 5 cashnow.io Cybercrime gangs hiding in Russia A data center in Moscow, Russia high great Frequent and random

[0129] In this embodiment, the access frequency and communication volume analysis shows that loan123.com and cashnow.io have high access frequencies and high communication volumes, indicating that these two domains have high user activity and data transmission volume.

[0130] The access frequency and communication volume of quickcash.net and fastmoney.co are moderate, suggesting they may be medium-sized illegal lending platforms.

[0131] The low frequency of access and volume of communication to easyloan.org suggests it may be a small or startup illegal lending platform.

[0132] In this embodiment, communication time pattern analysis is performed.

[0133] The communication activity of loan123.com is mainly concentrated during working hours, indicating that the domain name may have a large amount of data transmission and communication activity on weekdays.

[0134] The fact that quickcash.net's communication times are distributed throughout the day suggests that the domain may be engaged in illegal lending activities at any time.

[0135] The communication activity of easyloan.org is mainly at night, which may indicate that it is an illegal lending platform operating at night or has other abnormal behavior.

[0136] Fastmoney.co's communication times are concentrated during weekday peak hours, which is consistent with the communication patterns of legitimate financial service providers.

[0137] The frequent and random communication times of cashnow.io suggest that the domain may be engaged in illegal and clandestine cyber activities.

[0138] In this embodiment, the core domain names and related information of illegal lending apps were successfully identified and analyzed. Regarding these core domain names, it is recommended that relevant departments take the following measures:

[0139] Further investigation will be conducted into the domain names of suspected illegal lending platforms such as loan123.com, quickcash.net, and cashnow.io, and their illegal activities will be shut down in accordance with the law.

[0140] Focus on and monitor small or startup illegal lending platforms such as easyloan.org to prevent them from expanding and harming society.

[0141] Verify and regulate the legality of the business operations of legitimate financial service providers such as fastmoney.co, which may pose risks.

[0142] In this embodiment, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the method for deep detection of the effective core domain name of a harmful APP as described above.

[0143] In this embodiment, the present invention provides a computer-readable storage medium, which includes an embedded processing system and a stored program. When the embedded system control program is running, it controls the method for deep detection of the effective core domain name of a harmful APP to execute any of the above-described embedded industrial motion control methods.

[0144] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations will be apparent to those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for deep detection of the effective core domain name of a harmful APP, characterized in that: Follow these steps: S1: First, a sandbox environment is built. A network proxy service is then constructed within the sandbox environment to obtain the APP's communication traffic information. Next, in the sandbox testing environment, the APP connects to the gateway via TUN mode to access the internet. Automatic operations are then performed on the APP's internal processes, including login, registration, and refresh. S2: Perform operational analysis by limiting network bandwidth, latency, and packet loss rate parameters to simulate different levels of weak network conditions and monitor the APP's communication behavior; S3: Restart the APP according to the test progress and detect the communication behavior of the APP during the initialization process and state transition process after restarting; S4: Reset the installation during the test to simulate the situation of a new user's first installation; S5: Perform core domain name analysis, specifically including in-depth inspection of traffic logs; train a model based on the traffic logs, and analyze the traffic logs using the model. Specifically, based on the cleaned traffic logs and constructed dimensional indicators, use machine learning decision tree algorithms for model analysis to determine the APP's core domain names; the specific steps for model analysis using machine learning decision tree algorithms based on the cleaned traffic logs and constructed dimensional indicators are as follows: S 5.1 First, use the traffic log dataset D={(d1,d2,...,dn)}; Where di represents the i-th traffic log record i={1,2...n}, and each record di contains the fields domain name, IP address, port, protocol, communication volume, communication time, path, parameters, and return information; S 5.2 The traffic log dataset is cleaned to remove duplicate values ​​and handle missing values, as well as detect and handle outliers. S 5.3 Feature construction begins with domain name encoding, specifically One-Hot encoding: a binary vector is created for each domain name, with the length of the vector equal to the number of domain name categories, and the corresponding position of the domain name is set to 1, while the rest are 0. S 5.4 : Perform feature scaling, and standardize and normalize the numerical features, including communication volume and communication time. S 5.5 : Scale the feature values ​​to a specified range of 0 to 1; S 5.6 : Conduct core domain name analysis, use information gain in the decision tree algorithm to evaluate the correlation between dimensional indicators and the core domain name of the APP, and construct a tree structure that reflects the relationship between dimensional indicators and the core domain name of the APP. S6: The analysis will identify suspected core domains and intercept and verify them on the gateway side to confirm the validity of the analysis APP's data.

2. The method for deep detection of the effective core domain name of a harmful APP according to claim 1, characterized in that: In step S5, a deep inspection of the traffic logs is performed. The traffic logs specifically include data such as domain name, IP address, port, protocol, communication volume, communication time, path, parameters, and return information.

3. The method for deep detection of the effective core domain name of a harmful APP according to claim 1, characterized in that: The construction of dimensional indicators specifically includes building core domain name analysis dimensions based on the type of APP being analyzed. These dimensions include domain name, filing information, path keyword detection, non-standard port detection, correlation analysis, content monitoring, and trusted domain name list information. Among these, the filing information check includes verifying the filing information corresponding to the domain name, using regular expressions or database query methods to match and verify the filing information. Path keyword detection: This involves detecting keywords in the path using text matching algorithms to identify whether there are specially named keywords or sensitive information. Relevance analysis assesses the textual matching relevance between the domain name and the business description vector; content monitoring uses Natural Language Processing (NLP) to identify the presence of malicious content or sensitive information. Model analysis specifically includes model evaluation and optimization. Model evaluation metrics include using accuracy, precision, recall, and F1 score to assess model performance, and cross-validation is performed, using K-fold cross-validation to assess the model's stability and generalization ability.

4. The method for deep detection of the effective core domain name of a harmful APP according to claim 3, characterized in that: The dimensional indicator information for constructing domain name, filing information, path keyword detection, non-standard port detection, relevance analysis, content monitoring and trusted domain name list information also includes judging the relevance between the domain name and the APP; Check the filing information to see if there is any filing information; check the path to see if there are any specially named keywords; check the port to see if there is any non-standard port data; check the relevance of the domain name and the text matching relevance of the business; detect the content and match the specific text in the data; and whitelist the trusted domain name list.

5. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method for deep detection of the effective core domain name of a harmful APP as described in any one of claims 1-4.

6. A computer-storable medium, characterized in that: The computer-readable storage medium includes an embedded processing system and a stored program. When the embedded processing system controls the program to run, it executes the steps of implementing the method for deep detection of the effective core domain name of a harmful APP as described in any one of claims 1-4.

Images