Method for determining application security, electronic equipment and computer readable storage medium

Abstract

The invention discloses a method for determining application security, electronic equipment and a computer readable storage medium, and belongs to the field of Internet. The method for determining the application security comprises the steps that target information of a target application deployed in a sandbox environment is acquired, the target information is used for reflecting behavior characteristics of the target application, and the target application is used for being installed on a cloud mobile phone; inputting the target information into a target machine learning model; and determining the security of the target application based on the target machine learning model. The method is used for determining the security of the application.

Description

Technical Field

[0001] The present application belongs to the field of Internet, and specifically relates to a method for determining application security, an electronic device and a computer-readable storage medium. Background Art

[0002] Cloud phones are virtual phones that run in the cloud. The principle of cloud phones is to use virtual machine and other technologies on the server to allocate some resources, such as CPU, memory, etc., install various operating systems for mobile phones, and virtualize WIFI media access control (Media Access Control, MAC), International Mobile Equipment Identity (International Mobile Equipment Identity, IMEI) and other information, so as to create a simulated mobile phone.

[0003] In the related art, the newly uploaded applications are basically deployed directly to the cloud phone of the user. However, if the application uploaded by the user is a malicious application with risks, directly deploying the malicious application on the cloud phone may cause security risks to the cloud phone.

[0004] Therefore, a method for determining application security is needed to solve the problem of security risks in applications to be deployed on cloud phones. Summary of the invention

[0005] The embodiments of the present application provide a method for determining application security, an electronic device, and a computer-readable storage medium, which can solve the problem of security risks in applications to be deployed on cloud phones in related technologies.

[0006] In a first aspect, an embodiment of the present application provides a method for determining application security, including: Acquire target information of a target application deployed in a sandbox environment, where the target information is used to reflect behavioral characteristics of the target application, where the target application is an application installed on a cloud phone; Inputting the target information into a target machine learning model; Based on the target machine learning model, determine the security of the target application.

[0007] In a second aspect, an embodiment of the present application provides a device for determining application security, including: An acquisition module, used to acquire target information of a target application deployed in a sandbox environment, wherein the target information is used to reflect the behavior characteristics of the target application, and the target application is an application for installation on a cloud phone; A processing module is used to input the target information into a target machine learning model; based on the target machine learning model, determine the security of the target application.

[0008] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the method described in the first aspect are implemented.

[0009] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed, the steps of the method described in the first aspect are implemented.

[0010] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the method described in the first aspect.

[0011] In an embodiment of the present application, target information of a target application deployed in a sandbox environment is obtained, the target information is used to reflect the behavioral characteristics of the target application, and the target application is an application for installation on a cloud phone; the target information is input into a target machine learning model; based on the target machine learning model, the security of the target application is determined. In this way, before deploying the target application on a cloud phone, by first obtaining the target information of the target application through a sandbox environment, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be obtained before deploying the target application on the cloud phone. Only target applications that are determined to be safe will be deployed on the cloud phone, solving the problem of security risks in applications to be deployed on cloud phones in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 is a flow chart of a method for determining application security provided by an embodiment of the present application; Figure 2 is a flow chart of another method for determining application security provided by an embodiment of the present application; Figure 3 is a flow chart of another method for determining application security provided by an embodiment of the present application; Figure 4 is a flow chart of another method for determining application security provided by an embodiment of the present application; Figure 5 is a structural block diagram of a device for determining application security provided by an embodiment of the present application; Figure 6 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0015] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0016] The method for determining application security provided in the embodiment of the present application is applied to the situation of cloud phone business, and in particular, can be applied to assigning server nodes for providing cloud phone service functions to target users. Specifically, when the target user uploads a new application to the cloud phone for installation, the application is first assigned to the sandbox environment for deployment and operation, and the deployed application is simultaneously judged for security. After the security is detected, the application is migrated to the normal operating environment of the user's cloud phone. In this way, it is ensured that only secure target applications are deployed on the cloud phone, solving the problem of security risks in applications to be deployed on cloud phones in related technologies.

[0017] The method for determining application security provided in the embodiment of the present application is executed by a target device, wherein the target device may be one electronic device or multiple electronic devices. In other words, the method for implementing a cloud phone provided in the embodiment of the present application may be executed by one electronic device, wherein the electronic device may be a server, such as an independent physical server, a server cluster composed of multiple servers, and a cloud server capable of cloud computing. In the case where the method for determining application security provided in the embodiment of the present application is executed by multiple electronic devices, these multiple electronic devices may form a service cluster, which cooperate with each other to complete each step.

[0018] The following describes in detail the method for determining application security provided by the embodiment of the present application through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0019] Figure 1 is a flow chart of a method for determining application security provided by an embodiment of the present application. Figure 1 A method for determining application security provided by an embodiment of the present application may include: Step 110, obtaining target information of a target application deployed in a sandbox environment, wherein the target information is used to reflect the behavior characteristics of the target application, and the target application is an application for installation on a cloud phone; In an embodiment of the present application, a sandbox environment is an isolated test environment that allows software, programs or codes to be run in a closed setting environment without affecting external systems or environments.

[0020] Since the sandbox has the feature of isolating the environment, installing the target application in the sandbox is mainly to isolate the normal cloud phone environment. Apart from this, there is no other difference between the sandbox and the normal cloud phone, and the user can operate the target application in the sandbox. To facilitate the observation of the behavior of the target application, the embodiment of the present application can install the user's commonly used applications in the sandbox, simulate the user's data (such as text messages, contacts, call records, photos, etc.), and temporarily open permissions to the application.

[0021] The target application in the embodiment of the present application is an application to be installed on the cloud phone. Step 110 can be performed before the target application is installed on the cloud phone.

[0022] Step 120, inputting the target information into a target machine learning model; The target machine learning model in the embodiment of the present application can be a machine learning model obtained through training. In one embodiment, the target machine learning model is a trained machine learning model. The target machine learning model in the embodiment of the present application can be a gradient boosting model, such as a lightweight gradient boosting model (LightGBM). Among them, LightGBM is an efficient and scalable machine learning algorithm based on gradient boosted decision trees (Gradient Boosted Decision Trees, GBDT), as a member of the algorithm of the GBDT framework.

[0023] The target information in the embodiments of the present application may include multiple target sequences obtained based on multiple unit times; wherein, one unit time corresponds to one target sequence, and the unit time may be 1 hour or 1 minute, etc. In the case where the target application is a single orphan application (for example, an orphan application is an application compiled / modified by the target user himself, and the orphan application is not available to other users), a self-sliding method can be used to collect multiple target sequences of the target application in multiple unit times. For example, on the timeline of monitoring the target application, use 1 day as a sliding window, and move with a step size of 1 hour (i.e., one unit time). Each time it moves, a target sequence of the target application is obtained. After moving 24 times, 24 target sequences are obtained.

[0024] The target information in the embodiment of the present application may also include a mean value sequence, which is obtained based on the mean value of the target sequences of the multiple applications, and the target sequences of the multiple applications are obtained based on the same unit time. In the case where the target application is a non-orphan application, the target application can be multiple applications running simultaneously in a sandbox environment, and these multiple applications can be the same application. The target sequences of multiple applications in the same unit time can be collected in a mutual sliding manner. For example, if the unit time is 1 hour, the target sequences of these multiple applications in this 1 hour can be obtained. If the number of the same application running simultaneously is 5, 5 target sequences can be obtained, and then the average values ​​of these 5 target sequences can be calculated to obtain the mean value sequence.

[0025] The target sequence includes at least one of the following: a sequence associated with the target user logging into the cloud phone, a sequence associated with the target application applying for permissions, a sequence associated with calling other applications in the cloud phone except the target application, and a sequence associated with visiting a website. The sequence may include various numerical values ​​used to reflect the behavioral characteristics of the target application.

[0026] In a specific embodiment, the target sequence includes: a flag sequence of target users logging into the cloud phone within a unit period, a flag sequence of target applications applying for permissions in the cloud phone within a unit period; a frequency sequence of use of specified permissions in the cloud phone within a unit period; a frequency deviation sequence of use of specified permissions in the cloud phone within a unit period; an arithmetic sequence of use of specified permissions in the cloud phone within a unit period; an arithmetic deviation sequence of use of specified permissions in the cloud phone within a unit period; a number sequence of calls to other applications in the cloud phone except the target application within a unit period; a number sequence of calls to applications of a specified category in the cloud phone within a unit period; a deviation sequence of calls to applications of a specified category in the cloud phone within a unit period; a number sequence of visits to websites within a unit period; a deviation sequence of visits to websites within a unit period; and a data volume sequence of visits to websites within a unit period.

[0027] Step 130, determining the security of the target application based on the target machine learning model.

[0028] The output of the target machine learning model may be a probability value. The security of the target application may be determined based on the probability value output by the target machine learning model. Specifically, the probability value output by the target machine learning model may be compared with a threshold value, and the threshold value may be a threshold value set for malicious applications. When the probability value output by the target machine learning model is greater than or equal to the threshold value, the target application may be determined to be a malicious application. When the probability value output by the target machine learning model is less than the threshold value, the target application may be determined to be a safe application.

[0029] In an embodiment of the present application, target information of a target application deployed in a sandbox environment is obtained, the target information is used to reflect the behavioral characteristics of the target application, and the target application is an application for installation on a cloud phone; the target information is input into a target machine learning model; based on the target machine learning model, the security of the target application is determined. In this way, before deploying the target application on a cloud phone, by first obtaining the target information of the target application through a sandbox environment, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be obtained before deploying the target application on the cloud phone. Only target applications that are determined to be safe will be deployed on the cloud phone, solving the problem of security risks in applications to be deployed on cloud phones in related technologies.

[0030] Figure 2 is a flow chart of a method for determining application security provided by an embodiment of the present application. Figure 2 A method for determining application security provided by an embodiment of the present application may include: Step 210, obtaining target information of a target application deployed in a sandbox environment, wherein the target information is used to reflect the behavior characteristics of the target application, and the target application is an application for installation on a cloud phone; In the embodiment of the present application, before step 210, the target application uploaded by the target user may be received first, and the target application may be deployed in the sandbox environment if the target application uploaded by the target user meets the target condition. That is to say, the target application deployed in the sandbox environment is an application that meets the target condition. The target condition in the embodiment of the present application can be set as needed. In a specific embodiment, it can be determined whether the information digest algorithm of the installation package of the target application meets the target condition. Specifically, it can be determined whether the information digest algorithm (such as MD5) of the installation package of the target application appears in the unknown list or the malicious list; if the information digest algorithm (such as MD5) of the installation package of the target application appears in the unknown list or the malicious list, the target application can be deployed in the sandbox environment, and then the target information of the target application deployed in the sandbox environment is obtained. Among them, the unknown list is initially the MD5 of the APK package of the risky application published by some security websites. When an application in the subsequent unknown list is proved to be risky, the MD5 of the APK package of the application is moved to the malicious list. The applications in the malicious list are applications that are prohibited from being installed in the cloud phone. The applications in the unknown list are applications that need to be deployed in the sandbox environment for security verification. If the target application is verified as a safe application through the sandbox environment, the target application can be placed in the security list.

[0031] Step 220, inputting the target information into a target machine learning model; Step 230, determining the security of the target application based on the target machine learning model; Step 240, when it is determined that the target application is a safe application, installing the target application into the cloud phone; Step 250: If it is determined that the target application is a malicious application, a prompt is provided to remove the target application.

[0032] In an embodiment of the present application, when the target application is a malicious application, installation of the target application in the cloud phone is prohibited.

[0033] In addition, when the security list, unknown list, and malicious list are maintained, if the target application is a security application, the target application can be moved to the security list; if the target application is a malicious application, the target application can be moved to the malicious list.

[0034] Among them, step 210 to step 230 can refer to the above description.

[0035] In an embodiment of the present application, target information of a target application deployed in a sandbox environment is obtained, the target information is used to reflect the behavioral characteristics of the target application, and the target application is an application for installation on a cloud phone; the target information is input into a target machine learning model; based on the target machine learning model, the security of the target application is determined. In this way, before deploying the target application on a cloud phone, by first obtaining the target information of the target application through a sandbox environment, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be obtained before deploying the target application on the cloud phone. Only target applications that are determined to be safe will be deployed on the cloud phone, solving the problem of security risks in applications to be deployed on cloud phones in related technologies.

[0036] Figure 3 is a flow chart of a method for determining application security provided by an embodiment of the present application. Figure 3 A method for determining application security provided by an embodiment of the present application may include: Step 310, obtaining target information of a target application deployed in a sandbox environment, wherein the target information is used to reflect the behavior characteristics of the target application, and the target information includes a plurality of target sequences obtained based on a plurality of unit times; wherein one unit time corresponds to one target sequence; and the target application is an application for installation on a cloud phone; In an embodiment of the present application, the target application may be a single application running in a sandbox environment. Multiple target sequences of the target application in multiple unit times may be collected in a self-sliding manner. For example, on the time axis of the monitored target application, a day is used as a sliding window, and the window is moved in steps of 1 hour (i.e., one unit time). Each time the window is moved, a target sequence of the target application is obtained. After 24 moves, 24 target sequences are obtained.

[0037] The target sequence includes at least one of the following: a sequence associated with the target user logging into the cloud phone, a sequence associated with the target application applying for permissions, a sequence associated with calling other applications in the cloud phone except the target application, and a sequence associated with visiting a website. The sequence may include various numerical values ​​used to reflect the behavioral characteristics of the target application.

[0038] Step 320, inputting the plurality of target sequences into a target machine learning model; Step 330, determining multiple probability values ​​corresponding to the multiple target sequences based on the target machine learning model; In an embodiment of the present application, the number of target sequences may be the same as the number of probability values ​​obtained based on the target machine learning model. For example, when 24 target sequences are input into the target machine learning model, 24 probability values ​​corresponding to the 24 target sequences may be obtained.

[0039] Step 340, determining a first probability range based on the multiple probability values, the first probability range indicating a probability range of the target application itself operating normally; In an embodiment of the present application, determining the first probability range based on the multiple probability values ​​in step 340 may include: determining the mean and standard deviation of the multiple probability values ​​based on the multiple probability values; determining the first probability range based on the mean and the standard deviation; wherein the minimum value of the first probability range is the difference between the mean and the standard deviation, and the maximum value of the first probability range is the sum of the mean and the standard deviation. In this way, the first probability range can be determined using the mean and the standard deviation to ensure that the obtained first probability range conforms to mathematical laws and is more accurate.

[0040] Step 350: determining a second probability range and a third probability range based on the first probability range, wherein the minimum value of the second probability range is greater than or equal to the maximum value of the first probability range, and the maximum value of the third probability range is less than or equal to the minimum value of the first probability range; In the embodiment of the present application, the second probability range may be a range greater than or equal to the maximum value of the first probability range, and the third probability range may be a range less than or equal to the minimum value of the first probability range.

[0041] Step 360, obtaining at least one first probability value and at least one second probability value; the at least one first probability value is all probability values ​​in the plurality of probability values ​​that are within the second probability range, and the at least one second probability value is all probability values ​​in the plurality of probability values ​​that are within the third probability range; Step 370, determining at least one target probability value, wherein the at least one target probability value is the larger of the at least one first probability value and the at least one second probability value; In an embodiment of the present application, if the multiple probability values ​​are the 24 probability values ​​mentioned above, among these 24 probability values, 4 probability values ​​fall within the second probability range and 5 probability values ​​fall within the third probability range, then these 5 probability values ​​falling within the third probability range are determined as 5 target probability values.

[0042] Step 380, calculating the average value of the at least one target probability value; Step 390, determining the security of the target application based on the average value of the at least one target probability value; In the embodiment of the present application, the security of the target application can be determined by comparing the average value of the at least one target probability value with a threshold, wherein the threshold can be set as needed, for example, the threshold is 0.5. When the average value of the at least one target probability value is greater than or equal to the threshold, the target application is determined to be a malicious application; when the average value of the at least one target probability value is less than the threshold, the target application is determined to be a safe application.

[0043] In the embodiment of the present application, when it is determined that the target application is a safe application, the target application can be installed in the cloud phone; when it is determined that the target application is a malicious application, a prompt can be provided to remove the target application.

[0044] In an embodiment of the present application, before the target application is deployed on the cloud phone, the target information of the target application is first obtained through the sandbox environment, and the security of the target application is determined based on the target machine learning model and the target information. The security of the target application can be obtained before the target application is deployed on the cloud phone. Only the target application determined to be safe will be deployed on the cloud phone, solving the problem of security risks in the application to be deployed on the cloud phone in the related technology. In addition, in the process of determining the security of the target application based on the target machine learning model, by considering the second probability range and the third probability range, these two probability ranges can better reflect the malicious nature of the target application, and can ensure that the security of the target application based on this defect is more accurate. Moreover, for the probability values ​​that fall into the second probability range and the third probability range among the multiple probability values, the accuracy of the results is further ensured by introducing a voting mechanism and a mean algorithm.

[0045] Figure 4 is a flow chart of a method for determining application security provided by an embodiment of the present application. Figure 4 A method for determining application security provided by an embodiment of the present application may include: Step 410, obtaining target information of a target application deployed in a sandbox environment, the target information being used to reflect behavioral characteristics of the target application; the target application is a plurality of applications running simultaneously in the sandbox environment and being used to be installed on a cloud phone; the target information includes an average value sequence, the average value sequence being obtained based on an average value of target sequences of the plurality of applications, and the target sequences of the plurality of applications being obtained based on the same unit time; In an embodiment of the present application, the target application may be multiple applications running in a sandbox environment. These multiple applications may be the same application. Multiple target sequences of these multiple applications in the same unit time may be collected in a sliding manner. For example, if the unit time is 1 hour, the target sequences of these multiple applications in this 1 hour may be obtained. If the number of the same application running at the same time is 5, 5 target sequences may be obtained, and then the average of these 5 target sequences may be calculated to obtain the average sequence.

[0046] The target sequence includes at least one of the following: a sequence associated with the target user logging into the cloud phone, a sequence associated with the target application applying for permissions, a sequence associated with calling other applications in the cloud phone except the target application, and a sequence associated with visiting a website. The sequence may include various numerical values ​​used to reflect the behavioral characteristics of the target application.

[0047] Step 420, inputting the average value sequence into a target machine learning model; Step 430, determining a third probability value corresponding to the average value sequence based on the target machine learning model; Step 440: for each application in the plurality of applications, determine a fourth probability value corresponding to the application based on the target machine learning model; Step 450, determining a total probability value based on the third probability value and the fourth probability value; In the embodiment of the present application, step 450 can determine the total probability value in the following manner: determine the product of the third probability value and the first weight as the first result; determine the product of the fourth probability value and the second weight as the second result; determine the sum of the first result and the second result as the total probability value; wherein the first weight is less than the second weight. In this way, since the first weight is less than the second weight, the differences between the various applications can be reflected, ensuring that the total probability value obtained can reflect individual differences.

[0048] Step 460, determining the security of the application based on the total probability value; In an embodiment of the present application, the total probability value may be compared with a preset threshold to determine the security of the application. In one embodiment, step 460 may determine the security of the application in the following manner: if the total probability value is greater than or equal to the preset threshold, the application is determined to be a safe application; if the total probability value is less than the preset threshold, the application is determined to be a malicious application. The preset threshold may be set as needed, for example, the preset threshold is 0.5.

[0049] Step 470, determining the security of the target application based on the security of each application in the plurality of applications; In the embodiment of the present application, the step 470 of determining the security of the target application based on the security of each of the multiple applications may include: determining the target application as a secure application when each of the multiple applications is a secure application; and determining the target application as a malicious application when there is at least one malicious application in the multiple applications. In this way, malicious applications can be excluded to a large extent, ensuring that the security determined for the target application has a high degree of credibility.

[0050] In an embodiment of the present application, when it is determined that the target application is a safe application, the target application is installed in the cloud phone; when it is determined that the target application is a malicious application, a prompt may be provided to remove the target application.

[0051] In an embodiment of the present application, before deploying the target application on the cloud phone, the target information of the target application is obtained through the sandbox environment, and the security of the target application is determined based on the target machine learning model and the target information. The security of the target application can be obtained before deploying the target application on the cloud phone. Only target applications that are determined to be safe will be deployed on the cloud phone, solving the problem of security risks in applications to be deployed on cloud phones in related technologies. In addition, in the process of determining the security of the target application based on the target machine learning model, by comprehensively considering the third probability value corresponding to the average value sequence and the fourth probability value corresponding to each application itself, both the overall situation and the individual situation are taken into account, which can ensure that the total probability value obtained can be more targeted, thereby further ensuring the accuracy of the results.

[0052] The following is a further discussion of the method for determining the security of an application (APP) provided by an embodiment of the present application through a detailed example. It should be understood that the following discussion is only an example, and the following content can be combined with the various embodiments discussed in the above figures without conflict.

[0053] In the embodiment of the present application, three lists can be maintained. The first list is a safe list, which records the MD5 of the APK packages of safe applications. The second list is an unknown list, which records the MD5 of the APK packages of applications whose risks are not clearly identified. The third list is a malicious list, which records the MD5 of the APK packages of malicious applications.

[0054] The first list can initially collect the MD5 of security applications released by major manufacturers or application stores. Considering that some users will use historical applications for trial, the MD5 of each version of the APK package of the security application is recorded in the first list. When the application is proven to be safe in the second list, the MD5 of the APK package of the application is moved to the first list.

[0055] The second list, the unknown list, initially contains the MD5 of the APK packages of risky applications published by some security websites. When an application in the second list is subsequently proven to be risky, the MD5 of the APK package of the application is moved to the third list, the malicious list.

[0056] When the target user uploads the APK package of the application to the cloud phone, the APK package can be generated with MD5, and then the MD5 of the uploaded application can be compared with the first list, the second list and the third list. If the first list is hit, the application is allowed to be installed in the user's cloud phone. If the second list, the unknown list, is hit, the application is installed in the sandbox, and the icon of the application is displayed in the user's cloud phone, indicating that the application has been installed. If the third list, the malicious list, is hit, the application is prohibited from being installed in the user's cloud phone. If none of the lists are hit, the application is checked and killed with antivirus software. If the antivirus software prompts that there is a risk, the MD5 is written to the second list, the unknown list, and the application is installed in the sandbox. The icon of the application is displayed in the user's cloud phone, indicating that the application has been installed.

[0057] For target applications installed in the sandbox, without parsing the internal code of the malicious target application, target information reflecting the behavioral characteristics of the target application can be obtained through observation and detection. Specifically, malicious applications generally have the following autonomous behaviors: first, illegally applying for mobile phone permissions, thereby illegally collecting user data in the mobile phone; second, illegally calling other applications on the mobile phone, thereby illegally collecting user data of other applications; third, illegally accessing websites and transmitting user data.

[0058] Since users may also exhibit the above behaviors when operating security applications, there is no obvious difference between the two. Therefore, if the comparison strategy is set based solely on the characteristic values ​​of application-specific behaviors such as static thresholds, year-on-year thresholds, and predicted values, it will lead to certain deviations in detection.

[0059] In view of this, the embodiment of the present application regards the detection of safe applications and malicious applications as a binary classification problem, innovatively designs comprehensive features for the behavior of the applications, adopts LightGBM (Light Gradient Boosting Machine) to detect safe applications and malicious applications, and smoothes the results, achieving high accuracy and recall rates while consuming low resources.

[0060] The following is a discussion of the process of constructing the target sequence. Taking one day as the unit time period for sampling, the sampling frequency is set to 1 minute within one day, and the following sequences are collected for the application to reflect the characteristics of the application behavior: 1. Sequence A: The flag sequence of the target user logging into the cloud phone within a unit period Sequence A is the flag bit sequence of the user logging into the cloud phone. Within 1 minute, if the proportion of the time the user logs into the cloud phone is greater than or equal to 1 / 2, it is considered that the user has logged into the cloud phone within the 1 minute, and the value of the sampling point is set to 1. If the proportion of the time the user logs into the cloud phone is less than 1 / 2, it is considered that the user has not logged into the cloud phone within the 1 minute, and the value of the sampling point is set to 0.

[0061] Normal use of applications by users will have a certain degree of impact on the behavior of the applications, so the time users use cloud phones can be considered as a feature of application behavior.

[0062] 2. Sequence B: The flag sequence of the target application applying for permissions in the cloud phone within a unit period Sequence B is a sequence of n permissions in the cloud phone. If the application applies for a certain permission among the n permissions, the value corresponding to the permission is set to 1. If the application does not apply for a certain permission, the value corresponding to the permission is set to 0. Where n is a positive integer.

[0063] 3. Sequence C 1 ~C n : The frequency sequence of using the specified permissions in the cloud phone within a unit period Among them, sequence C i (i∈n) is the usage frequency sequence of the ith permission in the cloud phone. Within 1 minute, the number of times the application uses the ith permission is counted to form a sequence C i .

[0064] 4. Sequence C 1 '~C n ': The usage frequency deviation sequence of the specified permissions in the cloud phone within a unit period Sequence C i '(i∈n)is the usage frequency deviation sequence of the i-th permission in the cloud phone, which reflects the difference in frequency between the current application usage permission and the normal application usage permission.

[0065] For some typical security applications on the market, especially super applications of different categories, such as the well-known applications in the map category and the well-known applications in the chat category, the behaviors of these applications are relatively standardized and can be used as references. For k (where k is an integer greater than 1) well-known applications, C is counted according to point 3. 1 ~C n , get k groups C 1 ~C n , then for these k groups C 1 ~C n Take the average value and get C 1avg ~C navg , respectively C 1 ~Cn Subtract the corresponding C 1avg ~C navg , and take the absolute value to get C 1 '~C n '. 1 For example, the average value corresponding to C1 is C 1avg , C 1 Minus C 1avg A difference can be obtained, and the absolute value of this difference can be obtained to get C 1 '.

[0066] 5. Sequence D 1 ~D n : Arithmetic sequence of usage of specified permissions in the cloud phone within a unit period Sequence D i (i∈n) is the arithmetic sequence of the use of the i-th permission in the cloud phone. Within 1 minute, the number of times the current application uses the i-th permission is counted. If the number is greater than or equal to the threshold r, the sampling point of the 1 minute is set to 1. If the number is less than the threshold r, the sampling point of the 1 minute is set to 0, forming a sequence D i .

[0067] 6. D 1 '~D n ': Arithmetic deviation sequence of the use of specified permissions in the cloud phone within a unit period Sequence D i '(i∈n) is the arithmetic deviation sequence of the i-th permission in the cloud phone, which reflects the arithmetic difference between the current application usage permissions and the normal application usage permissions.

[0068] For some typical security applications on the market, especially super applications of different categories, such as the well-known applications in the map category and the well-known applications in the chat category, the behaviors of these applications are relatively standardized and can be used as references. For k (where k is an integer greater than 1) well-known applications, statistics D are collected according to point 5. 1 ~D n , get k groups D 1 ~D n , then for these k groups D 1 ~D n Take the average value and get D 1avg ~D navg , respectively D 1 ~D n Subtract D 1avg ~D navg , and take the absolute value to get D 1 '~D n '. 1 For example, the average value corresponding to D1 is D1avg , D 1 Subtract D 1avg A difference can be obtained, and the absolute value of this difference can be obtained to get D 1 '.

[0069] 7. Sequence E: The number of times other applications other than the target application are called in the cloud phone within a unit period Sequence E is the number of times other applications of the cloud phone are called. Within 1 minute, the number of times the current application calls other applications is counted to form sequence E.

[0070] 8. Sequence F 1 ~F m : The number of times the specified category of applications in the cloud phone are called within a unit period Divide other cloud phone applications into m categories, sequence F j (j∈m) is the number sequence of calling the j-th category application in the cloud phone. Within 1 minute, the number of times the application calls the j-th category application in the cloud phone is counted to form a sequence F.

[0071] 9. Sequence F 1 '~F m ': The deviation sequence of the number of calls to the specified category of applications in the cloud phone within a unit period sequenceF j '(j∈m) is the deviation sequence of the number of calls to the jth category of applications in the cloud phone, which reflects the difference in the number of calls between the current application and the normal application.

[0072] For some typical security applications on the market, especially super applications of different categories, such as well-known applications in the map category and well-known applications in the chat category, the behaviors of these applications are relatively standardized and can be used as references. For k (where k is an integer greater than 1) well-known applications, the F 1 ~F m , get k groups F 1 ~F m , then for these k groups F 1 ~F m Take the average value and get F 1avg ~F mavg , respectively, F 1 ~F m Subtract F 1avg ~F mavg , and take the absolute value to get F 1 '~F m '. 1 For example, the average value corresponding to F1 is F 1avg , F1 Subtract F 1avg A difference can be obtained, and the absolute value of this difference can be obtained to obtain F 1 '.

[0073] 10. Sequence G: The number of times a website is visited within a unit period Sequence G is a sequence of the number of times the website is visited. Within 1 minute, the number of times the current application visits the website is counted to form sequence G.

[0074] 11. Sequence G': Deviation sequence of the number of visits to the website within a unit period The sequence G' is a deviation sequence of the number of website visits, which reflects the difference in the number of website visits by the current application and the number of website visits by normal applications.

[0075] For some typical security applications on the market, especially super applications of different categories, such as the well-known applications in the map category and the well-known applications in the chat category, the behaviors of these applications are relatively standardized and can be used as references. According to point 10, for k (where k is an integer greater than 1) well-known applications, G is counted separately to obtain k groups of G, and then the average of these K groups of G is taken to obtain G avg , subtract G from G avg , and take the absolute value to get G'.

[0076] 12. Sequence H: The sequence of the amount of data accessing the website within a unit period Sequence H is a sequence of data volumes for accessing a website. Within 1 minute, the size of the data packets of the current application accessing the website is counted to form sequence H.

[0077] In the embodiment of the present application, at least one of the above 12 sequences can be selected as the target sequence. For various applications, at least one of the 12 sequences can be obtained in the above manner. For example, the 12 sequences can be collected as samples for security applications and malicious applications respectively, and a model (such as LightGBM) can be trained to achieve binary classification.

[0078] After the model is obtained through training, the trained model can be used in the application to determine the security of the application. Specifically, when monitoring the target application in the sandbox, the behavior characteristics of the target application are collected according to the specification (i.e., at least one of the above 12 sequences), the behavior characteristics are input into the model, and the model outputs the probability value of the target application being a malicious application. For example, if the probability value is greater than or equal to 0.5, the target application is determined to be a malicious application. If the probability value is less than 0.5, the target application is determined to be a safe application.

[0079] Although analyzing the behavior of an application from the characteristics of multiple behaviors can ensure a high degree of detection accuracy, the behavior of an application is somewhat random. Judging whether an application is a malicious application or a safe application based on a single detection still has a certain misjudgment rate. Therefore, the embodiments of the present application can smooth the results of the detection application in a sliding manner to reduce the misjudgment rate.

[0080] In the embodiment of the present application, the sliding modes are divided into self-sliding and mutual sliding.

[0081] In the embodiment of the present application, a self-sliding method can be used to determine the security of the target application.

[0082] Self-sliding is used when the application is an orphan. The application may be compiled / modified by the user and not used by other users. At this time, for the specified MD5, the sandbox only runs one application in real time. For example, on the timeline of the monitoring application, use 1 day as a sliding window and move it in steps of 1 hour. Each time it moves, use the sequence in the window to calculate a probability value according to the above process. After 24 moves, 24 probability values ​​are obtained.

[0083] In some cases, the user's operation on the application and the application's own operation conform to the normal distribution. The average value μ and the standard deviation σ are calculated for the 24 probability values. The average value μ determines the center position of the distribution, and the standard deviation σ determines the height and width of the distribution. In the embodiment of the present application, the screening range (first probability range) with μ±σ as the feature can be taken. The probability of the probability value being distributed within μ±σ is 0.6826. Considering that the user actively logs in to the cloud phone and operates the application for a short time, the probability value in μ±σ is usually the probability value calculated for the operation of the application itself.

[0084] In many cases, user operations have a certain activation effect on the malicious behavior of applications, such as intercepting the password entered by the user and sending it out, overusing the user-authorized permissions, etc. In this regard, the probability values ​​above μ±σ are screened out as the first set (i.e., the second probability range), and the probability values ​​below μ±σ are screened out as the second set (i.e., the third probability range). The first and second sets are more about the probability values ​​calculated when the user operates the application, which can better reflect the malicious nature of the application during security / malicious detection.

[0085] Considering the randomness of the application's behavior, the embodiment of the present application can use a voting mechanism to decide whether to use the first set or the second set. Specifically, the number of probability values ​​in the first set (i.e., the number of first probability values) and the number of probability values ​​in the second set (i.e., the number of second probability values) can be counted and compared.

[0086] If the number of probability values ​​in the first set is greater than the number of probability values ​​in the second set, the first set is used as the basis, and the average value of the probability values ​​in the first set is calculated. If the number of probability values ​​in the first set is less than the number of probability values ​​in the second set, the second set is used as the basis, and the average value of the probability values ​​in the second set is calculated. If the average value is greater than or equal to 0.5, the application is determined to be a malicious application. If the average value is less than 0.5, the application is determined to be a safe application.

[0087] In the embodiment of the present application, the mutual sliding method can also be used to determine the security of the target application.

[0088] Mutual sliding is used when the application is not an isolated copy. The application may be some cracked application, a newly released illegal application, etc. At this time, for the specified MD5, the sandbox runs multiple applications at the same time.

[0089] The target sequences of multiple applications (i.e., at least one of the 12 sequences above) are averaged to obtain an average sequence, and the average sequence is input into the model (e.g., LightGBM), and the model (e.g., LightGBM) outputs a malicious probability value.

[0090] In the embodiment of the present application, the total probability value can be calculated according to the following formula: S=αS 1 +βS 2 Among them, S is the total probability value, S 1 is the probability value calculated by applying the self-sequence (i.e., the fourth probability value), S 2 The probability value (ie, the third probability value) calculated for the average sequence of multiple applications, α is the second weight, and β is the first weight.

[0091] In the embodiment of the present application, if the total probability value is greater than or equal to 0.5, the application is determined to be a malicious application. If the total probability value is less than 0.5, the application is determined to be a safe application. At the same time, if any application is evaluated as a malicious application, the application is finally determined to be a malicious application. If all applications are evaluated as safe applications, the application is finally determined to be a safe application.

[0092] For safe applications, they are officially installed on the user's cloud phone, so that safe applications can receive normal service support and users can get a normal service experience. For malicious applications, users are prompted to remove the application and are prohibited from installing it on the cloud phone.

[0093] As can be seen from the above, the method for determining the security of cloud phones provided by the embodiment of the present application, for applications with unclear risks, first runs in a sandbox environment, and then transfers to the cloud phone after confirming that the application is safe, ensuring that users have a good operating experience while ensuring the security of the cloud phone, and effectively preventing Trojan programs from directly affecting the cloud phone data. Moreover, the embodiment of the present application can construct feature sequences from multiple dimensions, comprehensively describe the behavior of the application, and later provide a sliding method to process the detection results, so as to implement a reliable security strategy to perform security detection on the sandbox application, ensure the security of the application, and protect the security of the cloud phone.

[0094] Figure 5 is a structural block diagram of a device for determining application security provided by an embodiment of the present application. Figure 5 , a device 500 for determining application security provided in an embodiment of the present application may include: an acquisition module 510 and a processing module 520. Among them: An acquisition module 510 is used to acquire target information of a target application deployed in a sandbox environment, wherein the target information is used to reflect the behavior characteristics of the target application, and the target application is an application for installation on a cloud phone; The processing module 520 is used to input the target information into the target machine learning model; based on the target machine learning model, determine the security of the target application.

[0095] In the device for determining application security provided in the embodiment of the present application, target information of a target application deployed in a sandbox environment is obtained, the target information is used to reflect the behavioral characteristics of the target application, and the target application is an application for installation on a cloud phone; the target information is input into a target machine learning model; and the security of the target application is determined based on the target machine learning model. In this way, before deploying the target application on the cloud phone, by first obtaining the target information of the target application through the sandbox environment, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be obtained before deploying the target application on the cloud phone. Only target applications that are determined to be safe will be deployed on the cloud phone, solving the problem of security risks in applications to be deployed on cloud phones in related technologies.

[0096] The device for determining application security provided in the embodiment of the present application can implement each process implemented in the above method embodiment. The specific content implemented by each module can refer to the description of the method part above, and will not be repeated here to avoid repetition.

[0097] like Figure 6As shown, the embodiment of the present application also provides an electronic device 600. The electronic device 600 includes: a processor 610 and a memory 620, and the memory 620 stores a program or instruction. When the program or instruction is executed by the processor 610, the steps of any method described above (such as a method for determining the security of an application) are implemented. For example, when the program is executed by the processor 610, the following process is implemented: obtaining target information of a target application deployed in a sandbox environment, the target information is used to reflect the behavioral characteristics of the target application, and the target application is an application for installation on a cloud phone; inputting the target information into a target machine learning model; and determining the security of the target application based on the target machine learning model. In this way, before deploying the target application on the cloud phone, by first obtaining the target information of the target application through the sandbox environment, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be obtained before deploying the target application on the cloud phone. Only target applications that are determined to be safe will be deployed on the cloud phone, solving the problem of security risks in applications to be deployed on cloud phones in related technologies.

[0098] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of each embodiment of the method for determining application security are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0099] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0100] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0101] An embodiment of the present application provides a computer program product, which is stored in a storage medium. The program product is executed by at least one processor to implement the various processes of the above-mentioned method embodiment and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0102] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0103] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0104] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for determining application security, characterized in that: include: Acquire target information of a target application deployed in a sandbox environment, where the target information is used to reflect behavioral characteristics of the target application, where the target application is an application installed on a cloud phone; Inputting the target information into a target machine learning model; Based on the target machine learning model, determine the security of the target application.

2. The method according to claim 1, characterized in that The method further comprises: If it is determined that the target application is a safe application, installing the target application into the cloud phone; When it is determined that the target application is a malicious application, a prompt is provided to remove the target application.

3. The method according to claim 1, characterized in that Before obtaining target information of a target application deployed in a sandbox environment, the method further includes: Receive the target application uploaded by the target user; When the information digest algorithm of the installation package of the target application meets the target condition, the target application is deployed in the sandbox environment.

4. The method according to claim 1, characterized in that: The target information includes a plurality of target sequences obtained based on a plurality of unit times; wherein one unit time corresponds to one target sequence; and determining the security of the target application based on the target machine learning model includes: Determining, based on the target machine learning model, multiple probability values ​​corresponding to the multiple target sequences; Based on the multiple probability values, determining a first probability range, the first probability range indicating a probability range of normal operation of the target application itself; Based on the first probability range, determine a second probability range and a third probability range, wherein a minimum value of the second probability range is greater than or equal to a maximum value of the first probability range, and a maximum value of the third probability range is less than or equal to a minimum value of the first probability range; Obtain at least one first probability value and at least one second probability value; the at least one first probability value is all probability values ​​in the plurality of probability values ​​that are within the second probability range, and the at least one second probability value is all probability values ​​in the plurality of probability values ​​that are within the third probability range; Determining at least one target probability value, the at least one target probability value being the larger of the at least one first probability value and the at least one second probability value; calculating an average of the at least one target probability value; Based on an average of the at least one target probability value, the security of the target application is determined.

5. The method according to claim 4, characterized in that The determining a first probability range based on the multiple probability values ​​comprises: Based on the plurality of probability values, determining a mean and a standard deviation of the plurality of probability values; Determining a first probability range based on the mean and the standard deviation; The minimum value of the first probability range is the difference between the mean value and the standard deviation, and the maximum value of the first probability range is the sum of the mean value and the standard deviation.

6. The method according to claim 4, characterized in that The determining the security of the target application based on the average value of the at least one target probability value includes: When the average value of the at least one target probability value is greater than or equal to a threshold, determining that the target application is a malicious application; When the average value of the at least one target probability value is less than the threshold, the target application is determined to be a safe application.

7. The method according to claim 1, characterized in that The target applications are multiple applications running simultaneously in a sandbox environment; the target information includes an average value sequence, the average value sequence is obtained based on an average value of target sequences of the multiple applications, and the target sequences of the multiple applications are obtained based on the same unit time; Determining the security of the target application based on the target machine learning model includes: Determine, based on the target machine learning model, a third probability value corresponding to the average value sequence; For each of the multiple applications, determining a fourth probability value corresponding to the application based on the target machine learning model; Determining a total probability value based on the third probability value and the fourth probability value; Based on the total probability value, determining the security of the application; Based on the security of each of the multiple applications, the security of the target application is determined.

8. The method according to claim 7, characterized in that The determining of a total probability value based on the third probability value and the fourth probability value comprises: determining a product of a third probability value and the first weight as a first result; determining a product of a fourth probability value and a second weight as a second result; Determine the sum of the first result and the second result as a total probability value; The first weight is smaller than the second weight.

9. The method according to claim 7, characterized in that: The determining the security of the target application based on the security of each of the multiple applications includes: In a case where each of the multiple applications is a secure application, determining that the target application is a secure application; In a case where there is at least one malicious application among the multiple applications, the target application is determined to be a malicious application.

10. The method according to claim 4 or 7, characterized in that: The target sequence includes at least one of the following: a sequence associated with a target user logging into a cloud phone, a sequence associated with the target application applying for permissions, a sequence associated with calling other applications in the cloud phone except the target application, and a sequence associated with visiting a website.

11. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a program or instruction running on the processor, and when the program or instruction is executed by the processor, the steps of the method according to any one of claims 1 to 10 are implemented.

12. A computer-readable storage medium, characterized in that: The medium stores a program or an instruction, and when the program or the instruction is executed, the steps of the method according to any one of claims 1 to 10 are implemented.

13. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 10 when being executed.

Images