Method, electronic device, and computer-readable storage medium for determining application security

Abstract

The application discloses a method for determining application security, an electronic device and a computer readable storage medium, and belongs to the field of Internet. The method for determining application security comprises the following steps: obtaining target information of a target application deployed in a sandbox environment, wherein the target information is used to reflect the behavior characteristics of the target application, and the target application is an application used for installation on a cloud mobile phone; inputting the target information into a target machine learning model; and determining the security of the target application based on the target machine learning model. The application is used for determining the security of an application.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of Internet, and particularly relates to a method for determining application security, an electronic device and a computer readable storage medium. BACKGROUND

[0002] A cloud phone is a virtual phone running in the cloud. The principle of the cloud phone is to allocate some resources such as CPU, memory, etc. on a server using virtual machine technology, install various operating systems of the phone, and virtually MAC (Media Access Control) and IMEI (International Mobile Equipment Identity) information of WIFI, etc. to virtually simulate a phone.

[0003] In the related art, a user newly uploaded application is basically directly deployed on a cloud phone to which the user belongs. However, in the case that the application uploaded by the user is a malicious application with risks, directly deploying the malicious application on the cloud phone may cause security risks of the cloud phone.

[0004] Therefore, a method for determining application security is needed to solve the problem that the application to be deployed on the cloud phone has security risks. SUMMARY

[0005] The embodiments of the present application provide a method for determining application security, an electronic device and a computer readable storage medium, which can solve the problem that the application to be deployed on the cloud phone has security risks.

[0006] In a first aspect, the embodiments of the present application provide a method for determining application security, comprising:

[0007] obtaining target information of a target application deployed in a sandbox environment, the target information being used to reflect behavior characteristics of the target application, and the target application being an application for installation on a cloud phone;

[0008] inputting the target information into a target machine learning model;

[0009] determining security of the target application based on the target machine learning model.

[0010] In a second aspect, the embodiments of the present application provide a device for determining application security, comprising:

[0011] an obtaining module, configured to obtain target information of a target application deployed in a sandbox environment, the target information being used to reflect behavior characteristics of the target application, and the target application being an application for installation on a cloud phone;

[0012] The processing module is used to input the target information into the target machine learning model; and based on the target machine learning model, to determine the security of the target application.

[0013] Thirdly, embodiments of this application provide an electronic device including a processor and a memory, wherein the memory stores programs or instructions executable on the processor, and the programs or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0014] Fourthly, embodiments of this application provide a computer-readable storage medium on which a program or instructions are stored, which, when executed, implement the steps of the method described in the first aspect.

[0015] Fifthly, embodiments of this application provide a computer program product comprising a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0016] In this embodiment, target information of a target application deployed in a sandbox environment is obtained. This target information reflects the behavioral characteristics of the target application, which is an application intended for installation on a cloud phone. The target information is input into a target machine learning model. Based on the target machine learning model, the security of the target application is determined. Thus, by obtaining target information of the target application through a sandbox environment before deploying it on a cloud phone, and determining the security of the target application based on the target machine learning model and target information, the security of the target application can be assessed before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, thus addressing the security risks associated with applications to be deployed on cloud phones in related technologies. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a method for determining application security provided in an embodiment of this application;

[0019] Figure 2 This is a flowchart of another method for determining application security provided in an embodiment of this application;

[0020] Figure 3This is a flowchart of another method for determining application security provided in an embodiment of this application;

[0021] Figure 4 This is a flowchart of another method for determining application security provided in an embodiment of this application;

[0022] Figure 5 This is a structural block diagram of a device for determining application security provided in an embodiment of this application;

[0023] Figure 6 This is a schematic diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0024] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0026] The method for determining application security provided in this application embodiment is applied to cloud phone services, specifically, it can be used to allocate server nodes for providing cloud phone service functions to target users. Specifically, when a target user uploads a new application to the cloud phone for installation, the application is first deployed and run in a sandbox environment. A security check is performed on the deployed application simultaneously. After security is verified, the application is then migrated to the normal operating environment of the user's cloud phone. This ensures that only secure target applications are deployed on the cloud phone, addressing the security risks associated with applications deployed on cloud phones in related technologies.

[0027] The method for determining application security provided in this application embodiment is executed by a target device, which can be a single electronic device or multiple electronic devices. That is, the method for implementing a cloud phone provided in this application embodiment can be executed by a single electronic device, which can be a server, such as a standalone physical server, a server cluster consisting of multiple servers, or a cloud server capable of cloud computing. When the method for determining application security provided in this application embodiment is executed by multiple electronic devices, these multiple electronic devices can form a service cluster, and they cooperate to complete each step.

[0028] The method for determining application security provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0029] Figure 1 This is a flowchart illustrating a method for determining application security according to an embodiment of this application. (Refer to...) Figure 1 The method for determining application security provided in this application embodiment may include:

[0030] Step 110: Obtain target information of the target application deployed in the sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, which is an application for installation on a cloud phone.

[0031] In this embodiment of the application, the sandbox environment is an isolated testing environment that allows software, programs, or code to run in a closed setup environment without affecting external systems or environments.

[0032] Because sandboxes provide an isolated environment, installing the target application within them primarily isolates it from the normal cloud phone environment. Aside from this, there are no other differences between a sandbox and a normal cloud phone; users can operate the target application within the sandbox. To facilitate observation of the target application's behavior, embodiments of this application can install frequently used applications within the sandbox, simulating user data (such as SMS messages, contacts, call logs, photos, etc.), and temporarily granting permissions to the applications.

[0033] The target application in this embodiment is the application to be installed on the cloud phone. Step 110 can be performed before installing the target application on the cloud phone.

[0034] Step 120: Input the target information into the target machine learning model;

[0035] The target machine learning model in this application embodiment can be a machine learning model obtained through training. In one embodiment, the target machine learning model is a machine learning model that has been trained. The target machine learning model in this application embodiment can be a gradient boosting model, such as the Lightweight Gradient Boosting Model (LightGBM). LightGBM is an efficient and scalable machine learning algorithm based on Gradient Boosted Decision Trees (GBDT), and is a member of the GBDT framework.

[0036] The target information in this application embodiment may include multiple target sequences obtained based on multiple unit time periods; wherein, one unit time period corresponds to one target sequence, and the unit time period can be 1 hour or 1 minute, etc. When the target application is a single isolated application (for example, an application compiled / modified by the target user and not used by other users), a self-sliding method can be used to collect multiple target sequences of the target application over multiple unit time periods. For example, on the timeline of monitoring the target application, a one-day period is used as the sliding window, moving in steps of 1 hour (i.e., one unit time period). Each movement yields one target sequence of the target application; after 24 movements, 24 target sequences are obtained.

[0037] The target information in this embodiment may also include an average value sequence, which is obtained based on the average of the target values ​​of the multiple applications, and the target values ​​of the multiple applications are obtained based on the same unit of time. When the target application is not an isolated application, the target application can be multiple applications running simultaneously in a sandbox environment, and these multiple applications can be the same application. A sliding method can be used to collect the target values ​​of multiple applications within the same unit of time. For example, if the unit of time is 1 hour, the target values ​​of the multiple applications within that 1 hour can be obtained. If the number of the same application running simultaneously is 5, then 5 target values ​​can be obtained, and the average of these 5 target values ​​can then be calculated to obtain the average value sequence.

[0038] The target sequence includes at least one of the following: a sequence associated with a target user logging into a cloud phone, a sequence associated with the target application requesting permissions, a sequence associated with calling other applications on the cloud phone besides the target application, and a sequence associated with accessing a website. The sequence may contain various numerical values ​​reflecting the behavioral characteristics of the target application.

[0039] In one specific embodiment, the target sequence includes: a sequence of flags indicating target users logging into the cloud phone within a unit period; a sequence of flags indicating target applications requesting permissions in the cloud phone within a unit period; a sequence of usage frequency of specified permissions in the cloud phone within a unit period; a sequence of usage frequency deviation of specified permissions in the cloud phone within a unit period; an arithmetic sequence of usage of specified permissions in the cloud phone within a unit period; a sequence of arithmetic deviation of usage of specified permissions in the cloud phone within a unit period; a sequence of the number of times other applications in the cloud phone besides the target application are called within a unit period; a sequence of the number of times applications of a specified category are called in the cloud phone within a unit period; a sequence of the number of times applications of a specified category are called in the cloud phone within a unit period; a sequence of the number of times applications of a specified category are called in the cloud phone within a unit period; a sequence of the number of times a website is accessed within a unit period; a sequence of the number of times a website is accessed within a unit period; and a sequence of the amount of data accessed on the website within a unit period.

[0040] Step 130: Determine the security of the target application based on the target machine learning model.

[0041] The output of the target machine learning model can be a probability value. The security of the target application can be determined based on the probability value output by the target machine learning model. Specifically, the probability value output by the target machine learning model can be compared with a threshold, which can be a threshold set for malicious applications. If the probability value output by the target machine learning model is greater than or equal to the threshold, the target application can be determined to be a malicious application; if the probability value output by the target machine learning model is less than the threshold, the target application can be determined to be a safe application.

[0042] In this embodiment, target information of a target application deployed in a sandbox environment is obtained. This target information reflects the behavioral characteristics of the target application, which is an application intended for installation on a cloud phone. The target information is input into a target machine learning model. Based on the target machine learning model, the security of the target application is determined. Thus, by obtaining target information of the target application through a sandbox environment before deploying it on a cloud phone, and determining the security of the target application based on the target machine learning model and target information, the security of the target application can be assessed before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, thus addressing the security risks associated with applications to be deployed on cloud phones in related technologies.

[0043] Figure 2 This is a flowchart illustrating a method for determining application security according to an embodiment of this application. (Refer to...) Figure 2 The method for determining application security provided in this application embodiment may include:

[0044] Step 210: Obtain target information of the target application deployed in the sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, which is an application for installation on a cloud phone.

[0045] In this embodiment, before step 210, the target application uploaded by the target user can be received first. If the target application uploaded by the target user meets the target conditions, the target application is then deployed in the sandbox environment. That is, the target application deployed in the sandbox environment is an application that meets the target conditions. The target conditions in this embodiment can be set as needed. In a specific embodiment, it can be determined whether the message digest algorithm of the target application's installation package meets the target conditions. Specifically, it can be determined whether the message digest algorithm (e.g., MD5) of the target application's installation package appears in the unknown list or the malicious list. If the message digest algorithm (e.g., MD5) of the target application's installation package appears in the unknown list or the malicious list, the target application can be deployed in the sandbox environment, thereby obtaining the target information of the target application deployed in the sandbox environment. The unknown list initially consists of the MD5 hashes of the APK packages of risky applications published by some security websites. Subsequently, when an application in the unknown list is proven to be risky, the MD5 hash of the application's APK package is moved to the malicious list. Applications in the malicious list are applications that are prohibited from being installed on cloud phones. Applications in the unknown list are applications that need to be deployed in the sandbox environment for security verification. If the target application is verified as a secure application through the sandbox environment, it can be added to the security list.

[0046] Step 220: Input the target information into the target machine learning model;

[0047] Step 230: Determine the security of the target application based on the target machine learning model;

[0048] Step 240: If the target application is determined to be a secure application, the target application is installed on the cloud phone;

[0049] Step 250: If the target application is determined to be a malicious application, prompt the user to remove the target application.

[0050] In this embodiment of the application, if the target application is a malicious application, the installation of the target application on the cloud phone is prohibited.

[0051] In addition, if a safe application, an unknown application, and a malicious application are maintained, the target application can be moved to the safe application list if it is a safe application, and to the malicious application list if it is a malicious application.

[0052] Steps 210-230 can be referred to the previous description.

[0053] In this embodiment, target information of a target application deployed in a sandbox environment is obtained. This target information reflects the behavioral characteristics of the target application, which is an application intended for installation on a cloud phone. The target information is input into a target machine learning model. Based on the target machine learning model, the security of the target application is determined. Thus, by obtaining target information of the target application through a sandbox environment before deploying it on a cloud phone, and determining the security of the target application based on the target machine learning model and target information, the security of the target application can be assessed before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, thus addressing the security risks associated with applications to be deployed on cloud phones in related technologies.

[0054] Figure 3 This is a flowchart illustrating a method for determining application security according to an embodiment of this application. (Refer to...) Figure 3 The method for determining application security provided in this application embodiment may include:

[0055] Step 310: Obtain target information of the target application deployed in the sandbox environment. The target information is used to reflect the behavioral characteristics of the target application. The target information includes multiple target sequences obtained based on multiple unit time periods; wherein, one unit time period corresponds to one target sequence; the target application is an application used to install on a cloud phone.

[0056] In this embodiment, the target application can be a single application running in a sandbox environment. Multiple target sequences of the target application can be collected over multiple time units using a self-sliding method. For example, on the timeline of the monitored target application, a one-day period is used as the sliding window, moving in steps of one hour (i.e., one unit of time). Each movement yields one target sequence of the target application; after 24 movements, 24 target sequences are obtained.

[0057] The target sequence includes at least one of the following: a sequence associated with a target user logging into a cloud phone, a sequence associated with the target application requesting permissions, a sequence associated with calling other applications on the cloud phone besides the target application, and a sequence associated with accessing a website. The sequence may contain various numerical values ​​reflecting the behavioral characteristics of the target application.

[0058] Step 320: Input the multiple target sequences into the target machine learning model;

[0059] Step 330: Based on the target machine learning model, determine multiple probability values ​​corresponding to the multiple target sequences;

[0060] In this embodiment, the number of target sequences can be the same as the number of probability values ​​obtained based on the target machine learning model. For example, when 24 target sequences are input into the target machine learning model, 24 probability values ​​corresponding to the 24 target sequences can be obtained.

[0061] Step 340: Based on the plurality of probability values, determine a first probability range, wherein the first probability range indicates the probability range of the target application's normal operation.

[0062] In this embodiment, step 340, determining the first probability range based on the plurality of probability values, may include: determining the average and standard deviation of the plurality of probability values; and determining the first probability range based on the average and standard deviation. The minimum value of the first probability range is the difference between the average and the standard deviation, and the maximum value is the sum of the average and the standard deviation. Thus, the first probability range can be determined using the average and standard deviation, ensuring that the obtained first probability range conforms to mathematical laws and is more accurate.

[0063] Step 350: Based on the first probability range, determine a second probability range and a third probability range, wherein the minimum value of the second probability range is greater than or equal to the maximum value of the first probability range, and the maximum value of the third probability range is less than or equal to the minimum value of the first probability range.

[0064] In this embodiment of the application, the second probability range can be a range greater than or equal to the maximum value of the first probability range, and the third probability range can be a range less than or equal to the minimum value of the first probability range.

[0065] Step 360: Obtain at least one first probability value and at least one second probability value; the at least one first probability value is all probability values ​​among the plurality of probability values ​​that fall within the second probability range, and the at least one second probability value is all probability values ​​among the plurality of probability values ​​that fall within the third probability range;

[0066] Step 370: Determine at least one target probability value, wherein the at least one target probability value is the larger of the at least one first probability value and the at least one second probability value;

[0067] In this embodiment of the application, if the plurality of probability values ​​are the 24 probability values ​​mentioned above, and among these 24 probability values, 4 probability values ​​fall within the second probability range and 5 probability values ​​fall within the third probability range, then the 5 probability values ​​falling within the third probability range are determined as 5 target probability values.

[0068] Step 380: Calculate the average value of the at least one target probability value;

[0069] Step 390: Determine the security of the target application based on the average of the at least one target probability value;

[0070] In this embodiment, the security of a target application can be determined by comparing the average of the at least one target probability value with a threshold. The threshold can be set as needed, for example, a threshold of 0.5. If the average of the at least one target probability value is greater than or equal to the threshold, the target application is determined to be a malicious application; if the average of the at least one target probability value is less than the threshold, the target application is determined to be a safe application.

[0071] In this embodiment of the application, if the target application is determined to be a safe application, the target application can be installed on the cloud phone; if the target application is determined to be a malicious application, a prompt can be made to remove the target application.

[0072] In this embodiment, before deploying the target application on a cloud phone, target information of the target application is obtained through a sandbox environment. Based on the target machine learning model and the target information, the security of the target application is determined. This allows for the assessment of the target application's security before deployment on the cloud phone, ensuring that only applications deemed secure are deployed, thus addressing the security risks associated with applications deployed on cloud phones. Furthermore, in determining the security of the target application based on the target machine learning model, considering a second and third probability range—both of which better reflect the malicious nature of the target application—ensures a more accurate assessment of its security. Moreover, for probability values ​​falling within the second and third probability ranges, a voting mechanism and an averaging algorithm are introduced to further ensure the accuracy of the results.

[0073] Figure 4 This is a flowchart illustrating a method for determining application security according to an embodiment of this application. (Refer to...) Figure 4 The method for determining application security provided in this application embodiment may include:

[0074] Step 410: Obtain target information of the target application deployed in the sandbox environment. The target information is used to reflect the behavioral characteristics of the target application. The target application consists of multiple applications running simultaneously in the sandbox environment and is used to install on a cloud phone. The target information includes an average value sequence, which is obtained based on the average of the target sequences of the multiple applications. The target sequences of the multiple applications are obtained based on the same unit of time.

[0075] In this embodiment, the target application can be multiple applications running in a sandbox environment. These multiple applications can be the same application. Multiple target sequences of these multiple applications within the same unit of time can be collected using an interleaved sliding method. For example, if the unit of time is 1 hour, the target sequences of these multiple applications within that 1 hour can be obtained. If the number of the same application running simultaneously is 5, then 5 target sequences can be obtained. The average of these 5 target sequences can then be calculated to obtain the average sequence.

[0076] The target sequence includes at least one of the following: a sequence associated with a target user logging into a cloud phone, a sequence associated with the target application requesting permissions, a sequence associated with calling other applications on the cloud phone besides the target application, and a sequence associated with accessing a website. The sequence may contain various numerical values ​​reflecting the behavioral characteristics of the target application.

[0077] Step 420: Input the average value sequence into the target machine learning model;

[0078] Step 430: Based on the target machine learning model, determine the third probability value corresponding to the average value sequence;

[0079] Step 440: For each of the plurality of applications, determine the fourth probability value corresponding to the application based on the target machine learning model;

[0080] Step 450: Determine the total probability value based on the third probability value and the fourth probability value;

[0081] In this embodiment, step 450 can determine the total probability value as follows: determine the product of a third probability value and a first weight as a first result; determine the product of a fourth probability value and a second weight as a second result; and sum the first result and the second result to determine the total probability value; wherein the first weight is less than the second weight. Thus, since the first weight is less than the second weight, the differences between various applications can be reflected, ensuring that the obtained total probability value reflects individual differences.

[0082] Step 460: Determine the security of the application based on the total probability value;

[0083] In this embodiment, the security of an application can be determined by comparing the total probability value with a preset threshold. In one embodiment, step 460 can determine the security of an application as follows: if the total probability value is greater than or equal to the preset threshold, the application is determined to be a secure application; if the total probability value is less than the preset threshold, the application is determined to be a malicious application. The preset threshold can be set as needed, for example, a preset threshold of 0.5.

[0084] Step 470: Determine the security of the target application based on the security of each of the multiple applications;

[0085] In this embodiment, step 470, determining the security of the target application based on the security of each of the plurality of applications, may include: determining the target application as a secure application if each of the plurality of applications is a secure application; and determining the target application as a malicious application if at least one malicious application exists among the plurality of applications. This approach can largely eliminate malicious applications and ensure a high degree of reliability in determining the security of the target application.

[0086] In this embodiment of the application, if the target application is determined to be a safe application, the target application is installed on the cloud phone; if the target application is determined to be a malicious application, a prompt may be made to remove the target application.

[0087] In this embodiment, before deploying the target application on a cloud phone, target information of the target application is obtained through a sandbox environment. Based on the target machine learning model and the target information, the security of the target application is determined. This allows for the assessment of the target application's security before deployment on the cloud phone; only applications deemed secure are deployed, thus addressing the security risks associated with applications deployed on cloud phones. Furthermore, in determining the security of the target application based on the target machine learning model, the third probability value corresponding to the average sequence and the fourth probability value corresponding to each application are comprehensively considered. This approach considers both the overall and individual circumstances, ensuring that the obtained total probability value is more targeted and further guaranteeing the accuracy of the results.

[0088] The method for determining application (APP) security provided in this application will be further discussed below with detailed examples. It should be understood that the following discussion is merely illustrative, and the content below can be combined with the various embodiments described in the accompanying drawings without conflict.

[0089] In this application embodiment, three lists can be maintained. The first list is a security list, which records the MD5 hash of the APK package of a secure application. The second list is an unknown list, which records the MD5 hash of the APK package of an application for which no risk is clearly defined. The third list is a malicious list, which records the MD5 hash of the APK package of a malicious application.

[0090] The first list can initially collect the MD5 hashes of security applications published by major manufacturers or app stores. Considering that some users may try using previous applications, the MD5 hashes of the APK packages of various versions of security applications are recorded in the first list. When an application in the second list is proven to be secure, the MD5 hash of that application's APK package is moved to the first list.

[0091] The second list, the Unknown List, initially consists of the MD5 hashes of the APK packages of risky applications published by some security websites. Subsequently, when an application in the second list is proven to be risky, the MD5 hash of that application's APK package is moved to the third list, the Malicious List.

[0092] When a target user uploads an application's APK package to a cloud phone, an MD5 hash is generated for the APK package. This MD5 hash is then compared to a first, second, and third list of malicious listings. If the first list is matched, the application is allowed to be installed on the user's cloud phone. If the second list (unknown list) is matched, the application is installed in a sandbox, and its icon is displayed on the user's cloud phone to indicate that it has been installed. If the third list (malicious list) is matched, installation is prohibited. If none of the lists are matched, antivirus software scans the application. If the antivirus software flags a risk, the MD5 hash is added to the second list (unknown list), the application is installed in a sandbox, and its icon is displayed on the user's cloud phone to indicate that it has been installed.

[0093] For target applications installed in a sandbox, target information reflecting the behavioral characteristics of the target application can be obtained through observation and detection without parsing the internal code of the malicious target application. Specifically, malicious applications generally exhibit the following autonomous behaviors: first, illegally requesting permissions on the phone to illegally collect user data from the phone; second, illegally calling other applications on the phone to illegally collect user data from those applications; and third, illegally accessing websites and transmitting user data.

[0094] Since users may also exhibit the aforementioned behaviors when operating security applications, and there are no obvious differences between the two, relying solely on characteristic values ​​of application-specific behaviors, such as static thresholds, year-on-year thresholds, and predicted values, to set comparison strategies can lead to certain biases in detection.

[0095] In view of this, the embodiments of this application treat the detection of secure applications and malicious applications as a binary classification problem, and innovatively design comprehensive features for the behavior of applications. LightGBM (Light Gradient Boosting Machine) is used to detect secure applications and malicious applications, and the results are smoothed. While consuming low resources, it achieves high accuracy and recall.

[0096] The process of constructing the target sequence is discussed below. Using a 1-day sampling period, and setting the sampling frequency to 1 minute within that day, the following sequences were collected from the application to reflect the characteristics of its behavior:

[0097] 1. Sequence A: The sequence of flags indicating when a target user logs into the cloud phone within a unit period.

[0098] Sequence A is the flag sequence for user login to the cloud phone. If the user's login time is greater than or equal to 1 / 2 within 1 minute, it is considered that the user has logged into the cloud phone within 1 minute, and the value of the sampling point is set to 1. If the user's login time is less than 1 / 2, it is considered that the user has not logged into the cloud phone within 1 minute, and the value of the sampling point is set to 0.

[0099] Normal user use of the application will have a certain impact on the application's behavior. Therefore, the time users spend using cloud phones can be considered as a characteristic of application behavior.

[0100] 2. Sequence B: A sequence of flags indicating permissions requested by the target application in the cloud phone within a unit period.

[0101] Sequence B is a sequence of n permissions in the cloud phone. If the application requests a certain permission among the n permissions, the value corresponding to that permission is set to 1; if the application does not request a certain permission, the value corresponding to that permission is set to 0. Here, n is a positive integer.

[0102] 3. Sequence C1~C n : Frequency sequence of specified permissions used in a cloud phone within a unit period

[0103] Wherein, sequence C i (i∈n) represents the frequency sequence of the i-th permission in the cloud phone. Within one minute, the number of times the application uses the i-th permission is counted, forming a sequence C. i .

[0104] 4. Sequence C1'~C n ': Frequency deviation sequence of specified permissions used in cloud phones within a unit period

[0105] Sequence C i '(i∈n) is the frequency deviation sequence of the i-th permission in the cloud phone, which reflects the difference in frequency between the current application's permission and the normal application's permission.

[0106] For some typical security applications on the market, especially super apps of different categories, such as well-known map apps and chat apps, their behavior is relatively standardized and can be used as a reference. For k well-known apps (where k is an integer greater than 1), C1~C1 are statistically analyzed according to point 3. n We obtained k groups C1~C n Then for these k groups C1~C n Take the average value to get C 1avg ~C navg C1~C n Subtract the corresponding C 1avg ~C navg And take the absolute value to obtain C1'~C n Taking C1 as an example, the average value corresponding to C1 is C. 1avg C1 minus C 1avg A difference can be obtained, and the absolute value of this difference can be taken to obtain C1'.

[0107] 5. Sequences D1~D n : Arithmetic sequence for specifying permissions in a cloud phone within a unit period

[0108] Sequence D i (i∈n) is the arithmetic sequence of the use of the i-th permission in the cloud phone. Within 1 minute, the number of times the current application uses the i-th permission is counted. If the number is greater than or equal to the threshold r, the sampling point of that 1 minute is set to 1; if the number is less than the threshold r, the sampling point of that 1 minute is set to 0, forming sequence D. i .

[0109] 6. D1'~D n ': Arithmetic deviation sequence for specified permissions in a cloud phone within a unit period

[0110] Sequence D i ' (i∈n) is the arithmetic deviation sequence of the i-th permission in the cloud phone, which reflects the arithmetic difference between the current application's permission and the normal application's permission.

[0111] For some typical security applications on the market, especially super apps of different categories, such as well-known map apps and chat apps, their behavior is relatively standardized and can be used as a reference. For k well-known apps (where k is an integer greater than 1), statistics D1~D2 are calculated separately according to point 5. n We obtain k groups D1~D n Then for these k groups D1~D n Take the average value to get D 1avg ~Dnavg D1~D n Subtract D 1avg ~D navg And take the absolute value to obtain D1'~D n Taking D1 as an example, the average value corresponding to D1 is D. 1avg D1 minus D 1avg A difference can be obtained, and the absolute value of this difference can be used to obtain D1'.

[0112] 7. Sequence E: The sequence of the number of times other applications in the cloud phone besides the target application are called within a unit period.

[0113] Sequence E is the sequence of the number of times other applications on the cloud phone are called. Within 1 minute, the number of times the current application calls other applications is counted to form sequence E.

[0114] 8. Sequences F1~F m : A sequence of the number of times a specified type of application is invoked in a cloud phone within a unit period.

[0115] Other applications of cloud phones are divided into m categories, with sequence F. j (j∈m) is the sequence of the number of times the application of the j-th category in the cloud phone is called. Within 1 minute, the number of times the application calls the application of the j-th category in the cloud phone is counted to form the sequence F.

[0116] 9. Sequences F1' to F m ': The sequence of deviations in the number of times a specified category of application is invoked in a cloud phone within a unit period.

[0117] sequenceF j '(j∈m) is the deviation sequence of the number of times the application of the j-th category in the cloud phone is called, which reflects the difference in the number of times the current application calls other applications and the normal application calls other applications.

[0118] For some typical security applications on the market, especially super apps of different categories, such as well-known map apps and chat apps, their behavior is relatively standardized and can be used as a reference. For k well-known apps (where k is an integer greater than 1), calculate F1~F2 according to point 5. m We obtained k groups F1~F m Then for these k groups F1~F m Take the average value to get F 1avg ~F mavg F1~F m Subtract F 1avg ~F mavg And take the absolute value to obtain F1'~F mTaking F1 as an example, the average value corresponding to F1 is F. 1avg F1 minus F 1avg A difference can be obtained, and the absolute value of this difference can be used to obtain F1'.

[0119] 10. Sequence G: The sequence of website visits within a unit period.

[0120] Sequence G is a sequence of website accesses. Within one minute, the number of times the current application accesses the website is counted to form sequence G.

[0121] 11. Sequence G': The sequence of deviations in the number of website visits within a unit period.

[0122] Sequence G' is the deviation sequence of the number of times the website is accessed, which reflects the difference in the number of times the current application accesses the website compared to the number of times a normal application accesses the website.

[0123] For some typical security applications on the market, especially super apps of different categories, such as well-known map apps and chat apps, their behavior is relatively standardized and can be used as a reference. For k well-known apps (where k is an integer greater than 1), we statistically analyze G according to point 10, obtaining k groups of G. Then, we take the average of these k groups of G to obtain G0. avg Subtract G from G avg , and take the absolute value to get G'.

[0124] 12. Sequence H: The sequence of data accessed to the website within a unit period.

[0125] Sequence H is the sequence of data volume accessed to the website. Within 1 minute, the size of the data packets accessed by the current application to the website is counted to form sequence H.

[0126] In this embodiment, at least one of the 12 sequences obtained above can be selected as the target sequence. For various applications, at least one of these 12 sequences can be obtained using the above method. For example, these 12 sequences can be collected as samples for security applications and malicious applications respectively, and a model (e.g., LightGBM) can be trained to achieve binary classification.

[0127] After training the model, it can be used to determine the application's security. Specifically, when monitoring a target application in a sandbox, behavioral characteristics (at least one of the 12 sequences mentioned above) are collected from the target application according to specifications. These behavioral characteristics are then input into the model, which outputs a probability value indicating whether the target application is malicious. For example, if the probability value is greater than or equal to 0.5, the target application is determined to be malicious. If the probability value is less than 0.5, the target application is determined to be safe.

[0128] Although analyzing the behavior of an application from multiple behavioral features can ensure a high level of detection accuracy, the behavior of an application is somewhat random. Judging whether an application is malicious or safe based on a single detection still has a certain false positive rate. Therefore, the embodiments of this application use a sliding method to smooth the results of application detection in order to reduce the false positive rate.

[0129] In the embodiments of this application, the sliding method is divided into self-sliding and mutual sliding.

[0130] In this embodiment, a self-sliding method can be used to determine the security of the target application. This will be described in detail below.

[0131] Self-sliding is used when the application is a unique copy, such as one compiled / modified by the user and not shared with other users. In this case, for a given MD5 hash, the sandbox only runs one application in real time. For example, on the timeline of the monitored application, a one-day period is used as the sliding window, moving in one-hour increments. Each time it moves, a probability value is calculated using the sequence in the window according to the above process. After 24 moves, 24 probability values ​​are obtained.

[0132] In some cases, user actions on the application and the application's own actions follow a normal distribution. The mean μ and standard deviation σ are calculated for 24 probability values. The mean μ determines the center of the distribution, and the standard deviation σ determines the height and width of the distribution. In this embodiment, μ±σ can be taken as the filtering range of features (the first probability range). The probability of a probability value falling within μ±σ is 0.6826. Considering that a user's active login to the cloud phone and application actions are short-lived, the probability value within μ±σ is usually calculated from the application's own actions.

[0133] In many situations, user actions can activate malicious behavior in applications. For example, intercepting and sending user-entered passwords, or overusing user-authorized permissions. To address this, we filter out probability values ​​above μ±σ, forming the first set (i.e., the second probability range), and filter out probability values ​​below μ±σ, forming the second set (i.e., the third probability range). The first and second sets are primarily probability values ​​calculated based on user actions during application operation. These probability values ​​are more effective in reflecting the malicious nature of applications during security / maliciousness detection.

[0134] Considering the randomness of the application's behavior, embodiments of this application can use a voting mechanism to decide whether to use the first set or the second set. Specifically, the number of probability values ​​in the first set (i.e., the number of first probability values) and the number of probability values ​​in the second set (i.e., the number of second probability values) can be counted and compared.

[0135] If the number of probability values ​​in the first set is greater than the number of probability values ​​in the second set, then the first set is considered the primary set, and the average of the probability values ​​in the first set is calculated. If the number of probability values ​​in the first set is less than the number of probability values ​​in the second set, then the second set is considered the primary set, and the average of the probability values ​​in the second set is calculated. If the average is greater than or equal to 0.5, the application is determined to be malicious. If the average is less than 0.5, the application is determined to be secure.

[0136] In this embodiment, the security of the target application can also be determined by mutual sliding. This will be described in detail below.

[0137] Inter-sliding is used when the application is not an isolated copy. This application may be a cracked application, a newly released illegal application, etc. In this case, for a specified MD5, the sandbox runs multiple applications simultaneously.

[0138] The average sequence is obtained by averaging the target sequences of multiple applications (i.e., at least one of the 12 sequences above). The average sequence is then input into a model (e.g., LightGBM), which outputs the probability value of maliciousness.

[0139] In the embodiments of this application, the total probability value can be calculated according to the following formula:

[0140] S = αS1 + βS2

[0141] Where S is the total probability value, S1 is the probability value calculated by applying its own sequence (i.e., the fourth probability value), S2 is the probability value calculated by averaging the sequences of multiple applications (i.e., the third probability value), α is the second weight, and β is the first weight.

[0142] In this embodiment, if the total probability value is greater than or equal to 0.5, the application is determined to be a malicious application. If the total probability value is less than 0.5, the application is determined to be a safe application. Furthermore, if any application is evaluated as a malicious application, then that application is ultimately determined to be a malicious application. If all applications are evaluated as safe applications, then that application is ultimately determined to be a safe application.

[0143] For security applications, officially install them on the user's cloud phone to ensure normal service support and a normal user experience. For malicious applications, prompt the user to remove the application and prohibit its installation on the cloud phone.

[0144] As can be seen from the above, the method for determining the security of cloud phones provided in this application embodiment first runs applications with unclear risks in a sandbox environment. Only after confirming the application's security is it transferred to the cloud phone. This ensures a good user experience while also guaranteeing the security of the cloud phone, effectively preventing Trojan programs from directly affecting cloud phone data. Furthermore, this application embodiment can construct feature sequences from multiple dimensions to comprehensively describe the application's behavior. A sliding method is provided to process the detection results, enabling a reliable security strategy to perform security detection on sandboxed applications, ensuring application security and protecting the security of the cloud phone.

[0145] Figure 5 This is a structural block diagram of a device for determining application security provided in an embodiment of this application. (Refer to...) Figure 5 The device 500 for determining application security provided in this application embodiment may include: an acquisition module 510 and a processing module 520. Wherein:

[0146] The acquisition module 510 is used to acquire target information of a target application deployed in a sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, and the target application is an application for installation on a cloud phone.

[0147] The processing module 520 is used to input the target information into the target machine learning model; and to determine the security of the target application based on the target machine learning model.

[0148] In the apparatus for determining application security provided in this application embodiment, target information of a target application deployed in a sandbox environment is obtained. This target information reflects the behavioral characteristics of the target application, which is an application intended for installation on a cloud phone. The target information is input into a target machine learning model. Based on the target machine learning model, the security of the target application is determined. Thus, by obtaining the target information of the target application through a sandbox environment before deploying it on the cloud phone, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be determined before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, thus solving the problem of security risks associated with applications to be deployed on cloud phones in related technologies.

[0149] The apparatus for determining application security provided in this application embodiment can implement all the processes implemented in the above method embodiments. The specific implementation details of each module can be found in the preceding method section description; to avoid repetition, they will not be repeated here.

[0150] like Figure 6As shown in the illustration, this application also provides an electronic device 600. The electronic device 600 includes a processor 610 and a memory 620. The memory 620 stores programs or instructions, which, when executed by the processor 610, implement the steps of any of the methods described above (e.g., the method for determining application security). For example, when the program is executed by the processor 610, it implements the following process: obtaining target information of a target application deployed in a sandbox environment, the target information reflecting the behavioral characteristics of the target application, the target application being an application intended for installation on a cloud phone; inputting the target information into a target machine learning model; and determining the security of the target application based on the target machine learning model. Thus, by obtaining the target information of the target application through a sandbox environment before deploying the target application on the cloud phone, and determining the security of the target application based on the target machine learning model and the target information, the security of the target application can be determined before deployment on the cloud phone. Only target applications determined to be secure will be deployed on the cloud phone, solving the problem of security risks associated with applications to be deployed on cloud phones in related technologies.

[0151] This application also provides a readable storage medium storing a program or instructions that, when executed by a processor, implement the steps of various embodiments of the method for determining application security and achieve the same technical effect. To avoid repetition, these steps will not be repeated here.

[0152] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0153] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0154] This application provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the various processes of the above method embodiments and achieve the same technical effects. To avoid repetition, it will not be described again here.

[0155] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0156] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0157] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for determining application security, characterized in that, include: Obtain target information of a target application deployed in a sandbox environment. The target information is used to reflect the behavioral characteristics of the target application, which is an application for installation on a cloud phone. The target information is input into the target machine learning model; Based on the target machine learning model, the security of the target application is determined; The target information includes multiple target sequences obtained based on multiple unit time periods; wherein one unit time period corresponds to one target sequence; the target sequence includes at least one of the following: a sequence associated with a target user logging into a cloud phone, a sequence associated with the target application requesting permissions, a sequence associated with calling other applications in the cloud phone besides the target application, and a sequence associated with accessing a website; the step of determining the security of the target application based on the target machine learning model includes: Based on the target machine learning model, determine multiple probability values ​​corresponding to the multiple target sequences; Based on the plurality of probability values, a first probability range is determined, wherein the first probability range indicates the probability range of the target application's normal operation. Based on the first probability range, a second probability range and a third probability range are determined, wherein the minimum value of the second probability range is greater than or equal to the maximum value of the first probability range, and the maximum value of the third probability range is less than or equal to the minimum value of the first probability range. Obtain at least one first probability value and at least one second probability value; the at least one first probability value is all probability values ​​within the second probability range of the plurality of probability values, and the at least one second probability value is all probability values ​​within the third probability range of the plurality of probability values; Determine at least one target probability value, wherein the at least one target probability value is the larger of the at least one first probability value and the at least one second probability value; Calculate the average value of the at least one target probability value; The security of the target application is determined based on the average of the at least one target probability value.

2. The method according to claim 1, characterized in that, The method further includes: If the target application is determined to be a secure application, the target application will be installed on the cloud phone. If the target application is determined to be malicious, a prompt will appear to remove the target application.

3. The method according to claim 1, characterized in that, Before obtaining target information of the target application deployed in the sandbox environment, the method further includes: Receive target applications uploaded by target users; If the message digest algorithm of the installation package of the target application meets the target conditions, the target application will be deployed to the sandbox environment.

4. The method according to claim 1, characterized in that, Determining the first probability range based on the plurality of probability values ​​includes: Based on the plurality of probability values, determine the average and standard deviation of the plurality of probability values; Based on the average value and the standard deviation, a first probability range is determined; Wherein, the minimum value of the first probability range is the difference between the mean and the standard deviation, and the maximum value of the first probability range is the sum of the mean and the standard deviation.

5. The method according to claim 1, characterized in that, Determining the security of the target application based on the average of the at least one target probability value includes: If the average of the at least one target probability value is greater than or equal to a threshold, the target application is determined to be a malicious application; If the average of the at least one target probability value is less than the threshold, the target application is determined to be a secure application.

6. The method according to claim 1, characterized in that, The target application refers to multiple applications running simultaneously in a sandbox environment; the target information includes an average value sequence, which is obtained based on the average of the target sequences of the multiple applications, and the target sequences of the multiple applications are obtained based on the same unit of time. The step of determining the security of the target application based on the target machine learning model includes: Based on the target machine learning model, determine the third probability value corresponding to the average value sequence; For each of the plurality of applications, a fourth probability value corresponding to the application is determined based on the target machine learning model; Based on the third probability value and the fourth probability value, the total probability value is determined; The security of the application is determined based on the total probability value; The security of the target application is determined based on the security of each of the multiple applications.

7. The method according to claim 6, characterized in that, The determination of the total probability value based on the third probability value and the fourth probability value includes: The product of the third probability value and the first weight is determined as the first result; The product of the fourth probability value and the second weight is determined as the second result; The sum of the first result and the second result is determined as the total probability value; Wherein, the first weight is less than the second weight.

8. The method according to claim 6, characterized in that, Determining the security of the target application based on the security of each of the multiple applications includes: If each of the multiple applications is a secure application, then the target application is determined to be a secure application. If at least one malicious application exists among the multiple applications, the target application is determined to be a malicious application.

9. An electronic device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that run on the processor, the program or instructions which, when executed by the processor, implement the steps of the method as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, The medium stores a program or instructions that, when executed, implement the steps of the method as described in any one of claims 1-8.

11. A computer program product, characterized in that, Includes a computer program, which, when executed, implements the method as described in any one of claims 1-8.

Images