Fraud-related APP detection method and system, electronic equipment and medium

Abstract

The invention provides a fraud-related APP detection method and system, electronic equipment and a storage medium to solve the problems that application detection is single and limited in comprehensiveness and accuracy, and the method comprises the steps that fraud-related APP and normal APP sample data are acquired; preprocessing the sample data; analyzing the preprocessed sample data by adopting static and dynamic analysis to obtain analyzed data; the analyzed data is subjected to automatic feature extraction of static features and dynamic features through deep learning, the static features comprise structure, code and resource features, and the dynamic features comprise image, sequence, numerical value and text features; fusing the static features and the dynamic features through a feature splicing technology to form a feature set; constructing an anti-fraud neural network model; training the model through the feature set of the sample data; and performing fraud-related APP detection by using the trained model. According to the method and the device, efficient and accurate identification of the fraud-related App can be realized.

Description

Technical Field

[0001] The present disclosure relates to the field of computer security technology, and in particular to a method for detecting fraudulent APPs, a system for detecting fraudulent APPs, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the rapid development of mobile Internet, smartphones have become an indispensable part of people's daily lives. Various applications (Apps) have sprung up, greatly enriching users' digital lives. However, at the same time, some criminals also use Apps as a carrier to commit fraud, steal user privacy and other illegal activities, causing huge economic losses and information security threats to the majority of users. Therefore, how to effectively identify fraudulent Apps has become an important issue that needs to be solved in the current field of network security.

[0003] At present, a variety of technical means have been used to detect and identify fraudulent apps, among which the more common methods include rule-based static analysis, behavior-based dynamic analysis, and machine learning technology. Each of these technologies has certain advantages, but also has corresponding limitations. The existing technologies have the following main shortcomings in the detection of fraudulent apps: Single detection: Most existing technologies rely on a single detection method, which limits the comprehensiveness and accuracy of detection. Although static analysis can go deep into the code level, it is difficult to cover all execution paths and runtime behaviors; dynamic analysis is limited by the coverage and execution time of test cases, and may miss potential threats. Insufficient feature extraction: The number of features extracted in traditional methods is often small. When the feature set contains only a small number or incomplete features, the system may not be able to capture certain key behaviors or attributes of fraudulent apps. These omitted features may be the key to distinguishing normal apps from fraudulent apps, resulting in an increase in the detection blind area, allowing some fraudulent apps to evade detection. Insufficient data fusion: There are deficiencies in the strategy and model design of data fusion. How to effectively integrate multiple data sources to provide more comprehensive and accurate detection results is a challenge facing current technologies. Summary of the invention

[0004] In order to at least solve the problems existing in the prior art of single detection, limited comprehensiveness and accuracy of detection, insufficient feature extraction, and insufficient data fusion. The present invention provides a fraudulent APP detection method, a fraudulent APP detection system, an electronic device, and a computer-readable storage medium, which realize efficient and accurate identification of fraudulent APPs by deeply integrating the advantages of deep learning technology, static analysis, and dynamic analysis.

[0005] In a first aspect, the present disclosure provides a method for detecting fraudulent APPs, the method comprising:

[0006] Obtain sample data of fraudulent apps and normal apps;

[0007] Preprocess the sample data;

[0008] Use static and dynamic analysis to analyze the preprocessed sample data to obtain the data analyzed by the App;

[0009] Using deep learning to automatically extract static features and dynamic features from the parsed data, the static features include structural features, code features, and resource features, and the dynamic features include image features, sequence features, numerical features, and text features;

[0010] The static features and dynamic features are integrated through feature splicing technology to form a feature set;

[0011] Build an anti-fraud neural network model;

[0012] The anti-fraud neural network model is trained through the feature set of sample data;

[0013] Use the trained anti-fraud neural network model to detect fraudulent apps.

[0014] Furthermore, the preprocessing of the sample data includes:

[0015] Data cleaning: remove invalid or abnormal data;

[0016] Data filtering: Set filtering rules based on known fraud-related features to screen out suspected fraud-related app samples;

[0017] Data checking: Check and remove missing values ​​and duplicates in the data;

[0018] Data deduplication: Identify and delete duplicate samples by comparing the App name, package name, signature, and function description features;

[0019] Data labeling: Manually label the selected fraud-related App samples to clarify their fraud types and degree of harm.

[0020] Furthermore, the pre-processed sample data is analyzed by static and dynamic analysis to obtain data analyzed by the App, including:

[0021] Extract the App's package name, certificate fingerprint, and version number to obtain App metadata;

[0022] By analyzing the permission list requested by the App, we can determine the permissions related to sensitive information and the combination mode between permissions, obtain the actual permission usage of the App, and obtain sensitive permission data;

[0023] Analyze the App code, extract the control flow graph and data flow graph structure information, identify potential malicious logic, and obtain the code logic structure data;

[0024] Analyze the UI (User Interface) layout file of the App, extract the interface elements, layout hierarchy, and user interaction process information, and obtain UI layout and design data;

[0025] Analyze the resource files contained in the App, identify malicious content, and obtain the resource file content data;

[0026] Identify third-party SDKs (Software Development Kits) and services integrated in the App, analyze their versions, functions, and SDK code patterns, monitor SDK calls, and obtain third-party SDK and service data;

[0027] Monitor the system API (Application Programming Interface) and third-party API called during App runtime, analyze the call frequency, call sequence, and abnormal calls, identify the corresponding code snippets and logic during the call, and obtain API call pattern data;

[0028] Capture the network requests issued by the App, analyze the request URL (uniform resource locator), parameters, and response content, identify abnormal network behavior, pay attention to the corresponding code patterns, and obtain network request data.

[0029] Furthermore, the automatic feature extraction of static features and the automatic feature extraction of dynamic features of the parsed data using deep learning respectively include:

[0030] Structural feature extraction: Use graphical tools and rule engines to analyze the structural information of applications, including package names, permission usage, and component configuration;

[0031] Code feature extraction: Use static code analysis tools to extract source code and bytecode information of the application, including function calls, variable definitions, and control flow graphs;

[0032] Resource feature extraction: extract resource file information in the APP, including UI layout, icons, and string resources;

[0033] Image feature extraction: Use CNN (Convolutional Neural Networks) to process UI layout and design data, icon / image resource file content data, extract local features in the image, and gradually abstract higher-level features through convolutional layer and pooling layer structures;

[0034] Sequence feature extraction: Use RNN (Recurrent Neural Network) to process API call patterns, network requests, and code logic structure behavior data, convert sequence data into a fixed-length vector sequence, and capture dependencies and associations in the sequence;

[0035] Numerical and text feature extraction: Use NLP (Natural Language Processing) technology to convert sensitive permissions, API call frequency, App metadata, text-type resource file content, and third-party SDK name data into vector representations, and use these vectors as input to another RNN to capture the contextual relationships and semantic information in the text.

[0036] Furthermore, the fusion of static features and dynamic features by feature splicing technology to form a feature set includes:

[0037] A layered fusion strategy is used to gradually build more complex feature representations, including

[0038] The first fusion method: fusion through the following splicing function:

[0039] F fused =[F static ,F img ,F text ,F behavior ]

[0040] The second fusion method: weighted fusion is performed using the following formula:

[0041] F fused =λ static F static +λ img F img +λ text F text +λ behavior F behavior

[0042] Among them, F fused is the fused feature vector, F static is the extracted static feature vector, F img is the extracted image feature vector, F textis the extracted text feature vector, F behavior is the extracted behavioral feature vector, λ static is the weight coefficient of the static feature, λ img is the weight coefficient of the image feature, λ text is the weight coefficient of the text feature, λ behavior is the weight coefficient of the behavior feature.

[0043] Furthermore, the construction of the anti-fraud neural network model includes:

[0044] LSTM (Long Short-Term Memory) constructed with different network parameters is used as the base learner;

[0045] Use AdaBoost (Adaptive Boosting) to perform ensemble learning on multiple LSTM base learners;

[0046] Initialize weights;

[0047] Calculate classification error;

[0048] Update the weights of the samples based on the performance of the classifier, assigning more weight to misclassified samples;

[0049] Perform ensemble prediction.

[0050] Furthermore, the use of the trained model to detect fraudulent apps includes:

[0051] Input new APP samples into the trained anti-fraud neural network model for prediction. Analyze the input samples through the LSTM ensemble model to generate a prediction result on whether each APP is fraudulent.

[0052] The model integrates the prediction results of each base learner through a weighted voting mechanism, outputs the final classification decision, and identifies the fraud-related APPs.

[0053] In a second aspect, the present disclosure provides a fraudulent APP detection system, the system comprising:

[0054] An acquisition module, which is configured to acquire sample data of fraudulent apps and normal apps;

[0055] A preprocessing module, which is configured to preprocess the sample data;

[0056] The parsing module is configured to parse the pre-processed sample data using static and dynamic analysis to obtain data parsed by the App;

[0057] A feature extraction module, which is configured to use deep learning to perform automatic feature extraction of static features and automatic feature extraction of dynamic features on the parsed data, wherein the static features include structural features, code features, and resource features, and the dynamic features include image features, sequence features, numerical features, and text features;

[0058] A feature fusion module, which is configured to fuse static features and dynamic features through feature splicing technology to form a feature set;

[0059] a model building module configured to build an anti-fraud neural network model;

[0060] A training module configured to train an anti-fraud neural network model using a feature set of sample data;

[0061] The detection module is configured to use a trained anti-fraud neural network model to detect fraudulent apps.

[0062] In a third aspect, the present disclosure provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the fraudulent APP detection method as described in any one of the first aspects.

[0063] In a fourth aspect, the present disclosure provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the fraudulent APP detection method described in any one of the above-mentioned first aspects is implemented.

[0064] Beneficial effects:

[0065] The present invention provides a fraudulent APP detection method, a fraudulent APP detection system, an electronic device and a storage medium; by obtaining fraudulent APP sample data and normal APP sample data, automatically extracting static features and dynamic features of the sample data, and enhancing data by fusing static data and dynamic data, and then constructing an LSTM integrated model to perform fraudulent detection on the app, thereby quickly and accurately classifying new App samples, which can significantly improve the recognition accuracy of fraudulent apps, and by building a complete automated analysis and judgment process, reduce manual intervention, reduce labor costs, and improve analysis and judgment efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 A flowchart of a fraud-related APP detection method provided in the first embodiment of the present disclosure;

[0067] Figure 2 A schematic diagram of a process for intelligent analysis of fraudulent APPs provided in the second embodiment of the present disclosure;

[0068] Figure 3 A schematic diagram of the overall identification process of a fraudulent APP provided in the second embodiment of the present disclosure;

[0069] Figure 4 This is an architecture diagram of a fraud-related APP detection system provided in Embodiment 3 of the present disclosure;

[0070] Figure 5 This is an architecture diagram of an electronic device provided in Embodiment 4 of the present disclosure. DETAILED DESCRIPTION

[0071] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the present disclosure is further described in detail below in conjunction with the drawings and embodiments. It should be understood that the specific embodiments and drawings described herein are only used to explain the present invention, rather than to limit the present invention.

[0072] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence; and, in the absence of conflict, the embodiments in the present disclosure and the features in the embodiments can be arbitrarily combined with each other.

[0073] The terms used in the embodiments of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure. The singular forms of "a", "said" and "the" used in the embodiments of the present disclosure and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings.

[0074] In the subsequent description, the suffixes such as "module", "component" or "unit" used to represent elements are only used to facilitate the description of the present disclosure, and have no specific meanings. Therefore, "module", "component" or "unit" can be used in a mixed manner.

[0075] At present, the more common methods used to detect and identify fraudulent apps include rule-based static analysis, behavior-based dynamic analysis, and machine learning technology, etc. These technologies each have certain advantages, but also have corresponding limitations.

[0076] 1. Rule-based static analysis: This method uses a preset rule base to scan the static code of the App to check whether it contains malicious code, sensitive permission requests and other features. The advantages of this method are that it is simple to implement and efficient, and can quickly identify known fraudulent apps. However, its disadvantages are also obvious, that is, it is difficult to deal with new fraudulent methods, because the rule base needs to be constantly updated to maintain its effectiveness.

[0077] 2. Behavior-based dynamic analysis: This method simulates the running process of the App through a sandbox environment, monitors and records its behavior data, such as network requests, to analyze whether the App has abnormal behavior. This method can capture the actual behavior of the App at runtime and has a good effect on identifying unknown or variant fraudulent Apps. However, dynamic analysis only focuses on network requests and ignores the code logic association when making third-party SDK and API calls, resulting in the omission of key fraudulent behaviors.

[0078] 3. Machine learning technology: In recent years, with the continuous development of machine learning technology, more and more researchers have begun to apply it to the detection of fraudulent apps. Machine learning models can automatically learn and extract features from large amounts of data, and then make judgments on unknown apps. In particular, deep learning technologies, such as convolutional neural networks (CNN) and recurrent neural networks (RNN), have demonstrated powerful capabilities in image recognition, sequence processing and other fields, providing new ideas for the accurate identification of fraudulent apps. However, a single machine learning model is often difficult to fully capture the complex features of an app, and it is necessary to combine multiple technical means to fuse features to improve recognition results.

[0079] The technical solution of the present invention and how the technical solution of the present invention solves the above-mentioned problems existing in the prior art are described in detail below with specific embodiments. It is understandable that in the embodiments of the present application, the execution subject can perform some or all of the steps in the embodiments of the present application, and these steps or operations are only examples. The embodiments of the present application can also perform other operations or deformations of various operations. In addition, each step can be performed in a different order presented in the embodiments of the present application, and it is possible not to perform all the operations in the embodiments of the present application. And, the following several specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0080] Figure 1 A flowchart of a fraudulent APP detection method provided in the first embodiment of the present disclosure is shown in FIG. Figure 1 As shown, the method includes:

[0081] Step S101: Obtain sample data of fraudulent APPs and normal APP sample data;

[0082] Step S102: pre-processing the sample data;

[0083] Step S103: Analyze the pre-processed sample data using static and dynamic analysis to obtain data analyzed by the App;

[0084] Step S104: using deep learning to perform automatic feature extraction of static features and automatic feature extraction of dynamic features on the parsed data, the static features include structural features, code features and resource features, and the dynamic features include image features, sequence features, numerical features and text features;

[0085] Step S105: fusing static features and dynamic features through feature splicing technology to form a feature set;

[0086] Step S106: constructing an anti-fraud neural network model;

[0087] Step S107: training the anti-fraud neural network model using the feature set of the sample data;

[0088] Step S108: Use the trained anti-fraud neural network model to detect fraudulent apps.

[0089] The disclosed embodiments aim to achieve efficient and accurate identification of fraudulent apps through advanced deep learning technology, combining the advantages of static analysis and dynamic analysis. First, by obtaining sample data of fraudulent apps and normal app sample data, data enhancement is performed on the sample data, and the app is detected for fraud by building an LSTM integrated model, so as to quickly and accurately classify new app samples. It not only improves the efficiency and accuracy of identification, but also has strong generalization ability and adaptability, and can effectively respond to the ever-changing fraud methods.

[0090] Specifically, firstly, we obtain sample data of fraudulent APPs and normal APPs from sources such as APP stores, user feedback, and malware monitoring platforms; the sample data may contain static features (such as package name, permission usage, network requests, etc.) and dynamic behaviors (such as user interaction logs, time series events, etc.) of the APP. We preprocess the sample data, such as removing erroneous data, duplicate data, and labeling data. Then, we analyze the App: we use static and dynamic analysis to analyze the App comprehensively and deeply, understand and evaluate the behavior, function, and potential risks of the App from multiple perspectives, and obtain various essential attribute data after the App is analyzed. Then, we use deep learning to automatically extract static features from the App analyzed data to process structure, code, and resource features, and use deep learning to automatically extract dynamic features from the App analyzed data to process image, sequence, numerical, and text features. After extracting these essential attributes and key information reflecting the App, we merge them through feature splicing technology to form a more comprehensive and rich feature set. Feature splicing not only retains the original information of each feature, but also promotes the interaction and complementarity between features, providing a broader perspective for the model to understand and analyze complex data patterns. After feature fusion, a unified classifier is constructed to receive the fused feature vectors to output the final judgment result (fraudulent or non-fraudulent) through the model. The training set and test set of the data are obtained, and the anti-fraud neural network model is constructed. The model can be constructed using various neural network models, such as LSTM of deep learning, etc., and can be modeled according to actual needs. After the model is constructed, the anti-fraud neural network model is trained by the feature set of sample data, and the deep learning model is trained using the training set data. The model parameters are adjusted through the back propagation algorithm so that the model can better identify fraudulent apps. The trained model is evaluated, and indicators such as accuracy, recall rate, and F1 score are calculated to evaluate the performance of the model. This stage mainly focuses on improving the generalization ability of the model, reducing the risk of overfitting, and optimizing the performance of the model by adjusting hyperparameters. The model training process is similar to the existing model training process and will not be repeated here. After the model training is completed, the trained model is used to detect fraudulent apps, so as to conduct efficient, accurate, and automated fraudulent app judgment.

[0091] The disclosed embodiment obtains sample data of fraudulent apps and normal apps, automatically extracts static features and dynamic features from the sample data, performs data enhancement by fusing static data and dynamic data, and then constructs an LSTM integrated model to detect fraudulent apps, thereby quickly and accurately classifying new app samples, significantly improving the recognition accuracy of fraudulent apps, and by building a complete automated analysis and judgment process, reducing manual intervention, lowering labor costs, and improving analysis and judgment efficiency and accuracy.

[0092] Furthermore, the preprocessing of the sample data includes:

[0093] Data cleaning: remove invalid or abnormal data;

[0094] Data filtering: Set filtering rules based on known fraud-related features to screen out suspected fraud-related app samples;

[0095] Data checking: Check and remove missing values ​​and duplicates in the data;

[0096] Data deduplication: Identify and delete duplicate samples by comparing the App name, package name, signature, and function description features;

[0097] Data labeling: Manually label the selected fraud-related App samples to clarify their fraud types and degree of harm.

[0098] Data preprocessing is performed on both fraudulent App samples and normal samples to improve the overall data quality and make subsequent data analysis and model training more accurate and efficient, including but not limited to the following methods:

[0099] (1) Data cleaning: Remove invalid or abnormal data to ensure data quality.

[0100] (2) Data filtering: Set filtering rules based on known fraud-related features to screen out app samples suspected of being fraudulent.

[0101] (3) Check and remove missing values ​​and duplicates in the data. Ensure that the behavior records of all apps in the dataset are complete, paying special attention to key features such as timestamps, network requests, and permission calls in the logs.

[0102] (4) Data deduplication: Identify and delete duplicate samples by comparing features such as the App name, package name, signature, and function description.

[0103] (5) Data labeling: Professional security analysts or teams will manually label the selected fraud-related app samples to clarify their fraud type, degree of harm, and other information.

[0104] Furthermore, the pre-processed sample data is analyzed by static and dynamic analysis to obtain data analyzed by the App, including:

[0105] Extract the App's package name, certificate fingerprint, and version number to obtain App metadata;

[0106] By analyzing the permission list requested by the App, we can determine the permissions related to sensitive information and the combination mode between permissions, obtain the actual permission usage of the App, and obtain sensitive permission data;

[0107] Analyze the App code, extract the control flow graph and data flow graph structure information, identify potential malicious logic, and obtain the code logic structure data;

[0108] Analyze the UI layout file of the App, extract the interface elements, layout hierarchy, and user interaction process information, and obtain UI layout and design data;

[0109] Analyze the resource files contained in the App, identify malicious content, and obtain the resource file content data;

[0110] Identify third-party SDKs and services integrated in the App, analyze their versions, functions, and SDK code patterns, monitor SDK calls, and obtain third-party SDK and service data;

[0111] Monitor the system APIs and third-party APIs called during App runtime, analyze the call frequency, call sequence, and abnormal calls, identify the corresponding code snippets and logic during the call, and obtain API call pattern data;

[0112] Capture network requests issued by the App, analyze the request URL, parameters, and response content, identify abnormal network behavior, pay attention to the corresponding code patterns, and obtain network request data.

[0113] Through comprehensive and in-depth analysis of the App, we understand and evaluate the App's behavior, functions, and potential risks from multiple perspectives. This includes comprehensive analysis from multiple dimensions such as the App's static code, dynamic behavior, UI layout, and resource files, to obtain the various essential attributes of the App, making it easier to use deep learning technology (such as CNN, RNN) and the complementary advantages of static and dynamic analysis to achieve an in-depth understanding and evaluation of the App.

[0114] Furthermore, the automatic feature extraction of static features and the automatic feature extraction of dynamic features of the parsed data using deep learning respectively include:

[0115] Structural feature extraction: Use graphical tools and rule engines to analyze the structural information of applications, including package names, permission usage, and component configuration;

[0116] Code feature extraction: Use static code analysis tools to extract source code and bytecode information of the application, including function calls, variable definitions, and control flow graphs;

[0117] Resource feature extraction: extract resource file information in the APP, including UI layout, icons, and string resources;

[0118] Image feature extraction: Use CNN to process UI layout and design data, icon / image resource file content data, extract local features in the image, and gradually abstract higher-level features through convolutional layer and pooling layer structures;

[0119] Sequence feature extraction: Use RNN to process API call patterns, network requests, and code logic structure behavior data, convert sequence data into fixed-length vector sequences, and capture dependencies and associations in the sequence;

[0120] Numerical and text feature extraction: Use NLP technology to convert sensitive permissions, API call frequency, App metadata, text-type resource file content, and third-party SDK name data into vector representations, and use these vectors as input to another RNN to capture the contextual relationships and semantic information in the text.

[0121] Static features can be used to extract the structural features, code features, and resource features of an app. These structural features provide a basic overview of the application's functions and behaviors and can identify potential risks. For example, by analyzing the package name of the app, the source of the app and possible malicious intent can be determined. Code features can provide important information about the logic and behavior of the app. Resource features can help analyze the appearance and user experience of the app. For example, image processing technology can be used to analyze app icons and other image resources to identify potential misleading images or inappropriate content.

[0122] Use deep learning to automatically extract dynamic features from the data analyzed by the App to process image, sequence, numerical and text features. It can capture the actual behavior of the App at runtime (user interaction logs, time series events, etc.), understand the behavioral characteristics of malware more comprehensively, and improve the accuracy and efficiency of malware detection.

[0123] Furthermore, the fusion of static features and dynamic features by feature splicing technology to form a feature set includes:

[0124] A layered fusion strategy is used to gradually build more complex feature representations, including

[0125] The first fusion method: fusion through the following splicing function:

[0126] F fused =[F static ,F img ,F text ,F behavior ]

[0127] The second fusion method: weighted fusion is performed using the following formula:

[0128] F fused =λstatic F static +λ img F img +λ text F text +λ behavior F behavior

[0129] Among them, F fused is the fused feature vector, F static is the extracted static feature vector, F img is the extracted image feature vector, F text is the extracted text feature vector, F behavior is the extracted behavioral feature vector, λ static is the weight coefficient of the static feature, λ img is the weight coefficient of the image feature, λ text is the weight coefficient of the text feature, λ behavior is the weight coefficient of the behavior feature.

[0130] In the process of feature fusion, in order to control the dimension of the feature vector, a hierarchical fusion strategy is adopted to gradually build a more complex feature representation.

[0131] In these two fusion methods, F fused is the fused feature vector, which contains feature information from all sources. static is the extracted static feature vector, which contains information related to the application structure, code, and resources. img It is the extracted image feature vector, usually obtained by convolutional neural network (CNN) processing, reflecting the characteristics of visual elements such as APP interface and icons. text is the extracted text feature vector, which is obtained by natural language processing (NLP) technology, and usually includes information such as sensitive permissions, API call frequency, and comment content. is the extracted behavior feature vector, which is obtained by recurrent neural network (RNN) processing. behavior It is an extracted behavioral feature vector, usually obtained after processing by a recurrent neural network (RNN), which reflects the behavior data such as the API call pattern and network request of the APP.

[0132] In the feature fusion stage, a layered fusion strategy is adopted, that is, the image and text features are first fused, and then fused with the behavior sequence features. This strategy not only retains the original information of each feature, but also promotes the interaction and complementarity between features, provides a richer feature representation for the model, and further improves the recognition ability of the model.

[0133] Furthermore, the construction of the anti-fraud neural network model includes:

[0134] LSTM constructed with different network parameters as base learner;

[0135] Use AdaBoost to perform ensemble learning on multiple LSTM base learners;

[0136] Initialize weights;

[0137] Calculate classification error;

[0138] Update the weights of the samples based on the performance of the classifier, assigning more weight to misclassified samples;

[0139] Perform ensemble prediction.

[0140] The main steps of building an anti-fraud neural network model include:

[0141] LSTM constructed with different network parameters is used as the base learner, and long short-term memory network (LSTM) is used to process time series data (such as APP behavior logs, user operations, etc.). LSTM can learn long-term dependent behavior patterns and identify abnormal patterns from them, helping to better detect potential fraudulent operations, and the fused feature vector is used as the input of LSTM.

[0142] Use AdaBoost to perform ensemble learning on multiple LSTM base learners. By adjusting the weight of samples in each iteration, focus on samples that were misclassified by the previous classifier to improve the detection ability of the model.

[0143] Initialize the weights and set D m represents the weight distribution of the training samples in the mth boosting iteration, which are assigned similar values ​​1 / n in the first iteration;

[0144] Calculate the classification error. In the mth iteration, the total classification error of the current basic model can be calculated using the following formula:

[0145]

[0146] Among them, ε m represents the base learner L in the mth iteration m It measures the classification error of the base learner under the current weight D m The error rate of sample classification under the condition of D is higher. The higher the value, the more misclassified samples the current classifier has in this iteration. m(i) represents the weight of the i-th sample in the m-th iteration. AdaBoost adjusts the weight of the sample based on the performance of the previous classifier. For the samples that are misclassified, they will be given higher weights in the next iteration. This change in weight can help the algorithm focus on those samples that are difficult to classify. I indicates the function. When the prediction is wrong, its value is 1, which is used to indicate that the classifier L m Is the sample x correctly classified? i , L m (x i ) means that in the mth iteration, the base learner L m For the i-th sample x i The predicted output of i For comparison, it represents the true label of the i-th sample, usually 0 or 1 in a binary classification problem, indicating the category of the sample.

[0147] Update the weights of the samples based on the performance of the classifier, assigning more weight to misclassified samples:

[0148]

[0149] Among them, D m1 (i) The weight of the i-th sample in the m+1th iteration. AdaBoost adjusts the weight of the sample based on the performance of the previous classifier. For the misclassified samples, they will be given a higher weight in the next iteration. m Normalization factor is used to ensure that the sum of the weights of all samples is equal to 1. Its function is to standardize the updated value of the weight so that the total weight remains in a fixed range. Base learner L m The weight coefficient is used to measure the classification ability of the current base learner.

[0150] Ensemble prediction,After multiple rounds of iterations, the ensemble classifier consists of M base learners. Therefore, the final AdaBoost prediction is composed of voting weights The weighted combination is:

[0151]

[0152] Among them, F(x) is the final prediction result of the AdaBoost model for the input sample x, and the sgn symbol function is used to convert the weighted result into the final binary classification result.

[0153] When F(x) is greater than 0, it means that the model predicts that sample x belongs to the positive class (such as fraud-related APP)

[0154] When F(x) is less than 0, it means that the model predicts that sample x belongs to the positive class (such as normal APP)

[0155] When F(x) equals 0, you can usually choose to return 0, indicating that the category cannot be determined.

[0156] By constructing an LSTM ensemble model, LSTM, as a base learner, can effectively process time series data (such as APP behavior logs and user operations), learn and capture long-term dependent behavior patterns, and thus identify abnormal behaviors. This feature is particularly suitable for complex application scenarios, where user behavior and APP interactions may vary significantly over time. Secondly, combined with the AdaBoost method, by dynamically adjusting the weights of samples and focusing on those samples that were misclassified in the previous iteration, the detection ability of the model can be significantly improved. This weight adjustment mechanism enables the model to gradually focus on difficult-to-classify samples in multiple iterations, thereby improving its overall recognition performance. Finally, the prediction results of the ensemble model are generated through a weighted voting mechanism, so that the contribution of each base learner is reasonably reflected, further enhancing the reliability of the model in practical applications.

[0157] Furthermore, the use of the trained model to detect fraudulent apps includes:

[0158] Input new APP samples into the trained anti-fraud neural network model for prediction. Analyze the input samples through the LSTM ensemble model to generate a prediction result on whether each APP is fraudulent.

[0159] The model integrates the prediction results of each base learner through a weighted voting mechanism, outputs the final classification decision, and identifies the fraud-related APPs.

[0160] After the model training is completed, you only need to input the new APP samples to be tested into the integrated model for prediction. The model will automatically output the APP detection results to achieve automated analysis and judgment. Through the complete automated analysis and judgment process, you can reduce manual intervention, reduce labor costs, and improve the efficiency and accuracy of analysis and judgment.

[0161] The disclosed embodiment combines static and dynamic analysis with deep learning technology to conduct a more comprehensive and in-depth analysis of the App. Through data preprocessing and data enhancement, it is possible to capture multiple features of the App (structure, code and resources, images, sequences, numerical and text features), and use a deep learning model for automatic feature extraction and classification, and perform dynamic and static feature fusion to form a more comprehensive and rich feature set, which not only retains the original information of each feature, but also promotes the interaction and complementarity between features, providing the model with a broader perspective to understand and parse complex data patterns. This method has higher flexibility and accuracy, and can better deal with complex and changeable fraud-related apps.

[0162] The second embodiment of the present disclosure also provides a method for detecting fraudulent apps, which aims to achieve efficient and accurate identification of fraudulent apps through advanced deep learning technology, combined with the advantages of static analysis and dynamic analysis. The method obtains sample data of fraudulent apps and normal app sample data, performs data enhancement on the sample data, and performs fraudulent detection on apps by building an LSTM integrated model, thereby quickly and accurately classifying new app samples. The present invention not only improves the efficiency and accuracy of identification, but also has strong generalization ability and adaptability, and can effectively respond to ever-changing fraud methods.

[0163] like Figure 2 As shown in the figure, the process of intelligent analysis of fraudulent APPs includes:

[0164] Data preprocessing, such as data cleaning, data filtering, data deduplication, and data labeling;

[0165] APP analysis, including static analysis (App metadata, resource files, UI layout and design, permission application, code structure, API / SDK and other code patterns) and dynamic monitoring (API calls, SDK calls, dynamic code call logic, network requests, file operations, sensitive permission usage);

[0166] Feature extraction, including image features, sequence features, numerical and text features;

[0167] Feature fusion, feature vector representation, feature concatenation, and layered fusion;

[0168] Model training and evaluation, such as model training, generalization improvement, hyperparameter adjustment, and monitoring evaluation.

[0169] The overall identification process is as follows Figure 3 As shown, a collection of fraudulent apps and normal apps is obtained, and static and dynamic analysis of sample data is performed. Through feature analysis, image features (UI layout and design, resource file content (pictures, images)), sequence features (API call mode, network request, third-party SDK call mode, code logic structure), numerical and text features (APP metadata, sensitive permissions, resource file content (text), SDK name and purpose, etc.) are obtained. Image features are processed by CNN, sequence features are processed by RNN, and numerical and text features are processed by NLP and RNN, and then input into the constructed model for model training and evaluation, and the trained model is used to test APP recognition to obtain recognition results.

[0170] Technical details and implementation include:

[0171] 1. Obtain sample data of fraudulent apps and normal apps.

[0172] Obtain fraudulent app samples and normal app sample data from sources such as app stores, user feedback, and malware monitoring platforms;

[0173] Sample data may include static features of the app (such as package name, permission usage, network requests, etc.) and dynamic behaviors (such as user interaction logs, time series events, etc.).

[0174] 2. Preprocess the sample data of fraudulent apps and normal apps.

[0175] (1) Data cleaning: Remove invalid or abnormal data to ensure data quality.

[0176] (2) Data filtering: Set filtering rules based on known fraud-related features to screen out app samples suspected of being fraudulent.

[0177] (3) Check and remove missing values ​​and duplicates in the data. Ensure that the behavior records of all apps in the dataset are complete, paying special attention to key features such as timestamps, network requests, and permission calls in the logs.

[0178] (4) Data deduplication: Identify and delete duplicate samples by comparing features such as the App name, package name, signature, and function description.

[0179] (5) Data labeling: Professional security analysts or teams will manually label the selected fraud-related app samples to clarify their fraud type, degree of harm, and other information.

[0180] 3. App analysis: Use static and dynamic analysis to conduct a comprehensive and in-depth analysis of the App to understand and evaluate the App’s behavior, functions, and potential risks from multiple perspectives.

[0181] (1) App metadata: directly extract the App’s package name, certificate fingerprint, version number and other metadata.

[0182] (2) Sensitive permissions: Analyze the list of permissions requested by the app, especially those related to sensitive information such as privacy, communication, and location, as well as the combination patterns between permissions, and pay attention to the actual usage of permissions.

[0183] (3) Code logic structure: Analyze the App code, extract structural information such as control flow graphs and data flow graphs, and identify potential malicious logic (such as hidden code and malicious branches in conditional statements).

[0184] (4) UI layout and design: Analyze the UI layout files of the App (such as Android’s XML files) and extract information such as interface elements, layout hierarchy, and user interaction processes.

[0185] (5) Resource file content: Analyze the resource files contained in the App (such as images, audio, video, configuration files, etc.) and identify malicious content (such as hidden malicious code, fraudulent images, etc.).

[0186] (6) Third-party SDKs and services: Identify third-party SDKs and services integrated in the App, analyze their versions, functions, SDK code patterns, etc., and monitor SDK calls.

[0187] (7) API call pattern: Monitor the system APIs and third-party APIs called during App runtime, analyze the call frequency, call sequence, abnormal calls (such as unauthorized access to sensitive data), and identify the corresponding code snippets and logic during the call.

[0188] (8) Network Requests: Capture network requests issued by the App, analyze the request URL, parameters, response content, etc., identify abnormal network behaviors (such as communication with malicious servers), and pay attention to the corresponding code patterns.

[0189] 5. Static feature extraction

[0190] Use deep learning to automatically extract features from App parsed data to process structure, code, and resource features.

[0191] (1) Structural features: Use graphical tools and rule engines to analyze the structural information of applications, including package names, permission usage, component configuration, etc. These structural features provide a basic overview of application functions and behaviors and can identify potential risks. For example, by analyzing the package name of an app, you can determine the source of the application and possible malicious intent.

[0192] (2) Code features: Use static code analysis tools to extract the source code and bytecode information of the application, including function calls, variable definitions, control flow graphs, etc. These code features can provide important information about the logic and behavior of the app.

[0193] (3) Resource features: Extract resource file information from the app, such as UI layout, icons, string resources, etc. These resource features can help analyze the appearance and user experience of the app. For example, image processing technology can be used to analyze app icons and other image resources to identify potentially misleading images or inappropriate content.

[0194] 6. Dynamic feature extraction

[0195] Use deep learning to automatically extract features from data parsed by the App to process image, sequence, numerical, and text features.

[0196] (1) Image features: Use convolutional neural networks (CNNs) to process data such as UI layout and design, icon / image and other resource file contents, effectively extract local features in the image, and gradually abstract higher-level features through structures such as convolutional layers and pooling layers.

[0197] (2) Sequence features: Use recurrent neural networks (RNNs) to process behavioral data such as API call patterns, network requests, and code logic structures, convert sequence data into vector sequences of fixed length, and capture the dependencies and associations in the sequences.

[0198] (3) Numerical and text features: Use natural language processing (NLP) technology to convert sensitive permissions, API call frequency, App metadata, text-type resource file content, third-party SDK names, and other data into vector representations. These vectors will serve as input to another RNN to capture the contextual relationships and semantic information in the text.

[0199] 7. Feature Fusion

[0200] After these essential attributes and key information reflecting the App are extracted, they are fused through feature splicing technology to form a more comprehensive and rich feature set. Feature splicing not only retains the original information of each feature, but also promotes the interaction and complementarity between features, providing the model with a broader perspective to understand and analyze complex data patterns. After feature fusion, a unified classifier is constructed to receive the fused feature vector and output the final judgment result (fraud or not). In the process of feature fusion, in order to control the dimension of the feature vector, a hierarchical fusion strategy is adopted to gradually build a more complex feature representation.

[0201] The first fusion method: fusion through splicing function:

[0202] F fused =[F static ,F img ,F text ,F behavior ]

[0203] The second fusion method: weighted fusion:

[0204] F fused =λ static F static +λ img F img +λ text F text +λ behavior F behavior

[0205] Here, F fusedis the fused feature vector, which contains feature information from all sources, λ static is the weight coefficient of the static feature, F static is the extracted static feature vector, which contains information related to the application structure, code, and resources, etc. img is the weight coefficient of the image feature, F img is the extracted image feature vector, usually obtained by convolutional neural network (CNN) processing, reflecting the characteristics of visual elements such as APP interface and icons, λ text is the weight coefficient of the text feature, F text is the extracted text feature vector, which is obtained by natural language processing (NLP) technology, and usually includes information such as sensitive permissions, API call frequency, and comment content. is the extracted behavior feature vector, which is obtained by recurrent neural network (RNN) processing. behavior is the weight coefficient of the behavior feature, F behavior It is an extracted behavioral feature vector, usually obtained after processing by a recurrent neural network (RNN), which reflects the behavior data such as the API call pattern and network request of the APP.

[0206] 8. Build an anti-fraud neural network model

[0207] LSTM constructed with different network parameters is used as the base learner, and long short-term memory network (LSTM) is used to process time series data (such as APP behavior logs, user operations, etc.). LSTM can learn long-term dependent behavior patterns and identify abnormal patterns from them, helping to better detect potential fraudulent operations, and the fused feature vector is used as the input of LSTM.

[0208] Use AdaBoost to perform ensemble learning on multiple LSTM base learners. By adjusting the weight of samples in each iteration, focus on samples that were misclassified by the previous classifier to improve the detection ability of the model.

[0209] Initialize the weights and set D m represents the weight distribution of the training samples in the mth boosting iteration, which are assigned similar values ​​1 / n in the first iteration;

[0210] Calculate the classification error. In the mth iteration, the total classification error of the current basic model can be calculated using the following formula:

[0211]

[0212] Among them, ε m represents the base learner L in the mth iteration m It measures the classification error of the base learner under the current weight D mThe error rate of sample classification under the condition of D is higher. The higher the value, the more misclassified samples the current classifier has in this iteration. m (i) represents the weight of the i-th sample in the m-th iteration. AdaBoost adjusts the weight of the sample based on the performance of the previous classifier. For the samples that are misclassified, they will be given higher weights in the next iteration. This change in weight can help the algorithm focus on those samples that are difficult to classify. I indicates the function. When the prediction is wrong, its value is 1, which is used to indicate that the classifier L m Is the sample x correctly classified? i , L m (x i ) means that in the mth iteration, the base learner L m For the i-th sample x i The predicted output of i For comparison, it represents the true label of the i-th sample, usually 0 or 1 in a binary classification problem, indicating the category of the sample.

[0213] Update the weights of the samples based on the performance of the classifier, assigning more weight to misclassified samples:

[0214]

[0215]

[0216] Among them, D m+1 (i) The weight of the i-th sample in the m+1th iteration. AdaBoost adjusts the weight of the sample based on the performance of the previous classifier. For the misclassified samples, they will be given a higher weight in the next iteration. m Normalization factor is used to ensure that the sum of the weights of all samples is equal to 1. Its function is to standardize the updated value of the weight so that the total weight remains in a fixed range. Base learner L m The weight coefficient is used to measure the classification ability of the current base learner.

[0217] Ensemble prediction,After multiple rounds of iterations, the ensemble classifier consists of M base learners. Therefore, the final AdaBoost prediction is composed of voting weights The weighted combination is:

[0218]

[0219] Among them, F(x) is the final prediction result of the AdaBoost model for the input sample x, and the sgn symbol function is used to convert the weighted result into the final binary classification result.

[0220] When F(x) is greater than 0, it means that the model predicts that sample x belongs to the positive class (such as fraud-related APP)

[0221] When F(x) is less than 0, it means that the model predicts that sample x belongs to the positive class (such as normal APP)

[0222] When F(x) equals 0, you can usually choose to return 0, indicating that the category cannot be determined.

[0223] 9. Train the anti-fraud neural network model using preprocessed sample data

[0224] Use the training set data to train the deep learning model, adjust the model parameters through the back propagation algorithm, so that the model can better identify fraudulent apps, evaluate the trained model, calculate the accuracy, recall rate, F1 score and other indicators to evaluate the performance of the model. This stage mainly focuses on improving the generalization ability of the model, reducing the risk of overfitting, and optimizing the performance of the model by adjusting the hyperparameters.

[0225] 10. Use the trained model to detect fraudulent apps

[0226] After the model training is completed, the new APP samples are input into the integrated model for prediction. The input samples are analyzed by the LSTM integrated model to generate a prediction result on whether each APP is fraudulent. Finally, the model integrates the prediction results of each base learner through a weighted voting mechanism, outputs the final classification decision, and determines the fraudulent app.

[0227] The disclosed embodiment constructs a comprehensive feature vector project, which integrates image features, text features and behavior sequence features, and automatically extracts and fuses them through deep learning technology. This multi-dimensional feature fusion method significantly improves the model's recognition ability and accuracy for fraud-related apps. Comprehensive analysis is performed from multiple dimensions such as static code, dynamic behavior, UI layout, resource files, etc. of the App, and the advantages of deep learning technology (such as CNN, RNN) and static and dynamic analysis are complementary to achieve in-depth understanding and evaluation of the App. This combination enables the model to capture more potential fraud-related features and enhances the generalization ability and adaptability of the model. In the feature fusion stage, the present invention adopts a hierarchical fusion strategy, that is, the image and text features are first fused, and then fused with the behavior sequence features. This strategy not only retains the original information of each feature, but also promotes the interaction and complementarity between features, provides a richer feature representation for the model, and further improves the recognition ability of the model. When constructing the model, an LSTM integrated model is constructed. LSTM is used as a base learner, which can effectively process time series data (such as APP behavior logs and user operations), learn and capture long-term dependent behavior patterns, and thus identify abnormal behaviors. This feature is particularly suitable for complex application scenarios, where user behavior and APP interactions may vary significantly over time. Secondly, combined with the AdaBoost method, the detection ability of the model can be significantly improved by dynamically adjusting the weights of the samples and focusing on those samples that were misclassified in the previous iteration. This weight adjustment mechanism allows the model to gradually focus on difficult-to-classify samples over multiple iterations, thereby improving its overall recognition performance. Finally, the prediction results of the ensemble model are generated through a weighted voting mechanism, so that the contribution of each base learner is reasonably reflected, further enhancing the reliability of the model in practical applications.

[0228] The third embodiment of the present disclosure provides a fraudulent APP detection system, such as Figure 4 As shown, the system comprises:

[0229] An acquisition module 11 is configured to acquire sample data of fraudulent APPs and sample data of normal APPs;

[0230] A preprocessing module 12, which is configured to preprocess the sample data;

[0231] An analysis module 13 is configured to analyze the preprocessed sample data using static and dynamic analysis to obtain data analyzed by the App;

[0232] A feature extraction module 14, which is configured to use deep learning to perform automatic feature extraction of static features and automatic feature extraction of dynamic features on the parsed data, wherein the static features include structural features, code features, and resource features, and the dynamic features include image features, sequence features, numerical features, and text features;

[0233] A feature fusion module 15, which is configured to fuse static features and dynamic features through feature splicing technology to form a feature set;

[0234] A model building module 16, which is configured to build an anti-fraud neural network model;

[0235] A training module 17, which is configured to train the anti-fraud neural network model through a feature set of sample data;

[0236] The detection module 18 is configured to use the trained anti-fraud neural network model to detect fraudulent apps.

[0237] Furthermore, the preprocessing module 12 is specifically configured as follows:

[0238] Data cleaning: remove invalid or abnormal data;

[0239] Data filtering: Set filtering rules based on known fraud-related features to screen out suspected fraud-related app samples;

[0240] Data checking: Check and remove missing values ​​and duplicates in the data;

[0241] Data deduplication: Identify and delete duplicate samples by comparing the App name, package name, signature, and function description features;

[0242] Data labeling: Manually label the selected fraud-related App samples to clarify their fraud types and degree of harm.

[0243] Furthermore, the parsing module 13 is specifically configured as follows:

[0244] Extract the App's package name, certificate fingerprint, and version number to obtain App metadata;

[0245] By analyzing the permission list requested by the App, we can determine the permissions related to sensitive information and the combination mode between permissions, obtain the actual permission usage of the App, and obtain sensitive permission data;

[0246] Analyze the App code, extract the control flow graph and data flow graph structure information, identify potential malicious logic, and obtain the code logic structure data;

[0247] Analyze the UI layout file of the App, extract the interface elements, layout hierarchy, and user interaction process information, and obtain UI layout and design data;

[0248] Analyze the resource files contained in the App, identify malicious content, and obtain the resource file content data;

[0249] Identify third-party SDKs and services integrated in the App, analyze their versions, functions, and SDK code patterns, monitor SDK calls, and obtain third-party SDK and service data;

[0250] Monitor the system APIs and third-party APIs called during App runtime, analyze the call frequency, call sequence, and abnormal calls, identify the corresponding code snippets and logic during the call, and obtain API call pattern data;

[0251] Capture network requests issued by the App, analyze the request URL, parameters, and response content, identify abnormal network behavior, pay attention to the corresponding code patterns, and obtain network request data.

[0252] Furthermore, the feature extraction module 14 is specifically configured as follows:

[0253] Structural feature extraction: Use graphical tools and rule engines to analyze the structural information of applications, including package names, permission usage, and component configuration;

[0254] Code feature extraction: Use static code analysis tools to extract source code and bytecode information of the application, including function calls, variable definitions, and control flow graphs;

[0255] Resource feature extraction: extract resource file information in the APP, including UI layout, icons, and string resources;

[0256] Image feature extraction: Use CNN to process UI layout and design data, icon / image resource file content data, extract local features in the image, and gradually abstract higher-level features through convolutional layer and pooling layer structures;

[0257] Sequence feature extraction: Use RNN to process API call patterns, network requests, and code logic structure behavior data, convert sequence data into fixed-length vector sequences, and capture dependencies and associations in the sequence;

[0258] Numerical and text feature extraction: Use NLP technology to convert sensitive permissions, API call frequency, App metadata, text-type resource file content, and third-party SDK name data into vector representations, and use these vectors as input to another RNN to capture the contextual relationships and semantic information in the text.

[0259] Furthermore, the feature fusion module 15 is specifically configured as follows:

[0260] A layered fusion strategy is used to gradually build more complex feature representations, including

[0261] The first fusion method: fusion through the following splicing function:

[0262] F fused =[F static ,F img ,F text ,F behavior ]

[0263] The second fusion method: weighted fusion is performed using the following formula:

[0264] F fused =λ static F static +λ img F img +λ text F text +λ behavior F behavior

[0265] Among them, F fused is the fused feature vector, F static is the extracted static feature vector, F img is the extracted image feature vector, F text is the extracted text feature vector, F behavior is the extracted behavioral feature vector, λ static is the weight coefficient of the static feature, λ img is the weight coefficient of the image feature, λ text is the weight coefficient of the text feature, λ behavior is the weight coefficient of the behavior feature.

[0266] Furthermore, the model building module 16 is specifically configured as follows:

[0267] LSTM constructed with different network parameters as base learner;

[0268] Use AdaBoost to perform ensemble learning on multiple LSTM base learners;

[0269] Initialize weights;

[0270] Calculate classification error;

[0271] Update the weights of the samples based on the performance of the classifier, assigning more weight to misclassified samples;

[0272] Perform ensemble prediction.

[0273] Furthermore, the detection module 18 is specifically configured as follows:

[0274] Input new APP samples into the trained anti-fraud neural network model for prediction. Analyze the input samples through the LSTM ensemble model to generate a prediction result on whether each APP is fraudulent.

[0275] The model integrates the prediction results of each base learner through a weighted voting mechanism, outputs the final classification decision, and identifies the fraud-related APPs.

[0276] The fraudulent APP detection system of the disclosed embodiment is used to implement the fraudulent APP detection method in method embodiment 1 and embodiment 2, so the description is relatively simple. For details, please refer to the relevant description in the previous method embodiment, which will not be repeated here.

[0277] In addition, if Figure 5 As shown, the fourth embodiment of the present disclosure further provides an electronic device, including a memory 100 and a processor 200, wherein the memory 100 stores a computer program, and when the processor 200 runs the computer program stored in the memory 100, the processor 200 executes the above-mentioned various possible methods.

[0278] The memory 100 is connected to the processor 200. The memory 100 may be a flash memory, a read-only memory or other memory, and the processor 200 may be a central processing unit or a single-chip microcomputer.

[0279] In addition, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored, and the computer program is executed by a processor to perform the above-mentioned various possible methods.

[0280] The computer-readable storage medium includes volatile or non-volatile, removable or non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, computer program modules or other data). Computer-readable storage media include, but are not limited to, RAM (Random Access Memory), ROM (Read-Only Memory), EEPROM (Electrically Erasable Programmable read only memory), flash memory or other memory technology, CD-ROM (Compact Disc Read-Only Memory), Digital Video Disc (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer.

[0281] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present disclosure, but the present disclosure is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and substance of the present disclosure, and these modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A method for detecting fraudulent APPs, characterized in that: The method comprises: Obtain sample data of fraudulent apps and normal apps; Preprocess the sample data; Use static and dynamic analysis to analyze the preprocessed sample data to obtain the data analyzed by the App; Using deep learning to automatically extract static features and dynamic features from the parsed data, the static features include structural features, code features, and resource features, and the dynamic features include image features, sequence features, numerical features, and text features; The static features and dynamic features are integrated through feature splicing technology to form a feature set; Build an anti-fraud neural network model; The anti-fraud neural network model is trained through the feature set of sample data; Use the trained anti-fraud neural network model to detect fraudulent apps.

2. The method according to claim 1, characterized in that The preprocessing of the sample data comprises: Data cleaning: remove invalid or abnormal data; Data filtering: Set filtering rules based on known fraud-related features to screen out suspected fraud-related app samples; Data checking: Check and remove missing values ​​and duplicates in the data; Data deduplication: Identify and delete duplicate samples by comparing the App name, package name, signature, and function description features; Data labeling: Manually label the selected fraud-related App samples to clarify their fraud types and degree of harm.

3. The method according to claim 1, characterized in that The static and dynamic analysis is used to analyze the preprocessed sample data to obtain the data analyzed by the App, including: Extract the App's package name, certificate fingerprint, and version number to obtain App metadata; By analyzing the permission list requested by the App, we can determine the permissions related to sensitive information and the combination mode between permissions, obtain the actual permission usage of the App, and obtain sensitive permission data; Analyze the App code, extract the control flow graph and data flow graph structure information, identify potential malicious logic, and obtain the code logic structure data; Analyze the UI layout file of the App, extract the interface elements, layout hierarchy, and user interaction process information, and obtain UI layout and design data; Analyze the resource files contained in the App, identify malicious content, and obtain the resource file content data; Identify third-party software development kits (SDKs) and services integrated in the App, analyze their versions, functions, and SDK code patterns, monitor SDK calls, and obtain third-party SDK and service data; Monitor the system application programming interface API and third-party API called during App runtime, analyze the call frequency, call sequence, and abnormal calls, identify the corresponding code snippets and logic during the call, and obtain API call pattern data; Capture network requests issued by the App, analyze the Uniform Resource Locator System URL, parameters, and response content of the request, identify abnormal network behavior, pay attention to the corresponding code patterns, and obtain network request data.

4. The method according to claim 3, characterized in that The automatic feature extraction of static features and the automatic feature extraction of dynamic features of the parsed data using deep learning respectively include: Structural feature extraction: Use graphical tools and rule engines to analyze the structural information of applications, including package names, permission usage, and component configuration; Code feature extraction: Use static code analysis tools to extract source code and bytecode information of the application, including function calls, variable definitions, and control flow graphs; Resource feature extraction: extract resource file information in the APP, including UI layout, icons, and string resources; Image feature extraction: Use convolutional neural network (CNN) to process UI layout and design data, icon / image resource file content data, extract local features in the image, and gradually abstract higher-level features through convolutional layer and pooling layer structures; Sequence feature extraction: Use recurrent neural network (RNN) to process API call patterns, network requests, and code logic structure behavior data, convert sequence data into fixed-length vector sequences, and capture dependencies and associations in the sequence; Numerical and text feature extraction: Use natural language processing (NLP) technology to convert sensitive permissions, API call frequency, App metadata, text-type resource file content, and third-party SDK name data into vector representations, and use these vectors as input to another RNN to capture the contextual relationships and semantic information in the text.

5. The method according to claim 1, characterized in that The feature splicing technology is used to fuse static features and dynamic features to form a feature set, including: A layered fusion strategy is used to gradually build more complex feature representations, including the first fusion method: fusion through the following concatenation function: F fused =[F static ,F img ,F text ,F behavior ] The second fusion method: weighted fusion is performed using the following formula: F fused =λ static F static +λ img F img +λ text F text +λ behavior F behavior Among them, F fused is the fused feature vector, F static is the extracted static feature vector, F img is the extracted image feature vector, F text is the extracted text feature vector, F behavior is the extracted behavioral feature vector, λ static is the weight coefficient of the static feature, λ img is the weight coefficient of the image feature, λ text is the weight coefficient of the text feature, λ behavior is the weight coefficient of the behavior feature.

6. The method according to claim 1, characterized in that The construction of the anti-fraud neural network model includes: Long short-term memory artificial neural network LSTM constructed with different network parameters was used as the base learner; Use AdaBoost to perform ensemble learning on multiple LSTM base learners; Initialize weights; Calculate classification error; Update the weights of the samples based on the performance of the classifier, assigning more weight to misclassified samples; Perform ensemble prediction.

7. The method according to claim 6, characterized in that The method of using the trained model to detect fraudulent apps includes: Input new APP samples into the trained anti-fraud neural network model for prediction. Analyze the input samples through the LSTM ensemble model to generate a prediction result on whether each APP is fraudulent. The model integrates the prediction results of each base learner through a weighted voting mechanism, outputs the final classification decision, and identifies the fraud-related APPs.

8. A fraudulent APP detection system, characterized in that: The system comprises: An acquisition module, which is configured to acquire sample data of fraudulent apps and normal apps; A preprocessing module, which is configured to preprocess the sample data; The parsing module is configured to parse the pre-processed sample data using static and dynamic analysis to obtain data parsed by the App; A feature extraction module, which is configured to use deep learning to perform automatic feature extraction of static features and automatic feature extraction of dynamic features on the parsed data, wherein the static features include structural features, code features, and resource features, and the dynamic features include image features, sequence features, numerical features, and text features; A feature fusion module, which is configured to fuse static features and dynamic features through feature splicing technology to form a feature set; a model building module configured to build an anti-fraud neural network model; A training module configured to train an anti-fraud neural network model using a feature set of sample data; The detection module is configured to use a trained anti-fraud neural network model to detect fraudulent apps.

9. An electronic device, characterized in that: It includes a memory and a processor, wherein the memory stores a computer program, and when the processor runs the computer program stored in the memory, the processor executes the fraud-related APP detection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, the fraud-related APP detection method as described in any one of claims 1-7 is implemented.

Images