Illegal mobile application organization identification method and system based on multi-level feature collaboration and key clue traceability

Abstract

The invention provides an illegal mobile application organization identification method and system based on multi-level feature collaboration and key clue traceability, and relates to the field of network security, and the method comprises the steps: tracking key clues based on key static information and network communication features of applications, and carrying out the traceability through employing a WHOIS query tool, so as to obtain a traceability result, the key clue comprises an IP address and a domain name; performing feature learning by using a deep learning model according to the key static information, the applied network communication features and the traceability result to generate high-dimensional features; according to the high-dimensional features and the traceability result, performing multi-level feature correlation analysis by using a graph neural network to obtain a hierarchical structure and a behavior mode in the organization; on the basis of a hierarchical structure and a behavior mode in an organization, a network topology of an illegal organization is constructed, and dynamic updating is carried out through a reinforcement learning mechanism so as to adapt to a continuously changing illegal behavior mode. According to the method, the potential organization behind the illegal application can be quickly and efficiently identified.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for identifying illegal mobile application organizations based on multi-level feature collaboration and key clue tracing. Background Art

[0002] With the rapid development of the mobile internet, illegal applications (such as pornography, gambling, and fraud) have emerged in droves, posing a serious threat to user privacy, information security, and social order. These illegal applications often employ complex technical means to evade traditional detection methods by using diverse development frameworks (such as Flutter and React Native), abusing permissions, forging signatures, and concealing network communications. These applications are not only concealed in their functional design but also exhibit a highly dynamic and decentralized nature during operation, making it difficult to fully capture the full scope of their illegal activities using a single detection metric. Furthermore, some illegal applications extend their functionality by embedding third-party SDKs (such as those for advertising, payment, and social networking), further complicating tracing and identification.

[0003] Current detection methods for illegal applications mostly focus on single-dimensional analysis of permissions, signature features, or network traffic. However, these methods suffer from low recognition efficiency and insufficient correlation analysis when faced with organized illegal application operations, making them unable to effectively identify the characteristics of the organizations behind the production and operation of illegal applications. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method and system for identifying illegal mobile application organizations based on multi-level feature collaboration and key clue tracing, which can integrate the application's permission information, signature information, network traffic characteristics, dynamic behavior and log data, and through deep correlation analysis and clustering technology, quickly and efficiently identify the potential organizations behind illegal applications and reveal their operating models and risk characteristics.

[0005] In order to solve the above technical problems, the technical solutions of the present invention are as follows: First, a method for identifying illegal mobile application organizations based on multi-level feature collaboration and key clue tracing includes: Step 1: Use APK file parsing tools to extract key static information from the code, including signatures, certificates, and permission configurations. Step 2: Run the application in a dynamic sandbox to capture dynamic behaviors, including system calls and permission requests, and combine network traffic analysis to obtain the application's network communication characteristics; Step 3: Based on key static information and the network communication characteristics of the application, key clues are tracked and traced using the WHOIS query tool to obtain traceability results. Key clues include IP addresses and domain names. Step 4: Based on key static information, application network communication characteristics, and traceability results, a deep learning model is used to perform feature learning and generate high-dimensional features. Step 5: Based on the high-dimensional features and traceability results, a graph neural network is used to perform multi-level feature correlation analysis to obtain the internal hierarchical structure and behavior patterns of the organization. Step 6: Based on the internal hierarchical structure and behavior patterns of the organization, the network topology of the illegal organization is constructed and dynamically updated through the reinforcement learning mechanism to adapt to the ever-changing illegal behavior patterns.

[0006] Furthermore, APK file parsing tools are used to extract key static information from the code, including signatures, certificates, and permission configurations, including: Use APK file parsing tools to extract code layer features; Combined with the historical database, it analyzes applications that reuse or forge signatures, marks potential related objects, and extracts third-party SDK distribution and dependency information.

[0007] Furthermore, based on key static information and the network communication characteristics of the application, key clues are tracked and traced using the WHOIS query tool to obtain traceability results. Key clues include IP addresses and domain names, including: Track and trace key clues through key static information and application network communication characteristics; Combine WHOIS queries, DNS resolution records, and payment chain tracking systems to extract the domain name registrant's historical activity track, server distribution, and capital flow; Through the email and contact information embedded in the resource file, combined with the public database, a reverse query is performed to obtain the potential connections between illegal applications, among which the potential connections between illegal applications are the tracing results.

[0008] Furthermore, based on key static information, application network communication characteristics, and traceability results, a deep learning model is used to learn features and generate high-dimensional features, including: Based on key static information, application network communication characteristics, and traceability results, a hybrid deep learning model is used for feature learning and modeling. Pre-train basic features through deep belief networks (DBNs) to extract the potential distribution relationship between the code layer and the traffic layer; The stacked autoencoder (SAE) is used to fuse the code layer and traffic layer features to generate semantically rich high-dimensional features.

[0009] Furthermore, based on high-dimensional features and traceability results, we use graph neural networks to perform multi-level feature association analysis to obtain the internal hierarchical structure and behavioral patterns of the organization, including: Based on high-dimensional features and traceability results, multi-level correlation analysis is performed on data at the code layer and traffic layer; The causal relationship between features is constructed through causal inference technology, and the roles and behavior patterns of members within the organization are analyzed in combination with graph neural networks (GNN) to obtain the results of feature association analysis.

[0010] Furthermore, code layer features include signature information, certificate fields, permission configuration, component call relations, control flow graphs, embedded URLs, and key data.

[0011] Furthermore, key clues include IP addresses, domain names, payment accounts, email addresses, and contact information.

[0012] Secondly, the illegal mobile application organization identification system based on multi-level feature collaboration and key clue tracing includes: The extraction module is used to use APK file parsing tools to extract key static information from the code, including signatures, certificates, and permission configurations; The acquisition module is used to run the application through a dynamic sandbox, capture dynamic behaviors, including system calls and permission requests, and combine network traffic analysis to obtain the application's network communication characteristics; The tracing module is used to track key clues based on key static information and application network communication characteristics, and use the WHOIS query tool to trace the source to obtain tracing results. Key clues include IP addresses and domain names; The learning module is used to learn features using a deep learning model and generate high-dimensional features based on key static information, application network communication characteristics, and traceability results. The association analysis module is used to perform multi-level feature association analysis using graph neural networks based on high-dimensional features and traceability results to obtain the internal hierarchical structure and behavior patterns of the organization; A building module is used to construct the network topology of illegal organizations based on the internal hierarchical structure and behavior patterns of the organization, and dynamically updates it through a reinforcement learning mechanism to adapt to the ever-changing illegal behavior patterns.

[0013] According to a third aspect, a computing device includes: one or more processors; The storage device is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method.

[0014] In a fourth aspect, a computer-readable storage medium stores a program, which implements the method when executed by a processor.

[0015] The above solution of the present invention includes at least the following beneficial effects: Through the deep integration of code-level information mining and dynamic behavior capture technology, combined with hybrid deep learning models (stacked autoencoders and deep belief networks), causal inference and graph neural network analysis, we can accurately identify the production and operation organizations of illegal applications (such as pornography, gambling, fraud, etc.), reveal their behavior patterns and organizational structure, and comprehensively improve the efficiency and accuracy of illegal application organization detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of the overall functional structure of the present invention. DETAILED DESCRIPTION

[0017] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0018] like Figure 1 As shown, an embodiment of the present invention proposes an illegal mobile application organization identification method based on multi-level feature collaboration and key clue tracing, and the method includes the following steps: Step 1: Use APK file parsing tools to extract key static information from the code, including signatures, certificates, and permission configurations. Specifically: Step 11: Decompile the target application using an APK file parsing tool (such as JADX) to extract the static code structure, including information such as classes, methods, and fields. By parsing the manifest file, extract the configuration information and permission declarations of components (such as Activities, Services, and BroadcastReceivers), and analyze whether they contain high-risk operations (such as dynamic code loading). Assume that the parsed static code set is:

[0019] in, Represents the class and method information of the target application.

[0020] Preferably, a batch parsing tool can be used to implement static code parsing of a large number of APK files to extract potential malicious behavior features.

[0021] Step 12: Extract the signature and digital certificate information from the APK file, including the issuer, subject, and expiration date. Calculate the signature fingerprint using a hash value (such as SHA-256) to verify its consistency with signatures of historical malicious apps. Extract payment information (such as Alipay and WeChat payment interfaces) and embedded payment accounts, and analyze the associated fund flows and security.

[0022] The extracted data sets are:

[0023] in, Represents signature hash, certificate content, and payment account information.

[0024] Preferably, the payment chain tracking system can be combined to locate the flow of funds and the source of operating funds of illegal organizations.

[0025] Step 13: Extract the embedded email address, URL, domain name, and other information from the APK resource file, and analyze the domain name registrant information and historical activity track by combining domain name resolution records and the WHOIS database. The extracted domain name and email information set is:

[0026] in, This includes email addresses, domain names, and associated registrant information.

[0027] Preferably, the historical activity patterns of illegal domain names can be tracked through domain name attribution databases (such as RDAP or WHOIS).

[0028] Step 14: Parse the permissions declared in the manifest file, focusing on analyzing high-risk permissions (such as READ_SMS and ACCESS_FINE_LOCATION) and their distribution. Extract component configurations (such as the dynamic registration behavior of Broadcast Receiver) and mark unauthorized high-privilege calls.

[0029] The extracted permissions and component features are:

[0030] in, Indicates the permission type and calling status.

[0031] Preferably, potential risks can be automatically marked in conjunction with a behavioral rule library for high-risk permission calls.

[0032] Step 15: Extract sensitive information embedded in the APK, such as URLs, encryption keys, and configuration files, and analyze whether this data points to known malicious domains or servers. Combined with embedded payment information, locate the illegal payment address. The extracted resource feature set is:

[0033] in, Indicates hard-coded URL or key information.

[0034] Preferably, the legitimacy of sensitive information can be checked in conjunction with a domain name attribution database and a payment account verification tool.

[0035] Step 16: Detect third-party SDKs used in the target app, including advertising SDKs, payment SDKs, and social SDKs, extracting their versions, call behavior, and permission requirements. Analyze whether the SDKs pose risks of private data collection or permission abuse. The extracted SDK feature set is:

[0036] in, Includes SDK type and version information.

[0037] Preferably, a database of known high-risk SDKs can be used to quickly identify high-risk dependencies in illegal applications.

[0038] Step 17: Use static analysis tools to generate the target application's call graph (CG) and control flow graph (CFG). Analyze the call paths of sensitive APIs (such as network requests and file operations) and identify potential malicious behavior paths. The extracted call relationships and control flow sets are:

[0039] in, Represents call paths and control flow characteristics.

[0040] Preferably, specific sensitive call chains (such as dynamically loading DEX files) can be marked through a rule library.

[0041] Step 2: Run the application in a dynamic sandbox to capture dynamic behaviors, including system calls and permission requests. Combined with network traffic analysis, the network communication characteristics of the application are obtained, which may include: Step 21: Use an automated testing framework (such as Appium or MonkeyRunner) to drive the target app to run in a custom sandbox environment, simulating regular user operations (such as logging in, browsing, and clicking). The captured dynamic behaviors include: system call chains, dynamic permission requests, component loading processes (such as dynamically bound services or dynamically registered BroadcastReceivers), and file operations (such as reading / writing files and dynamically loading resources). Let the captured dynamic behavior set be:

[0042] in, Indicates the system calls, dynamic permissions, or file operations recorded during the application's operation.

[0043] Preferably, the sandbox environment can be integrated with automated debugging tools (such as strace or ptrace) to accurately record the function stack of dynamic call behavior.

[0044] Step 22: Use a traffic capture tool (such as Wireshark or Tcpdump) to collect real-time network traffic generated by the target application during operation. The collected traffic includes DNS requests, HTTP / HTTPS communication packets, encrypted communication data, and traffic packet header information. The collected raw traffic data set is represented as:

[0045] in, Indicates information about a single data packet.

[0046] The traffic collection process can be modeled as follows:

[0047] in The network communication behavior of the target application, is the capture time window.

[0048] Step 23: parse and extract features from the collected traffic data, which mainly includes the following aspects: (1) Communication frequency: Count the access frequency and time interval of each IP, and extract short-term high-frequency access features: ; in, For a specific time period Number of communications within Indicates the communication frequency characteristics.

[0049] (2) Data packet characteristics: Analyze data packet size, header information, and protocol distribution to extract application communication patterns: ; in, Indicates the size distribution of communication packets under a specific protocol.

[0050] (3) DNS request characteristics: extract the domain name, TTL value and resolution result of the DNS query, and record the switching behavior of the backup domain name and dynamic domain name: ; in, Indicates the domain name, TTL, and resolution result of a single DNS request.

[0051] Preferably, the time window division method can be combined to analyze short-term and long-term traffic behaviors:

[0052] Step 24: Capture the dynamic behavior and traffic characteristics Mapping to a time series matrix: ; The rows of the matrix represent dynamic behaviors, traffic characteristics, and DNS requests, and the columns represent time steps.

[0053] Preferably, local features of the time series are extracted through a sliding window mechanism, and the formula is: ; Step 25: The clustering result set is: ; in, Represents a type of behavior pattern, such as batch requests or high-frequency communication. Preferably, an anomaly detection algorithm (such as Isolation Forest) is used to mark high-frequency abnormal behaviors:

[0054] Step 26: Combine dynamic behavior characteristics and traffic characteristics to generate a unified high-dimensional vector: ; in, is the fusion function, Represents the generated high-dimensional feature vector. Preferably, cross-domain feature alignment can be achieved through generative adversarial networks (GAN): ; Final eigenvector Used for subsequent model training and deep feature learning.

[0055] Preferably, the entire process of dynamic behavior capture and traffic analysis can be implemented through automated scripts, supporting batch analysis and real-time feature extraction, thereby improving the efficiency and accuracy of illegal application analysis.

[0056] Step 3: Based on key static information and the network communication characteristics of the application, track key clues and use the WHOIS query tool to trace the source to obtain the traceability results. Key clues include IP addresses and domain names, specifically: Step 31: Use the URLs extracted in step 1 and the DNS request data captured in step 2 to build a domain name set: ; in, For the target domain name, use the WHOIS query tool to extract the registration information of each domain name, including the registrant name, email address, registration time, registrar and other fields: ; Assume that the registration information set of all domain names is: ; Combined with email reverse lookup technology, we analyze the registrant's historical activity trajectory and extract the set of associated domain names: ; in, All domain names associated with a registered email address.

[0057] Preferably, the domain name association matrix is ​​established by combining the historical WHOIS database and analyzing the registrant's domain name changes and batch registration behaviors: ; in, Indicates the domain name and Belonging to the same registrant, domain name registrant information tracing provides the preliminary relationship of nodes and edges for the basic association of illegal organizations.

[0058] Step 32: Extract the payment account set of the target application from static and dynamic analysis: ; in, Including account information, payment platform and transaction serial number. Through the payment interface query tool, track the flow of funds in the payment account and build a payment association matrix: ; in, Indicates payment account and There is a capital flow correlation. Use association rule mining technology to analyze capital flow patterns and extract high-frequency trading paths: ; in, The threshold for the amount of funds transferred.

[0059] Step 33: Extract the DNS request set of the target application from the traffic data captured by dynamic analysis: ; For each domain name The resolution record of the extracted IP address is: ; Combine historical resolution records with geolocation tools to analyze the geographical distribution and attribution of IP addresses: ; in, Indicates the ownership information of the IP address.

[0060] Using the relationship between domain names and IP addresses, we can build a DNS correlation matrix: ; in, Indicates the domain name and Resolves to the same IP address.

[0061] Step 34: Combine domain name registration information, payment account information, and DNS resolution records to build a preliminary association network: ; Among them, the node set IP Edge Set There is a connection

[0062] Calculate the importance of each node in the network, estimated by the PaqeRank algorithm: ; in, For nodes the importance of For nodes The set of neighbors of For nodes degree; is the damping factor (taken as 0.85).

[0063] Step 4: Based on key static information, application network communication characteristics, and traceability results, a deep learning model is used to perform feature learning and generate high-dimensional features. Specifically, the following steps are performed: Step 41: Design a hybrid deep learning framework consisting of a deep belief network (DBN) and a stacked autoencoder (SAE). First, the DBN is used to learn the underlying distribution relationship between the code layer and traffic layer features layer by layer. Then, the SAE is used to mine nonlinear structures and optimize the feature fusion representation.

[0064] (1) Deep Belief Network (DBN) pre-training: Assume that the code layer feature set is , the clue tracing feature is The input features are defined as:

[0065] The input features are trained by Restricted Boltzmann Machine (RBM) Pre-train layer by layer to learn the basic distribution and initialize the model parameters. The energy function of RBM is defined as: ; in, and are the units of the visible layer and the hidden layer respectively; is the connection weight; and is the bias term.

[0066] By minimizing the energy function, the initial representation of the features is learned H DBN .

[0067] (2) Stacked Autoencoder (SAE) Nonlinear Modeling: The output of DBN is used as the input of SAE, and the features are nonlinearly compressed and represented by layer-by-layer encoding and decoding to capture high-level feature semantics. The encoding and decoding process of SAE is defined as: ; ; in, and Indicates the The weights and biases of the layers, and are activation function and decoding function respectively, For the Hidden representation of the layer.

[0068] Step 42: code layer features , Traffic layer characteristics and clue features Perform deep modeling.

[0069] (1) Code layer feature modeling: Code layer features (such as signature information, permission configuration, SDK calls, etc.) to train layer by layer, extract potential correlations between features, and generate implicit representations: ; (2) Traffic layer feature modeling: Traffic layer behavior characteristics (such as system calls, traffic patterns, dynamic loading paths, etc.) to perform nonlinear compression modeling and generate high-order feature representations: ; (3) Clue feature modeling: Traceability characteristics (such as domain names, payment accounts, DNS resolution records, etc.) to model and generate associated representations: ; (4) Fusion process: The weights of the DBN intermediate layer are used to initialize the parameters of the SAE, further optimizing the fused global representation and generating a high-dimensional semantic vector: ; in, Represents the feature fusion function.

[0070] In step 43, to adapt to the diverse behavior patterns of illegal mobile applications, the present invention utilizes a transfer learning mechanism to optimize the hybrid model, enabling it to maintain efficient analysis capabilities across diverse illegal behavior scenarios. The core of transfer learning is to leverage knowledge from the source domain (e.g., existing illegal application feature data) to guide the model's generalization capabilities in the target domain (e.g., new illegal behavior feature data). The loss function for transfer learning is defined as: ; in, Represents the loss of the source domain (known illegal application dataset), which is used to maintain the stability of the model on existing data. Represents the loss of the target domain (new illegal behavior dataset), which is used to guide the model to adapt to new features. is the weight coefficient used to balance the learning of the two areas.

[0071] During the transfer process, the model first extracts basic feature representations from the source domain using a deep belief network (DBN), and then uses a stacked autoencoder (SAE) to perform nonlinear mapping on the target domain features. By minimizing the transfer loss function, the model can efficiently learn new illegal behavior features while preserving the expressive power of existing features.

[0072] Step 44: After completing deep learning and migration optimization, the hybrid model of the present invention outputs a high-dimensional semantic vector that integrates code layer features (code structure, signature information, permission configuration) and traffic layer features (system call chain, network traffic pattern) for subsequent causal inference and organizational association analysis. The output high-dimensional feature vector Expressed as: ; in, Represents the characteristics of a certain dimension, reflecting the complex relationship between the code layer and dynamic behavior, The generation process combines cross-domain feature alignment of multi-level data with deep compression representation to ensure the semantic consistency and distinguishability of the vector.

[0073] This high-dimensional semantic vector can not only reveal the behavior patterns of illegal applications, but also effectively associate the potential collaborative relationships between gang members. This high-dimensional semantic vector can reveal the behavior patterns of illegal applications and their potential relationships with organizational members, providing key input data for subsequent causal inference and organizational analysis. The output feature vector It will be directly used in step 5 (multi-level feature association and organization analysis) and step 6 (illegal organization network construction).

[0074] Step 5: Based on the high-dimensional features and traceability results, a graph neural network is used to perform multi-level feature correlation analysis to obtain the internal hierarchical structure and behavior patterns of the organization, including: Step 51: Analyze code layer features using causal inference technology , Traffic layer characteristics and traceability data ,Constructing a causal relationship network of illegal software organizations Node Collection Including entities such as applications, domain names, payment accounts and server IP. Represents causal relationships between entities (such as payment accounts Supported domain names Use conditional independence test methods (such as PC algorithm) to infer causal relationships: ; Causal strength is described by structural equation modeling (SEM): ; in, represents the causal coefficient, is the noise term.

[0075] Step 52: Combine the relationships in the causal network to construct a feature matrix containing the code layer, traffic layer, and traceability data: ; in, Indicates the The entity's Features (such as number of payments, number of DNS resolutions). Dimensionality reduction through principal component analysis (PCA): ; in, is the dimension reduction weight matrix, is the feature representation after dimensionality reduction. The features after dimensionality reduction are used to identify the characteristics of different members in illegal organizations.

[0076] Step 53: Use the high-dimensional semantic vector generated in step 54 As node features, combined with causal network , organizational analysis and recognition are performed through graph neural networks (GNN).

[0077] (1) Node embedding update rules: The node embedding update of GNN is defined as: ; in, Representation node In the Feature embedding of layers; For nodes The set of neighbors of and For the Layer weights and biases; is a non-linear activation function.

[0078] (2) Community division and cluster analysis: The embedded nodes are divided into communities using the Louvain algorithm, with the goal of maximizing modularity.

[0079] ; in, is the adjacency matrix element, representing the node and Whether there is an edge; and is the degree of the node; is the Kronecker function, representing the node and Whether they belong to the same community.

[0080] (3) Organizational relationship and hierarchical structure analysis: The community division result set is: ; in, Represents the subgroups of illegal organizations. Based on the division results, the core members of the organization and their collaborative relationships are analyzed to reveal the hierarchical structure and behavior patterns of illegal software organizations.

[0081] Step 6: Based on the internal hierarchical structure and behavior patterns of the organization, the network topology of the illegal organization is constructed and dynamically updated through a reinforcement learning mechanism to adapt to the ever-changing illegal behavior patterns. Specifically, the topology includes: Organize network topology construction and dynamic update. The specific steps are as follows: Step 61: Using the causal network Clustering results of graph neural network (GNN) , building a dynamic topology map of illegal software organizations .

[0082] Node Collection Including members of illegal organizations (such as application ,domain name , payment account and server IP ); edge set Indicates the relationship between members (such as capital flow, domain name reuse, and code collaboration).

[0083] Edge weights are calculated by weighting the combination of different relationships between members: ; in, The intensity of fund flow is measured by payment account and The frequency and amount of funds flowing between The degree of domain name or IP address reuse, which measures the node and Whether it resolves to the same IP address; The similarity between the code layer and the traffic layer features is calculated by high-dimensional feature vector calculate; Adjustment parameters are used to balance the weights of different relationships.

[0084] In the edge weight formula Defined as: ; in, and For nodes and high-dimensional semantic vector.

[0085] To measure the hierarchy of the organization, the modularity index of the topological graph is calculated

[0086] ; in, Represents the adjacency matrix element, represents the node and Whether there is an edge; is the degree of the node; Total number of edges; is the Kronecker function, representing the node and Whether they belong to the same community.

[0087] Step 62: Dynamic update and adaptive optimization: Based on reinforcement learning (RL) technology, the topology graph Enable dynamic updates to adapt to new illegal behaviors.

[0088] (1) State and action definition: state The structure of the current topology graph, represented as a set of nodes and edges Action For operations on the graph, such as adding a new node , add edge , or adjust edge weights .

[0089] (2) Reward function definition: Reward Function Measure the contribution of newly added nodes and edges: ; in, is the behavior coverage, which indicates the proportion of illegal nodes successfully detected by the model: ; Modularity index, which measures the tightness of organizational hierarchy.

[0090] (3) Dynamic adjustment and optimization: The optimization goal of reinforcement learning is to maximize the expected return of the strategy

[0091] ; in, is the value function of the next state, is a discount factor used to balance short-term and long-term benefits.

[0092] The policy gradient method is used to adjust the policy Optimize the topology to adapt to new illegal behavior patterns (4) Node importance update: Recalculate node importance (such as PageRank) based on the updated results of reinforcement learning; ; in, For nodes the importance of For nodes The set of neighbors of For nodes degree.

[0093] Step 63: Finally, output the dynamically updated illegal organization network topology , including the following: (1) Organizational hierarchy: Displaying the core members of illegal software organizations and their division of labor; (2) Real-time structure update: Integrating the adjustment of new nodes and edges to maintain the real-time and robustness of the model; (3) Behavior pattern coverage: Through the dynamic update mechanism, new illegal behaviors are efficiently captured. The above process is the illegal mobile application organization identification technology based on multi-level feature collaboration and key clue tracing.

[0094] Figure 1 Among them, the illegal software database is used to store the APK files of illegal software and their associated data, including static code layer features, dynamic traffic layer features, domain name traceability information, payment chain data and historical analysis results, providing comprehensive data support and model verification basis for the entire analysis process.

[0095] Static information mining and feature extraction is used to parse the APK file of the target application to extract code-level features such as signature information, certificate fields, permission configuration, component call relationship (CG), control flow graph (CFG), embedded URLs and keys, etc., to mark potential malicious behaviors and provide reference for dynamic analysis.

[0096] Dynamic behavior capture and network traffic analysis are used to run the target application in a sandbox environment, capture runtime system call chains, dynamic permission requests, component loading, and file operation behaviors, and combine network traffic capture tools to extract dynamic traffic layer features such as DNS requests, communication patterns, alternative domain names, and packet behaviors.

[0097] Code-level features are used to extract static code data such as signatures, certificates, permission configurations, and embedded URLs from static information mining as preliminary marking features of malicious behavior for subsequent association analysis and modeling.

[0098] Traffic layer features are used to capture runtime data obtained through dynamic behavior capture, including system call chains, permission usage patterns, network communication behaviors, and dynamic loading paths, to reveal malicious behavior patterns and potential collaborative relationships.

[0099] Key clue tracking and tracing is used to utilize clues such as domain names, payment accounts, email addresses, and IP addresses in code layer features and traffic layer features to locate the associated nodes of illegal organizations through WHOIS queries, payment chain tracking, and DNS resolution history, and to build a preliminary multi-dimensional association network.

[0100] Deep Belief Network (DBN) pre-training is used to pre-train multi-level features using a deep belief network, learn the basic distribution of static and dynamic data, and provide optimized weight initialization for subsequent deep nonlinear modeling.

[0101] Stacked Autoencoder (SAE) multi-layer network mining is used to further fuse the nonlinear relationship between code layers and dynamic features through stacked autoencoders, generate high-dimensional semantic feature representations, capture complex behavioral patterns, and support organizational analysis and network topology modeling.

[0102] Multi-level feature association and organizational analysis is used to combine deep feature learning results and key clue tracking information, use causal inference technology to build a causal relationship network between organizational members, and analyze the internal structure of the organization through graph neural networks (GNN) to reveal core members and collaborative behaviors.

[0103] Illegal organization network construction is used to build a dynamic network topology map of illegal organizations based on the results of multi-level feature association and organizational analysis, display hierarchical relationships and behavioral division of labor, and dynamically update the network model through reinforcement learning to adapt to new illegal behavior patterns, providing accurate decision-making support for supervision and governance.

[0104] This method innovatively combines code-level and traffic-level feature analysis, using multi-level data fusion and deep learning techniques to accurately identify and trace the behavior of illegal software organizations. Compared to traditional methods, this method demonstrates greater robustness and adaptability in handling new types of illegal behavior and complex correlation patterns.

[0105] By designing a hybrid deep learning framework, this paper can mine hidden relationships among illegal software organizations from multiple layers of features, including signature information, permission configuration, payment data, network traffic, and dynamic behavior, revealing their collaboration patterns and resource sharing mechanisms. Causal inference and graph neural networks further enhance the ability to analyze relationships between organizational members, providing strong support for correlation modeling.

[0106] Dynamic updates and reinforcement learning mechanisms enable the system to optimize the network topology of illegal organizations in real time, adapt to evolving illegal behavior patterns, and improve the timeliness and accuracy of analysis. This invention also provides the ability to rapidly respond to new threats through high-dimensional semantic feature generation and dynamic feedback.

[0107] The present invention has demonstrated wide applicability in the detection of illegal software organizations, and can be extended to malware monitoring, botnet analysis, and the prevention and control of other complex network security threats, providing accurate and efficient technical support for regulatory and law enforcement agencies. It is an intelligent solution for complex network environments.

[0108] The illegal mobile application organization identification system based on multi-level feature collaboration and key clue tracing includes: The extraction module is used to use APK file parsing tools to extract key static information from the code, including signatures, certificates, and permission configurations; The acquisition module is used to run the application through a dynamic sandbox, capture dynamic behaviors, including system calls and permission requests, and combine network traffic analysis to obtain the application's network communication characteristics; The tracing module is used to track key clues based on key static information and application network communication characteristics, and use the WHOIS query tool to trace the source to obtain tracing results. Key clues include IP addresses and domain names; The learning module is used to learn features using a deep learning model and generate high-dimensional features based on key static information, application network communication characteristics, and traceability results. The association analysis module is used to perform multi-level feature association analysis using graph neural networks based on high-dimensional features and traceability results to obtain the internal hierarchical structure and behavior patterns of the organization; A building module is used to construct the network topology of illegal organizations based on the internal hierarchical structure and behavior patterns of the organization, and dynamically updates it through a reinforcement learning mechanism to adapt to the ever-changing illegal behavior patterns.

[0109] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. An illegal mobile application organization identification method based on multi-level feature collaboration and key clue tracing, characterized by: The method comprises: Step 1: Use APK file parsing tools to extract key static information from the code, including signatures, certificates, and permission configurations; Step 2: Run the application through a dynamic sandbox to capture dynamic behaviors, including system calls and permission requests, and combine network traffic analysis to obtain the network communication characteristics of the application; Step 3: Based on the key static information and the network communication characteristics of the application, track the key clues and use the WHOIS query tool to trace the source to obtain the traceability results. The key clues include IP addresses and domain names. Step 4: Based on the key static information, the network communication characteristics of the application and the traceability results, a deep learning model is used to perform feature learning to generate high-dimensional features. Step 5: Based on the high-dimensional features and traceability results, use graph neural networks to perform multi-level feature association analysis to obtain the internal hierarchical structure and behavior patterns of the organization; Step 6: Based on the internal hierarchy and behavior patterns of the organization, the network topology of the illegal organization is constructed and dynamically updated through the reinforcement learning mechanism to adapt to the changing illegal behavior patterns.

2. The illegal mobile application organization identification method based on multi-level feature collaboration and key clue tracing according to claim 1 is characterized in that: Use APK file parsing tools to extract key static information from the code, including signatures, certificates, and permission configurations, including: Use APK file parsing tools to extract code layer features; Combined with the historical database, analyze applications that reuse signatures or forge signatures, mark potential related objects, and extract third-party SDK distribution and dependency information.

3. The illegal mobile application organization identification method based on multi-level feature collaboration and key clue tracing according to claim 2 is characterized in that: Based on key static information and the network communication characteristics of the application, key clues are tracked and traced using the WHOIS query tool to obtain traceability results. Key clues include IP addresses and domain names, including: Track and trace key clues through key static information and application network communication characteristics; Combine WHOIS query, DNS resolution records and payment chain tracking system to extract the historical activity track, server distribution and capital flow of domain name registrants; Through the email address and contact information embedded in the resource file, combined with the public database, a reverse query is performed to obtain the potential connection between illegal applications, among which the potential connection between illegal applications is the tracing result.

4. The illegal mobile application organization identification method based on multi-level feature collaboration and key clue tracing according to claim 3 is characterized in that: Based on key static information, application network communication characteristics and traceability results, deep learning models are used to learn features and generate high-dimensional features, including: Based on key static information, application network communication characteristics and traceability results, a hybrid deep learning model is used for feature learning and modeling; Pre-train the basic features through the deep belief network to extract the potential distribution relationship between the code layer and the traffic layer; The stacked autoencoder is used to fuse the code layer and flow layer features to generate semantically rich high-dimensional features.

5. The illegal mobile application organization identification method based on multi-level feature collaboration and key clue tracing according to claim 4 is characterized in that: Based on high-dimensional features and traceability results, multi-level feature association analysis is performed using graph neural networks to obtain the internal hierarchical structure and behavior patterns of the organization, including: Based on high-dimensional features and traceability results, multi-level correlation analysis is performed on the data at the code layer and traffic layer; The causal relationship between features is constructed through causal inference technology, and the roles and behavior patterns of members within the organization are analyzed in combination with graph neural networks to obtain the results of feature association analysis.

6. The illegal mobile application organization identification method based on multi-level feature collaboration and key clue tracing according to claim 5 is characterized in that: Code layer features include signature information, certificate fields, permission configuration, component call relationships, control flow graphs, embedded URLs, and key data.

7. The illegal mobile application organization identification method based on multi-level feature collaboration and key clue tracing according to claim 6 is characterized in that: Key clues include IP addresses, domain names, payment accounts, email addresses and contact information.

8. An illegal mobile application organization identification system based on multi-level feature collaboration and key clue tracing, characterized by: The system is used to perform the method according to any one of claims 1 to 7, comprising: The extraction module is used to use the APK file parsing tool to extract key static information from the code, including signatures, certificates, and permission configurations; The acquisition module is used to run the application through a dynamic sandbox, capture dynamic behaviors, including system calls and permission requests, and obtain the network communication characteristics of the application in combination with network traffic analysis; The tracing module is used to track key clues based on key static information and network communication characteristics of applications, and use the WHOIS query tool to trace the source to obtain the tracing results. The key clues include IP addresses and domain names; The learning module is used to learn features using a deep learning model and generate high-dimensional features based on key static information, application network communication features, and traceability results; The association analysis module is used to perform multi-level feature association analysis using graph neural networks based on high-dimensional features and traceability results to obtain the internal hierarchical structure and behavior patterns of the organization; A building module is used to construct the network topology of illegal organizations based on the hierarchy and behavior patterns within the organization, and dynamically update it through a reinforcement learning mechanism to adapt to the changing illegal behavior patterns.

9. A computing device, characterized in that include: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program, which, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images