An abnormal APP recognition method, device, medium and equipment

Abstract

The present invention relates to the technical field of data processing, and particularly to a method, device, medium and equipment for identifying abnormal APPs. An APP quantity distribution function is constructed based on the device operation data of a target user and the information of seed APPs. Focusing on the target time period with concentrated and rich information, sparse information in other time periods, as well as possible interference information and possible analysis errors are excluded. Based on the target time period, the abnormality degree of APPs is calculated in three dimensions: the name of the APP, the application type, and the operation time. Finally, considering the situations of multiple target users, abnormal APPs and normal APPs are accurately identified. By quantifying the abnormality of the initial APP through the multi-dimensional correlation between the initial APP and the seed APP, potential abnormal APPs can be discovered more precisely, improving the accuracy of identifying abnormal APPs and providing effective support for the security protection of mobile devices.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and particularly to a method, device, medium and equipment for identifying abnormal APPs. Background Art

[0002] In the prior art, the identification of abnormal APPs mainly relies on fixed feature matching, permission analysis and other methods. However, these methods have many limitations: on the one hand, fixed feature matching requires continuous updating of the feature library to cope with newly emerging APPs, and it is difficult to identify new abnormal APPs in real time and accurately; on the other hand, simple permission analysis can only judge from the perspective of permission usage and cannot conduct comprehensive analysis in combination with user usage behaviors; in addition, existing methods are difficult to mine the potential risks of abnormal APPs from the time dimension, resulting in poor accuracy of the identification results of abnormal APPs and difficulty in meeting the requirements of accurate and efficient identification of abnormal APPs.

[0003] Therefore, how to improve the identification accuracy of abnormal APPs has become an urgent problem to be solved. Summary of the Invention

[0004] In view of the above technical problems, the technical solution adopted by the present invention is an abnormal APP identification method, which includes the following steps:

[0005] S1, obtaining M target users, device operation data corresponding to each target user in each preset time slice, N seed APPs, and a reference name and a reference application type corresponding to each seed APP, where the device operation data includes a number of initial APPs operated by the corresponding target user in the corresponding preset time slice, and an initial name, an initial application type and an operation time corresponding to each initial APP, and the seed APPs refer to pre-selected APPs with abnormal risks, and M and N are integers greater than 0.

[0006] S2, for any target user, obtaining an APP quantity distribution function corresponding to the current target user according to the device operation data corresponding to the current target user in each preset time slice, where the abscissa of the APP quantity distribution function is the preset time slice, and the ordinate is the quantity of initial APPs in the corresponding preset time slice.

[0007] S3, obtaining a target time period corresponding to the current target user according to the APP quantity distribution function corresponding to the current target user, where the target time period includes a number of consecutive preset time slices.

[0008] S4, obtaining the abnormal degree of each initial APP corresponding to the current target user according to the device operation data corresponding to the current target user in the target time period.

[0009] S5. Traverse all target users and obtain the anomaly degree corresponding to each initial APP for each target user.

[0010] S6. According to the anomaly degree corresponding to each initial APP for each target user, obtain the recognition type corresponding to each initial APP, where the recognition type includes abnormal APPs and normal APPs.

[0011] The present invention also provides an abnormal APP recognition device, which includes:

[0012] A data acquisition module, configured to obtain M target users, the device operation data corresponding to each target user in each preset time slice, N seed APPs, and the reference name and reference application type corresponding to each seed APP, where the device operation data includes a number of initial APPs operated by the corresponding target user in the corresponding preset time slice and the initial name, initial application type, and operation time corresponding to each initial APP. The seed APPs refer to the APPs with abnormal risks pre-selected, and M and N are integers greater than 0.

[0013] A function fitting module, configured to, for any target user, obtain the APP quantity distribution function corresponding to the current target user according to the device operation data corresponding to the current target user in each preset time slice, where the abscissa of the APP quantity distribution function corresponds to the preset time slice, and the ordinate corresponds to the quantity of initial APPs in the corresponding preset time slice.

[0014] A time period screening module, configured to obtain the target time period corresponding to the current target user according to the APP quantity distribution function corresponding to the current target user, where the target time period includes a number of consecutive preset time slices.

[0015] A first anomaly degree acquisition module, configured to obtain the anomaly degree corresponding to each initial APP for the current target user according to the device operation data corresponding to the current target user in the target time period.

[0016] A second anomaly degree acquisition module, configured to traverse all target users and obtain the anomaly degree corresponding to each initial APP for each target user.

[0017] An APP recognition module, configured to obtain the recognition type corresponding to each initial APP according to the anomaly degree corresponding to each initial APP for each target user, where the recognition type includes abnormal APPs and normal APPs.

[0018] The present invention also provides a non-transitory computer-readable storage medium, in which at least one instruction or at least one segment of program is stored, and the at least one instruction or the at least one segment of program is loaded and executed by a processor to implement the above-mentioned abnormal APP recognition method.

[0019] The present invention also provides an electronic device, including a processor and the above-mentioned non-transitory computer-readable storage medium.

[0020] The present invention has at least the following beneficial effects: By comprehensively collecting the device operation data and seed APP information of the target user, constructing an APP quantity distribution function, and then focusing on the target time period with concentrated and rich information for subsequent analysis, excluding the sparse information in other time periods, as well as the possible interference information and possible analysis errors, and on the basis of the target time period, calculating the abnormality degree of the APP in three dimensions of the APP name, application type, and operation time, and finally synthesizing the situations of multiple target users, finally accurately identifying abnormal APPs and normal APPs. By quantifying the abnormality of the initial APP through the multi-dimensional correlation between the initial APP and the seed APP, potential abnormal APPs can be found more accurately, improving the recognition accuracy of abnormal APPs and providing effective support for the security protection of mobile devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0022] Figure 1 It is a flowchart of an abnormal APP recognition method provided in Embodiment 1 of the present invention;

[0023] Figure 2 It is a schematic structural diagram of an abnormal APP recognition device provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0024] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification, claims and the above-mentioned drawings of the present invention are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It can be understood that, under appropriate circumstances, the above-mentioned terms for distinguishing similar objects can be interchanged, so that the present invention can also implement other embodiments other than the above-mentioned illustrated embodiments or described embodiments. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server comprising a series of steps or units does not necessarily limit to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0026] Embodiment 1

[0027] Embodiment 1 provides an abnormal APP recognition method, and the abnormal APP recognition method includes the following steps, as Figure 1 shown:

[0028] S1, obtain M target users, the device operation data corresponding to each target user in each preset time slice, N seed APPs, and the reference name and reference application type corresponding to each seed APP. Among them, the device operation data includes a number of initial APPs operated by the corresponding target user in the corresponding preset time slice, and the initial name, initial application type and operation time corresponding to each initial APP. The seed APP refers to an APP with abnormal risk preselected, and M and N are integers greater than 0.

[0029] S2, for any target user, according to the device operation data corresponding to the current target user in each preset time slice, obtain the APP quantity distribution function corresponding to the current target user. Among them, the abscissa of the APP quantity distribution function is the preset time slice, and the ordinate is the quantity of the initial APPs in the corresponding preset time slice.

[0030] S3, according to the APP quantity distribution function corresponding to the current target user, obtain the target time period corresponding to the current target user. Among them, the target time period includes a number of consecutive preset time slices.

[0031] S4, according to the device operation data corresponding to the current target user in the target time period, obtain the abnormal degree corresponding to each initial APP for the current target user.

[0032] S5, traverse all target users, and obtain the abnormal degree corresponding to each initial APP for each target user.

[0033] S6. Obtain the recognition type corresponding to each initial APP according to the degree of abnormality of each initial APP corresponding to each target user, where the recognition type includes abnormal APPs and normal APPs.

[0034] Among them, the target user refers to the user group selected for the recognition and analysis of abnormal APPs. The device operation data refers to the operation records of the target user on the corresponding device, such as the data corresponding to the download operation and startup operation of each APP. The initial APP is the APP operated by the target user within the preset time slice and serves as the object for abnormal recognition. The seed APP is a pre-selected APP with abnormal risks and serves as the reference standard for subsequent identification of abnormal APPs. The initial name is the name of the initial APP itself and is one of the basic identifiers for identifying the APP. The reference name is the standard name preset for the seed APP and is used for comparison and reference with the name of the initial APP. The initial application type is the application type to which the initial APP belongs, and the reference application type is the standard application type preset for the seed APP, such as social, gaming, tool, etc. The initial application type can be used for comparison with the reference application type to assist in judging whether the APP is abnormal. The operation time is the specific time when the target user operates the initial APP, which can reflect the time pattern of the target user's operation of the APP and helps analyze whether the APP is abnormal.

[0035] The APP quantity distribution function is a function constructed with the preset time slice as the abscissa and the quantity of initial APPs within the corresponding preset time slice as the ordinate, which can intuitively display the variation law of the quantity of initial APPs operated by the target user in different time slices and help determine the key time periods for subsequent analysis.

[0036] Based on the APP quantity distribution function corresponding to the current target user, the target time period can consist of several consecutive preset time slices, and the quantity of initial APPs corresponding to the several consecutive preset time slices meets the preset quantity ratio, so as to focus on the target time period with concentrated and rich information for subsequent analysis, excluding the sparse information in other time periods, as well as the possible interference information and analysis errors that may be caused, and improving the accuracy of abnormal recognition.

[0037] According to the device operation data of the current target user within the target time period, calculate the degree of abnormality of each initial APP for this target user in the three dimensions of the name, application type, and operation time of the APP, and comprehensively quantify the abnormality of each initial APP within a specific time period for a specific user based on the multi-dimensional correlation between the initial APP and the seed APP, providing a specific numerical basis for judging whether the APP is abnormal.

[0038] Taking into account the situations of multiple target users comprehensively, and determining the recognition type of each APP according to the abnormality degree of each initial APP corresponding to each target user, so as to avoid misjudgment caused by the special behaviors of individual users and make the abnormal recognition result more universal and reliable.

[0039] In a specific embodiment, S2 includes the following steps:

[0040] S21, for any preset time slice, according to the device operation data corresponding to the current target user within the current preset time slice, obtain the first quantity of all initial APPs corresponding to the current target user for the current preset time slice.

[0041] S22, traverse all preset time slices, and obtain the first quantity of all initial APPs corresponding to the current target user for each preset time slice.

[0042] S23, use each preset time slice as the abscissa and the first quantity corresponding to each preset time slice as the ordinate, and fit to obtain the APP quantity distribution function corresponding to the current target user.

[0043] Among them, using each preset time slice as the abscissa and the first quantity corresponding to each preset time slice as the ordinate, and using the function fitting algorithm to transform the discrete data points into a continuous function through fitting, to obtain the APP quantity distribution function corresponding to the current target user, so as to more intuitively observe the change trend of the number of APPs used by the target user in different time slices and provide a basis for subsequent operations such as determining the target time period.

[0044] Among them, those skilled in the art know that any function fitting algorithm in the prior art falls within the protection scope of the present invention and will not be elaborated here. For example, function fitting algorithms such as linear fitting and polynomial fitting. Specifically, the implementer can select a suitable function fitting algorithm according to the actual data characteristics and requirements.

[0045] As described above, through the statistics of a single preset time slice, the traversal of all preset time slices, and the final fitting operation, the APP usage situations of the target user in different time slices are presented in the form of a function, providing a key data model for subsequent abnormal APP recognition based on the time dimension.

[0046] In a specific embodiment, S3 includes the following steps:

[0047] S31, determine the time slice corresponding to the peak position of the APP quantity distribution function corresponding to the current target user as the peak time slice.

[0048] S32. Taking the peak time slice as a reference, obtain the first time slice and the second time slice corresponding to the APP quantity distribution function, where the function area between the first time slice and the peak time slice conforms to a first preset reference value, and the function area between the second time slice and the peak time slice conforms to a second preset reference value.

[0049] S33. According to the difference between each preset time slice and the first time slice, determine the preset time slice closest to the first time slice as the first reference time slice.

[0050] S34. According to the difference between each preset time slice and the second time slice, determine the preset time slice closest to the second time slice as the second reference time slice.

[0051] S35. According to the chronological order of each preset time slice, form the target time period corresponding to the current target user based on the first reference time slice, the second reference time slice, and all the preset time slices between the first reference time slice and the second reference time slice.

[0052] Among them, in the APP quantity distribution function corresponding to the current target user, find the position where the function value reaches the maximum, and the time slice corresponding to this position is the peak time slice. This peak time slice represents a period when the target user uses the most APPs. Based on this as a reference, the target time period can be further determined, which helps to focus on the time period when the target user is more active in using the APP for subsequent analysis.

[0053] By setting the first preset reference value and the second preset reference value and combining the function area to determine the first time slice and the second time slice, it is possible to more scientifically divide the key time period boundaries related to the peak time slice from the overall perspective of the function, providing a more accurate basis for subsequent determination of the target time period.

[0054] Since the actual first time slice and second time slice may not exactly coincide with a certain preset time slice, by finding the closest preset time slice, it is convenient for subsequent analysis and processing based on the preset time slice.

[0055] Based on the first reference time slice and the second reference time slice, the target time period is composed of several consecutive preset time slices. It can be seen that this target time period includes the key time periods when the target user uses a relatively large number of APPs and is related to the peak time. Subsequent analysis of abnormal APPs will focus on the target time period, excluding the sparse information in other time periods, as well as the possible interference information and analysis errors that may be caused, thereby improving the pertinence and accuracy of APP type analysis.

[0056] As described above, by taking the peak time of the APP quantity distribution function as the core and combining with the preset reference value to determine the time slice boundary, the target time period when the target user is more active in using the APP is finally determined, providing a clear time range for calculating the APP anomaly degree based on the device operation data subsequently, which helps to more accurately identify the abnormal APP.

[0057] In a specific embodiment, S4 includes the following steps:

[0058] S41. According to the device operation data corresponding to the current target user in the target time period, each seed APP corresponding to the current target user in the target time period is determined as a reference APP, each initial APP other than the seed APP corresponding to the current target user in the target time period is determined as a first APP to be identified, and each initial APP corresponding to the current target user outside the target time period is determined as a second APP to be identified.

[0059] S42. For any first APP to be identified, according to the initial name, initial application type and operation time corresponding to the current first APP to be identified, and the reference name, reference application type and operation time corresponding to each reference APP, the anomaly degree corresponding to the current first APP to be identified for the current target user is obtained.

[0060] S43. For any second APP to be identified, the preset anomaly value is determined as the anomaly degree corresponding to the current second APP to be identified for the current target user.

[0061] Among them, for the first APP to be identified corresponding to the target time period, by comparing the name similarity, application type matching degree, operation time proximity, etc. between each first APP to be identified and each reference APP, the association degree between each first APP to be identified and each reference APP is comprehensively evaluated, so as to evaluate the anomaly degree of each first APP to be identified. For example, since the seed APP is a pre-selected APP with anomaly risk, if the name of the first APP to be identified is similar to the name of the reference APP, the application type is the same, and the operation time is close, then the association degree between the first APP to be identified and the seed APP with anomaly risk is relatively high, and the anomaly degree of the first APP to be identified is correspondingly high.

[0062] When the second APP to be recognized corresponds to a time period outside the target time period, since the number of APPs corresponding to the time period outside the target time period is small and the effective information is relatively sparse, the influence of interference information during the correlation analysis of APPs based on limited effective information is large, and the possible analysis error is large. Therefore, directly using the preset outlier as the abnormal degree of the second APP to be recognized for the current target user can, to a certain extent, unify the evaluation criteria and further simplify the calculation process of the abnormal degree of the initial APP outside the target time period, improving the recognition efficiency and accuracy.

[0063] The preset outlier is a fixed value set in advance, used to quickly and uniformly mark the abnormal situation of APPs that appear outside the target time period. The specific value of the preset outlier can be set by the implementer according to the actual situation. For example, the preset outlier can be set to 0.

[0064] As described above, first classify the initial APPs based on the seed APP and the target time period. For the initial APPs that are not seeds within the target time period, calculate the abnormal degree in detail by comparing with the reference APPs. For the initial APPs outside the target time period, directly use the preset outlier to characterize the abnormal situation, which not only ensures the accuracy of abnormal recognition but also improves the processing efficiency, providing a specific quantitative basis for subsequent identification of abnormal APPs.

[0065] In a specific embodiment, S42 includes the following steps:

[0066] S421, according to the initial name corresponding to the current first APP to be recognized and the reference names corresponding to each reference APP, obtain the first correlation degree between the current first APP to be recognized and each reference APP.

[0067] S422, according to the initial application type corresponding to the current first APP to be recognized and the reference application types corresponding to each reference APP, obtain the second correlation degree between the current first APP to be recognized and each reference APP.

[0068] S423, according to the operation time corresponding to the current first APP to be recognized and the operation times corresponding to each reference APP, obtain the third correlation degree between the current first APP to be recognized and each reference APP.

[0069] S424, according to the first correlation degree, the second correlation degree, and the third correlation degree between the current first APP to be recognized and each reference APP, obtain the target correlation degree between the current first APP to be recognized and each reference APP.

[0070] S425. Obtain the abnormality degree of the current first APP to be recognized for the current target user according to the target association degree between the current first APP to be recognized and each reference APP.

[0071] Among them, the name is an important identifier for recognizing the APP. By comparing the similarity between the initial name and the reference name, the similarity of the first APP to be recognized and the reference APP at the name level can be judged, and then the first association degree can be determined. Those skilled in the art know that any text similarity calculation method in the prior art falls within the protection scope of the present invention, and will not be elaborated here. For example, similarity algorithms such as edit distance, cosine similarity, and semantic similarity.

[0072] The application type reflects the functions and uses of the APP. By comparing the consistency between the initial application type and the reference application type, the similarity of the first APP to be recognized and the reference APP in terms of functions can be judged, and then the second association degree can be determined.

[0073] The operation time reflects the habits and rules of the target user operating the APP. By comparing the proximity between the operation times, the similarity of the first APP to be recognized and the reference APP at the operation habit level can be judged from the time dimension, and then the third association degree can be determined.

[0074] Integrate the first association degree, the second association degree, and the third association degree to obtain the target association degree between the current first APP to be recognized and each reference APP. Specifically, different weights can be assigned to the first association degree, the second association degree, and the third association degree respectively in a weighted summation manner, and the association degrees in the three aspects of name, application type, and operation time are integrated to obtain a comprehensive association index, which more comprehensively reflects the similarity between the first APP to be recognized and the reference APP.

[0075] Finally, convert the comprehensive association situation between the first APP to be recognized and the reference APP into a quantitative index of the abnormality degree, providing a clear numerical basis for subsequent judgment of whether the APP is an abnormal APP. Correspondingly, the abnormality degree is positively correlated with the target association degree.

[0076] As described above, calculate the association degrees between the first APP to be recognized and the reference APP from the three dimensions of name, application type, and operation time respectively, then synthesize these association degrees into the target association degree, and finally determine the abnormality degree of the first APP to be recognized according to the target association degree. Through a multi-dimensional and gradually in-depth analysis method, the abnormal situation of the first APP to be recognized can be comprehensively and carefully evaluated, improving the accuracy of abnormal recognition.

[0077] In a specific embodiment, S422 further includes the following steps:

[0078] S4221. For any reference APP, according to the reference application type corresponding to the current reference APP and the initial application type corresponding to each first APP to be recognized, obtain the second quantity of the first APPs to be recognized that are of the same type as the current reference APP.

[0079] S4222. Determine the ratio of the second quantity corresponding to the current reference APP to the total quantity of the first APPs to be recognized corresponding to the current target user as the reference weight corresponding to the current reference APP.

[0080] S4223. Determine the sum of the preset weight value and the reference weight corresponding to the current reference APP as the target weight corresponding to the current reference APP.

[0081] S4224. If the initial application type corresponding to the current first APP to be recognized is the same as the reference application type corresponding to the current reference APP, determine the target weight corresponding to the current reference APP as the second correlation degree between the current first APP to be recognized and the current reference APP.

[0082] S4225. If the initial application type corresponding to the current first APP to be recognized is different from the reference application type corresponding to the current reference APP, determine the preset degree value as the second correlation degree between the current first APP to be recognized and the current reference APP.

[0083] S4226. Traverse all the reference APPs to obtain the second correlation degree between the current first APP to be recognized and each reference APP.

[0084] Among them, the reference weight reflects the relative importance of the reference APP in representing the abnormal degree of the first APP to be recognized. The target weight comprehensively considers the preset fixed factors and the relative importance of the reference APP itself, providing a more reasonable weight basis for calculating the second correlation degree later. The specific value of the preset weight value can be set by the implementer according to the actual situation. For example, in this embodiment, the preset weight value can be set to 1.

[0085] In the case where the application types are the same, the target weight can reflect the closeness of the association between the two APPs and serve as a quantitative value of the second correlation degree. For APPs with different application types, the preset degree value is directly used to represent the association degree between them to simplify the calculation process and improve the reliability of the second correlation degree. Correspondingly, the specific value of the preset degree value can be set by the implementer according to the actual situation. For example, in this embodiment, the preset degree value can be set to 0.

[0086] As described above, by gradually calculating the reference weight and the target weight by counting the number of APPs with the same type, and determining the second correlation degree according to whether the application types are the same, the relative importance of the reference APPs and the matching of the application types are comprehensively considered, providing a data basis for accurately evaluating the second correlation degree between the first APP to be identified and the reference APPs.

[0087] In a specific embodiment, S6 further includes the following steps:

[0088] S61, obtaining a preset abnormal degree threshold.

[0089] S62, for any initial APP, determining the average value of the abnormal degrees corresponding to all target users of the current initial APP as the target abnormal degree corresponding to the current initial APP.

[0090] S63, if the target abnormal degree corresponding to the current initial APP is greater than the preset abnormal degree threshold, determining that the recognition type corresponding to the current initial APP is an abnormal APP.

[0091] S64, if the target abnormal degree corresponding to the current initial APP is less than or equal to the preset abnormal degree threshold, determining that the recognition type corresponding to the current initial APP is a normal APP.

[0092] Among them, the specific value of the preset abnormal degree threshold can be set by the implementer according to the actual situation.

[0093] As described above, by comprehensively collecting the device operation data and seed APP information of target users, constructing an APP quantity distribution function, and then focusing on the target time period with concentrated and rich information for subsequent analysis, excluding the sparse information in other time periods, as well as possible interference information and possible analysis errors caused thereby, and calculating the abnormal degree of the APP in three dimensions of the APP name, application type, and operation time based on the target time period, and finally comprehensively considering the situations of multiple target users, finally accurately identifying abnormal APPs and normal APPs. By quantifying the abnormal situation of the initial APP by comprehensively considering the multi-dimensional correlation between the initial APP and the seed APP, potential abnormal APPs can be discovered more accurately, improving the recognition accuracy of abnormal APPs and providing effective support for the security protection of mobile devices.

[0094] Embodiment 2

[0095] This Embodiment 2 provides an abnormal APP recognition device, which includes, as Figure 2 shown:

[0096] A data acquisition module 21, configured to obtain M target users, device operation data corresponding to each target user in each preset time slice, N seed APPs, and a reference name and a reference application type corresponding to each seed APP, where the device operation data includes a number of initial APPs operated by the corresponding target user in the corresponding preset time slice, and an initial name, an initial application type, and an operation time corresponding to each initial APP. The seed APPs refer to pre-selected APPs with abnormal risks, and M and N are integers greater than 0.

[0097] A function fitting module 22, configured to, for any target user, obtain an APP quantity distribution function corresponding to the current target user according to the device operation data corresponding to the current target user in each preset time slice, where the abscissa of the APP quantity distribution function is the preset time slice, and the ordinate is the quantity of initial APPs in the corresponding preset time slice.

[0098] A time period screening module 23, configured to obtain a target time period corresponding to the current target user according to the APP quantity distribution function corresponding to the current target user, where the target time period includes a number of consecutive preset time slices.

[0099] A first abnormal degree acquisition module 24, configured to obtain the abnormal degree corresponding to each initial APP for the current target user according to the device operation data corresponding to the current target user in the target time period.

[0100] A second abnormal degree acquisition module 25, configured to traverse all target users to obtain the abnormal degree corresponding to each initial APP for each target user.

[0101] An APP identification module 26, configured to obtain an identification type corresponding to each initial APP according to the abnormal degree corresponding to each initial APP for each target user, where the identification type includes abnormal APPs and normal APPs.

[0102] In a specific embodiment, the function fitting module 22 includes:

[0103] A first quantity acquisition sub-module, configured to, for any preset time slice, obtain a first quantity of all initial APPs corresponding to the current preset time slice for the current target user according to the device operation data corresponding to the current target user in the current preset time slice.

[0104] A time slice traversal sub-module, configured to traverse all preset time slices to obtain a first quantity of all initial APPs corresponding to each preset time slice for the current target user.

[0105] A function fitting sub-module, which is used to construct the abscissa with each preset time slice and construct the ordinate with the first quantity corresponding to each preset time slice, and fit to obtain the APP quantity distribution function corresponding to the current target user.

[0106] In a specific embodiment, the time period screening module 23 includes:

[0107] A peak time slice determination sub-module, which is used to determine the time slice corresponding to the peak position of the APP quantity distribution function corresponding to the current target user as the peak time slice.

[0108] A time slice determination sub-module, which is used to take the peak time slice as a reference to obtain the first time slice and the second time slice corresponding to the APP quantity distribution function, wherein the function area between the first time slice and the peak time slice meets the first preset reference value, and the function area between the second time slice and the peak time slice meets the second preset reference value.

[0109] A first reference time slice determination sub-module, which is used to determine the preset time slice closest to the first time slice as the first reference time slice according to the difference between each preset time slice and the first time slice.

[0110] A second reference time slice determination sub-module, which is used to determine the preset time slice closest to the second time slice as the second reference time slice according to the difference between each preset time slice and the second time slice.

[0111] A target time period composition sub-module, which is used to form the target time period corresponding to the current target user according to the time sequence corresponding to each preset time slice and all the preset time slices between the first reference time slice, the second reference time slice, the first reference time slice and the second reference time slice.

[0112] In a specific embodiment, the first abnormal degree acquisition module 24 includes:

[0113] An APP classification sub-module, which is used to determine each seed APP corresponding to the current target user in the target time period as a reference APP according to the device operation data corresponding to the current target user in the target time period, determine all initial APPs other than the seed APPs corresponding to the current target user in the target time period as the first APPs to be identified, and determine all initial APPs corresponding to the current target user outside the target time period as the second APPs to be identified.

[0114] A first abnormal degree acquisition sub-module, which is used to obtain the abnormal degree of the current first APP to be identified corresponding to the current target user for any first APP to be identified according to the initial name, initial application type and operation time corresponding to the current first APP to be identified, and the reference name, reference application type and operation time corresponding to each reference APP.

[0115] The second abnormal degree acquisition sub-module is used to determine the abnormal degree corresponding to the current second APP to be recognized for the current target user by taking the preset abnormal value for any second APP to be recognized.

[0116] In a specific embodiment, the first abnormal degree acquisition sub-module includes:

[0117] The first association degree acquisition unit is used to obtain the first association degree between the current first APP to be recognized and each reference APP according to the initial name corresponding to the current first APP to be recognized and the reference name corresponding to each reference APP.

[0118] The second association degree acquisition unit is used to obtain the second association degree between the current first APP to be recognized and each reference APP according to the initial application type corresponding to the current first APP to be recognized and the reference application type corresponding to each reference APP.

[0119] The third association degree acquisition unit is used to obtain the third association degree between the current first APP to be recognized and each reference APP according to the operation time corresponding to the current first APP to be recognized and the operation time corresponding to each reference APP.

[0120] The target association degree acquisition unit is used to obtain the target association degree between the current first APP to be recognized and each reference APP according to the first association degree, the second association degree, and the third association degree between the current first APP to be recognized and each reference APP.

[0121] The abnormal degree acquisition unit is used to obtain the abnormal degree corresponding to the current first APP for the current target user according to the target association degree between the current first APP to be recognized and each reference APP.

[0122] In a specific embodiment, the second association degree acquisition unit further includes:

[0123] The second quantity acquisition sub-unit is used to obtain the second quantity of the first APPs to be recognized with the same type as the current reference APP for any reference APP according to the reference application type corresponding to the current reference APP and the initial application type corresponding to each first APP to be recognized.

[0124] The reference weight acquisition sub-unit is used to determine the ratio of the second quantity corresponding to the current reference APP to the total quantity of the first APPs to be recognized corresponding to the current target user as the reference weight corresponding to the current reference APP.

[0125] A target weight acquisition subunit, configured to determine the sum of a preset weight value and a reference weight corresponding to the current reference APP as the target weight corresponding to the current reference APP.

[0126] A first correlation degree acquisition subunit, configured to, if the initial application type corresponding to the current first APP to be recognized is the same as the reference application type corresponding to the current reference APP, determine the target weight corresponding to the current reference APP as the second correlation degree between the current first APP to be recognized and the current reference APP.

[0127] A second correlation degree acquisition subunit, configured to, if the initial application type corresponding to the current first APP to be recognized is different from the reference application type corresponding to the current reference APP, determine a preset degree value as the second correlation degree between the current first APP to be recognized and the current reference APP.

[0128] A third correlation degree acquisition subunit, configured to traverse all reference APPs to obtain the second correlation degree between the current first APP to be recognized and each reference APP.

[0129] In a specific embodiment, the APP recognition module 26 further includes:

[0130] A threshold acquisition sub-module, configured to obtain a preset abnormal degree threshold.

[0131] A target abnormal degree acquisition sub-module, configured to, for any initial APP, determine the average value of the abnormal degrees corresponding to all target users of the current initial APP as the target abnormal degree corresponding to the current initial APP.

[0132] An abnormal APP recognition module, configured to, if the target abnormal degree corresponding to the current initial APP is greater than the preset abnormal degree threshold, determine that the recognition type corresponding to the current initial APP is an abnormal APP.

[0133] A normal APP recognition module, configured to, if the target abnormal degree corresponding to the current initial APP is less than or equal to the preset abnormal degree threshold, determine that the recognition type corresponding to the current initial APP is a normal APP.

[0134] It should be noted that for the information interaction, execution process, etc. between the above modules, since they are based on the same concept as the method embodiment of the present invention, for their specific functions and the technical effects brought, reference can be specifically made to the method embodiment part, and details are not described herein again.

[0135] Embodiment III

[0136] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which at least one instruction or at least one program segment is stored, and the at least one instruction or at least one program segment is loaded and executed by a processor to implement the steps:

[0137] S1. Obtain M target users, the device operation data corresponding to each target user in each preset time slice, N seed APPs, and the reference name and reference application type corresponding to each seed APP. Among them, the device operation data includes a number of initial APPs operated by the corresponding target user in the corresponding preset time slice, and the initial name, initial application type, and operation time corresponding to each initial APP. The seed APP refers to an APP with abnormal risk selected in advance, and M and N are integers greater than 0.

[0138] S2. For any target user, according to the device operation data corresponding to the current target user in each preset time slice, obtain the APP quantity distribution function corresponding to the current target user. Among them, the abscissa of the APP quantity distribution function corresponds to the preset time slice, and the ordinate corresponds to the quantity of initial APPs in the corresponding preset time slice.

[0139] S3. According to the APP quantity distribution function corresponding to the current target user, obtain the target time period corresponding to the current target user. Among them, the target time period includes a number of consecutive preset time slices.

[0140] S4. According to the device operation data corresponding to the current target user in the target time period, obtain the abnormal degree corresponding to each initial APP for the current target user.

[0141] S5. Traverse all target users to obtain the abnormal degree corresponding to each initial APP for each target user.

[0142] S6. According to the abnormal degree corresponding to each initial APP for each target user, obtain the recognition type corresponding to each initial APP. Among them, the recognition type includes abnormal APPs and normal APPs.

[0143] Those of ordinary skill in the art can understand that all or part of the processes of implementing the methods in the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, storage, database, or other medium used in the various embodiments provided in the present application can include non-volatile and / or volatile memories. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchronization Link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and Rambus dynamic RAM (RDRAM), etc.

[0144] Those skilled in the art can clearly understand that for the convenience and brevity of description, only the above division of each functional unit and module is used as an example. In actual applications, the above functions can be allocated to different functional units and modules according to needs, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0145] Embodiment 4

[0146] Embodiment 4 of the present invention provides an electronic device, which includes a processor and the non-transitory computer-readable storage medium in Embodiment 3 of the present invention.

[0147] The above are only the preferred embodiments of the present invention, and do not impose any form of limitation on the present invention. Although the present invention has been disclosed above with the preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some changes or modifications within the scope of the technical solution of the present invention to make equivalent embodiments with equivalent changes. However, as long as it does not depart from the content of the technical solution of the present invention, any simple modification, equivalent change, and modification made to the above embodiments according to the technical essence of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. An abnormal APP recognition method, characterized in that, The abnormal APP recognition method includes the following steps: S1. Obtain M target users, the device operation data corresponding to each target user in each preset time slice, N seed APPs, and the reference name and reference application type corresponding to each seed APP. Among them, the device operation data includes a number of initial APPs operated by the corresponding target user in the corresponding preset time slice, and the initial name, initial application type, and operation time corresponding to each initial APP. The seed APP refers to an APP selected in advance with abnormal risk, and M and N are integers greater than 0; S2. For any target user, according to the device operation data corresponding to the current target user in each preset time slice, obtain the APP quantity distribution function corresponding to the current target user. Among them, the abscissa of the APP quantity distribution function is the preset time slice, and the ordinate is the quantity of initial APPs in the corresponding preset time slice; S3. According to the APP quantity distribution function corresponding to the current target user, obtain the target time period corresponding to the current target user. Among them, the target time period includes a number of consecutive preset time slices; S4. According to the device operation data corresponding to the current target user in the target time period, obtain the abnormal degree corresponding to each initial APP for the current target user; S5. Traverse all target users to obtain the abnormal degree corresponding to each initial APP for each target user; S6. According to the abnormal degree corresponding to each initial APP for each target user, obtain the recognition type corresponding to each initial APP. Among them, the recognition type includes abnormal APPs and normal APPs.

2. The abnormal APP recognition method according to claim 1, characterized in that, S2 includes the following steps: S21. For any preset time slice, according to the device operation data corresponding to the current target user in the current preset time slice, obtain the first quantity of all initial APPs corresponding to the current preset time slice for the current target user; S22. Traverse all preset time slices to obtain the first quantity of all initial APPs corresponding to each preset time slice for the current target user; S23. Use each preset time slice as the abscissa and the first quantity corresponding to each preset time slice as the ordinate to fit and obtain the APP quantity distribution function corresponding to the current target user.

3. The abnormal APP recognition method according to claim 1, characterized in that S3 includes the following steps: S31. Determine the time slice corresponding to the peak position of the APP quantity distribution function corresponding to the current target user as the peak time slice; S32. Based on the peak time slice, obtain the first time slice and the second time slice corresponding to the APP quantity distribution function. Among them, the function area between the first time slice and the peak time slice meets the first preset reference value, and the function area between the second time slice and the peak time slice meets the second preset reference value; S33. According to the difference between each preset time slice and the first time slice, determine the preset time slice closest to the first time slice as the first reference time slice; S34. According to the difference between each preset time slice and the second time slice, determine the preset time slice closest to the second time slice as the second reference time slice; S35. According to the chronological order corresponding to each preset time slice, a target time period corresponding to the current target user is formed by the first reference time slice, the second reference time slice, and all the preset time slices between the first reference time slice and the second reference time slice.

4. The abnormal APP recognition method according to claim 1, wherein S4 includes the following steps: S41. According to the device operation data corresponding to the current target user within the target time period, each seed APP corresponding to the current target user within the target time period is determined as a reference APP, each initial APP other than the seed APP corresponding to the current target user within the target time period is determined as a first APP to be recognized, and each initial APP corresponding to the current target user outside the target time period is determined as a second APP to be recognized; S42. For any first APP to be recognized, according to the initial name, initial application type, and operation time corresponding to the current first APP to be recognized, and the reference name, reference application type, and operation time corresponding to each reference APP, the abnormal degree of the current first APP to be recognized corresponding to the current target user is obtained; S43. For any second APP to be recognized, the preset abnormal value is determined as the abnormal degree of the current second APP to be recognized corresponding to the current target user.

5. The abnormal APP recognition method according to claim 4, wherein S42 includes the following steps: S421. According to the initial name corresponding to the current first APP to be recognized and the reference names corresponding to each reference APP, the first association degree between the current first APP to be recognized and each reference APP is obtained; S422. According to the initial application type corresponding to the current first APP to be recognized and the reference application types corresponding to each reference APP, the second association degree between the current first APP to be recognized and each reference APP is obtained; S423. According to the operation time corresponding to the current first APP to be recognized and the operation times corresponding to each reference APP, the third association degree between the current first APP to be recognized and each reference APP is obtained; S424. According to the first association degree, second association degree, and third association degree between the current first APP to be recognized and each reference APP, the target association degree between the current first APP to be recognized and each reference APP is obtained; S425. According to the target association degree between the current first APP to be recognized and each reference APP, the abnormal degree of the current first APP to be recognized corresponding to the current target user is obtained.

6. The abnormal APP recognition method according to claim 5, wherein S422 further includes the following steps: S4221. For any reference APP, according to the reference application type corresponding to the current reference APP and the initial application types corresponding to each first APP to be recognized, the second quantity of the first APPs to be recognized with the same type as the current reference APP is obtained; S4222. The ratio of the second quantity corresponding to the current reference APP to the total quantity of the first APPs to be recognized corresponding to the current target user is determined as the reference weight corresponding to the current reference APP; S4223. The sum of the preset weight value and the reference weight corresponding to the current reference APP is determined as the target weight corresponding to the current reference APP. S4224. If the initial application type corresponding to the current first APP to be recognized is the same as the reference application type corresponding to the current reference APP, then determine the target weight corresponding to the current reference APP as the second association degree between the current first APP to be recognized and the current reference APP; S4225. If the initial application type corresponding to the current first APP to be recognized is different from the reference application type corresponding to the current reference APP, then determine the preset degree value as the second association degree between the current first APP to be recognized and the current reference APP; S4226. Traverse all reference APPs to obtain the second association degree between the current first APP to be recognized and each reference APP.

7. The abnormal APP recognition method according to claim 1, wherein S6 further includes the following steps: S61. Obtain the preset abnormal degree threshold; S62. For any initial APP, determine the average value of the abnormal degrees corresponding to all target users of the current initial APP as the target abnormal degree corresponding to the current initial APP; S63. If the target abnormal degree corresponding to the current initial APP is greater than the preset abnormal degree threshold, then determine the recognition type corresponding to the current initial APP as an abnormal APP; S64. If the target abnormal degree corresponding to the current initial APP is less than or equal to the preset abnormal degree threshold, then determine the recognition type corresponding to the current initial APP as a normal APP.

8. An abnormal APP recognition device, characterized in that, The abnormal APP recognition device includes: A data acquisition module, configured to acquire M target users, the device operation data corresponding to each target user in each preset time slice, N seed APPs, and the reference name and reference application type corresponding to each seed APP, where the device operation data includes a number of initial APPs operated by the corresponding target user in the corresponding preset time slice and the initial name, initial application type, and operation time corresponding to each initial APP. A seed APP refers to an APP selected in advance with abnormal risk, and M and N are integers greater than 0; A function fitting module, configured to, for any target user, obtain the APP quantity distribution function corresponding to the current target user according to the device operation data corresponding to the current target user in each preset time slice, where the abscissa of the APP quantity distribution function corresponds to the preset time slice, and the ordinate corresponds to the quantity of initial APPs in the corresponding preset time slice; A time period screening module, configured to obtain the target time period corresponding to the current target user according to the APP quantity distribution function corresponding to the current target user, where the target time period includes a number of consecutive preset time slices; A first abnormal degree acquisition module, configured to obtain the abnormal degree corresponding to each initial APP for the current target user according to the device operation data corresponding to the current target user in the target time period; A second abnormal degree acquisition module, configured to traverse all target users to obtain the abnormal degree corresponding to each initial APP for each target user; The APP recognition module is configured to obtain the recognition type corresponding to each initial APP according to the abnormality degree corresponding to each initial APP of each target user, wherein the recognition type includes abnormal APPs and normal APPs.

9. A non-transitory computer-readable storage medium storing at least one instruction or at least one program segment, characterized in that, The at least one instruction or the at least one program is loaded and executed by a processor to implement the abnormal APP recognition method according to any one of claims 1-7.

10. An electronic device, characterized in that, It includes a processor and the non-transitory computer-readable storage medium described in claim 9.

Images